@camada/hono 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 camada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,215 @@
+# @camada/hono
+
+camada for [Hono](https://hono.dev) on Cloudflare Workers: enforces the tenant snapshot inline
+(your ordered custom rules, then block, allow, challenge), serves a first-party proof-of-work
+challenge page and beacon, records the outcomes your handlers know (`track()`),
+and ships wire events through `waitUntil` so nothing is on the response path.
+Fails open by design — a camada outage or bug never 5xxes your app.
+
+Not yet on npm — consumed via a `file:` dependency from a sibling checkout.
+
+## Quickstart
+
+```ts
+import { Hono } from 'hono';
+import { camada } from '@camada/hono';
+
+const app = new Hono();
+app.use('*', camada());        // reads CAMADA_KEY / CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL from the Worker env
+app.get('/', (c) => c.text('hello'));
+export default app;
+```
+
+Env (printed by camada onboarding / `npm run seed` in dev):
+
+```
+CAMADA_KEY=<ingest_token>.<snap_token>
+CAMADA_INGEST_URL=http://localhost:8787        # dev only; defaults to production ingest
+```
+
+Workers hand env vars to the request, not to a process, so `camada()` builds its engine from
+`c.env` on the first request. An app that reads its own config can pass the values instead:
+
+```ts
+app.use('*', camada({ key: MY_KEY, ingestUrl: MY_INGEST }));
+```
+
+## camada-backend (the dogfood mount — contracts §H, SEC-07)
+
+Mount it in front of the API, and never in front of health or the Stripe webhook: those must
+answer whatever the snapshot says.
+
+```ts
+import { camada } from '@camada/hono';
+
+const guard = camada();                    // key, ingest and snapshot URLs come from c.env
+const OPEN = new Set(['/api/health', '/api/stripe/webhook']);
+
+app.use('/api/*', (c, next) => (OPEN.has(c.req.path) ? next() : guard(c, next)));
+```
+
+Call `camada()` once and reuse the handler. Engines are cached per resolved configuration, so
+mounting the same config twice shares one snapshot poller and one event queue, while two mounts
+with different keys or URLs each get their own — a Workers isolate hosting several Hono apps
+never enforces one tenant's snapshot on another, nor signs its cookies with another's secret.
+
+Without `CAMADA_KEY` the middleware is inert (one log line, no requests, no enforcement), so an
+unprovisioned environment behaves exactly as if camada were not installed.
+
+## What it does per request
+
+1. Refreshes the snapshot off-path through `waitUntil` (lazy mode — no interval timers on an
+   edge runtime). Every poll and event batch carries `x-camada-sdk: @camada/hono/<version>`,
+   and polls ask for snapshot v5 (`x-camada-snapshot: 5`) — the container that carries your
+   ordered custom rules.
+2. Resolves the client from `cf-connecting-ip`, falling back to `X-Forwarded-For` under your
+   tenant's trusted-proxy config. Neither header is ever trusted blindly: `cf-connecting-ip`
+   counts only on Workers (where Cloudflare sets it and a client cannot forge it, and where
+   `request.cf` proves it), and `X-Forwarded-For` counts only under a trusted-proxy config. On
+   `@hono/node-server`, Bun or Deno the CF header is ignored — there it is just another header
+   the caller controls.
+3. Runs your ordered custom rules (see below), then the allow, block and challenge lists.
+4. **Block** → `403` with `x-block-reason` before your handler; the event still ships, with
+   `st: 403` and `blk: <reason>` so the analyst counts SDK blocks apart from your own 403s.
+5. **Skip** → a skip rule or the allow list wins over a wider block (an allow-listed IP
+   inside a blocked CIDR or ASN goes through).
+6. **Challenge** → a `403` proof-of-work page (see below).
+7. Otherwise your handler runs, and the settled response ships one batched, redacted event with
+   its real status (Authorization and Cookie values never leave the isolate; credential-looking
+   query values are scrubbed — see `@camada/core`).
+
+## Custom rules
+
+Your Rules page holds one ordered list per project, and this middleware walks it before the
+allow, block and challenge lists. First match wins — the order *is* the precedence — and each
+rule carries one of four actions:
+
+| action | what the middleware does | on the event |
+|---|---|---|
+| `skip` | passes the request | nothing |
+| `block` | `403` before your handler | `blk: "rule"`, `rl: "<rule id>"` |
+| `challenge` | serves the proof-of-work page (`challenge: false` opts out) | `blk: "challenge"` |
+| `warn` | passes the request and marks it for the analyst | `wrn: "<rule id>"` |
+
+A skip rule also carries a *record matches* flag, which only the analyst reads: a recorded skip
+is still scored and shows on your dashboard as Allowed, an unrecorded one is dropped before
+scoring. Either way the request passes here, unstamped — the built-in Allow-list is a skip rule
+with recording on.
+
+A rule block also names the row that decided, so the response says which rule to edit:
+
+```
+HTTP/1.1 403 Forbidden
+x-block-reason: rule
+x-block-rule: cr_4f2a9c1b7e03
+```
+
+Every condition type enforces at this tap: `ip`, `path`, `ua` and `header` like everywhere else,
+plus the `asn`, `country` and `tlsx` conditions only `request.cf` can judge. A `header`
+condition (`is`, `contains`, `matches`) reads the name case-insensitively, and headers are the
+request plane's alone — the analyst never sees them, so a header rule is enforced by a v5 SDK
+like this one or not at all. A project that has not published the v5 container is answered with
+v4 or v3, and the lists in it keep enforcing.
+
+## The challenge (SDK-04)
+
+A `challenge` verdict serves a self-contained 403 page: no external assets, `no-store`, and an
+inline SHA-256 solver that finds a counter whose digest starts with 16 zero bits (tens of
+milliseconds) and posts it to `POST /__camada/challenge`. That endpoint checks the nonce and the
+work, sets `_cch` (an HMAC token, 1 h, `HttpOnly; SameSite=Lax`) and 302s back to the original
+URL. Events: `{ st: 403, blk: "challenge" }` when served, `{ st: 200, ch: 1 }` when passed.
+
+Requests that are not HTML navigations (no `text/html` in `Accept`, or a `sec-fetch-dest` other
+than `document`) get `403 {"error":"challenge_required"}` instead — an API client should see a
+status it can act on, not a page it cannot solve.
+
+The nonce and the cookie are bound to the client IP, so a request camada cannot identify is
+never challenged (it would mint a cookie any other unidentified client could present).
+
+## Options
+
+| option | default | meaning |
+|---|---|---|
+| `key` | `env.CAMADA_KEY` | `<ingest_token>.<snap_token>`; without it the middleware is inert |
+| `ingestUrl` | `env.CAMADA_INGEST_URL` | ingest base; batches go to `<ingestUrl>/e` |
+| `snapshotUrl` | `<ingestUrl>/snapshot` | snapshot endpoint |
+| `trustedProxy` | server config | `none` / `vercel` / `hops:N` / `cidrs:a,b`, or the parsed object |
+| `challenge` | `true` | serve the proof-of-work page for `challenge` verdicts |
+| `challengePath` | `/__camada/challenge` | where that page posts its solution |
+| `snapshotVersion` | `5` | `4` drops the custom rules, `3` the allow/challenge sides too |
+| `scriptPath` | `/_cam/b.js` | where the first-party beacon script is served |
+| `fpPath` | `/_cam/fp` | where that script posts the beacon; keep it in `scriptPath`'s directory |
+| `env` | `c.env` | overrides the Worker env (tests) |
+
+`CAMADA_CHALLENGE=0` in the Worker env switches the challenge off without a code change.
+
+`CAMADA_DISABLED=1` in the Worker env switches everything off, checked per request.
+
+## The first-party beacon
+
+Bots that never run JavaScript are the cheapest to catch. Put the tag in the `<head>` of the
+pages you render and the middleware does the rest:
+
+```ts
+import { camada, scriptTag } from '@camada/hono';
+
+app.use('*', camada());
+app.get('/', (c) => c.html(`<html><head>${scriptTag(c)}</head><body>…</body></html>`));
+```
+
+`scriptTag(c)` returns `<script src="/_cam/b.js?r=<rid>" async></script>` — the `rid` is this
+request's event id, so the analyst joins the beacon to the page view. The middleware serves the
+script at `GET /_cam/b.js` (cacheable, 1 h) and relays `POST /_cam/fp` (≤ 32 KB, answers 204)
+onto the event batch as a `sig: 1` row stamped with the client ip camada resolved — never the
+one the body claims. Both endpoints sit behind the verdict: a blocked client gets 403 there
+too. The tag is `''` when camada is off for the request or the project turned the beacon off
+in its settings, and the endpoints stand down with it.
+
+Mounting on a prefix (`app.use('/api/*', camada())`) means `/_cam/*` never reaches the
+middleware; move both paths under it — `camada({ scriptPath: '/api/_cam/b.js', fpPath:
+'/api/_cam/fp' })` — the script derives the post path from its own `src`, so the two must
+share a directory.
+
+## App-context events
+
+The wire shows a `POST /login`; only your handler knows whether it failed. Tell camada:
+
+```ts
+import { camada, track } from '@camada/hono';
+
+app.post('/login', async (c) => {
+  const ok = await signIn(c);
+  if (!ok) track(c, 'login_failed', { user: email });   // await optional — the flush rides waitUntil
+  return ok ? c.redirect('/') : c.text('Invalid credentials', 401);
+});
+```
+
+`track(c, event, { user? })` ships `{ et, uid, rid, sid, ip, ts }` joined to this request's event.
+The user identifier is HMAC-hashed in-process with the ingest token — the raw value never leaves
+the isolate. It never throws and is a no-op where the middleware did not run. The event name is
+free-form; the analyst's rules read this vocabulary:
+
+| event | when |
+|---|---|
+| `login_failed` / `login_succeeded` | a credential check settled |
+| `signup` | an account was created |
+| `password_reset` | a reset was requested |
+| `mfa_failed` | a second factor was rejected |
+| `payment_failed` / `payment_succeeded` | a charge settled |
+| `coupon_failed` | a promo code was rejected |
+
+## What this tap can see
+
+`request.cf` gives Workers the client's `asn`, `country`, `tlsClientExtensionsSha1` and
+`httpProtocol`, so ASN, country and TLS-fingerprint rules genuinely enforce here — unlike a bare
+Node app, which sees none of them. The connection terminates at Cloudflare, so the protocol on
+the event is the visitor's own, not a proxy hop's (camada never reads a forwarded protocol
+header for it). With the beacon and `track()` it is the full in-app position. workerd
+normalises header order, so the raw-wire-order signal is the one thing not available here; the
+analyst knows that from the tap's capability mask (`sdk-hono`) and never scores its absence as
+evidence.
+
+## Fail open
+
+Every entry point runs inside camada's guard. A dead ingest, a corrupt snapshot, a bug in this
+package: telemetry is lost, the request is not.

