@camada/bun 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 camada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,181 @@
+# @camada/bun
+
+camada for [Bun.serve](https://bun.sh/docs/api/http): enforces the tenant snapshot inline (your
+ordered custom rules, then block, allow, challenge), serves a first-party proof-of-work challenge
+page and beacon, records the outcomes your handlers know (`track()`), and ships wire events in
+batches off the response path. A thin binding over `@camada/core/fetch`: the socket peer comes
+from `server.requestIP`, the env from `Bun.env`, and the snapshot polls on a timer because a Bun
+server lives long enough to have one. Fails open by design — a camada outage or bug never 5xxes
+your app.
+
+Not yet on npm — consumed via a `file:` dependency from a sibling checkout.
+
+## Quickstart
+
+```ts
+import { camada } from '@camada/bun';
+
+Bun.serve({
+  fetch: camada()((req, server) => new Response('hello')),   // reads CAMADA_KEY / CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL from Bun.env
+});
+```
+
+`camada()` builds one instance and returns `wrap`; call it once and wrap every handler the
+server runs with the same `wrap`. With Bun's `routes` the fallback `fetch` and each route
+handler are separate entry points, so each one is wrapped:
+
+```ts
+import { camada, scriptTag } from '@camada/bun';
+
+const guard = camada();
+
+Bun.serve({
+  routes: {
+    '/': guard((req) => new Response(`<html><head>${scriptTag(req)}</head><body>home</body></html>`, { headers: { 'content-type': 'text/html' } })),
+    '/api/health': () => new Response('ok'),   // unwrapped: answers whatever the snapshot says
+  },
+  fetch: guard((req) => new Response('not found', { status: 404 })),
+});
+```
+
+Env (printed by camada onboarding / `npm run seed` in dev):
+
+```
+CAMADA_KEY=<ingest_token>.<snap_token>
+CAMADA_INGEST_URL=http://localhost:8787        # dev only; defaults to production ingest
+```
+
+The engine is built from `Bun.env` (or `process.env` under Node) on the first request, merged
+with whatever the app passes in code:
+
+```ts
+const guard = camada({ key: MY_KEY, ingestUrl: MY_INGEST });
+```
+
+Without `CAMADA_KEY` the wrapper is inert (one log line, no requests, no enforcement), so an
+unprovisioned environment behaves exactly as if camada were not installed.
+
+## What it does per request
+
+1. Keeps the snapshot fresh on an unref'd 30 s timer (the server steers the cadence per tenant)
+   and drains the event queue on `beforeExit`, `SIGTERM` and `SIGINT`. `mode: 'lazy'` or
+   `CAMADA_SERVERLESS=1` refreshes per request instead, for a Bun that is not a long-lived
+   process. Every poll and event batch carries `x-camada-sdk: @camada/bun/<version>`, and polls
+   ask for snapshot v5 (`x-camada-snapshot: 5`) — the container that carries your ordered
+   custom rules.
+2. Resolves the client from the socket Bun vouches for (`server.requestIP(req)`), then
+   `X-Forwarded-For` under your tenant's trusted-proxy config. No header is ever trusted on its
+   own: without a trusted-proxy config a forwarded header is just another header the caller
+   controls, and `cf-connecting-ip` / `x-real-ip` are never read.
+3. Runs your ordered custom rules, then the allow, block and challenge lists.
+4. **Block** → `403` with `x-block-reason` before your handler; the event still ships, with
+   `st: 403` and `blk: <reason>` so the analyst counts SDK blocks apart from your own 403s.
+5. **Skip** → a skip rule or the allow list wins over a wider block.
+6. **Challenge** → a `403` proof-of-work page: no external assets, `no-store`, an inline SHA-256
+   solver that posts to `POST /__camada/challenge`, which sets `_cch` (an HMAC token bound to
+   the client ip, 1 h) and 302s back. Non-HTML requests get `403 {"error":"challenge_required"}`.
