@camada/deno 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 camada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,155 @@
+# @camada/deno
+
+camada for [Deno](https://deno.com) `Deno.serve`: enforces the tenant snapshot inline (your
+ordered custom rules, then block, allow, challenge), serves a first-party proof-of-work challenge
+page and beacon, records the outcomes your handler knows (`track()`), and ships wire events in
+batches off the response path. A thin binding over `@camada/core/fetch`, the pipeline every
+Web-fetch adapter shares. Fails open by design — a camada outage or bug never 5xxes your app.
+
+Not yet on npm — consumed via a `file:` dependency from a sibling checkout. Built with tsup like
+the rest of the workspace; there is no `deno.json` this round. From Deno, once published it is
+`npm:@camada/deno`; locally, an import-map entry pointing at the sibling build works:
+
+```json
+{ "imports": { "@camada/deno": "../camada-deno/dist/index.js" } }
+```
+
+## Quickstart
+
+```ts
+import { camada } from '@camada/deno';
+
+Deno.serve(camada()((req, info) => new Response('hello')));
+```
+
+Env (printed by camada onboarding / `npm run seed` in dev), read key by key through
+`Deno.env.get` — run with `--allow-env`, or the granular
+`--allow-env=CAMADA_KEY,CAMADA_INGEST_URL,CAMADA_SNAPSHOT_URL` (a key outside the grant simply
+reads as unset):
+
+```
+CAMADA_KEY=<ingest_token>.<snap_token>
+CAMADA_INGEST_URL=http://localhost:8787        # dev only; defaults to production ingest
+```
+
+`camada()` reads the env on each request and builds its engine on the first configured one; a
+denied env read (no `--allow-env` at all) is caught, logged as denied at most once a minute, and
+leaves the wrapper inert — the app still answers. An app that reads its own config can pass the values instead:
+
+```ts
+Deno.serve(camada({ key: MY_KEY, ingestUrl: MY_INGEST })(handler));
+```
+
+Call `camada()` once and reuse the wrapper. Engines are cached per resolved configuration, so
+wrapping two handlers with the same config shares one snapshot poller and one event queue,
+while two wrappers with different keys or URLs each get their own — a process hosting several
+apps never enforces one tenant's snapshot on another, nor signs its cookies with another's
+secret. Without `CAMADA_KEY` the wrapper is inert (one log line, no requests, no enforcement).
+
+## What it does per request
+
+1. Keeps the snapshot fresh. Deno is a long-lived process, so the default is `mode: 'timer'`: an
+   interval poll at the cadence your tenant config sets. `CAMADA_SERVERLESS=1` (or
+   `mode: 'lazy'`) switches to a per-request staleness check for Deno Deploy, where an isolate
+   may be frozen between requests. Every poll and event batch carries
+   `x-camada-sdk: @camada/deno/<version>`, and polls ask for snapshot v5
+   (`x-camada-snapshot: 5`) — the container that carries your ordered custom rules.
+2. Resolves the client from `info.remoteAddr` — the TCP peer Deno vouches for — combined with
+   `X-Forwarded-For` only under your tenant's trusted-proxy config. A client header on its own
+   (`x-forwarded-for`, `x-real-ip`, `cf-connecting-ip`) is never the ip: any caller can set it.
+   Over a unix socket there is no peer, so the ip is null: the request is still captured, but
+   ip rules cannot match it and it is never challenged.
+3. Runs your ordered custom rules, then the allow, block and challenge lists.
+4. **Block** → `403` with `x-block-reason` before your handler; the event still ships, with
+   `st: 403` and `blk: <reason>` so the analyst counts SDK blocks apart from your own 403s.
+5. **Skip** → a skip rule or the allow list wins over a wider block.
+6. **Challenge** → a `403` proof-of-work page (HTML navigations) or `403 {"error":"challenge_required"}`
+   (everything else), verified at `POST /__camada/challenge`, which sets `_cch` and 302s back.
+7. Otherwise your handler runs; the settled response ships one batched, redacted event with its
+   real status. A handler that throws ships `st: 500` — what `Deno.serve` answers for it — and
+   rethrows (an `onError` answering with another status is not seen here). A first visit is given the `_sfp` session
+   cookie (appended even to a `Response.redirect()`, whose headers are immutable).