package/dist/index.cjs

@@ -0,0 +1,341 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  camada: () => camada,
+  resetCamada: () => resetCamada,
+  resolveEnv: () => resolveEnv,
+  scriptTag: () => scriptTag,
+  track: () => track
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/camada.ts
+var import_iife_string = __toESM(require("@camada/browser/iife-string"), 1);
+var import_core3 = require("@camada/core");
+
+// src/env.ts
+var import_core = require("@camada/core");
+var asProxy = (v) => typeof v === "string" ? (0, import_core.parseTrustedProxyEnv)(v) : v ?? null;
+function resolveEnv(opts, env) {
+  const raw = opts.key || env.CAMADA_KEY;
+  const key = (0, import_core.parseKey)(raw);
+  const ingestToken = key?.ingestToken ?? env.CAMADA_TOKEN;
+  const snapToken = key?.snapToken ?? env.CAMADA_SNAPSHOT_TOKEN;
+  if (!ingestToken || !snapToken) return null;
+  const ingestUrl = (opts.ingestUrl || env.CAMADA_INGEST_URL || "https://in.camada.dev").replace(/\/$/, "");
+  return {
+    ingestToken,
+    snapToken,
+    secret: raw || `${ingestToken}.${snapToken}`,
+    ingestUrl,
+    snapshotUrl: opts.snapshotUrl || env.CAMADA_SNAPSHOT_URL || `${ingestUrl}/snapshot`,
+    trustedProxy: asProxy(opts.trustedProxy) ?? (0, import_core.parseTrustedProxyEnv)(env.CAMADA_TRUSTED_PROXY)
+  };
+}
+
+// src/context.ts
+var import_core2 = require("@camada/core");
+var VAR = "__camada";
+var beaconEnabled = (e) => e.snap.config?.beacon !== false;
+var readVars = (c) => c.get(VAR);
+function track(c, event, data) {
+  const vars = (0, import_core2.guarded)(() => readVars(c), void 0);
+  if (!vars) return Promise.resolve();
+  const p = (0, import_core2.guardedAsync)(async () => {
+    const uid = data?.user ? await (0, import_core2.hashUserId)(data.user, vars.eng.env.ingestToken) : null;
+    ship(vars.eng, { tap: import_core2.TAP_HONO, et: event, uid, rid: vars.rid, sid: vars.sid, ip: vars.ip, ts: Date.now() }, vars.waitUntil);
+  }, void 0);
+  vars.waitUntil(p);
+  return p;
+}
+function scriptTag(c) {
+  return (0, import_core2.guarded)(() => {
+    const vars = readVars(c);
+    if (!vars || !beaconEnabled(vars.eng)) return "";
+    return `<script src="${vars.scriptPath}?r=${vars.rid}" async></script>`;
+  }, "");
+}
+
+// package.json
+var name = "@camada/hono";
+var version = "0.3.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var DEFAULT_CHALLENGE_PATH = "/__camada/challenge";
+var SCRIPT_PATH = "/_cam/b.js";
+var FP_PATH = "/_cam/fp";
+var FP_MAX = 32 * 1024;
+var SESSION_COOKIE = "_sfp";
+var SESSION_MAX_AGE = 2592e3;
+var BODY_MAX = 4 * 1024;
+var encoder = new TextEncoder();
+var engines = /* @__PURE__ */ new Map();
+function resetCamada() {
+  for (const e of engines.values()) {
+    e.snap.stop();
+    e.queue.stop();
+  }
+  engines.clear();
+}
+function ensure(opts, ctxEnv) {
+  const env = resolveEnv(opts, ctxEnv);
+  if (!env) {
+    (0, import_core3.logRateLimited)(new Error("CAMADA_KEY not set \u2014 camada is inactive"));
+    return null;
+  }
+  const snapshotVersion = opts.snapshotVersion ?? import_core3.DEFAULT_SNAPSHOT_VERSION;
+  const id = `${env.ingestToken}|${env.ingestUrl}|${env.snapshotUrl}|${snapshotVersion}`;
+  const cached = engines.get(id);
+  if (cached) return cached;
+  const injected = opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {};
+  const engine = {
+    env,
+    snap: new import_core3.SnapshotClient({
+      url: env.snapshotUrl,
+      token: env.snapToken,
+      mode: "lazy",
+      sdk: SDK_ID,
+      snapshotVersion,
+      ...injected
+    }),
+    queue: new import_core3.EventQueue({ url: env.ingestUrl, token: env.ingestToken, sdk: SDK_ID, ...injected }),
+    kit: (0, import_core3.createChallengeAsync)({ secret: env.secret })
+  };
+  engines.set(id, engine);
+  return engine;
+}
+var cookieValue = (cookie, name2) => {
+  const src = "; " + cookie;
+  const i = src.indexOf("; " + name2 + "=");
+  if (i === -1) return null;
+  const start = i + name2.length + 3;
+  const j = src.indexOf(";", start);
+  return src.slice(start, j === -1 ? void 0 : j);
+};
+var cfOf = (req) => req.cf ?? {};
+var trustedProxy = (e) => e.env.trustedProxy ?? e.snap.config?.trusted_proxy ?? null;
+var clientIp = (e, req) => {
+  const cf = req.cf;
+  const direct = cf ? req.headers.get("cf-connecting-ip") : null;
+  return direct || (0, import_core3.resolveClientIp)(null, req.headers.get("x-forwarded-for"), trustedProxy(e));
+};
+function describeRequest(e, req) {
+  const url = new URL(req.url);
+  const cookies = req.headers.get("cookie") || "";
+  return { url, path: url.pathname, cf: cfOf(req), ip: clientIp(e, req), sid: cookieValue(cookies, SESSION_COOKIE) };
+}
+function buildEvent(req, path, query, ip, sid, rid = crypto.randomUUID(), newSession = false) {
+  const headers = [];
+  req.headers.forEach((v, k) => headers.push([k, v]));
+  const cf = cfOf(req);
+  const ev = (0, import_core3.buildWireEvent)(
+    {
+      method: req.method,
+      host: req.headers.get("host") ?? new URL(req.url).host,
+      path,
+      query,
+      headers,
+      ip,
+      // The client's connection terminates at Cloudflare, so `cf.httpProtocol` really is the
+      // visitor's protocol (ea's TAP_CAPS grants this tap TRUE_PROTO on that basis). Never read
+      // a forwarded header for this — that would be the proxy's hop, not the client's.
+      httpVersion: cf.httpProtocol ? cf.httpProtocol.replace(/^HTTP\//i, "") : null
+    },
+    { tap: import_core3.TAP_HONO, rid, sid, newSession }
+  );
+  if (cf.asn) ev.asn = cf.asn;
+  if (cf.country) ev.cc = cf.country;
+  if (cf.tlsClientExtensionsSha1) ev.tlsx = cf.tlsClientExtensionsSha1;
+  return ev;
+}
+function ship(e, ev, waitUntil) {
+  e.queue.push(ev);
+  e.queue.flush(waitUntil);
+}
+async function relayBeacon(eng, req, ip, waitUntil) {
+  const noContent = () => new Response(null, { status: 204, headers: { "cache-control": "no-store" } });
+  if (Number(req.headers.get("content-length")) > FP_MAX) return new Response(null, { status: 413 });
+  const body = await req.text();
+  if (encoder.encode(body).byteLength > FP_MAX) return new Response(null, { status: 413 });
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return noContent();
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return noContent();
+  ship(eng, { ...parsed, sig: 1, ip, tap: import_core3.TAP_HONO }, waitUntil);
+  return noContent();
+}
+function camada(opts = {}) {
+  const challengePath = opts.challengePath ?? DEFAULT_CHALLENGE_PATH;
+  const scriptPath = opts.scriptPath ?? SCRIPT_PATH;
+  const fpPath = opts.fpPath ?? FP_PATH;
+  return async function camadaHono(c, next) {
+    const env = (0, import_core3.guarded)(() => ({ ...c.env, ...opts.env }), {});
+    const eng = (0, import_core3.guarded)(() => env.CAMADA_DISABLED === "1" ? null : ensure(opts, env), null);
+    if (!eng) return next();
+    const challengeOn = opts.challenge !== false && env.CAMADA_CHALLENGE !== "0";
+    const waitUntil = (p) => {
+      try {
+        c.executionCtx?.waitUntil(p);
+      } catch {
+      }
+    };
+    let warnRule = null;
+    let vars = null;
+    let newSession = false;
+    const answer = await (0, import_core3.guardedAsync)(async () => {
+      eng.snap.ensureFresh(waitUntil);
+      const req = c.req.raw;
+      const { url, path, cf, ip, sid } = describeRequest(eng, req);
+      const v = eng.snap.verdict({
+        ip,
+        path,
+        ua: req.headers.get("user-agent"),
+        // §D3: without ua every `ua` rule is false
+        // `header` conditions read the request through this getter; `Headers.get` is
+        // case-insensitive, so the lower-cased name the matcher asks with finds whatever
+        // spelling the client sent. Without it every `header` rule is false.
+        header: (n) => req.headers.get(n),
+        asn: cf.asn ?? null,
+        country: cf.country ?? null,
+        tlsx: cf.tlsClientExtensionsSha1 ?? null
+      });
+      warnRule = v.warn ? v.rule ?? null : null;
+      if (v.block) {
+        const ev = buildEvent(req, path, url.search, ip, sid);
+        ev.st = 403;
+        ev.blk = v.reason;
+        if (v.rule) ev.rl = v.rule;
+        ship(eng, ev, waitUntil);
+        const headers = {
+          "content-type": "text/plain",
+          "x-block-reason": String(v.reason ?? ""),
+          "x-block-version": v.version ?? ""
+        };
+        if (v.rule) headers["x-block-rule"] = v.rule;
+        return new Response("Forbidden", { status: 403, headers });
+      }
+      if (challengeOn && ip) {
+        if (req.method === "POST" && path === challengePath) return verify(eng, req, ip, sid, challengePath, waitUntil);
+        const token = cookieValue(req.headers.get("cookie") || "", import_core3.CHALLENGE_COOKIE);
+        if (v.challenge && !await eng.kit.tokenValid(ip, Date.now(), token)) {
+          return serve(eng, req, ip, sid, challengePath, path + url.search, waitUntil);
+        }
+      }
+      if (beaconEnabled(eng)) {
+        if (req.method === "GET" && path === scriptPath) {
+          return new Response(import_iife_string.default, { status: 200, headers: { "content-type": "application/javascript", "cache-control": "public, max-age=3600" } });
+        }
+        if (req.method === "POST" && path === fpPath) return relayBeacon(eng, req, ip, waitUntil);
+      }
+      newSession = !sid;
+      vars = { eng, rid: crypto.randomUUID(), sid: sid ?? crypto.randomUUID(), ip, waitUntil, scriptPath };
+      c.set(VAR, vars);
+      return null;
+    }, null);
+    if (answer) return answer;
+    await next();
+    (0, import_core3.guarded)(() => {
+      if (!vars || !newSession) return;
+      const secure = new URL(c.req.raw.url).protocol === "https:" ? "; Secure" : "";
+      c.res.headers.append("set-cookie", `${SESSION_COOKIE}=${vars.sid}; Path=/; Max-Age=${SESSION_MAX_AGE}; HttpOnly; SameSite=Lax${secure}`);
+    }, void 0);
+    void (0, import_core3.guardedAsync)(async () => {
+      const req = c.req.raw;
+      const { url, path, ip } = describeRequest(eng, req);
+      const cfg = eng.snap.config;
+      if ((cfg?.exclude || []).some((x) => path.startsWith(x))) return;
+      if (Math.random() >= (cfg?.sample ?? 1)) return;
+      const ev = buildEvent(req, path, url.search, ip, vars?.sid ?? null, vars?.rid, newSession);
+      ev.st = c.res.status;
+      if (warnRule) ev.wrn = warnRule;
+      ship(eng, ev, waitUntil);
+    }, void 0);
+  };
+}
+async function serve(eng, req, ip, sid, action, target, waitUntil) {
+  const url = new URL(req.url);
+  const ev = buildEvent(req, url.pathname, url.search, ip, sid);
+  ev.st = 403;
+  ev.blk = "challenge";
+  ship(eng, ev, waitUntil);
+  if (!(0, import_core3.wantsHtml)(req.headers.get("accept"), req.headers.get("sec-fetch-dest"))) {
+    return new Response('{"error":"challenge_required"}', {
+      status: 403,
+      headers: { "content-type": "application/json", "cache-control": "no-store", "x-camada-challenge": "1" }
+    });
+  }
+  const html = (0, import_core3.challengePage)({ nonce: await eng.kit.nonce(ip, Date.now()), action, to: (0, import_core3.safeReturnTo)(target) });
+  return new Response(html, {
+    status: 403,
+    headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "x-camada-challenge": "1" }
+  });
+}
+async function verify(eng, req, ip, sid, action, waitUntil) {
+  const url = new URL(req.url);
+  if (Number(req.headers.get("content-length")) > BODY_MAX) return new Response(null, { status: 413 });
+  const body = await req.text();
+  if (body.length > BODY_MAX) return new Response(null, { status: 413 });
+  const form = (0, import_core3.parseFormBody)(body);
+  const to = (0, import_core3.safeReturnTo)(form.to);
+  const now = Date.now();
+  if (!await eng.kit.verify(ip, now, form.nonce, form.solution)) {
+    const html = (0, import_core3.challengePage)({ nonce: await eng.kit.nonce(ip, now), action, to });
+    return new Response(html, { status: 403, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } });
+  }
+  const ev = buildEvent(req, url.pathname, "", ip, sid);
+  ev.st = 200;
+  ev.ch = 1;
+  ship(eng, ev, waitUntil);
+  return new Response(null, {
+    status: 302,
+    headers: {
+      location: to,
+      "set-cookie": (0, import_core3.challengeCookie)(await eng.kit.issue(ip, now), url.protocol === "https:"),
+      "cache-control": "no-store"
+    }
+  });
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  camada,
+  resetCamada,
+  resolveEnv,
+  scriptTag,
+  track
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/camada.ts","../src/env.ts","../src/context.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/hono — the one-line install for a Hono app on Cloudflare Workers:\n//   app.use('*', camada());   // env: CAMADA_KEY (+ CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL in dev)\n//   c.html(`<head>${scriptTag(c)}</head>…`)   // the first-party beacon\n//   track(c, 'login_failed', { user })         // an outcome the wire cannot show\nexport { camada, resetCamada } from './camada.js';\nexport { track, scriptTag } from './context.js';\nexport { resolveEnv, type CamadaHonoOptions, type ResolvedEnv } from './env.js';\n","// @camada/hono — the Hono middleware for Cloudflare Workers (SEC-07, D33).\n//   app.use('*', camada());\n// Workers-native: `cf-connecting-ip` for the client address, `request.cf` for asn / country /\n// TLS fingerprint (so ASN and country rules really enforce at this tap), and\n// `c.executionCtx.waitUntil` so the snapshot poll and the event flush outlive the response.\n// Everything runs inside camada's fail-open envelope: a camada bug, a dead ingest or a corrupt\n// snapshot costs telemetry, never the app's response.\nimport type { Context, MiddlewareHandler, Next } from 'hono';\nimport iife from '@camada/browser/iife-string';\nimport {\n  SnapshotClient, EventQueue, buildWireEvent, resolveClientIp, logRateLimited, guardedAsync,\n  guarded, createChallengeAsync, challengePage, challengeCookie, safeReturnTo, wantsHtml, parseFormBody,\n  CHALLENGE_COOKIE, DEFAULT_SNAPSHOT_VERSION, TAP_HONO,\n  type AsyncChallengeKit, type TrustedProxyConfig, type WireEvent,\n} from '@camada/core';\nimport { resolveEnv, type CamadaHonoOptions, type ResolvedEnv } from './env.js';\nimport { VAR, beaconEnabled, type CamadaVars } from './context.js';\nimport { SDK_ID } from './version.js';\n\nconst DEFAULT_CHALLENGE_PATH = '/__camada/challenge';\nconst SCRIPT_PATH = '/_cam/b.js';   // the beacon IIFE; its auto-init posts to the sibling `fp` and reads the rid from ?r=\nconst FP_PATH = '/_cam/fp';\nconst FP_MAX = 32 * 1024;        // matches the analyst's /fp cap: never accept what ingest will 413\nconst SESSION_COOKIE = '_sfp';   // the same session cookie as every other tap: sid/ns stay comparable\nconst SESSION_MAX_AGE = 2592000;\nconst BODY_MAX = 4 * 1024;       // the verify form is ~120 bytes; anything larger is not ours\nconst encoder = new TextEncoder();\n\nexport interface Engine {\n  env: ResolvedEnv;\n  snap: SnapshotClient;\n  queue: EventQueue;\n  kit: AsyncChallengeKit;\n}\n\nexport type WaitUntil = (p: Promise<unknown>) => void;\n\n// One engine per resolved configuration, not per module: a Workers isolate can host several\n// Hono apps, and a shared singleton would enforce the first tenant's snapshot on the second\n// and sign its `_cch` cookies with the first tenant's secret. An unconfigured request is never\n// cached — a warm-up or a differently-keyed mount must not leave the isolate inert for good.\nconst engines = new Map<string, Engine>();\n\n/** Test/reset hook: drops every cached engine. */\nexport function resetCamada(): void {\n  for (const e of engines.values()) { e.snap.stop(); e.queue.stop(); }\n  engines.clear();\n}\n\nfunction ensure(opts: CamadaHonoOptions, ctxEnv: Record<string, string | undefined>): Engine | null {\n  const env = resolveEnv(opts, ctxEnv);\n  if (!env) {\n    logRateLimited(new Error('CAMADA_KEY not set — camada is inactive'));\n    return null;\n  }\n  const snapshotVersion = opts.snapshotVersion ?? DEFAULT_SNAPSHOT_VERSION;\n  const id = `${env.ingestToken}|${env.ingestUrl}|${env.snapshotUrl}|${snapshotVersion}`;\n  const cached = engines.get(id);\n  if (cached) return cached;\n  const injected = opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {};   // never pass an explicit undefined key\n  const engine: Engine = {\n    env,\n    snap: new SnapshotClient({\n      url: env.snapshotUrl, token: env.snapToken, mode: 'lazy', sdk: SDK_ID,\n      snapshotVersion, ...injected,\n    }),\n    queue: new EventQueue({ url: env.ingestUrl, token: env.ingestToken, sdk: SDK_ID, ...injected }),\n    kit: createChallengeAsync({ secret: env.secret }),\n  };\n  engines.set(id, engine);\n  return engine;\n}\n\nconst cookieValue = (cookie: string, name: string): string | null => {\n  const src = '; ' + cookie;\n  const i = src.indexOf('; ' + name + '=');\n  if (i === -1) return null;\n  const start = i + name.length + 3;\n  const j = src.indexOf(';', start);\n  return src.slice(start, j === -1 ? undefined : j);\n};\n\ninterface CfProps { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string }\nconst cfOf = (req: Request): CfProps => ((req as Request & { cf?: CfProps }).cf ?? {});\n\nconst trustedProxy = (e: Engine): TrustedProxyConfig | null =>\n  e.env.trustedProxy ?? e.snap.config?.trusted_proxy ?? null;\n\n/** Cloudflare sets `cf-connecting-ip` itself and a client cannot forge it — but only on\n *  Workers, which is also the only place `request.cf` exists. On any other Hono runtime\n *  (node-server, Bun, Deno) that header is attacker-controlled, so it is ignored there and the\n *  trusted-proxy rules decide, exactly as they do for X-Forwarded-For. */\nconst clientIp = (e: Engine, req: Request): string | null => {\n  const cf = (req as Request & { cf?: unknown }).cf;\n  const direct = cf ? req.headers.get('cf-connecting-ip') : null;\n  return direct || resolveClientIp(null, req.headers.get('x-forwarded-for'), trustedProxy(e));\n};\n\ninterface RequestFacts {\n  url: URL;\n  path: string;\n  cf: CfProps;\n  ip: string | null;\n  sid: string | null;\n}\n\nfunction describeRequest(e: Engine, req: Request): RequestFacts {\n  const url = new URL(req.url);\n  const cookies = req.headers.get('cookie') || '';\n  return { url, path: url.pathname, cf: cfOf(req), ip: clientIp(e, req), sid: cookieValue(cookies, SESSION_COOKIE) };\n}\n\nfunction buildEvent(\n  req: Request, path: string, query: string, ip: string | null, sid: string | null,\n  rid: string = crypto.randomUUID(), newSession = false,   // the capture path passes the ids it shared with the app; camada's own answers need none\n): WireEvent {\n  const headers: Array<[string, string]> = [];\n  req.headers.forEach((v, k) => headers.push([k, v]));   // workerd normalises header order: no HEADER_ORDER signal here\n  const cf = cfOf(req);\n  const ev = buildWireEvent(\n    {\n      method: req.method, host: req.headers.get('host') ?? new URL(req.url).host, path, query, headers, ip,\n      // The client's connection terminates at Cloudflare, so `cf.httpProtocol` really is the\n      // visitor's protocol (ea's TAP_CAPS grants this tap TRUE_PROTO on that basis). Never read\n      // a forwarded header for this — that would be the proxy's hop, not the client's.\n      httpVersion: cf.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n    },\n    { tap: TAP_HONO, rid, sid, newSession },\n  );\n  if (cf.asn) ev.asn = cf.asn;\n  if (cf.country) ev.cc = cf.country;\n  if (cf.tlsClientExtensionsSha1) ev.tlsx = cf.tlsClientExtensionsSha1;\n  return ev;\n}\n\n/** Push then flush through `waitUntil` — the one rule every row (wire event, beacon, track()) follows. */\nexport function ship(e: Engine, ev: unknown, waitUntil: WaitUntil): void {\n  e.queue.push(ev);\n  e.queue.flush(waitUntil);\n}\n\n/** 204 and a `sig: 1` row on the event batch — one request per flush at the analyst, not one per page view. */\nasync function relayBeacon(eng: Engine, req: Request, ip: string | null, waitUntil: WaitUntil): Promise<Response> {\n  const noContent = () => new Response(null, { status: 204, headers: { 'cache-control': 'no-store' } });\n  if (Number(req.headers.get('content-length')) > FP_MAX) return new Response(null, { status: 413 });\n  const body = await req.text();\n  if (encoder.encode(body).byteLength > FP_MAX) return new Response(null, { status: 413 });\n  let parsed: unknown;\n  try { parsed = JSON.parse(body); } catch { return noContent(); }   // not a beacon: drop it, never ship junk\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return noContent();\n  // Spread first: the ip and the tap are the server's to say, whatever the body claimed.\n  ship(eng, { ...(parsed as Record<string, unknown>), sig: 1, ip, tap: TAP_HONO }, waitUntil);\n  return noContent();\n}\n\nexport function camada(opts: CamadaHonoOptions = {}): MiddlewareHandler {\n  const challengePath = opts.challengePath ?? DEFAULT_CHALLENGE_PATH;\n  const scriptPath = opts.scriptPath ?? SCRIPT_PATH;\n  const fpPath = opts.fpPath ?? FP_PATH;\n\n  return async function camadaHono(c: Context, next: Next): Promise<Response | void> {\n    // Reading c.env and building the engine are inside the guard too: a Workers env carries\n    // non-string bindings, and a throw here would 5xx the app on its very first request.\n    const env = guarded(() => ({ ...(c.env as Record<string, string | undefined> | undefined), ...opts.env }), {} as Record<string, string | undefined>);\n    const eng = guarded(() => (env.CAMADA_DISABLED === '1' ? null : ensure(opts, env)), null);\n    if (!eng) return next();\n    // Same opt-out as @camada/next: the code option, or CAMADA_CHALLENGE=0 in the Worker env.\n    const challengeOn = opts.challenge !== false && env.CAMADA_CHALLENGE !== '0';\n\n    const waitUntil: WaitUntil = (p) => {\n      try { c.executionCtx?.waitUntil(p); } catch { /* no execution context outside a fetch handler */ }\n    };\n\n    // The id of the `warn` rule that let this request through, read again after next() when the\n    // response event is built (§D3). Every other action settles before the app ever runs.\n    let warnRule: string | null = null;\n    // Set on the capture path only: the ids this request shares with the app (scriptTag, track)\n    // and with its own post-response event. Null when camada answered the request itself.\n    let vars: CamadaVars | null = null;\n    let newSession = false;\n\n    const answer = await guardedAsync(async (): Promise<Response | null> => {\n      eng.snap.ensureFresh(waitUntil);\n\n      const req = c.req.raw;\n      const { url, path, cf, ip, sid } = describeRequest(eng, req);\n\n      const v = eng.snap.verdict({\n        ip, path, ua: req.headers.get('user-agent'),   // §D3: without ua every `ua` rule is false\n        // `header` conditions read the request through this getter; `Headers.get` is\n        // case-insensitive, so the lower-cased name the matcher asks with finds whatever\n        // spelling the client sent. Without it every `header` rule is false.\n        header: (n) => req.headers.get(n),\n        asn: cf.asn ?? null, country: cf.country ?? null, tlsx: cf.tlsClientExtensionsSha1 ?? null,\n      });\n      warnRule = v.warn ? v.rule ?? null : null;\n\n      if (v.block) {\n        const ev = buildEvent(req, path, url.search, ip, sid);\n        ev.st = 403;\n        ev.blk = v.reason;   // SDK-01: the analyst counts SDK blocks apart from the app's own 403s ('rule' when a rule decided)\n        if (v.rule) ev.rl = v.rule;\n        ship(eng, ev, waitUntil);\n        const headers: Record<string, string> = {\n          'content-type': 'text/plain', 'x-block-reason': String(v.reason ?? ''), 'x-block-version': v.version ?? '',\n        };\n        if (v.rule) headers['x-block-rule'] = v.rule;   // a custom rule blocked: name it, so the customer knows which row to edit\n        return new Response('Forbidden', { status: 403, headers });\n      }\n\n      // A challenge needs a resolved client ip: the nonce and the `_cch` cookie are bound to it.