+7. Otherwise your handler runs, the `_sfp` session cookie is appended on a first visit (also
+   onto a `Response.redirect()`, whose headers are immutable — the response is rebuilt around
+   the same body), and the settled response ships one batched, redacted event with its real
+   status (Authorization and Cookie values never leave the process — see `@camada/core`). A
+   handler that throws ships the event with `st: 500` — what Bun answers for it — and the error
+   goes on to Bun's `error` callback (a callback that answers with another status is not seen
+   here); a handler that returns nothing after `server.upgrade(req)` (Bun's WebSocket pattern)
+   is passed through and ships `st: 101`, with no Response to carry a cookie.
+
+## Options
+
+| option | default | meaning |
+|---|---|---|
+| `key` | `env.CAMADA_KEY` | `<ingest_token>.<snap_token>`; without it the wrapper is inert |
+| `ingestUrl` | `env.CAMADA_INGEST_URL` | ingest base; batches go to `<ingestUrl>/e` |
+| `snapshotUrl` | `<ingestUrl>/snapshot` | snapshot endpoint |
+| `trustedProxy` | server config | `none` / `vercel` / `hops:N` / `cidrs:a,b`, or the parsed object |
+| `challenge` | `true` | serve the proof-of-work page for `challenge` verdicts |
+| `challengePath` | `/__camada/challenge` | where that page posts its solution |
+| `snapshotVersion` | `5` | `4` drops the custom rules, `3` the allow/challenge sides too |
+| `scriptPath` | `/_cam/b.js` | where the first-party beacon script is served |
+| `fpPath` | `/_cam/fp` | where that script posts the beacon; keep it in `scriptPath`'s directory |
+| `mode` | `timer` (or `lazy`) | `timer` polls the snapshot on an unref'd interval (long-lived process); `lazy` refreshes it per request off-path. `CAMADA_SERVERLESS=1` forces `lazy` |
+| `env` | `Bun.env` | overrides the host env (tests, and apps that read config themselves) |
+
+`CAMADA_CHALLENGE=0` in the env switches the challenge off without a code change.
+
+`CAMADA_DISABLED=1` in the env switches everything off, checked per request.
+
+## The first-party beacon
+
+Bots that never run JavaScript are the cheapest to catch. Put the tag in the `<head>` of the
+pages you render and the wrapper does the rest:
+
+```ts
+import { camada, scriptTag } from '@camada/bun';
+
+Bun.serve({
+  fetch: camada()((req) => new Response(`<html><head>${scriptTag(req)}</head><body>…</body></html>`, { headers: { 'content-type': 'text/html' } })),
+});
+```
+
+`scriptTag(req)` returns `<script src="/_cam/b.js?r=<rid>" async></script>` — the `rid` is this
+request's event id, so the analyst joins the beacon to the page view. `scriptTag` and `track`
+find their request by the `Request` object Bun handed you — pass that one, not a `clone()`. The wrapper serves the
+script at `GET /_cam/b.js` (cacheable, 1 h) and relays `POST /_cam/fp` (≤ 32 KB, answers 204)
+onto the event batch as a `sig: 1` row stamped with the client ip camada resolved — never the
+one the body claims. Both endpoints sit behind the verdict: a blocked client gets 403 there
+too. The tag is `''` when camada is off for the request or the project turned the beacon off
+in its settings, and the endpoints stand down with it.
+
+With `routes`, the two paths are answered by whichever wrapped handler Bun dispatches to — the
+fallback `fetch` in the example above — so wrap the fallback even when every route is wrapped.
+Moving them (`camada({ scriptPath: '/api/_cam/b.js', fpPath: '/api/_cam/fp' })`) keeps the
+same rule: the script derives the post path from its own `src`, so the two must share a directory.