+
+## Options
+
+| option | default | meaning |
+|---|---|---|
+| `key` | `env.CAMADA_KEY` | `<ingest_token>.<snap_token>`; without it the wrapper is inert |
+| `ingestUrl` | `env.CAMADA_INGEST_URL` | ingest base; batches go to `<ingestUrl>/e` |
+| `snapshotUrl` | `<ingestUrl>/snapshot` | snapshot endpoint |
+| `trustedProxy` | server config | `none` / `vercel` / `hops:N` / `cidrs:a,b`, or the parsed object |
+| `challenge` | `true` | serve the proof-of-work page for `challenge` verdicts |
+| `challengePath` | `/__camada/challenge` | where that page posts its solution |
+| `snapshotVersion` | `5` | `4` drops the custom rules, `3` the allow/challenge sides too |
+| `scriptPath` | `/_cam/b.js` | where the first-party beacon script is served |
+| `fpPath` | `/_cam/fp` | where that script posts the beacon; keep it in `scriptPath`'s directory |
+| `mode` | `timer` (or `lazy`) | `timer` polls the snapshot on an unref'd interval (long-lived process); `lazy` refreshes it per request off-path. `CAMADA_SERVERLESS=1` forces `lazy` |
+| `env` | `Deno.env` | overrides the process env (tests, and apps that read config themselves) |
+
+`CAMADA_CHALLENGE=0` in the env switches the challenge off without a code change.
+
+`CAMADA_DISABLED=1` in the env switches everything off, checked per request.
+
+## The first-party beacon
+
+Bots that never run JavaScript are the cheapest to catch. Put the tag in the `<head>` of the
+pages you render and the wrapper does the rest:
+
+```ts
+import { camada, scriptTag } from '@camada/deno';
+
+Deno.serve(camada()((req) =>
+  new Response(`<html><head>${scriptTag(req)}</head><body>…</body></html>`, { headers: { 'content-type': 'text/html' } })));
+```
+
+`scriptTag(req)` returns `<script src="/_cam/b.js?r=<rid>" async></script>` — the `rid` is this
+request's event id, so the analyst joins the beacon to the page view. The wrapper serves the
+script at `GET /_cam/b.js` (cacheable, 1 h) and relays `POST /_cam/fp` (≤ 32 KB, answers 204)
+onto the event batch as a `sig: 1` row stamped with the client ip camada resolved — never the
+one the body claims. Both endpoints sit behind the verdict: a blocked client gets 403 there
+too. The tag is `''` when camada is off for the request or the project turned the beacon off
+in its settings, and the endpoints stand down with it. `scriptTag` and `track` find their
+request by the `Request` object `Deno.serve` handed you, so pass that one, not a clone.
+
+## App-context events
+
+The wire shows a `POST /login`; only your handler knows whether it failed. Tell camada:
+
+```ts
+import { camada, track } from '@camada/deno';
+
+Deno.serve(camada()(async (req) => {
+  const ok = await signIn(req);
+  if (!ok) track(req, 'login_failed', { user: email });   // await optional — the flush is off-path
+  return ok ? Response.redirect('/', 302) : new Response('Invalid credentials', { status: 401 });
+}));
+```
+
+`track(req, event, { user? })` ships `{ et, uid, rid, sid, ip, ts }` joined to this request's event.
+The user identifier is HMAC-hashed in-process with the ingest token — the raw value never leaves
+the process. It never throws and is a no-op where the wrapper did not run. The event name is
+free-form; the analyst's rules read this vocabulary:
+
+| event | when |
+|---|---|
+| `login_failed` / `login_succeeded` | a credential check settled |
+| `signup` | an account was created |
+| `password_reset` | a reset was requested |
+| `mfa_failed` | a second factor was rejected |
+| `payment_failed` / `payment_succeeded` | a charge settled |
+| `coupon_failed` | a promo code was rejected |
+
+## What this tap can see
+
+The in-app position: the beacon, the client hints and headers, the settled status, the `_sfp`
+session and the app context from `track()`. Deno vouches for the socket peer (`info.remoteAddr`)
+and nothing else about the connection: no ASN, no country, no TLS fingerprint and no client
+protocol reach this tap, so `asn`, `country` and `tlsx` conditions cannot match here and `proto`
+is null on the event (camada never reads a forwarded protocol header for it). Header order is normalised by the `Headers` object, so the raw-wire-order signal is not
+available either. The analyst knows all of this from the tap's capability mask (`sdk-deno`) and
+never scores an absence as evidence.
+
+## Fail open
+
+Every entry point runs inside camada's guard. A dead ingest, a corrupt snapshot, a denied env
+read, a bug in this package: telemetry is lost, the request is not.