\n      // Without one, fail open rather than mint a cookie every unidentified client could use.\n      if (challengeOn && ip) {\n        // The verify endpoint answers first — a challenged client must be able to reach it.\n        if (req.method === 'POST' && path === challengePath) return verify(eng, req, ip, sid, challengePath, waitUntil);\n        const token = cookieValue(req.headers.get('cookie') || '', CHALLENGE_COOKIE);\n        if (v.challenge && !(await eng.kit.tokenValid(ip, Date.now(), token))) {\n          return serve(eng, req, ip, sid, challengePath, path + url.search, waitUntil);\n        }\n      }\n\n      // The beacon endpoints come after enforcement (a blocked or challenged client gets neither\n      // the script nor a relay) and before the app (they are camada's, not its) — @camada/node's order.\n      if (beaconEnabled(eng)) {\n        if (req.method === 'GET' && path === scriptPath) {\n          return new Response(iife, { status: 200, headers: { 'content-type': 'application/javascript', 'cache-control': 'public, max-age=3600' } });\n        }\n        if (req.method === 'POST' && path === fpPath) return relayBeacon(eng, req, ip, waitUntil);\n      }\n\n      // Capture: mint the ids the app, the beacon and the post-response event all share. The\n      // session is decided here rather than after next() so track() inside the handler and the\n      // event both carry the sid a first visit is about to be given.\n      newSession = !sid;\n      vars = { eng, rid: crypto.randomUUID(), sid: sid ?? crypto.randomUUID(), ip, waitUntil, scriptPath };\n      c.set(VAR, vars);\n      return null;\n    }, null);\n\n    if (answer) return answer;\n\n    await next();\n\n    // Mint the shared session cookie the other taps use, so `sid`/`ns` are real here too\n    // (ea's capability mask for sdk-hono claims SESSION). Never overwrite an existing one.\n    guarded(() => {\n      if (!vars || !newSession) return;\n      const secure = new URL(c.req.raw.url).protocol === 'https:' ? '; Secure' : '';\n      c.res.headers.append('set-cookie', `${SESSION_COOKIE}=${vars.sid}; Path=/; Max-Age=${SESSION_MAX_AGE}; HttpOnly; SameSite=Lax${secure}`);\n    }, undefined);\n\n    // The response has settled, so this tap ships the real status — unlike @camada/next's\n    // middleware position, which can only report pre-response.\n    void guardedAsync(async () => {\n      const req = c.req.raw;\n      const { url, path, ip } = describeRequest(eng, req);\n      const cfg = eng.snap.config;\n      if ((cfg?.exclude || []).some((x) => path.startsWith(x))) return;\n      if (Math.random() >= (cfg?.sample ?? 1)) return;\n      // `vars` is null only when the guard above threw before setting it — then the event still ships, with fresh ids.\n      const ev = buildEvent(req, path, url.search, ip, vars?.sid ?? null, vars?.rid, newSession);\n      ev.st = c.res.status;\n      if (warnRule) ev.wrn = warnRule;   // §D3: the warn rule that let this request through\n      ship(eng, ev, waitUntil);\n    }, undefined);\n  };\n}\n\n/** 403 + the proof-of-work page (HTML navigations) or 403 JSON, plus the `blk: \"challenge\"` event. */\nasync function serve(eng: Engine, req: Request, ip: string, sid: string | null, action: string, target: string, waitUntil: WaitUntil): Promise<Response> {\n  const url = new URL(req.url);\n  const ev = buildEvent(req, url.pathname, url.search, ip, sid);\n  ev.st = 403;\n  ev.blk = 'challenge';\n  ship(eng, ev, waitUntil);\n\n  if (!wantsHtml(req.headers.get('accept'), req.headers.get('sec-fetch-dest'))) {\n    return new Response('{\"error\":\"challenge_required\"}', {\n      status: 403,\n      headers: { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-camada-challenge': '1' },\n    });\n  }\n  const html = challengePage({ nonce: await eng.kit.nonce(ip, Date.now()), action, to: safeReturnTo(target) });\n  return new Response(html, {\n    status: 403,\n    headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'x-camada-challenge': '1' },\n  });\n}\n\n/** POST from the page: validate, set `_cch`, 302 back, ship `{ st: 200, ch: 1 }`. */\nasync function verify(eng: Engine, req: Request, ip: string, sid: string | null, action: string, waitUntil: WaitUntil): Promise<Response> {\n  const url = new URL(req.url);\n  // camada answers this path before the app runs, so it must not become a place to post\n  // hundreds of megabytes at an unauthenticated endpoint.\n  if (Number(req.headers.get('content-length')) > BODY_MAX) return new Response(null, { status: 413 });\n  const body = await req.text();\n  if (body.length > BODY_MAX) return new Response(null, { status: 413 });\n  const form = parseFormBody(body);\n  const to = safeReturnTo(form.to);\n  const now = Date.now();\n  if (!(await eng.kit.verify(ip, now, form.nonce, form.solution))) {\n    const html = challengePage({ nonce: await eng.kit.nonce(ip, now), action, to });\n    return new Response(html, { status: 403, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' } });\n  }\n  const ev = buildEvent(req, url.pathname, '', ip, sid);\n  ev.st = 200;\n  ev.ch = 1;   // challenge passed (contract §A3 ingest field)\n  ship(eng, ev, waitUntil);\n  return new Response(null, {\n    status: 302,\n    headers: {\n      location: to,\n      'set-cookie': challengeCookie(await eng.kit.issue(ip, now), url.protocol === 'https:'),\n      'cache-control': 'no-store',\n    },\n  });\n}\n","// Workers hand env vars per request on `c.env`, not on a process — so the engine is built from\n// whatever the first request carries, merged with the options the app passed in code.\nimport { parseKey, parseTrustedProxyEnv, type SnapshotVersion, type TrustedProxyConfig } from '@camada/core';\n\nexport interface ResolvedEnv {\n  ingestToken: string;\n  snapToken: string;\n  secret: string;                            // HMAC key for the challenge nonce/cookie — never leaves the isolate\n  ingestUrl: string;\n  snapshotUrl: string;\n  trustedProxy: TrustedProxyConfig | null;   // null = defer to server-delivered config\n}\n\nexport interface CamadaHonoOptions {\n  key?: string;\n  ingestUrl?: string;\n  snapshotUrl?: string;\n  trustedProxy?: TrustedProxyConfig | string | null;\n  challenge?: boolean;            // enforce `challenge` verdicts with the first-party page (default true)\n  challengePath?: string;         // where that page posts its solution (default /__camada/challenge)\n  snapshotVersion?: SnapshotVersion;   // 5 (default) also carries the tenant's ordered custom rules; 4 the allow/challenge sides only; 3 opts out of both\n  scriptPath?: string;            // where the first-party beacon script is served (default /_cam/b.js)\n  fpPath?: string;                // where that script posts the beacon (default /_cam/fp; must share scriptPath's directory — the script derives it)\n  env?: Record<string, string | undefined>;   // overrides c.env (tests, and apps that read config themselves)\n  fetchImpl?: typeof fetch;\n}\n\nconst asProxy = (v: CamadaHonoOptions['trustedProxy']): TrustedProxyConfig | null =>\n  typeof v === 'string' ? parseTrustedProxyEnv(v) : v ?? null;\n\n/** Returns null (the middleware stays inert, one log line) rather than throwing on bad config. */\nexport function resolveEnv(opts: CamadaHonoOptions, env: Record<string, string | undefined>): ResolvedEnv | null {\n  const raw = opts.key || env.CAMADA_KEY;\n  const key = parseKey(raw);\n  const ingestToken = key?.ingestToken ?? env.CAMADA_TOKEN;\n  const snapToken = key?.snapToken ?? env.CAMADA_SNAPSHOT_TOKEN;\n  if (!ingestToken || !snapToken) return null;\n  const ingestUrl = (opts.ingestUrl || env.CAMADA_INGEST_URL || 'https://in.camada.dev').replace(/\\/$/, '');   // PLACEHOLDER default — confirm the production ingest domain before any npm publish\n  return {\n    ingestToken, snapToken,\n    secret: raw || `${ingestToken}.${snapToken}`,\n    ingestUrl,\n    snapshotUrl: opts.snapshotUrl || env.CAMADA_SNAPSHOT_URL || `${ingestUrl}/snapshot`,\n    trustedProxy: asProxy(opts.trustedProxy) ?? parseTrustedProxyEnv(env.CAMADA_TRUSTED_PROXY),\n  };\n}\n","// Per-request state the middleware leaves on the Hono context for the two helpers an app calls\n// from its own handlers: `scriptTag(c)` (the beacon tag) and `track(c, event, data)` (an\n// app-context outcome). The key is private — the helpers are the API, not `c.get`. When the\n// middleware did not run for this request (a path it is not mounted on, no key, CAMADA_DISABLED,\n// or a request it answered itself) there is nothing on the context and both helpers stand down.\nimport type { Context } from 'hono';\nimport { guarded, guardedAsync, hashUserId, TAP_HONO } from '@camada/core';\nimport { ship, type Engine, type WaitUntil } from './camada.js';\n\nexport const VAR = '__camada';\n\nexport interface CamadaVars {\n  eng: Engine;\n  rid: string;            // the request id the page event carries; the beacon and track() join on it\n  sid: string;            // the `_sfp` session — the one just minted when the request arrived without it\n  ip: string | null;\n  waitUntil: WaitUntil;\n  scriptPath: string;\n}\n\nexport const beaconEnabled = (e: Engine): boolean => e.snap.config?.beacon !== false;   // tenant switch; a cold engine serves\n\nconst readVars = (c: Context): CamadaVars | undefined => c.get(VAR) as CamadaVars | undefined;\n\n/**\n * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,\n * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`\n * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event\n * through its rid and session. The user identifier is HMAC-hashed in-process with the ingest\n * token — the raw value never reaches the queue. Never throws, never rejects; awaiting it is\n * optional (the flush rides `waitUntil`), so a handler may fire and forget.\n */\nexport function track(c: Context, event: string, data?: { user?: string }): Promise<void> {\n  const vars = guarded(() => readVars(c), undefined);\n  if (!vars) return Promise.resolve();\n  const p = guardedAsync(async () => {\n    const uid = data?.user ? await hashUserId(data.user, vars.eng.env.ingestToken) : null;\n    ship(vars.eng, { tap: TAP_HONO, et: event, uid, rid: vars.rid, sid: vars.sid, ip: vars.ip, ts: Date.now() }, vars.waitUntil);\n  }, undefined);\n  vars.waitUntil(p);   // the isolate may freeze right after the response: hold it open for the flush\n  return p;\n}\n\n/** The `<script>` tag for an HTML response — `''` when camada is off for this request or the tenant turned the beacon off. */\nexport function scriptTag(c: Context): string {\n  return guarded(() => {\n    const vars = readVars(c);\n    if (!vars || !beaconEnabled(vars.eng)) return '';\n    return `<script src=\"${vars.scriptPath}?r=${vars.rid}\" async></script>`;\n  }, '');\n}\n","{\n  \"name\": \"@camada/hono\",\n  \"version\": \"0.3.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=18\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Hono on Cloudflare Workers: snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"hono\": \">=4\"\n  },\n  \"devDependencies\": {\n    \"@cloudflare/workers-types\": \"^4.20250109.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"hono\": \"^4.6.