+
+## App-context events
+
+The wire shows a `POST /login`; only your handler knows whether it failed. Tell camada:
+
+```ts
+import { camada, track } from '@camada/bun';
+
+Bun.serve({
+  fetch: camada()(async (req) => {
+    const ok = await signIn(req);
+    if (!ok) track(req, 'login_failed', { user: email });   // await optional — it never throws
+    return ok ? Response.redirect('/') : new Response('Invalid credentials', { status: 401 });
+  }),
+});
+```
+
+`track(req, event, { user? })` ships `{ et, uid, rid, sid, ip, ts }` joined to this request's
+event. The user identifier is HMAC-hashed in-process with the ingest token — the raw value never
+leaves the process. It never throws and is a no-op where the wrapper did not run. The event name
+is free-form; the analyst's rules read this vocabulary:
+
+| event | when |
+|---|---|
+| `login_failed` / `login_succeeded` | a credential check settled |
+| `signup` | an account was created |
+| `password_reset` | a reset was requested |
+| `mfa_failed` | a second factor was rejected |
+| `payment_failed` / `payment_succeeded` | a charge settled |
+| `coupon_failed` | a promo code was rejected |
+
+## What this tap can see
+
+This is the in-app position: the beacon, the client hints the browser sends, the real response
+status, the `_sfp` session and the app context from `track()`. Bun vouches for one connection
+fact — the socket address from `server.requestIP` — and nothing else: no ASN, country or TLS
+fingerprint (those rules never match here), no client protocol (the event's `proto` is null; a
+forwarded protocol header is never read for it), and `Headers` normalises order, so the
+raw-wire-order signal is not available either. The analyst knows all of that from the tap's
+capability mask (`sdk-bun`) and never scores an absence as evidence.
+
+## Fail open
+
+Every entry point runs inside camada's guard. A dead ingest, a corrupt snapshot, a bug in this
+package: telemetry is lost, the request is not.
+
+## Tests
+
+`npm test` runs the suite under vitest in Node with a stub `server` (the two snapshot-mode tests
+use vitest's fake timers, which `bun test` does not provide).

package/dist/index.cjs

@@ -0,0 +1,93 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  camada: () => camada,
+  resetCamada: () => resetCamada,
+  scriptTag: () => scriptTag,
+  track: () => track
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/camada.ts
+var import_core = require("@camada/core");
+var import_fetch = require("@camada/core/fetch");
+var import_iife_string = __toESM(require("@camada/browser/iife-string"), 1);
+
+// package.json
+var name = "@camada/bun";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var slots = /* @__PURE__ */ new WeakMap();
+var instances = /* @__PURE__ */ new Set();
+function camada(opts = {}) {
+  const cam = (0, import_fetch.createFetchCamada)({ tap: import_core.TAP_BUN, sdk: SDK_ID, iife: import_iife_string.default }, { ...opts, mode: opts.mode ?? "timer" });
+  instances.add(cam);
+  return function wrap(handler) {
+    return async (req, server) => {
+      const peer = (0, import_core.guarded)(() => server?.requestIP?.(req)?.address ?? null, null);
+      const r = await cam.before(req, { peer, env: globalThis.Bun?.env ?? globalThis.process?.env });
+      if (!r) return handler(req, server);
+      if (r.response) return r.response;
+      slots.set(req, r.vars);
+      let res;
+      try {
+        res = await handler(req, server);
+      } catch (err) {
+        cam.after(req, r.vars, 500);
+        throw err;
+      }
+      if (!res) {
+        cam.after(req, r.vars, 101);
+        return res;
+      }
+      cam.after(req, r.vars, res.status);
+      return r.vars.sessionCookie ? (0, import_fetch.withSetCookie)(res, r.vars.sessionCookie) : res;