package/dist/index.cjs

@@ -0,0 +1,103 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  camada: () => camada,
+  resetCamada: () => resetCamada,
+  scriptTag: () => scriptTag,
+  track: () => track
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/camada.ts
+var import_iife_string = __toESM(require("@camada/browser/iife-string"), 1);
+var import_core = require("@camada/core");
+var import_fetch = require("@camada/core/fetch");
+
+// package.json
+var name = "@camada/deno";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var instances = /* @__PURE__ */ new Set();
+var slots = /* @__PURE__ */ new WeakMap();
+var ENV_KEYS = ["CAMADA_KEY", "CAMADA_TOKEN", "CAMADA_SNAPSHOT_TOKEN", "CAMADA_INGEST_URL", "CAMADA_SNAPSHOT_URL", "CAMADA_TRUSTED_PROXY", "CAMADA_CHALLENGE", "CAMADA_DISABLED", "CAMADA_SERVERLESS"];
+function hostEnv() {
+  const deno = globalThis.Deno;
+  if (!deno) return globalThis.process?.env;
+  const env = {};
+  let denied = 0;
+  for (const k of ENV_KEYS) {
+    try {
+      env[k] = deno.env.get(k);
+    } catch {
+      denied++;
+    }
+  }
+  if (denied === ENV_KEYS.length) (0, import_core.logRateLimited)(new Error("Deno.env access denied \u2014 run with --allow-env (or --allow-env=CAMADA_KEY,CAMADA_INGEST_URL,CAMADA_SNAPSHOT_URL); camada is inactive"));
+  return env;
+}
+var peerOf = (info) => info?.remoteAddr?.transport === "tcp" ? info.remoteAddr.hostname ?? null : null;
+function camada(opts = {}) {
+  const cam = (0, import_fetch.createFetchCamada)({ tap: import_core.TAP_DENO, sdk: SDK_ID, iife: import_iife_string.default }, { ...opts, mode: opts.mode ?? "timer" });
+  instances.add(cam);
+  return (handler) => async (req, info) => {
+    const r = await cam.before(req, { peer: peerOf(info), env: hostEnv() });
+    if (!r) return handler(req, info);
+    if (r.response) return r.response;
+    slots.set(req, r.vars);
+    let res;
+    try {
+      res = await handler(req, info);
+    } catch (err) {
+      cam.after(req, r.vars, 500);
+      throw err;
+    }
+    cam.after(req, r.vars, res.status);
+    return r.vars.sessionCookie ? (0, import_fetch.withSetCookie)(res, r.vars.sessionCookie) : res;
+  };
+}
+var track = (req, event, data) => (0, import_fetch.track)(slots.get(req), event, data);
+var scriptTag = (req) => (0, import_fetch.scriptTag)(slots.get(req));
+function resetCamada() {
+  for (const cam of instances) cam.reset();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  camada,
+  resetCamada,
+  scriptTag,
+  track
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/deno — the one-line install for a Deno.serve app:\n//   Deno.serve(camada()(handler));   // env: CAMADA_KEY (+ CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL in dev)\n//   new Response(`<head>${scriptTag(req)}</head>…`)   // the first-party beacon\n//   track(req, 'login_failed', { user })              // an outcome the wire cannot show\nexport {\n  camada, track, scriptTag, resetCamada,\n  type CamadaDenoOptions, type CamadaDenoVars, type ServeHandlerInfo, type ServeHandler, type WrappedHandler,\n} from './camada.js';\n","// @camada/deno — the Deno.serve wrapper over @camada/core/fetch (SDK-G04).\n//   Deno.serve(camada()(handler));\n// The runtime vouches for exactly one thing here: `info.remoteAddr`, the TCP socket peer. It goes\n// in as `ctx.peer` and core combines it with X-Forwarded-For under the trusted-proxy rules; a\n// client header on its own never becomes the ip. Deno is a long-lived process, so the snapshot\n// polls on a timer by default (CAMADA_SERVERLESS=1 or `mode: 'lazy'` for Deno Deploy), and there\n// is no `waitUntil`: the event flush is a fire-and-forget promise the process keeps alive.