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACQA,yBAAiB;AACjB,IAAAA,eAKO;;;ACZP,kBAA8F;AAyB9F,IAAM,UAAU,CAAC,MACf,OAAO,MAAM,eAAW,kCAAqB,CAAC,IAAI,KAAK;AAGlD,SAAS,WAAW,MAAyB,KAA6D;AAC/G,QAAM,MAAM,KAAK,OAAO,IAAI;AAC5B,QAAM,UAAM,sBAAS,GAAG;AACxB,QAAM,cAAc,KAAK,eAAe,IAAI;AAC5C,QAAM,YAAY,KAAK,aAAa,IAAI;AACxC,MAAI,CAAC,eAAe,CAAC,UAAW,QAAO;AACvC,QAAM,aAAa,KAAK,aAAa,IAAI,qBAAqB,yBAAyB,QAAQ,OAAO,EAAE;AACxG,SAAO;AAAA,IACL;AAAA,IAAa;AAAA,IACb,QAAQ,OAAO,GAAG,WAAW,IAAI,SAAS;AAAA,IAC1C;AAAA,IACA,aAAa,KAAK,eAAe,IAAI,uBAAuB,GAAG,SAAS;AAAA,IACxE,cAAc,QAAQ,KAAK,YAAY,SAAK,kCAAqB,IAAI,oBAAoB;AAAA,EAC3F;AACF;;;ACvCA,IAAAC,eAA4D;AAGrD,IAAM,MAAM;AAWZ,IAAM,gBAAgB,CAAC,MAAuB,EAAE,KAAK,QAAQ,WAAW;AAE/E,IAAM,WAAW,CAAC,MAAuC,EAAE,IAAI,GAAG;AAU3D,SAAS,MAAM,GAAY,OAAe,MAAyC;AACxF,QAAM,WAAO,sBAAQ,MAAM,SAAS,CAAC,GAAG,MAAS;AACjD,MAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,QAAM,QAAI,2BAAa,YAAY;AACjC,UAAM,MAAM,MAAM,OAAO,UAAM,yBAAW,KAAK,MAAM,KAAK,IAAI,IAAI,WAAW,IAAI;AACjF,SAAK,KAAK,KAAK,EAAE,KAAK,uBAAU,IAAI,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,KAAK,SAAS;AAAA,EAC7H,GAAG,MAAS;AACZ,OAAK,UAAU,CAAC;AAChB,SAAO;AACT;AAGO,SAAS,UAAU,GAAoB;AAC5C,aAAO,sBAAQ,MAAM;AACnB,UAAM,OAAO,SAAS,CAAC;AACvB,QAAI,CAAC,QAAQ,CAAC,cAAc,KAAK,GAAG,EAAG,QAAO;AAC9C,WAAO,gBAAgB,KAAK,UAAU,MAAM,KAAK,GAAG;AAAA,EACtD,GAAG,EAAE;AACP;;;ACjDE,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AJgBxC,IAAM,yBAAyB;AAC/B,IAAM,cAAc;AACpB,IAAM,UAAU;AAChB,IAAM,SAAS,KAAK;AACpB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,WAAW,IAAI;AACrB,IAAM,UAAU,IAAI,YAAY;AAehC,IAAM,UAAU,oBAAI,IAAoB;AAGjC,SAAS,cAAoB;AAClC,aAAW,KAAK,QAAQ,OAAO,GAAG;AAAE,MAAE,KAAK,KAAK;AAAG,MAAE,MAAM,KAAK;AAAA,EAAG;AACnE,UAAQ,MAAM;AAChB;AAEA,SAAS,OAAO,MAAyB,QAA2D;AAClG,QAAM,MAAM,WAAW,MAAM,MAAM;AACnC,MAAI,CAAC,KAAK;AACR,qCAAe,IAAI,MAAM,8CAAyC,CAAC;AACnE,WAAO;AAAA,EACT;AACA,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,KAAK,GAAG,IAAI,WAAW,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW,IAAI,eAAe;AACpF,QAAM,SAAS,QAAQ,IAAI,EAAE;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,WAAW,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AACnE,QAAM,SAAiB;AAAA,IACrB;AAAA,IACA,MAAM,IAAI,4BAAe;AAAA,MACvB,KAAK,IAAI;AAAA,MAAa,OAAO,IAAI;AAAA,MAAW,MAAM;AAAA,MAAQ,KAAK;AAAA,MAC/D;AAAA,MAAiB,GAAG;AAAA,IACtB,CAAC;AAAA,IACD,OAAO,IAAI,wBAAW,EAAE,KAAK,IAAI,WAAW,OAAO,IAAI,aAAa,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC9F,SAAK,mCAAqB,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAClD;AACA,UAAQ,IAAI,IAAI,MAAM;AACtB,SAAO;AACT;AAEA,IAAM,cAAc,CAAC,QAAgBC,UAAgC;AACnE,QAAM,MAAM,OAAO;AACnB,QAAM,IAAI,IAAI,QAAQ,OAAOA,QAAO,GAAG;AACvC,MAAI,MAAM,GAAI,QAAO;AACrB,QAAM,QAAQ,IAAIA,MAAK,SAAS;AAChC,QAAM,IAAI,IAAI,QAAQ,KAAK,KAAK;AAChC,SAAO,IAAI,MAAM,OAAO,MAAM,KAAK,SAAY,CAAC;AAClD;AAGA,IAAM,OAAO,CAAC,QAA4B,IAAmC,MAAM,CAAC;AAEpF,IAAM,eAAe,CAAC,MACpB,EAAE,IAAI,gBAAgB,EAAE,KAAK,QAAQ,iBAAiB;AAMxD,IAAM,WAAW,CAAC,GAAW,QAAgC;AAC3D,QAAM,KAAM,IAAmC;AAC/C,QAAM,SAAS,KAAK,IAAI,QAAQ,IAAI,kBAAkB,IAAI;AAC1D,SAAO,cAAU,8BAAgB,MAAM,IAAI,QAAQ,IAAI,iBAAiB,GAAG,aAAa,CAAC,CAAC;AAC5F;AAUA,SAAS,gBAAgB,GAAW,KAA4B;AAC9D,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAC7C,SAAO,EAAE,KAAK,MAAM,IAAI,UAAU,IAAI,KAAK,GAAG,GAAG,IAAI,SAAS,GAAG,GAAG,GAAG,KAAK,YAAY,SAAS,cAAc,EAAE;AACnH;AAEA,SAAS,WACP,KAAc,MAAc,OAAe,IAAmB,KAC9D,MAAc,OAAO,WAAW,GAAG,aAAa,OACrC;AACX,QAAM,UAAmC,CAAC;AAC1C,MAAI,QAAQ,QAAQ,CAAC,GAAG,MAAM,QAAQ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,QAAM,KAAK,KAAK,GAAG;AACnB,QAAM,SAAK;AAAA,IACT;AAAA,MACE,QAAQ,IAAI;AAAA,MAAQ,MAAM,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE;AAAA,MAAM;AAAA,MAAM;AAAA,MAAO;AAAA,MAAS;AAAA;AAAA;AAAA;AAAA,MAIlG,aAAa,GAAG,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,IAC3E;AAAA,IACA,EAAE,KAAK,uBAAU,KAAK,KAAK,WAAW;AAAA,EACxC;AACA,MAAI,GAAG,IAAK,IAAG,MAAM,GAAG;AACxB,MAAI,GAAG,QAAS,IAAG,KAAK,GAAG;AAC3B,MAAI,GAAG,wBAAyB,IAAG,OAAO,GAAG;AAC7C,SAAO;AACT;AAGO,SAAS,KAAK,GAAW,IAAa,WAA4B;AACvE,IAAE,MAAM,KAAK,EAAE;AACf,IAAE,MAAM,MAAM,SAAS;AACzB;AAGA,eAAe,YAAY,KAAa,KAAc,IAAmB,WAAyC;AAChH,QAAM,YAAY,MAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AACpG,MAAI,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC,IAAI,OAAQ,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACjG,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,QAAQ,OAAO,IAAI,EAAE,aAAa,OAAQ,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACvF,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM,IAAI;AAAA,EAAG,QAAQ;AAAE,WAAO,UAAU;AAAA,EAAG;AAC/D,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,UAAU;AAErF,OAAK,KAAK,EAAE,GAAI,QAAoC,KAAK,GAAG,IAAI,KAAK,sBAAS,GAAG,SAAS;AAC1F,SAAO,UAAU;AACnB;AAEO,SAAS,OAAO,OAA0B,CAAC,GAAsB;AACtE,QAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,SAAS,KAAK,UAAU;AAE9B,SAAO,eAAe,WAAW,GAAY,MAAsC;AAGjF,UAAM,UAAM,sBAAQ,OAAO,EAAE,GAAI,EAAE,KAAwD,GAAG,KAAK,IAAI,IAAI,CAAC,CAAuC;AACnJ,UAAM,UAAM,sBAAQ,MAAO,IAAI,oBAAoB,MAAM,OAAO,OAAO,MAAM,GAAG,GAAI,IAAI;AACxF,QAAI,CAAC,IAAK,QAAO,KAAK;AAEtB,UAAM,cAAc,KAAK,cAAc,SAAS,IAAI,qBAAqB;AAEzE,UAAM,YAAuB,CAAC,MAAM;AAClC,UAAI;AAAE,UAAE,cAAc,UAAU,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqD;AAAA,IACnG;AAIA,QAAI,WAA0B;AAG9B,QAAI,OAA0B;AAC9B,QAAI,aAAa;AAEjB,UAAM,SAAS,UAAM,2BAAa,YAAsC;AACtE,UAAI,KAAK,YAAY,SAAS;AAE9B,YAAM,MAAM,EAAE,IAAI;AAClB,YAAM,EAAE,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI,gBAAgB,KAAK,GAAG;AAE3D,YAAM,IAAI,IAAI,KAAK,QAAQ;AAAA,QACzB;AAAA,QAAI;AAAA,QAAM,IAAI,IAAI,QAAQ,IAAI,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,QAI1C,QAAQ,CAAC,MAAM,IAAI,QAAQ,IAAI,CAAC;AAAA,QAChC,KAAK,GAAG,OAAO;AAAA,QAAM,SAAS,GAAG,WAAW;AAAA,QAAM,MAAM,GAAG,2BAA2B;AAAA,MACxF,CAAC;AACD,iBAAW,EAAE,OAAO,EAAE,QAAQ,OAAO;AAErC,UAAI,EAAE,OAAO;AACX,cAAM,KAAK,WAAW,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAG;AACpD,WAAG,KAAK;AACR,WAAG,MAAM,EAAE;AACX,YAAI,EAAE,KAAM,IAAG,KAAK,EAAE;AACtB,aAAK,KAAK,IAAI,SAAS;AACvB,cAAM,UAAkC;AAAA,UACtC,gBAAgB;AAAA,UAAc,kBAAkB,OAAO,EAAE,UAAU,EAAE;AAAA,UAAG,mBAAmB,EAAE,WAAW;AAAA,QAC1G;AACA,YAAI,EAAE,KAAM,SAAQ,cAAc,IAAI,EAAE;AACxC,eAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,MAC3D;AAIA,UAAI,eAAe,IAAI;AAErB,YAAI,IAAI,WAAW,UAAU,SAAS,cAAe,QAAO,OAAO,KAAK,KAAK,IAAI,KAAK,eAAe,SAAS;AAC9G,cAAM,QAAQ,YAAY,IAAI,QAAQ,IAAI,QAAQ,KAAK,IAAI,6BAAgB;AAC3E,YAAI,EAAE,aAAa,CAAE,MAAM,IAAI,IAAI,WAAW,IAAI,KAAK,IAAI,GAAG,KAAK,GAAI;AACrE,iBAAO,MAAM,KAAK,KAAK,IAAI,KAAK,eAAe,OAAO,IAAI,QAAQ,SAAS;AAAA,QAC7E;AAAA,MACF;AAIA,UAAI,cAAc,GAAG,GAAG;AACtB,YAAI,IAAI,WAAW,SAAS,SAAS,YAAY;AAC/C,iBAAO,IAAI,SAAS,mBAAAC,SAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,0BAA0B,iBAAiB,uBAAuB,EAAE,CAAC;AAAA,QAC3I;AACA,YAAI,IAAI,WAAW,UAAU,SAAS,OAAQ,QAAO,YAAY,KAAK,KAAK,IAAI,SAAS;AAAA,MAC1F;AAKA,mBAAa,CAAC;AACd,aAAO,EAAE,KAAK,KAAK,OAAO,WAAW,GAAG,KAAK,OAAO,OAAO,WAAW,GAAG,IAAI,WAAW,WAAW;AACnG,QAAE,IAAI,KAAK,IAAI;AACf,aAAO;AAAA,IACT,GAAG,IAAI;AAEP,QAAI,OAAQ,QAAO;AAEnB,UAAM,KAAK;AAIX,8BAAQ,MAAM;AACZ,UAAI,CAAC,QAAQ,CAAC,WAAY;AAC1B,YAAM,SAAS,IAAI,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,aAAa,WAAW,aAAa;AAC3E,QAAE,IAAI,QAAQ,OAAO,cAAc,GAAG,cAAc,IAAI,KAAK,GAAG,qBAAqB,eAAe,2BAA2B,MAAM,EAAE;AAAA,IACzI,GAAG,MAAS;AAIZ,aAAK,2BAAa,YAAY;AAC5B,YAAM,MAAM,EAAE,IAAI;AAClB,YAAM,EAAE,KAAK,MAAM,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAClD,YAAM,MAAM,IAAI,KAAK;AACrB,WAAK,KAAK,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,EAAG;AAC1D,UAAI,KAAK,OAAO,MAAM,KAAK,UAAU,GAAI;AAEzC,YAAM,KAAK,WAAW,KAAK,MAAM,IAAI,QAAQ,IAAI,MAAM,OAAO,MAAM,MAAM,KAAK,UAAU;AACzF,SAAG,KAAK,EAAE,IAAI;AACd,UAAI,SAAU,IAAG,MAAM;AACvB,WAAK,KAAK,IAAI,SAAS;AAAA,IACzB,GAAG,MAAS;AAAA,EACd;AACF;AAGA,eAAe,MAAM,KAAa,KAAc,IAAY,KAAoB,QAAgB,QAAgB,WAAyC;AACvJ,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,WAAW,KAAK,IAAI,UAAU,IAAI,QAAQ,IAAI,GAAG;AAC5D,KAAG,KAAK;AACR,KAAG,MAAM;AACT,OAAK,KAAK,IAAI,SAAS;AAEvB,MAAI,KAAC,wBAAU,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC5E,WAAO,IAAI,SAAS,kCAAkC;AAAA,MACpD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,YAAY,sBAAsB,IAAI;AAAA,IACxG,CAAC;AAAA,EACH;AACA,QAAM,WAAO,4BAAc,EAAE,OAAO,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,GAAG,QAAQ,QAAI,2BAAa,MAAM,EAAE,CAAC;AAC3G,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,4BAA4B,iBAAiB,YAAY,sBAAsB,IAAI;AAAA,EAChH,CAAC;AACH;AAGA,eAAe,OAAO,KAAa,KAAc,IAAY,KAAoB,QAAgB,WAAyC;AACxI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAG3B,MAAI,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC,IAAI,SAAU,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACnG,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,KAAK,SAAS,SAAU,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACrE,QAAM,WAAO,4BAAc,IAAI;AAC/B,QAAM,SAAK,2BAAa,KAAK,EAAE;AAC/B,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,CAAE,MAAM,IAAI,IAAI,OAAO,IAAI,KAAK,KAAK,OAAO,KAAK,QAAQ,GAAI;AAC/D,UAAM,WAAO,4BAAc,EAAE,OAAO,MAAM,IAAI,IAAI,MAAM,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC;AAC9E,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,4BAA4B,iBAAiB,WAAW,EAAE,CAAC;AAAA,EACjI;AACA,QAAM,KAAK,WAAW,KAAK,IAAI,UAAU,IAAI,IAAI,GAAG;AACpD,KAAG,KAAK;AACR,KAAG,KAAK;AACR,OAAK,KAAK,IAAI,SAAS;AACvB,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,UAAU;AAAA,MACV,kBAAc,8BAAgB,MAAM,IAAI,IAAI,MAAM,IAAI,GAAG,GAAG,IAAI,aAAa,QAAQ;AAAA,MACrF,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;","names":["import_core","import_core","name","iife"]}

package/dist/index.d.cts

@@ -0,0 +1,46 @@
+import { MiddlewareHandler, Context } from 'hono';
+import { TrustedProxyConfig, SnapshotVersion } from '@camada/core';
+
+interface ResolvedEnv {
+    ingestToken: string;
+    snapToken: string;
+    secret: string;
+    ingestUrl: string;
+    snapshotUrl: string;
+    trustedProxy: TrustedProxyConfig | null;
+}
+interface CamadaHonoOptions {
+    key?: string;
+    ingestUrl?: string;
+    snapshotUrl?: string;
+    trustedProxy?: TrustedProxyConfig | string | null;
+    challenge?: boolean;
+    challengePath?: string;
+    snapshotVersion?: SnapshotVersion;
+    scriptPath?: string;
+    fpPath?: string;
+    env?: Record<string, string | undefined>;
+    fetchImpl?: typeof fetch;
+}
+/** Returns null (the middleware stays inert, one log line) rather than throwing on bad config. */
+declare function resolveEnv(opts: CamadaHonoOptions, env: Record<string, string | undefined>): ResolvedEnv | null;
+
+/** Test/reset hook: drops every cached engine. */
+declare function resetCamada(): void;
+declare function camada(opts?: CamadaHonoOptions): MiddlewareHandler;
+
+/**
+ * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,
+ * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`
+ * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event
+ * through its rid and session. The user identifier is HMAC-hashed in-process with the ingest
+ * token — the raw value never reaches the queue. Never throws, never rejects; awaiting it is
+ * optional (the flush rides `waitUntil`), so a handler may fire and forget.
+ */
+declare function track(c: Context, event: string, data?: {
+    user?: string;
+}): Promise<void>;
+/** The `<script>` tag for an HTML response — `''` when camada is off for this request or the tenant turned the beacon off. */
+declare function scriptTag(c: Context): string;
+
+export { type CamadaHonoOptions, type ResolvedEnv, camada, resetCamada, resolveEnv, scriptTag, track };

package/dist/index.d.ts

@@ -0,0 +1,46 @@
+import { MiddlewareHandler, Context } from 'hono';
+import { TrustedProxyConfig, SnapshotVersion } from '@camada/core';
+
+interface ResolvedEnv {
+    ingestToken: string;
+    snapToken: string;
+    secret: string;
+    ingestUrl: string;
+    snapshotUrl: string;
+    trustedProxy: TrustedProxyConfig | null;
+}
+interface CamadaHonoOptions {
+    key?: string;
+    ingestUrl?: string;
+    snapshotUrl?: string;
+    trustedProxy?: TrustedProxyConfig | string | null;
+    challenge?: boolean;
+    challengePath?: string;
+    snapshotVersion?: SnapshotVersion;
+    scriptPath?: string;
+    fpPath?: string;
+    env?: Record<string, string | undefined>;
+    fetchImpl?: typeof fetch;
+}
+/** Returns null (the middleware stays inert, one log line) rather than throwing on bad config. */
+declare function resolveEnv(opts: CamadaHonoOptions, env: Record<string, string | undefined>): ResolvedEnv | null;
+
+/** Test/reset hook: drops every cached engine. */
+declare function resetCamada(): void;
+declare function camada(opts?: CamadaHonoOptions): MiddlewareHandler;
+
+/**
+ * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,
+ * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`
+ * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event
+ * through its rid and session. The user identifier is HMAC-hashed in-process with the ingest
+ * token — the raw value never reaches the queue. Never throws, never rejects; awaiting it is
+ * optional (the flush rides `waitUntil`), so a handler may fire and forget.