+    };
+  };
+}
+var track = (req, event, data) => (0, import_fetch.track)(slots.get(req), event, data);
+var scriptTag = (req) => (0, import_fetch.scriptTag)(slots.get(req));
+function resetCamada() {
+  for (const cam of instances) cam.reset();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  camada,
+  resetCamada,
+  scriptTag,
+  track
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/bun — the one-line install for a Bun.serve app:\n//   Bun.serve({ fetch: camada()(handler) });   // env: CAMADA_KEY (+ CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL in dev)\n//   new Response(`<head>${scriptTag(req)}</head>…`, { headers: { 'content-type': 'text/html' } })   // the first-party beacon\n//   track(req, 'login_failed', { user })       // an outcome the wire cannot show\nexport { camada, track, scriptTag, resetCamada, type CamadaBunOptions, type CamadaBunVars, type BunServer, type BunHandler } from './camada.js';\n","// @camada/bun — the Bun.serve binding for @camada/core/fetch. `wrap` sits around the app's fetch\n// handler: the socket peer comes from `server.requestIP` (the one address Bun vouches for), the\n// env from Bun.env, and there is no waitUntil — a long-lived process polls on a timer and drains\n// on exit instead. Bun has no per-request context object, so the Request itself keys the slot.\nimport { TAP_BUN, guarded } from '@camada/core';\nimport { createFetchCamada, withSetCookie, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\n/** The one thing the wrapper needs from Bun's server, typed structurally so the emitted types need no `bun` import; any `Bun.Server` satisfies it. */\nexport interface BunServer { requestIP(req: Request): { address: string } | null }\n/** A Bun fetch handler. `undefined`/`void` is what Bun's own websocket pattern returns after `server.upgrade(req)`. */\nexport type BunHandler<S extends BunServer = BunServer, R extends Response | undefined | void = Response> = (req: Request, server: S) => R | Promise<R>;\nexport type CamadaBunOptions = FetchCamadaOptions;\nexport type CamadaBunVars = FetchVars;\n\nconst slots = new WeakMap<Request, FetchVars>();   // set only when the app is about to run; camada's own answers leave nothing\nconst instances = new Set<FetchCamada>();\n\n/**\n * Builds one camada instance and returns `wrap`, which turns a Bun fetch handler into a guarded\n * one: `Bun.serve({ fetch: camada()(handler) })`. Timer mode by default (a server process lives\n * long enough to poll); `mode: 'lazy'` or CAMADA_SERVERLESS=1 switches to per-request refresh.\n */\nexport function camada(opts: CamadaBunOptions = {}) {\n  const cam = createFetchCamada({ tap: TAP_BUN, sdk: SDK_ID, iife }, { ...opts, mode: opts.mode ?? 'timer' });\n  instances.add(cam);\n  return function wrap<S extends BunServer, R extends Response | undefined | void>(handler: BunHandler<S, R>): (req: Request, server: S) => Promise<Response | R> {\n    return async (req, server) => {\n      // Guarded: a runtime that is not Bun (or a Bun without a socket for this request) hands us\n      // no peer rather than a throw. Client headers are core's to judge under the trusted-proxy rules.\n      const peer = guarded(() => server?.requestIP?.