\nimport iife from '@camada/browser/iife-string';\nimport { TAP_DENO, logRateLimited } from '@camada/core';\nimport { createFetchCamada, withSetCookie, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchVars } from '@camada/core/fetch';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaDenoOptions = FetchCamadaOptions;\nexport type CamadaDenoVars = FetchVars;\n\n/** The second argument Deno.serve hands a handler, typed structurally so this package needs no Deno types. */\nexport interface ServeHandlerInfo {\n  remoteAddr: { transport: 'tcp' | 'udp' | 'unix' | 'unixpacket'; hostname?: string; port?: number };\n}\nexport type ServeHandler = (req: Request, info: ServeHandlerInfo) => Response | Promise<Response>;\nexport type WrappedHandler = (req: Request, info: ServeHandlerInfo) => Promise<Response>;\n\ntype DenoGlobal = { env: { get(name: string): string | undefined } };\ntype Env = Record<string, string | undefined>;\n\n// Every camada() call owns one pipeline; resetCamada() must reach all of them.\nconst instances = new Set<FetchCamada>();\n// The per-request slot: Deno hands the same Request object to the handler, so track() and\n// scriptTag() find their vars by it without the app threading anything through.\nconst slots = new WeakMap<Request, FetchVars>();\n\n/** Every key core reads, fetched one by one: `Deno.env.get` works under a granular\n *  `--allow-env=CAMADA_KEY,…` grant, where `toObject()` (and enumerating `process.env`) throws. */\nconst ENV_KEYS = ['CAMADA_KEY', 'CAMADA_TOKEN', 'CAMADA_SNAPSHOT_TOKEN', 'CAMADA_INGEST_URL', 'CAMADA_SNAPSHOT_URL', 'CAMADA_TRUSTED_PROXY', 'CAMADA_CHALLENGE', 'CAMADA_DISABLED', 'CAMADA_SERVERLESS'];\n\n/** Deno.env where there is a Deno (a Node test process has only process.env). A key the grant does\n *  not cover throws NotCapable; that costs enforcement, never the response, and is logged as what it is. */\nfunction hostEnv(): Env | undefined {\n  const deno = (globalThis as { Deno?: DenoGlobal }).Deno;\n  if (!deno) return globalThis.process?.env;\n  const env: Env = {};\n  let denied = 0;\n  for (const k of ENV_KEYS) {\n    try { env[k] = deno.env.get(k); } catch { denied++; }\n  }\n  if (denied === ENV_KEYS.length) logRateLimited(new Error('Deno.env access denied — run with --allow-env (or --allow-env=CAMADA_KEY,CAMADA_INGEST_URL,CAMADA_SNAPSHOT_URL); camada is inactive'));\n  return env;\n}\n\n/** Only a TCP peer is an address; a unix socket has none, and camada then sees no client ip. */\nconst peerOf = (info: ServeHandlerInfo | undefined): string | null =>\n  info?.remoteAddr?.transport === 'tcp' ? info.remoteAddr.hostname ?? null : null;\n\n/**\n * Builds the wrapper: `Deno.serve(camada()(handler))`. Mode defaults to `timer` (a long-lived\n * process polls the snapshot on an unref'd interval); `opts.mode` overrides and CAMADA_SERVERLESS=1\n * forces lazy. Deno's setInterval returns a number, so that unref is a no-op there and the poll\n * keeps the process alive until resetCamada() or exit — under Node (vitest) resetCamada() is what\n * lets a test process end.\n */\nexport function camada(opts: CamadaDenoOptions = {}): (handler: ServeHandler) => WrappedHandler {\n  const cam = createFetchCamada({ tap: TAP_DENO, sdk: SDK_ID, iife }, { ...opts, mode: opts.mode ?? 'timer' });\n  instances.add(cam);\n  return (handler) => async (req, info) => {\n    const r = await cam.before(req, { peer: peerOf(info), env: hostEnv() });\n    if (!r) return handler(req, info);\n    if (r.response) return r.response;\n    slots.set(req, r.vars);\n    let res: Response;\n    try {\n      res = await handler(req, info);\n    } catch (err) {\n      cam.after(req, r.vars, 500);   // Deno.serve answers 500 for a thrown handler (an onError returning its own status is not visible here)\n      throw err;\n    }\n    cam.after(req, r.vars, res.status);\n    return