+ */
+declare function track(c: Context, event: string, data?: {
+    user?: string;
+}): Promise<void>;
+/** The `<script>` tag for an HTML response — `''` when camada is off for this request or the tenant turned the beacon off. */
+declare function scriptTag(c: Context): string;
+
+export { type CamadaHonoOptions, type ResolvedEnv, camada, resetCamada, resolveEnv, scriptTag, track };

package/dist/index.js

@@ -0,0 +1,317 @@
+// src/camada.ts
+import iife from "@camada/browser/iife-string";
+import {
+  SnapshotClient,
+  EventQueue,
+  buildWireEvent,
+  resolveClientIp,
+  logRateLimited,
+  guardedAsync as guardedAsync2,
+  guarded as guarded2,
+  createChallengeAsync,
+  challengePage,
+  challengeCookie,
+  safeReturnTo,
+  wantsHtml,
+  parseFormBody,
+  CHALLENGE_COOKIE,
+  DEFAULT_SNAPSHOT_VERSION,
+  TAP_HONO as TAP_HONO2
+} from "@camada/core";
+
+// src/env.ts
+import { parseKey, parseTrustedProxyEnv } from "@camada/core";
+var asProxy = (v) => typeof v === "string" ? parseTrustedProxyEnv(v) : v ?? null;
+function resolveEnv(opts, env) {
+  const raw = opts.key || env.CAMADA_KEY;
+  const key = parseKey(raw);
+  const ingestToken = key?.ingestToken ?? env.CAMADA_TOKEN;
+  const snapToken = key?.snapToken ?? env.CAMADA_SNAPSHOT_TOKEN;
+  if (!ingestToken || !snapToken) return null;
+  const ingestUrl = (opts.ingestUrl || env.CAMADA_INGEST_URL || "https://in.camada.dev").replace(/\/$/, "");
+  return {
+    ingestToken,
+    snapToken,
+    secret: raw || `${ingestToken}.${snapToken}`,
+    ingestUrl,
+    snapshotUrl: opts.snapshotUrl || env.CAMADA_SNAPSHOT_URL || `${ingestUrl}/snapshot`,
+    trustedProxy: asProxy(opts.trustedProxy) ?? parseTrustedProxyEnv(env.CAMADA_TRUSTED_PROXY)
+  };
+}
+
+// src/context.ts
+import { guarded, guardedAsync, hashUserId, TAP_HONO } from "@camada/core";
+var VAR = "__camada";
+var beaconEnabled = (e) => e.snap.config?.beacon !== false;
+var readVars = (c) => c.get(VAR);
+function track(c, event, data) {
+  const vars = guarded(() => readVars(c), void 0);
+  if (!vars) return Promise.resolve();
+  const p = guardedAsync(async () => {
+    const uid = data?.user ? await hashUserId(data.user, vars.eng.env.ingestToken) : null;
+    ship(vars.eng, { tap: TAP_HONO, et: event, uid, rid: vars.rid, sid: vars.sid, ip: vars.ip, ts: Date.now() }, vars.waitUntil);
+  }, void 0);
+  vars.waitUntil(p);
+  return p;
+}
+function scriptTag(c) {
+  return guarded(() => {
+    const vars = readVars(c);
+    if (!vars || !beaconEnabled(vars.eng)) return "";
+    return `<script src="${vars.scriptPath}?r=${vars.rid}" async></script>`;
+  }, "");
+}
+
+// package.json
+var name = "@camada/hono";
+var version = "0.3.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var DEFAULT_CHALLENGE_PATH = "/__camada/challenge";
+var SCRIPT_PATH = "/_cam/b.js";
+var FP_PATH = "/_cam/fp";
+var FP_MAX = 32 * 1024;
+var SESSION_COOKIE = "_sfp";
+var SESSION_MAX_AGE = 2592e3;
+var BODY_MAX = 4 * 1024;
+var encoder = new TextEncoder();
+var engines = /* @__PURE__ */ new Map();
+function resetCamada() {
+  for (const e of engines.values()) {
+    e.snap.stop();
+    e.queue.stop();
+  }
+  engines.clear();
+}
+function ensure(opts, ctxEnv) {
+  const env = resolveEnv(opts, ctxEnv);
+  if (!env) {
+    logRateLimited(new Error("CAMADA_KEY not set \u2014 camada is inactive"));
+    return null;
+  }
+  const snapshotVersion = opts.snapshotVersion ?? DEFAULT_SNAPSHOT_VERSION;
+  const id = `${env.ingestToken}|${env.ingestUrl}|${env.snapshotUrl}|${snapshotVersion}`;
+  const cached = engines.get(id);
+  if (cached) return cached;
+  const injected = opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {};
+  const engine = {
+    env,
+    snap: new SnapshotClient({
+      url: env.snapshotUrl,
+      token: env.snapToken,
+      mode: "lazy",
+      sdk: SDK_ID,
+      snapshotVersion,
+      ...injected
+    }),
+    queue: new EventQueue({ url: env.ingestUrl, token: env.ingestToken, sdk: SDK_ID, ...injected }),
+    kit: createChallengeAsync({ secret: env.secret })
+  };
+  engines.set(id, engine);
+  return engine;
+}
+var cookieValue = (cookie, name2) => {
+  const src = "; " + cookie;
+  const i = src.indexOf("; " + name2 + "=");
+  if (i === -1) return null;
+  const start = i + name2.length + 3;
+  const j = src.indexOf(";", start);
+  return src.slice(start, j === -1 ? void 0 : j);
+};
+var cfOf = (req) => req.cf ?? {};
+var trustedProxy = (e) => e.env.trustedProxy ?? e.snap.config?.trusted_proxy ?? null;
+var clientIp = (e, req) => {
+  const cf = req.cf;
+  const direct = cf ? req.headers.get("cf-connecting-ip") : null;
+  return direct || resolveClientIp(null, req.headers.get("x-forwarded-for"), trustedProxy(e));
+};
+function describeRequest(e, req) {
+  const url = new URL(req.url);
+  const cookies = req.headers.get("cookie") || "";
+  return { url, path: url.pathname, cf: cfOf(req), ip: clientIp(e, req), sid: cookieValue(cookies, SESSION_COOKIE) };
+}
+function buildEvent(req, path, query, ip, sid, rid = crypto.randomUUID(), newSession = false) {
+  const headers = [];
+  req.headers.forEach((v, k) => headers.push([k, v]));
+  const cf = cfOf(req);
+  const ev = buildWireEvent(
+    {
+      method: req.method,
+      host: req.headers.get("host") ?? new URL(req.url).host,
+      path,
+      query,
+      headers,
+      ip,
+      // The client's connection terminates at Cloudflare, so `cf.httpProtocol` really is the
+      // visitor's protocol (ea's TAP_CAPS grants this tap TRUE_PROTO on that basis). Never read
+      // a forwarded header for this — that would be the proxy's hop, not the client's.
+      httpVersion: cf.httpProtocol ? cf.httpProtocol.replace(/^HTTP\//i, "") : null
+    },
+    { tap: TAP_HONO2, rid, sid, newSession }
+  );
+  if (cf.asn) ev.asn = cf.asn;
+  if (cf.country) ev.cc = cf.country;
+  if (cf.tlsClientExtensionsSha1) ev.tlsx = cf.tlsClientExtensionsSha1;
+  return ev;
+}
+function ship(e, ev, waitUntil) {
+  e.queue.push(ev);
+  e.queue.flush(waitUntil);
+}
+async function relayBeacon(eng, req, ip, waitUntil) {
+  const noContent = () => new Response(null, { status: 204, headers: { "cache-control": "no-store" } });
+  if (Number(req.headers.get("content-length")) > FP_MAX) return new Response(null, { status: 413 });
+  const body = await req.text();
+  if (encoder.encode(body).byteLength > FP_MAX) return new Response(null, { status: 413 });
+  let parsed;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return noContent();
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return noContent();
+  ship(eng, { ...parsed, sig: 1, ip, tap: TAP_HONO2 }, waitUntil);
+  return noContent();
+}
+function camada(opts = {}) {
+  const challengePath = opts.challengePath ?? DEFAULT_CHALLENGE_PATH;
+  const scriptPath = opts.scriptPath ?? SCRIPT_PATH;
+  const fpPath = opts.fpPath ?? FP_PATH;
+  return async function camadaHono(c, next) {
+    const env = guarded2(() => ({ ...c.env, ...opts.env }), {});
+    const eng = guarded2(() => env.CAMADA_DISABLED === "1" ? null : ensure(opts, env), null);
+    if (!eng) return next();
+    const challengeOn = opts.challenge !== false && env.CAMADA_CHALLENGE !== "0";
+    const waitUntil = (p) => {
+      try {
+        c.executionCtx?.waitUntil(p);
+      } catch {
+      }
+    };
+    let warnRule = null;
+    let vars = null;
+    let newSession = false;
+    const answer = await guardedAsync2(async () => {
+      eng.snap.ensureFresh(waitUntil);
+      const req = c.req.raw;
+      const { url, path, cf, ip, sid } = describeRequest(eng, req);
+      const v = eng.snap.verdict({
+        ip,
+        path,
+        ua: req.headers.get("user-agent"),
+        // §D3: without ua every `ua` rule is false
+        // `header` conditions read the request through this getter; `Headers.get` is
+        // case-insensitive, so the lower-cased name the matcher asks with finds whatever
+        // spelling the client sent. Without it every `header` rule is false.