(req)?.address ?? null, null);\n      const r = await cam.before(req, { peer, env: globalThis.Bun?.env ?? globalThis.process?.env });   // Bun.env is process.env under Bun; the fallback is this suite under Node\n      if (!r) return handler(req, server);\n      if (r.response) return r.response;\n      slots.set(req, r.vars);\n      let res: R;\n      try {\n        res = await handler(req, server);\n      } catch (err) {\n        cam.after(req, r.vars, 500);   // Bun answers 500 for a thrown handler (an `error` callback returning its own status is not visible here)\n        throw err;\n      }\n      if (!res) { cam.after(req, r.vars, 101); return res; }   // a websocket upgrade: Bun answers 101 itself, so there is no Response to carry a cookie\n      cam.after(req, r.vars, res.status);\n      return r.vars.sessionCookie ? withSetCookie(res, r.vars.sessionCookie) : res;\n    };\n  };\n}\n\n/** An outcome the wire cannot show (`login_failed`, `signup`, …) joined to this request's event;\n *  the user is HMAC-hashed in-process. A silent no-op where the wrapper did not run. */\nexport const track = (req: Request, event: string, data?: { user?: string }): Promise<void> => coreTrack(slots.get(req), event, data);\n\n/** The beacon `<script>` tag for an HTML response — `''` where the wrapper did not run or the tenant turned the beacon off. */\nexport const scriptTag = (req: Request): string => coreScriptTag(slots.get(req));\n\n/** Test/reset hook: stops every poller and exit handler of every instance this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/bun\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Bun.serve: snapshot enforcement, first-party challenge and beacon, track() outcomes, the socket peer from server.requestIP, timer-polled snapshot with exit flush\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"devDependencies\": {\n    \"@types/bun\": \"^1.2.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACIA,kBAAiC;AACjC,mBAA4J;AAC5J,yBAAiB;;;ACLf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFaxC,IAAM,QAAQ,oBAAI,QAA4B;AAC9C,IAAM,YAAY,oBAAI,IAAiB;AAOhC,SAAS,OAAO,OAAyB,CAAC,GAAG;AAClD,QAAM,UAAM,gCAAkB,EAAE,KAAK,qBAAS,KAAK,QAAQ,yBAAAA,QAAK,GAAG,EAAE,GAAG,MAAM,MAAM,KAAK,QAAQ,QAAQ,CAAC;AAC1G,YAAU,IAAI,GAAG;AACjB,SAAO,SAAS,KAAiE,SAA+E;AAC9J,WAAO,OAAO,KAAK,WAAW;AAG5B,YAAM,WAAO,qBAAQ,MAAM,QAAQ,YAAY,GAAG,GAAG,WAAW,MAAM,IAAI;AAC1E,YAAM,IAAI,MAAM,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,WAAW,KAAK,OAAO,WAAW,SAAS,IAAI,CAAC;AAC7F,UAAI,CAAC,EAAG,QAAO,QAAQ,KAAK,MAAM;AAClC,UAAI,EAAE,SAAU,QAAO,EAAE;AACzB,YAAM,IAAI,KAAK,EAAE,IAAI;AACrB,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,QAAQ,KAAK,MAAM;AAAA,MACjC,SAAS,KAAK;AACZ,YAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAC1B,cAAM;AAAA,MACR;AACA,UAAI,CAAC,KAAK;AAAE,YAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAAG,eAAO;AAAA,MAAK;AACrD,UAAI,MAAM,KAAK,EAAE,MAAM,IAAI,MAAM;AACjC,aAAO,EAAE,KAAK,oBAAgB,4BAAc,KAAK,EAAE,KAAK,aAAa,IAAI;AAAA,IAC3E;AAAA,EACF;AACF;AAIO,IAAM,QAAQ,CAAC,KAAc,OAAe,aAA4C,aAAAC,OAAU,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI;AAG7H,IAAM,YAAY,CAAC,YAAyB,aAAAC,WAAc,MAAM,IAAI,GAAG,CAAC;AAGxE,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":["iife","coreTrack","coreScriptTag"]}

package/dist/index.d.cts

@@ -0,0 +1,29 @@
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+/** The one thing the wrapper needs from Bun's server, typed structurally so the emitted types need no `bun` import; any `Bun.Server` satisfies it. */
+interface BunServer {
+    requestIP(req: Request): {
+        address: string;
+    } | null;
+}
+/** A Bun fetch handler. `undefined`/`void` is what Bun's own websocket pattern returns after `server.upgrade(req)`. */
+type BunHandler<S extends BunServer = BunServer, R extends Response | undefined | void = Response> = (req: Request, server: S) => R | Promise<R>;
+type CamadaBunOptions = FetchCamadaOptions;
+type CamadaBunVars = FetchVars;
+/**
+ * Builds one camada instance and returns `wrap`, which turns a Bun fetch handler into a guarded
+ * one: `Bun.serve({ fetch: camada()(handler) })`. Timer mode by default (a server process lives
+ * long enough to poll); `mode: 'lazy'` or CAMADA_SERVERLESS=1 switches to per-request refresh.