r.vars.sessionCookie ? withSetCookie(res, r.vars.sessionCookie) : res;\n  };\n}\n\n/** Records an outcome the handler knows (`login_failed`, `signup`, ...), joined to this request's\n *  event. Never throws; a silent no-op where the wrapper did not run. See @camada/core/fetch. */\nexport const track = (req: Request, event: string, data?: { user?: string }): Promise<void> => coreTrack(slots.get(req), event, data);\n\n/** The `<script>` tag for an HTML response; `''` where the wrapper did not run or the beacon is off. */\nexport const scriptTag = (req: Request): string => coreScriptTag(slots.get(req));\n\n/** Test/reset hook: stops every poller and queue this module created and drops their engines; the wrappers stay wired and rebuild lazily. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/deno\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Deno.serve: snapshot enforcement, first-party challenge and beacon, track() outcomes, timer-polled snapshot and batched event shipping\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^22.10.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOA,yBAAiB;AACjB,kBAAyC;AACzC,mBAA4J;;;ACR1J,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFuBxC,IAAM,YAAY,oBAAI,IAAiB;AAGvC,IAAM,QAAQ,oBAAI,QAA4B;AAI9C,IAAM,WAAW,CAAC,cAAc,gBAAgB,yBAAyB,qBAAqB,uBAAuB,wBAAwB,oBAAoB,mBAAmB,mBAAmB;AAIvM,SAAS,UAA2B;AAClC,QAAM,OAAQ,WAAqC;AACnD,MAAI,CAAC,KAAM,QAAO,WAAW,SAAS;AACtC,QAAM,MAAW,CAAC;AAClB,MAAI,SAAS;AACb,aAAW,KAAK,UAAU;AACxB,QAAI;AAAE,UAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC;AAAA,IAAG,QAAQ;AAAE;AAAA,IAAU;AAAA,EACtD;AACA,MAAI,WAAW,SAAS,OAAQ,iCAAe,IAAI,MAAM,0IAAqI,CAAC;AAC/L,SAAO;AACT;AAGA,IAAM,SAAS,CAAC,SACd,MAAM,YAAY,cAAc,QAAQ,KAAK,WAAW,YAAY,OAAO;AAStE,SAAS,OAAO,OAA0B,CAAC,GAA8C;AAC9F,QAAM,UAAM,gCAAkB,EAAE,KAAK,sBAAU,KAAK,QAAQ,yBAAAA,QAAK,GAAG,EAAE,GAAG,MAAM,MAAM,KAAK,QAAQ,QAAQ,CAAC;AAC3G,YAAU,IAAI,GAAG;AACjB,SAAO,CAAC,YAAY,OAAO,KAAK,SAAS;AACvC,UAAM,IAAI,MAAM,IAAI,OAAO,KAAK,EAAE,MAAM,OAAO,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;AACtE,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK,IAAI;AAChC,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,IAAI,KAAK,EAAE,IAAI;AACrB,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,QAAQ,KAAK,IAAI;AAAA,IAC/B,SAAS,KAAK;AACZ,UAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAC1B,YAAM;AAAA,IACR;AACA,QAAI,MAAM,KAAK,EAAE,MAAM,IAAI,MAAM;AACjC,WAAO,EAAE,KAAK,oBAAgB,4BAAc,KAAK,EAAE,KAAK,aAAa,IAAI;AAAA,EAC3E;AACF;AAIO,IAAM,QAAQ,CAAC,KAAc,OAAe,aAA4C,aAAAC,OAAU,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI;AAG7H,IAAM,YAAY,CAAC,YAAyB,aAAAC,WAAc,MAAM,IAAI,GAAG,CAAC;AAGxE,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":["iife","coreTrack","coreScriptTag"]}

package/dist/index.d.cts

@@ -0,0 +1,33 @@
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+type CamadaDenoOptions = FetchCamadaOptions;
+type CamadaDenoVars = FetchVars;
+/** The second argument Deno.serve hands a handler, typed structurally so this package needs no Deno types. */
+interface ServeHandlerInfo {
+    remoteAddr: {
+        transport: 'tcp' | 'udp' | 'unix' | 'unixpacket';
+        hostname?: string;
+        port?: number;
+    };
+}
+type ServeHandler = (req: Request, info: ServeHandlerInfo) => Response | Promise<Response>;
+type WrappedHandler = (req: Request, info: ServeHandlerInfo) => Promise<Response>;
+/**
+ * Builds the wrapper: `Deno.serve(camada()(handler))`. Mode defaults to `timer` (a long-lived
+ * process polls the snapshot on an unref'd interval); `opts.mode` overrides and CAMADA_SERVERLESS=1
+ * forces lazy. Deno's setInterval returns a number, so that unref is a no-op there and the poll
+ * keeps the process alive until resetCamada() or exit — under Node (vitest) resetCamada() is what
+ * lets a test process end.