+        header: (n) => req.headers.get(n),
+        asn: cf.asn ?? null,
+        country: cf.country ?? null,
+        tlsx: cf.tlsClientExtensionsSha1 ?? null
+      });
+      warnRule = v.warn ? v.rule ?? null : null;
+      if (v.block) {
+        const ev = buildEvent(req, path, url.search, ip, sid);
+        ev.st = 403;
+        ev.blk = v.reason;
+        if (v.rule) ev.rl = v.rule;
+        ship(eng, ev, waitUntil);
+        const headers = {
+          "content-type": "text/plain",
+          "x-block-reason": String(v.reason ?? ""),
+          "x-block-version": v.version ?? ""
+        };
+        if (v.rule) headers["x-block-rule"] = v.rule;
+        return new Response("Forbidden", { status: 403, headers });
+      }
+      if (challengeOn && ip) {
+        if (req.method === "POST" && path === challengePath) return verify(eng, req, ip, sid, challengePath, waitUntil);
+        const token = cookieValue(req.headers.get("cookie") || "", CHALLENGE_COOKIE);
+        if (v.challenge && !await eng.kit.tokenValid(ip, Date.now(), token)) {
+          return serve(eng, req, ip, sid, challengePath, path + url.search, waitUntil);
+        }
+      }
+      if (beaconEnabled(eng)) {
+        if (req.method === "GET" && path === scriptPath) {
+          return new Response(iife, { status: 200, headers: { "content-type": "application/javascript", "cache-control": "public, max-age=3600" } });
+        }
+        if (req.method === "POST" && path === fpPath) return relayBeacon(eng, req, ip, waitUntil);
+      }
+      newSession = !sid;
+      vars = { eng, rid: crypto.randomUUID(), sid: sid ?? crypto.randomUUID(), ip, waitUntil, scriptPath };
+      c.set(VAR, vars);
+      return null;
+    }, null);
+    if (answer) return answer;
+    await next();
+    guarded2(() => {
+      if (!vars || !newSession) return;
+      const secure = new URL(c.req.raw.url).protocol === "https:" ? "; Secure" : "";
+      c.res.headers.append("set-cookie", `${SESSION_COOKIE}=${vars.sid}; Path=/; Max-Age=${SESSION_MAX_AGE}; HttpOnly; SameSite=Lax${secure}`);
+    }, void 0);
+    void guardedAsync2(async () => {
+      const req = c.req.raw;
+      const { url, path, ip } = describeRequest(eng, req);
+      const cfg = eng.snap.config;
+      if ((cfg?.exclude || []).some((x) => path.startsWith(x))) return;
+      if (Math.random() >= (cfg?.sample ?? 1)) return;
+      const ev = buildEvent(req, path, url.search, ip, vars?.sid ?? null, vars?.rid, newSession);
+      ev.st = c.res.status;
+      if (warnRule) ev.wrn = warnRule;
+      ship(eng, ev, waitUntil);
+    }, void 0);
+  };
+}
+async function serve(eng, req, ip, sid, action, target, waitUntil) {
+  const url = new URL(req.url);
+  const ev = buildEvent(req, url.pathname, url.search, ip, sid);
+  ev.st = 403;
+  ev.blk = "challenge";
+  ship(eng, ev, waitUntil);
+  if (!wantsHtml(req.headers.get("accept"), req.headers.get("sec-fetch-dest"))) {
+    return new Response('{"error":"challenge_required"}', {
+      status: 403,
+      headers: { "content-type": "application/json", "cache-control": "no-store", "x-camada-challenge": "1" }
+    });
+  }
+  const html = challengePage({ nonce: await eng.kit.nonce(ip, Date.now()), action, to: safeReturnTo(target) });
+  return new Response(html, {
+    status: 403,
+    headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store", "x-camada-challenge": "1" }
+  });
+}
+async function verify(eng, req, ip, sid, action, waitUntil) {
+  const url = new URL(req.url);
+  if (Number(req.headers.get("content-length")) > BODY_MAX) return new Response(null, { status: 413 });
+  const body = await req.text();
+  if (body.length > BODY_MAX) return new Response(null, { status: 413 });
+  const form = parseFormBody(body);
+  const to = safeReturnTo(form.to);
+  const now = Date.now();
+  if (!await eng.kit.verify(ip, now, form.nonce, form.solution)) {
+    const html = challengePage({ nonce: await eng.kit.nonce(ip, now), action, to });
+    return new Response(html, { status: 403, headers: { "content-type": "text/html; charset=utf-8", "cache-control": "no-store" } });
+  }
+  const ev = buildEvent(req, url.pathname, "", ip, sid);
+  ev.st = 200;
+  ev.ch = 1;
+  ship(eng, ev, waitUntil);
+  return new Response(null, {
+    status: 302,
+    headers: {
+      location: to,
+      "set-cookie": challengeCookie(await eng.kit.issue(ip, now), url.protocol === "https:"),
+      "cache-control": "no-store"
+    }
+  });
+}
+export {
+  camada,
+  resetCamada,
+  resolveEnv,
+  scriptTag,
+  track
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/camada.ts","../src/env.ts","../src/context.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/hono — the Hono middleware for Cloudflare Workers (SEC-07, D33).\n//   app.use('*', camada());\n// Workers-native: `cf-connecting-ip` for the client address, `request.cf` for asn / country /\n// TLS fingerprint (so ASN and country rules really enforce at this tap), and\n// `c.executionCtx.waitUntil` so the snapshot poll and the event flush outlive the response.\n// Everything runs inside camada's fail-open envelope: a camada bug, a dead ingest or a corrupt\n// snapshot costs telemetry, never the app's response.\nimport type { Context, MiddlewareHandler, Next } from 'hono';\nimport iife from '@camada/browser/iife-string';\nimport {\n  SnapshotClient, EventQueue, buildWireEvent, resolveClientIp, logRateLimited, guardedAsync,\n  guarded, createChallengeAsync, challengePage, challengeCookie, safeReturnTo, wantsHtml, parseFormBody,\n  CHALLENGE_COOKIE, DEFAULT_SNAPSHOT_VERSION, TAP_HONO,\n  type AsyncChallengeKit, type TrustedProxyConfig, type WireEvent,\n} from '@camada/core';\nimport { resolveEnv, type CamadaHonoOptions, type ResolvedEnv } from './env.js';\nimport { VAR, beaconEnabled, type CamadaVars } from './context.js';\nimport { SDK_ID } from './version.js';\n\nconst DEFAULT_CHALLENGE_PATH = '/__camada/challenge';\nconst SCRIPT_PATH = '/_cam/b.js';   // the beacon IIFE; its auto-init posts to the sibling `fp` and reads the rid from ?r=\nconst FP_PATH = '/_cam/fp';\nconst FP_MAX = 32 * 1024;        // matches the analyst's /fp cap: never accept what ingest will 413\nconst SESSION_COOKIE = '_sfp';   // the same session cookie as every other tap: sid/ns stay comparable\nconst SESSION_MAX_AGE = 2592000;\nconst BODY_MAX = 4 * 1024;       // the verify form is ~120 bytes; anything larger is not ours\nconst encoder = new TextEncoder();\n\nexport interface Engine {\n  env: ResolvedEnv;\n  snap: SnapshotClient;\n  queue: EventQueue;\n  kit: AsyncChallengeKit;\n}\n\nexport type WaitUntil = (p: Promise<unknown>) => void;\n\n// One engine per resolved configuration, not per module: a Workers isolate can host several\n// Hono apps, and a shared singleton would enforce the first tenant's snapshot on the second\n// and sign its `_cch` cookies with the first tenant's secret. An unconfigured request is never\n// cached — a warm-up or a differently-keyed mount must not leave the isolate inert for good.\nconst engines = new Map<string, Engine>();\n\n/** Test/reset hook: drops every cached engine. */\nexport function resetCamada(): void {\n  for (const e of engines.values()) { e.snap.stop(); e.queue.stop(); }\n  engines.clear();\n}\n\nfunction ensure(opts: CamadaHonoOptions, ctxEnv: Record<string, string | undefined>): Engine | null {\n  const env = resolveEnv(opts, ctxEnv);\n  if (!env) {\n    logRateLimited(new Error('CAMADA_KEY not set — camada is inactive'));\n    return null;\n  }\n  const snapshotVersion = opts.snapshotVersion ?? DEFAULT_SNAPSHOT_VERSION;\n  const id = `${env.ingestToken}|${env.ingestUrl}|${env.snapshotUrl}|${snapshotVersion}`;\n  const cached = engines.get(id);\n  if (cached) return cached;\n  const injected = opts.fetchImpl ? { fetchImpl: opts.fetchImpl } : {};   // never pass an explicit undefined key\n  const engine: Engine = {\n    env,\n    snap: new SnapshotClient({\n      url: env.snapshotUrl, token: env.snapToken, mode: 'lazy', sdk: SDK_ID,\n      snapshotVersion, ...injected,\n    }),\n    queue: new EventQueue({ url: env.ingestUrl, token: env.ingestToken, sdk: SDK_ID, ...injected }),\n    kit: createChallengeAsync({ secret: env.secret }),\n  };\n  engines.set(id, engine);\n  return engine;\n}\n\nconst cookieValue = (cookie: string, name: string): string | null => {\n  const src = '; ' + cookie;\n  const i = src.indexOf('; ' + name + '=');\n  if (i === -1) return null;\n  const start = i + name.length + 3;\n  const j = src.indexOf(';', start);\n  return src.slice(start, j === -1 ? undefined : j);\n};\n\ninterface CfProps { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string }\nconst cfOf = (req: Request): CfProps => ((req as Request & { cf?: CfProps }).cf ?? {});\n\nconst trustedProxy = (e: Engine): TrustedProxyConfig | null =>\n  e.env.trustedProxy ?? e.snap.config?.trusted_proxy ?? null;\n\n/** Cloudflare sets `cf-connecting-ip` itself and a client cannot forge it — but only on\n *  Workers, which is also the only place `request.cf` exists. On any other Hono runtime\n *  (node-server, Bun, Deno) that header is attacker-controlled, so it is ignored there and the\n *  trusted-proxy rules decide, exactly as they do for X-Forwarded-For. */\nconst clientIp = (e: Engine, req: Request): string | null => {\n  const cf = (req as Request & { cf?: unknown }).cf;\n  const direct = cf ? req.headers.get('cf-connecting-ip') : null;\n  return direct || resolveClientIp(null, req.headers.get('x-forwarded-for'), trustedProxy(e));\n};\n\ninterface RequestFacts {\n  url: URL;\n  path: string;\n  cf: CfProps;\n  ip: string | null;\n  sid: string | null;\n}\n\nfunction describeRequest(e: Engine, req: Request): RequestFacts {\n  const url = new URL(req.url);\n  const cookies = req.headers.get('cookie') || '';\n  return { url, path: url.pathname, cf: cfOf(req), ip: clientIp(e, req), sid: cookieValue(cookies, SESSION_COOKIE) };\n}\n\nfunction buildEvent(\n  req: Request, path: string, query: string, ip: string | null, sid: string | null,\n  rid: string = crypto.randomUUID(), newSession = false,   // the capture path passes the ids it shared with the app; camada's own answers need none\n): WireEvent {\n  const headers: Array<[string, string]> = [];\n  req.headers.forEach((v, k) => headers.push([k, v]));   // workerd normalises header order: no HEADER_ORDER signal here\n  const cf = cfOf(req);\n  const ev = buildWireEvent(\n    {\n      method: req.method, host: req.headers.get('host') ?? new URL(req.url).host, path, query, headers, ip,\n      // The client's connection terminates at Cloudflare, so `cf.httpProtocol` really is the\n      // visitor's protocol (ea's TAP_CAPS grants this tap TRUE_PROTO on that basis). Never read\n      // a forwarded header for this — that would be the proxy's hop, not the client's.\n      httpVersion: cf.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n    },\n    { tap: TAP_HONO, rid, sid, newSession },\n  );\n  if (cf.asn) ev.asn = cf.asn;\n  if (cf.country) ev.cc = cf.country;\n  if (cf.tlsClientExtensionsSha1) ev.tlsx = cf.tlsClientExtensionsSha1;\n  return ev;\n}\n\n/** Push then flush through `waitUntil` — the one rule every row (wire event, beacon, track()) follows. */\nexport function ship(e: Engine, ev: unknown, waitUntil: WaitUntil): void {\n  e.queue.push(ev);\n  e.queue.flush(waitUntil);\n}\n\n/** 204 and a `sig: 1` row on the event batch — one request per flush at the analyst, not one per page view. */\nasync function relayBeacon(eng: Engine, req: Request, ip: string | null, waitUntil: WaitUntil): Promise<Response> {\n  const noContent = () => new Response(null, { status: 204, headers: { 'cache-control': 'no-store' } });\n  if (Number(req.headers.get('content-length')) > FP_MAX) return new Response(null, { status: 413 });\n  const body = await req.text();\n  if (encoder.encode(body).byteLength > FP_MAX) return new Response(null, { status: 413 });\n  let parsed: unknown;\n  try { parsed = JSON.parse(body); } catch { return noContent(); }   // not a beacon: drop it, never ship junk\n  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) return noContent();\n  // Spread first: the ip and the tap are the server's to say, whatever the body claimed.\n  ship(eng, { ...(parsed as Record<string, unknown>), sig: 1, ip, tap: TAP_HONO }, waitUntil);\n  return noContent();\n}\n\nexport function camada(opts: CamadaHonoOptions = {}): MiddlewareHandler {\n  const challengePath = opts.challengePath ?? DEFAULT_CHALLENGE_PATH;\n  const scriptPath = opts.scriptPath ?? SCRIPT_PATH;\n  const fpPath = opts.fpPath ?? FP_PATH;\n\n  return async function camadaHono(c: Context, next: Next): Promise<Response | void> {\n    // Reading c.env and building the engine are inside the guard too: a Workers env carries\n    // non-string bindings, and a throw here would 5xx the app on its very first request.\n    const env = guarded(() => ({ ...(c.env as Record<string, string | undefined> | undefined), ...opts.env }), {} as Record<string, string | undefined>);\n    const eng = guarded(() => (env.CAMADA_DISABLED === '1' ? null : ensure(opts, env)), null);\n    if (!eng) return next();\n    // Same opt-out as @camada/next: the code option, or CAMADA_CHALLENGE=0 in the Worker env.\n    const challengeOn = opts.challenge !== false && env.CAMADA_CHALLENGE !== '0';\n\n    const waitUntil: WaitUntil = (p) => {\n      try { c.executionCtx?.waitUntil(p); } catch { /* no execution context outside a fetch handler */ }\n    };\n\n    // The id of the `warn` rule that let this request through, read again after next() when the\n    // response event is built (§D3). Every other action settles before the app ever runs.\n    let warnRule: string | null = null;\n    // Set on the capture path only: the ids this request shares with the app (scriptTag, track)\n    // and with its own post-response event. Null when camada answered the request itself.