+ */
+declare function camada(opts?: CamadaBunOptions): <S extends BunServer, R extends Response | undefined | void>(handler: BunHandler<S, R>) => (req: Request, server: S) => Promise<Response | R>;
+/** An outcome the wire cannot show (`login_failed`, `signup`, …) joined to this request's event;
+ *  the user is HMAC-hashed in-process. A silent no-op where the wrapper did not run. */
+declare const track: (req: Request, event: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The beacon `<script>` tag for an HTML response — `''` where the wrapper did not run or the tenant turned the beacon off. */
+declare const scriptTag: (req: Request) => string;
+/** Test/reset hook: stops every poller and exit handler of every instance this module created. */
+declare function resetCamada(): void;
+
+export { type BunHandler, type BunServer, type CamadaBunOptions, type CamadaBunVars, camada, resetCamada, scriptTag, track };

package/dist/index.d.ts

@@ -0,0 +1,29 @@
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+/** The one thing the wrapper needs from Bun's server, typed structurally so the emitted types need no `bun` import; any `Bun.Server` satisfies it. */
+interface BunServer {
+    requestIP(req: Request): {
+        address: string;
+    } | null;
+}
+/** A Bun fetch handler. `undefined`/`void` is what Bun's own websocket pattern returns after `server.upgrade(req)`. */
+type BunHandler<S extends BunServer = BunServer, R extends Response | undefined | void = Response> = (req: Request, server: S) => R | Promise<R>;
+type CamadaBunOptions = FetchCamadaOptions;
+type CamadaBunVars = FetchVars;
+/**
+ * Builds one camada instance and returns `wrap`, which turns a Bun fetch handler into a guarded
+ * one: `Bun.serve({ fetch: camada()(handler) })`. Timer mode by default (a server process lives
+ * long enough to poll); `mode: 'lazy'` or CAMADA_SERVERLESS=1 switches to per-request refresh.
+ */
+declare function camada(opts?: CamadaBunOptions): <S extends BunServer, R extends Response | undefined | void>(handler: BunHandler<S, R>) => (req: Request, server: S) => Promise<Response | R>;
+/** An outcome the wire cannot show (`login_failed`, `signup`, …) joined to this request's event;
+ *  the user is HMAC-hashed in-process. A silent no-op where the wrapper did not run. */
+declare const track: (req: Request, event: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The beacon `<script>` tag for an HTML response — `''` where the wrapper did not run or the tenant turned the beacon off. */
+declare const scriptTag: (req: Request) => string;
+/** Test/reset hook: stops every poller and exit handler of every instance this module created. */
+declare function resetCamada(): void;
+
+export { type BunHandler, type BunServer, type CamadaBunOptions, type CamadaBunVars, camada, resetCamada, scriptTag, track };

package/dist/index.js

@@ -0,0 +1,53 @@
+// src/camada.ts
+import { TAP_BUN, guarded } from "@camada/core";
+import { createFetchCamada, withSetCookie, track as coreTrack, scriptTag as coreScriptTag } from "@camada/core/fetch";
+import iife from "@camada/browser/iife-string";
+
+// package.json
+var name = "@camada/bun";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var slots = /* @__PURE__ */ new WeakMap();
+var instances = /* @__PURE__ */ new Set();
+function camada(opts = {}) {
+  const cam = createFetchCamada({ tap: TAP_BUN, sdk: SDK_ID, iife }, { ...opts, mode: opts.mode ?? "timer" });
+  instances.add(cam);
+  return function wrap(handler) {
+    return async (req, server) => {