+ */
+declare function camada(opts?: CamadaDenoOptions): (handler: ServeHandler) => WrappedHandler;
+/** Records an outcome the handler knows (`login_failed`, `signup`, ...), joined to this request's
+ *  event. Never throws; a silent no-op where the wrapper did not run. See @camada/core/fetch. */
+declare const track: (req: Request, event: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The `<script>` tag for an HTML response; `''` where the wrapper did not run or the beacon is off. */
+declare const scriptTag: (req: Request) => string;
+/** Test/reset hook: stops every poller and queue this module created and drops their engines; the wrappers stay wired and rebuild lazily. */
+declare function resetCamada(): void;
+
+export { type CamadaDenoOptions, type CamadaDenoVars, type ServeHandler, type ServeHandlerInfo, type WrappedHandler, camada, resetCamada, scriptTag, track };

package/dist/index.d.ts

@@ -0,0 +1,33 @@
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+type CamadaDenoOptions = FetchCamadaOptions;
+type CamadaDenoVars = FetchVars;
+/** The second argument Deno.serve hands a handler, typed structurally so this package needs no Deno types. */
+interface ServeHandlerInfo {
+    remoteAddr: {
+        transport: 'tcp' | 'udp' | 'unix' | 'unixpacket';
+        hostname?: string;
+        port?: number;
+    };
+}
+type ServeHandler = (req: Request, info: ServeHandlerInfo) => Response | Promise<Response>;
+type WrappedHandler = (req: Request, info: ServeHandlerInfo) => Promise<Response>;
+/**
+ * Builds the wrapper: `Deno.serve(camada()(handler))`. Mode defaults to `timer` (a long-lived
+ * process polls the snapshot on an unref'd interval); `opts.mode` overrides and CAMADA_SERVERLESS=1
+ * forces lazy. Deno's setInterval returns a number, so that unref is a no-op there and the poll
+ * keeps the process alive until resetCamada() or exit — under Node (vitest) resetCamada() is what
+ * lets a test process end.
+ */
+declare function camada(opts?: CamadaDenoOptions): (handler: ServeHandler) => WrappedHandler;
+/** Records an outcome the handler knows (`login_failed`, `signup`, ...), joined to this request's
+ *  event. Never throws; a silent no-op where the wrapper did not run. See @camada/core/fetch. */
+declare const track: (req: Request, event: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The `<script>` tag for an HTML response; `''` where the wrapper did not run or the beacon is off. */
+declare const scriptTag: (req: Request) => string;
+/** Test/reset hook: stops every poller and queue this module created and drops their engines; the wrappers stay wired and rebuild lazily. */
+declare function resetCamada(): void;
+
+export { type CamadaDenoOptions, type CamadaDenoVars, type ServeHandler, type ServeHandlerInfo, type WrappedHandler, camada, resetCamada, scriptTag, track };

package/dist/index.js

@@ -0,0 +1,63 @@
+// src/camada.ts
+import iife from "@camada/browser/iife-string";
+import { TAP_DENO, logRateLimited } from "@camada/core";
+import { createFetchCamada, withSetCookie, track as coreTrack, scriptTag as coreScriptTag } from "@camada/core/fetch";
+
+// package.json
+var name = "@camada/deno";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var instances = /* @__PURE__ */ new Set();
+var slots = /* @__PURE__ */ new WeakMap();
+var ENV_KEYS = ["CAMADA_KEY", "CAMADA_TOKEN", "CAMADA_SNAPSHOT_TOKEN", "CAMADA_INGEST_URL", "CAMADA_SNAPSHOT_URL", "CAMADA_TRUSTED_PROXY", "CAMADA_CHALLENGE", "CAMADA_DISABLED", "CAMADA_SERVERLESS"];
+function hostEnv() {
+  const deno = globalThis.Deno;
+  if (!deno) return globalThis.process?.env;
+  const env = {};
+  let denied = 0;
+  for (const k of ENV_KEYS) {
+    try {
+      env[k] = deno.env.get(k);
+    } catch {
+      denied++;
+    }
+  }
+  if (denied === ENV_KEYS.length) logRateLimited(new Error("Deno.env access denied \u2014 run with --allow-env (or --allow-env=CAMADA_KEY,CAMADA_INGEST_URL,CAMADA_SNAPSHOT_URL); camada is inactive"));
+  return env;
+}
+var peerOf = (info) => info?.remoteAddr?.transport === "tcp" ? info.remoteAddr.hostname ?? null : null;
+function camada(opts = {}) {
+  const cam = createFetchCamada({ tap: TAP_DENO, sdk: SDK_ID, iife }, { ...opts, mode: opts.mode ?? "timer" });
+  instances.add(cam);
+  return (handler) => async (req, info) => {
+    const r = await cam.before(req, { peer: peerOf(info), env: hostEnv() });
+    if (!r) return handler(req, info);
+    if (r.response) return r.response;
+    slots.set(req, r.vars);
+    let res;
+    try {
+      res = await handler(req, info);
+    } catch (err) {
+      cam.after(req, r.vars, 500);
+      throw err;
+    }
+    cam.after(req, r.vars, res.status);
+    return r.vars.sessionCookie ? withSetCookie(res, r.vars.sessionCookie) : res;
+  };
+}
+var track = (req, event, data) => coreTrack(slots.get(req), event, data);
+var scriptTag = (req) => coreScriptTag(slots.get(req));
+function resetCamada() {
+  for (const cam of instances) cam.reset();
+}
+export {
+  camada,
+  resetCamada,
+  scriptTag,
+  track
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/deno — the Deno.serve wrapper over @camada/core/fetch (SDK-G04).\n//   Deno.serve(camada()(handler));\n// The runtime vouches for exactly one thing here: `info.remoteAddr`, the TCP socket peer. It goes\n// in as `ctx.peer` and core combines it with X-Forwarded-For under the trusted-proxy rules; a\n// client header on its own never becomes the ip. Deno is a long-lived process, so the snapshot\n// polls on a timer by default (CAMADA_SERVERLESS=1 or `mode: 'lazy'` for Deno Deploy), and there\n// is no `waitUntil`: the event flush is a fire-and-forget promise the process keeps alive.\nimport iife from '@camada/browser/iife-string';\nimport { TAP_DENO, logRateLimited } from '@camada/core';\nimport { createFetchCamada, withSetCookie, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchVars } from '@camada/core/fetch';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaDenoOptions = FetchCamadaOptions;\nexport type CamadaDenoVars = FetchVars;\n\n/** The second argument Deno.serve hands a handler, typed structurally so this package needs no Deno types. */\nexport interface ServeHandlerInfo {\n  remoteAddr: { transport: 'tcp' | 'udp' | 'unix' | 'unixpacket'; hostname?: string; port?: number };\n}\nexport type ServeHandler = (req: Request, info: ServeHandlerInfo) => Response | Promise<Response>;\nexport type WrappedHandler = (req: Request, info: ServeHandlerInfo) => Promise<Response>;\n\ntype DenoGlobal = { env: { get(name: string): string | undefined } };\ntype Env = Record<string, string | undefined>;\n\n// Every camada() call owns one pipeline; resetCamada() must reach all of them.\nconst instances = new Set<FetchCamada>();\n// The per-request slot: Deno hands the same Request object to the handler, so track() and\n// scriptTag() find their vars by it without the app threading anything through.\nconst slots = new WeakMap<Request, FetchVars>();\n\n/** Every key core reads, fetched one by one: `Deno.env.get` works under a granular\n *  `--allow-env=CAMADA_KEY,…` grant, where `toObject()` (and enumerating `process.env`) throws. */\nconst ENV_KEYS = ['CAMADA_KEY', 'CAMADA_TOKEN', 'CAMADA_SNAPSHOT_TOKEN', 'CAMADA_INGEST_URL', 'CAMADA_SNAPSHOT_URL', 'CAMADA_TRUSTED_PROXY', 'CAMADA_CHALLENGE', 'CAMADA_DISABLED', 'CAMADA_SERVERLESS'];\n\n/** Deno.env where there is a Deno (a Node test process has only process.env). A key the grant does\n *  not cover throws NotCapable; that costs enforcement, never the response, and is logged as what it is. */\nfunction hostEnv(): Env | undefined {\n  const deno = (globalThis as { Deno?: DenoGlobal }).Deno;\n  if (!deno) return globalThis.process?.env;\n  const env: Env = {};\n  let denied = 0;\n  for (const k of ENV_KEYS) {\n    try { env[k] = deno.env.get(k); } catch { denied++; }\n  }\n  if (denied === ENV_KEYS.length) logRateLimited(new Error('Deno.env access denied — run with --allow-env (or --allow-env=CAMADA_KEY,CAMADA_INGEST_URL,CAMADA_SNAPSHOT_URL); camada is inactive'));\n  return env;\n}\n\n/** Only a TCP peer is an address; a unix socket has none, and camada then sees no client ip. */\nconst peerOf = (info: ServeHandlerInfo | undefined): string | null =>\n  info?.remoteAddr?.transport === 'tcp' ? info.remoteAddr.hostname ?? null : null;\n\n/**\n * Builds the wrapper: `Deno.serve(camada()(handler))`. Mode defaults to `timer` (a long-lived\n * process polls the snapshot on an unref'd interval); `opts.mode` overrides and CAMADA_SERVERLESS=1\n * forces lazy. Deno's setInterval returns a number, so that unref is a no-op there and the poll\n * keeps the process alive until resetCamada() or exit — under Node (vitest) resetCamada() is what\n * lets a test process end.