+      const peer = guarded(() => server?.requestIP?.(req)?.address ?? null, null);
+      const r = await cam.before(req, { peer, env: globalThis.Bun?.env ?? globalThis.process?.env });
+      if (!r) return handler(req, server);
+      if (r.response) return r.response;
+      slots.set(req, r.vars);
+      let res;
+      try {
+        res = await handler(req, server);
+      } catch (err) {
+        cam.after(req, r.vars, 500);
+        throw err;
+      }
+      if (!res) {
+        cam.after(req, r.vars, 101);
+        return res;
+      }
+      cam.after(req, r.vars, res.status);
+      return r.vars.sessionCookie ? withSetCookie(res, r.vars.sessionCookie) : res;
+    };
+  };
+}
+var track = (req, event, data) => coreTrack(slots.get(req), event, data);
+var scriptTag = (req) => coreScriptTag(slots.get(req));
+function resetCamada() {
+  for (const cam of instances) cam.reset();
+}
+export {
+  camada,
+  resetCamada,
+  scriptTag,
+  track
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/bun — the Bun.serve binding for @camada/core/fetch. `wrap` sits around the app's fetch\n// handler: the socket peer comes from `server.requestIP` (the one address Bun vouches for), the\n// env from Bun.env, and there is no waitUntil — a long-lived process polls on a timer and drains\n// on exit instead. Bun has no per-request context object, so the Request itself keys the slot.\nimport { TAP_BUN, guarded } from '@camada/core';\nimport { createFetchCamada, withSetCookie, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\n/** The one thing the wrapper needs from Bun's server, typed structurally so the emitted types need no `bun` import; any `Bun.Server` satisfies it. */\nexport interface BunServer { requestIP(req: Request): { address: string } | null }\n/** A Bun fetch handler. `undefined`/`void` is what Bun's own websocket pattern returns after `server.upgrade(req)`. */\nexport type BunHandler<S extends BunServer = BunServer, R extends Response | undefined | void = Response> = (req: Request, server: S) => R | Promise<R>;\nexport type CamadaBunOptions = FetchCamadaOptions;\nexport type CamadaBunVars = FetchVars;\n\nconst slots = new WeakMap<Request, FetchVars>();   // set only when the app is about to run; camada's own answers leave nothing\nconst instances = new Set<FetchCamada>();\n\n/**\n * Builds one camada instance and returns `wrap`, which turns a Bun fetch handler into a guarded\n * one: `Bun.serve({ fetch: camada()(handler) })`. Timer mode by default (a server process lives\n * long enough to poll); `mode: 'lazy'` or CAMADA_SERVERLESS=1 switches to per-request refresh.\n */\nexport function camada(opts: CamadaBunOptions = {}) {\n  const cam = createFetchCamada({ tap: TAP_BUN, sdk: SDK_ID, iife }, { ...opts, mode: opts.mode ?? 'timer' });\n  instances.add(cam);\n  return function wrap<S extends BunServer, R extends Response | undefined | void>(handler: BunHandler<S, R>): (req: Request, server: S) => Promise<Response | R> {\n    return async (req, server) => {\n      // Guarded: a runtime that is not Bun (or a Bun without a socket for this request) hands us\n      // no peer rather than a throw. Client headers are core's to judge under the trusted-proxy rules.\n      const peer = guarded(() => server?.requestIP?.