\n */\nexport function camada(opts: CamadaDenoOptions = {}): (handler: ServeHandler) => WrappedHandler {\n  const cam = createFetchCamada({ tap: TAP_DENO, sdk: SDK_ID, iife }, { ...opts, mode: opts.mode ?? 'timer' });\n  instances.add(cam);\n  return (handler) => async (req, info) => {\n    const r = await cam.before(req, { peer: peerOf(info), env: hostEnv() });\n    if (!r) return handler(req, info);\n    if (r.response) return r.response;\n    slots.set(req, r.vars);\n    let res: Response;\n    try {\n      res = await handler(req, info);\n    } catch (err) {\n      cam.after(req, r.vars, 500);   // Deno.serve answers 500 for a thrown handler (an onError returning its own status is not visible here)\n      throw err;\n    }\n    cam.after(req, r.vars, res.status);\n    return r.vars.sessionCookie ? withSetCookie(res, r.vars.sessionCookie) : res;\n  };\n}\n\n/** Records an outcome the handler knows (`login_failed`, `signup`, ...), joined to this request's\n *  event. Never throws; a silent no-op where the wrapper did not run. See @camada/core/fetch. */\nexport const track = (req: Request, event: string, data?: { user?: string }): Promise<void> => coreTrack(slots.get(req), event, data);\n\n/** The `<script>` tag for an HTML response; `''` where the wrapper did not run or the beacon is off. */\nexport const scriptTag = (req: Request): string => coreScriptTag(slots.get(req));\n\n/** Test/reset hook: stops every poller and queue this module created and drops their engines; the wrappers stay wired and rebuild lazily. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/deno\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Deno.serve: snapshot enforcement, first-party challenge and beacon, track() outcomes, timer-polled snapshot and batched event shipping\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^22.10.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";AAOA,OAAO,UAAU;AACjB,SAAS,UAAU,sBAAsB;AACzC,SAAS,mBAAmB,eAAe,SAAS,WAAW,aAAa,qBAAgF;;;ACR1J,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFuBxC,IAAM,YAAY,oBAAI,IAAiB;AAGvC,IAAM,QAAQ,oBAAI,QAA4B;AAI9C,IAAM,WAAW,CAAC,cAAc,gBAAgB,yBAAyB,qBAAqB,uBAAuB,wBAAwB,oBAAoB,mBAAmB,mBAAmB;AAIvM,SAAS,UAA2B;AAClC,QAAM,OAAQ,WAAqC;AACnD,MAAI,CAAC,KAAM,QAAO,WAAW,SAAS;AACtC,QAAM,MAAW,CAAC;AAClB,MAAI,SAAS;AACb,aAAW,KAAK,UAAU;AACxB,QAAI;AAAE,UAAI,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC;AAAA,IAAG,QAAQ;AAAE;AAAA,IAAU;AAAA,EACtD;AACA,MAAI,WAAW,SAAS,OAAQ,gBAAe,IAAI,MAAM,0IAAqI,CAAC;AAC/L,SAAO;AACT;AAGA,IAAM,SAAS,CAAC,SACd,MAAM,YAAY,cAAc,QAAQ,KAAK,WAAW,YAAY,OAAO;AAStE,SAAS,OAAO,OAA0B,CAAC,GAA8C;AAC9F,QAAM,MAAM,kBAAkB,EAAE,KAAK,UAAU,KAAK,QAAQ,KAAK,GAAG,EAAE,GAAG,MAAM,MAAM,KAAK,QAAQ,QAAQ,CAAC;AAC3G,YAAU,IAAI,GAAG;AACjB,SAAO,CAAC,YAAY,OAAO,KAAK,SAAS;AACvC,UAAM,IAAI,MAAM,IAAI,OAAO,KAAK,EAAE,MAAM,OAAO,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;AACtE,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK,IAAI;AAChC,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,IAAI,KAAK,EAAE,IAAI;AACrB,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,QAAQ,KAAK,IAAI;AAAA,IAC/B,SAAS,KAAK;AACZ,UAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAC1B,YAAM;AAAA,IACR;AACA,QAAI,MAAM,KAAK,EAAE,MAAM,IAAI,MAAM;AACjC,WAAO,EAAE,KAAK,gBAAgB,cAAc,KAAK,EAAE,KAAK,aAAa,IAAI;AAAA,EAC3E;AACF;AAIO,IAAM,QAAQ,CAAC,KAAc,OAAe,SAA4C,UAAU,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI;AAG7H,IAAM,YAAY,CAAC,QAAyB,cAAc,MAAM,IAAI,GAAG,CAAC;AAGxE,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":[]}

package/package.json

@@ -0,0 +1,37 @@
+{
+  "name": "@camada/deno",
+  "version": "0.1.0",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "description": "camada SDK for Deno.serve: snapshot enforcement, first-party challenge and beacon, track() outcomes, timer-polled snapshot and batched event shipping",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@camada/core": "^0.3.0",
+    "@camada/browser": "^0.2.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/camada-app/camada-deno.git"
+  },
+  "homepage": "https://github.com/camada-app/camada-deno#readme",
+  "bugs": {
+    "url": "https://github.com/camada-app/camada-deno/issues"
+  }
+}