(req)?.address ?? null, null);\n      const r = await cam.before(req, { peer, env: globalThis.Bun?.env ?? globalThis.process?.env });   // Bun.env is process.env under Bun; the fallback is this suite under Node\n      if (!r) return handler(req, server);\n      if (r.response) return r.response;\n      slots.set(req, r.vars);\n      let res: R;\n      try {\n        res = await handler(req, server);\n      } catch (err) {\n        cam.after(req, r.vars, 500);   // Bun answers 500 for a thrown handler (an `error` callback returning its own status is not visible here)\n        throw err;\n      }\n      if (!res) { cam.after(req, r.vars, 101); return res; }   // a websocket upgrade: Bun answers 101 itself, so there is no Response to carry a cookie\n      cam.after(req, r.vars, res.status);\n      return r.vars.sessionCookie ? withSetCookie(res, r.vars.sessionCookie) : res;\n    };\n  };\n}\n\n/** An outcome the wire cannot show (`login_failed`, `signup`, …) joined to this request's event;\n *  the user is HMAC-hashed in-process. A silent no-op where the wrapper did not run. */\nexport const track = (req: Request, event: string, data?: { user?: string }): Promise<void> => coreTrack(slots.get(req), event, data);\n\n/** The beacon `<script>` tag for an HTML response — `''` where the wrapper did not run or the tenant turned the beacon off. */\nexport const scriptTag = (req: Request): string => coreScriptTag(slots.get(req));\n\n/** Test/reset hook: stops every poller and exit handler of every instance this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/bun\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Bun.serve: snapshot enforcement, first-party challenge and beacon, track() outcomes, the socket peer from server.requestIP, timer-polled snapshot with exit flush\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"devDependencies\": {\n    \"@types/bun\": \"^1.2.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";AAIA,SAAS,SAAS,eAAe;AACjC,SAAS,mBAAmB,eAAe,SAAS,WAAW,aAAa,qBAAgF;AAC5J,OAAO,UAAU;;;ACLf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFaxC,IAAM,QAAQ,oBAAI,QAA4B;AAC9C,IAAM,YAAY,oBAAI,IAAiB;AAOhC,SAAS,OAAO,OAAyB,CAAC,GAAG;AAClD,QAAM,MAAM,kBAAkB,EAAE,KAAK,SAAS,KAAK,QAAQ,KAAK,GAAG,EAAE,GAAG,MAAM,MAAM,KAAK,QAAQ,QAAQ,CAAC;AAC1G,YAAU,IAAI,GAAG;AACjB,SAAO,SAAS,KAAiE,SAA+E;AAC9J,WAAO,OAAO,KAAK,WAAW;AAG5B,YAAM,OAAO,QAAQ,MAAM,QAAQ,YAAY,GAAG,GAAG,WAAW,MAAM,IAAI;AAC1E,YAAM,IAAI,MAAM,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,WAAW,KAAK,OAAO,WAAW,SAAS,IAAI,CAAC;AAC7F,UAAI,CAAC,EAAG,QAAO,QAAQ,KAAK,MAAM;AAClC,UAAI,EAAE,SAAU,QAAO,EAAE;AACzB,YAAM,IAAI,KAAK,EAAE,IAAI;AACrB,UAAI;AACJ,UAAI;AACF,cAAM,MAAM,QAAQ,KAAK,MAAM;AAAA,MACjC,SAAS,KAAK;AACZ,YAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAC1B,cAAM;AAAA,MACR;AACA,UAAI,CAAC,KAAK;AAAE,YAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAAG,eAAO;AAAA,MAAK;AACrD,UAAI,MAAM,KAAK,EAAE,MAAM,IAAI,MAAM;AACjC,aAAO,EAAE,KAAK,gBAAgB,cAAc,KAAK,EAAE,KAAK,aAAa,IAAI;AAAA,IAC3E;AAAA,EACF;AACF;AAIO,IAAM,QAAQ,CAAC,KAAc,OAAe,SAA4C,UAAU,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI;AAG7H,IAAM,YAAY,CAAC,QAAyB,cAAc,MAAM,IAAI,GAAG,CAAC;AAGxE,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":[]}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@camada/bun",
+  "version": "0.1.0",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "description": "camada SDK for Bun.serve: snapshot enforcement, first-party challenge and beacon, track() outcomes, the socket peer from server.requestIP, timer-polled snapshot with exit flush",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@camada/core": "^0.3.0",
+    "@camada/browser": "^0.2.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/camada-app/camada-bun.git"
+  },
+  "homepage": "https://github.com/camada-app/camada-bun#readme",
+  "bugs": {
+    "url": "https://github.com/camada-app/camada-bun/issues"
+  }
+}