\n    let vars: CamadaVars | null = null;\n    let newSession = false;\n\n    const answer = await guardedAsync(async (): Promise<Response | null> => {\n      eng.snap.ensureFresh(waitUntil);\n\n      const req = c.req.raw;\n      const { url, path, cf, ip, sid } = describeRequest(eng, req);\n\n      const v = eng.snap.verdict({\n        ip, path, ua: req.headers.get('user-agent'),   // §D3: without ua every `ua` rule is false\n        // `header` conditions read the request through this getter; `Headers.get` is\n        // case-insensitive, so the lower-cased name the matcher asks with finds whatever\n        // spelling the client sent. Without it every `header` rule is false.\n        header: (n) => req.headers.get(n),\n        asn: cf.asn ?? null, country: cf.country ?? null, tlsx: cf.tlsClientExtensionsSha1 ?? null,\n      });\n      warnRule = v.warn ? v.rule ?? null : null;\n\n      if (v.block) {\n        const ev = buildEvent(req, path, url.search, ip, sid);\n        ev.st = 403;\n        ev.blk = v.reason;   // SDK-01: the analyst counts SDK blocks apart from the app's own 403s ('rule' when a rule decided)\n        if (v.rule) ev.rl = v.rule;\n        ship(eng, ev, waitUntil);\n        const headers: Record<string, string> = {\n          'content-type': 'text/plain', 'x-block-reason': String(v.reason ?? ''), 'x-block-version': v.version ?? '',\n        };\n        if (v.rule) headers['x-block-rule'] = v.rule;   // a custom rule blocked: name it, so the customer knows which row to edit\n        return new Response('Forbidden', { status: 403, headers });\n      }\n\n      // A challenge needs a resolved client ip: the nonce and the `_cch` cookie are bound to it.\n      // Without one, fail open rather than mint a cookie every unidentified client could use.\n      if (challengeOn && ip) {\n        // The verify endpoint answers first — a challenged client must be able to reach it.\n        if (req.method === 'POST' && path === challengePath) return verify(eng, req, ip, sid, challengePath, waitUntil);\n        const token = cookieValue(req.headers.get('cookie') || '', CHALLENGE_COOKIE);\n        if (v.challenge && !(await eng.kit.tokenValid(ip, Date.now(), token))) {\n          return serve(eng, req, ip, sid, challengePath, path + url.search, waitUntil);\n        }\n      }\n\n      // The beacon endpoints come after enforcement (a blocked or challenged client gets neither\n      // the script nor a relay) and before the app (they are camada's, not its) — @camada/node's order.\n      if (beaconEnabled(eng)) {\n        if (req.method === 'GET' && path === scriptPath) {\n          return new Response(iife, { status: 200, headers: { 'content-type': 'application/javascript', 'cache-control': 'public, max-age=3600' } });\n        }\n        if (req.method === 'POST' && path === fpPath) return relayBeacon(eng, req, ip, waitUntil);\n      }\n\n      // Capture: mint the ids the app, the beacon and the post-response event all share. The\n      // session is decided here rather than after next() so track() inside the handler and the\n      // event both carry the sid a first visit is about to be given.\n      newSession = !sid;\n      vars = { eng, rid: crypto.randomUUID(), sid: sid ?? crypto.randomUUID(), ip, waitUntil, scriptPath };\n      c.set(VAR, vars);\n      return null;\n    }, null);\n\n    if (answer) return answer;\n\n    await next();\n\n    // Mint the shared session cookie the other taps use, so `sid`/`ns` are real here too\n    // (ea's capability mask for sdk-hono claims SESSION). Never overwrite an existing one.\n    guarded(() => {\n      if (!vars || !newSession) return;\n      const secure = new URL(c.req.raw.url).protocol === 'https:' ? '; Secure' : '';\n      c.res.headers.append('set-cookie', `${SESSION_COOKIE}=${vars.sid}; Path=/; Max-Age=${SESSION_MAX_AGE}; HttpOnly; SameSite=Lax${secure}`);\n    }, undefined);\n\n    // The response has settled, so this tap ships the real status — unlike @camada/next's\n    // middleware position, which can only report pre-response.\n    void guardedAsync(async () => {\n      const req = c.req.raw;\n      const { url, path, ip } = describeRequest(eng, req);\n      const cfg = eng.snap.config;\n      if ((cfg?.exclude || []).some((x) => path.startsWith(x))) return;\n      if (Math.random() >= (cfg?.sample ?? 1)) return;\n      // `vars` is null only when the guard above threw before setting it — then the event still ships, with fresh ids.\n      const ev = buildEvent(req, path, url.search, ip, vars?.sid ?? null, vars?.rid, newSession);\n      ev.st = c.res.status;\n      if (warnRule) ev.wrn = warnRule;   // §D3: the warn rule that let this request through\n      ship(eng, ev, waitUntil);\n    }, undefined);\n  };\n}\n\n/** 403 + the proof-of-work page (HTML navigations) or 403 JSON, plus the `blk: \"challenge\"` event. */\nasync function serve(eng: Engine, req: Request, ip: string, sid: string | null, action: string, target: string, waitUntil: WaitUntil): Promise<Response> {\n  const url = new URL(req.url);\n  const ev = buildEvent(req, url.pathname, url.search, ip, sid);\n  ev.st = 403;\n  ev.blk = 'challenge';\n  ship(eng, ev, waitUntil);\n\n  if (!wantsHtml(req.headers.get('accept'), req.headers.get('sec-fetch-dest'))) {\n    return new Response('{\"error\":\"challenge_required\"}', {\n      status: 403,\n      headers: { 'content-type': 'application/json', 'cache-control': 'no-store', 'x-camada-challenge': '1' },\n    });\n  }\n  const html = challengePage({ nonce: await eng.kit.nonce(ip, Date.now()), action, to: safeReturnTo(target) });\n  return new Response(html, {\n    status: 403,\n    headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'x-camada-challenge': '1' },\n  });\n}\n\n/** POST from the page: validate, set `_cch`, 302 back, ship `{ st: 200, ch: 1 }`. */\nasync function verify(eng: Engine, req: Request, ip: string, sid: string | null, action: string, waitUntil: WaitUntil): Promise<Response> {\n  const url = new URL(req.url);\n  // camada answers this path before the app runs, so it must not become a place to post\n  // hundreds of megabytes at an unauthenticated endpoint.\n  if (Number(req.headers.get('content-length')) > BODY_MAX) return new Response(null, { status: 413 });\n  const body = await req.text();\n  if (body.length > BODY_MAX) return new Response(null, { status: 413 });\n  const form = parseFormBody(body);\n  const to = safeReturnTo(form.to);\n  const now = Date.now();\n  if (!(await eng.kit.verify(ip, now, form.nonce, form.solution))) {\n    const html = challengePage({ nonce: await eng.kit.nonce(ip, now), action, to });\n    return new Response(html, { status: 403, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' } });\n  }\n  const ev = buildEvent(req, url.pathname, '', ip, sid);\n  ev.st = 200;\n  ev.ch = 1;   // challenge passed (contract §A3 ingest field)\n  ship(eng, ev, waitUntil);\n  return new Response(null, {\n    status: 302,\n    headers: {\n      location: to,\n      'set-cookie': challengeCookie(await eng.kit.issue(ip, now), url.protocol === 'https:'),\n      'cache-control': 'no-store',\n    },\n  });\n}\n","// Workers hand env vars per request on `c.env`, not on a process — so the engine is built from\n// whatever the first request carries, merged with the options the app passed in code.\nimport { parseKey, parseTrustedProxyEnv, type SnapshotVersion, type TrustedProxyConfig } from '@camada/core';\n\nexport interface ResolvedEnv {\n  ingestToken: string;\n  snapToken: string;\n  secret: string;                            // HMAC key for the challenge nonce/cookie — never leaves the isolate\n  ingestUrl: string;\n  snapshotUrl: string;\n  trustedProxy: TrustedProxyConfig | null;   // null = defer to server-delivered config\n}\n\nexport interface CamadaHonoOptions {\n  key?: string;\n  ingestUrl?: string;\n  snapshotUrl?: string;\n  trustedProxy?: TrustedProxyConfig | string | null;\n  challenge?: boolean;            // enforce `challenge` verdicts with the first-party page (default true)\n  challengePath?: string;         // where that page posts its solution (default /__camada/challenge)\n  snapshotVersion?: SnapshotVersion;   // 5 (default) also carries the tenant's ordered custom rules; 4 the allow/challenge sides only; 3 opts out of both\n  scriptPath?: string;            // where the first-party beacon script is served (default /_cam/b.js)\n  fpPath?: string;                // where that script posts the beacon (default /_cam/fp; must share scriptPath's directory — the script derives it)\n  env?: Record<string, string | undefined>;   // overrides c.env (tests, and apps that read config themselves)\n  fetchImpl?: typeof fetch;\n}\n\nconst asProxy = (v: CamadaHonoOptions['trustedProxy']): TrustedProxyConfig | null =>\n  typeof v === 'string' ? parseTrustedProxyEnv(v) : v ?? null;\n\n/** Returns null (the middleware stays inert, one log line) rather than throwing on bad config. */\nexport function resolveEnv(opts: CamadaHonoOptions, env: Record<string, string | undefined>): ResolvedEnv | null {\n  const raw = opts.key || env.CAMADA_KEY;\n  const key = parseKey(raw);\n  const ingestToken = key?.ingestToken ?? env.CAMADA_TOKEN;\n  const snapToken = key?.snapToken ?? env.CAMADA_SNAPSHOT_TOKEN;\n  if (!ingestToken || !snapToken) return null;\n  const ingestUrl = (opts.ingestUrl || env.CAMADA_INGEST_URL || 'https://in.camada.dev').replace(/\\/$/, '');   // PLACEHOLDER default — confirm the production ingest domain before any npm publish\n  return {\n    ingestToken, snapToken,\n    secret: raw || `${ingestToken}.${snapToken}`,\n    ingestUrl,\n    snapshotUrl: opts.snapshotUrl || env.CAMADA_SNAPSHOT_URL || `${ingestUrl}/snapshot`,\n    trustedProxy: asProxy(opts.trustedProxy) ?? parseTrustedProxyEnv(env.CAMADA_TRUSTED_PROXY),\n  };\n}\n","// Per-request state the middleware leaves on the Hono context for the two helpers an app calls\n// from its own handlers: `scriptTag(c)` (the beacon tag) and `track(c, event, data)` (an\n// app-context outcome). The key is private — the helpers are the API, not `c.get`. When the\n// middleware did not run for this request (a path it is not mounted on, no key, CAMADA_DISABLED,\n// or a request it answered itself) there is nothing on the context and both helpers stand down.\nimport type { Context } from 'hono';\nimport { guarded, guardedAsync, hashUserId, TAP_HONO } from '@camada/core';\nimport { ship, type Engine, type WaitUntil } from './camada.js';\n\nexport const VAR = '__camada';\n\nexport interface CamadaVars {\n  eng: Engine;\n  rid: string;            // the request id the page event carries; the beacon and track() join on it\n  sid: string;            // the `_sfp` session — the one just minted when the request arrived without it\n  ip: string | null;\n  waitUntil: WaitUntil;\n  scriptPath: string;\n}\n\nexport const beaconEnabled = (e: Engine): boolean => e.snap.config?.beacon !== false;   // tenant switch; a cold engine serves\n\nconst readVars = (c: Context): CamadaVars | undefined => c.get(VAR) as CamadaVars | undefined;\n\n/**\n * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,\n * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`\n * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event\n * through its rid and session. The user identifier is HMAC-hashed in-process with the ingest\n * token — the raw value never reaches the queue. Never throws, never rejects; awaiting it is\n * optional (the flush rides `waitUntil`), so a handler may fire and forget.\n */\nexport function track(c: Context, event: string, data?: { user?: string }): Promise<void> {\n  const vars = guarded(() => readVars(c), undefined);\n  if (!vars) return Promise.resolve();\n  const p = guardedAsync(async () => {\n    const uid = data?.user ? await hashUserId(data.user, vars.eng.env.ingestToken) : null;\n    ship(vars.eng, { tap: TAP_HONO, et: event, uid, rid: vars.rid, sid: vars.sid, ip: vars.ip, ts: Date.now() }, vars.waitUntil);\n  }, undefined);\n  vars.waitUntil(p);   // the isolate may freeze right after the response: hold it open for the flush\n  return p;\n}\n\n/** The `<script>` tag for an HTML response — `''` when camada is off for this request or the tenant turned the beacon off. */\nexport function scriptTag(c: Context): string {\n  return guarded(() => {\n    const vars = readVars(c);\n    if (!vars || !beaconEnabled(vars.eng)) return '';\n    return `<script src=\"${vars.scriptPath}?r=${vars.rid}\" async></script>`;\n  }, '');\n}\n","{\n  \"name\": \"@camada/hono\",\n  \"version\": \"0.3.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=18\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Hono on Cloudflare Workers: snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"hono\": \">=4\"\n  },\n  \"devDependencies\": {\n    \"@cloudflare/workers-types\": \"^4.20250109.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"hono\": \"^4.6.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";AAQA,OAAO,UAAU;AACjB;AAAA,EACE;AAAA,EAAgB;AAAA,EAAY;AAAA,EAAgB;AAAA,EAAiB;AAAA,EAAgB,gBAAAA;AAAA,EAC7E,WAAAC;AAAA,EAAS;AAAA,EAAsB;AAAA,EAAe;AAAA,EAAiB;AAAA,EAAc;AAAA,EAAW;AAAA,EACxF;AAAA,EAAkB;AAAA,EAA0B,YAAAC;AAAA,OAEvC;;;ACZP,SAAS,UAAU,4BAA2E;AAyB9F,IAAM,UAAU,CAAC,MACf,OAAO,MAAM,WAAW,qBAAqB,CAAC,IAAI,KAAK;AAGlD,SAAS,WAAW,MAAyB,KAA6D;AAC/G,QAAM,MAAM,KAAK,OAAO,IAAI;AAC5B,QAAM,MAAM,SAAS,GAAG;AACxB,QAAM,cAAc,KAAK,eAAe,IAAI;AAC5C,QAAM,YAAY,KAAK,aAAa,IAAI;AACxC,MAAI,CAAC,eAAe,CAAC,UAAW,QAAO;AACvC,QAAM,aAAa,KAAK,aAAa,IAAI,qBAAqB,yBAAyB,QAAQ,OAAO,EAAE;AACxG,SAAO;AAAA,IACL;AAAA,IAAa;AAAA,IACb,QAAQ,OAAO,GAAG,WAAW,IAAI,SAAS;AAAA,IAC1C;AAAA,IACA,aAAa,KAAK,eAAe,IAAI,uBAAuB,GAAG,SAAS;AAAA,IACxE,cAAc,QAAQ,KAAK,YAAY,KAAK,qBAAqB,IAAI,oBAAoB;AAAA,EAC3F;AACF;;;ACvCA,SAAS,SAAS,cAAc,YAAY,gBAAgB;AAGrD,IAAM,MAAM;AAWZ,IAAM,gBAAgB,CAAC,MAAuB,EAAE,KAAK,QAAQ,WAAW;AAE/E,IAAM,WAAW,CAAC,MAAuC,EAAE,IAAI,GAAG;AAU3D,SAAS,MAAM,GAAY,OAAe,MAAyC;AACxF,QAAM,OAAO,QAAQ,MAAM,SAAS,CAAC,GAAG,MAAS;AACjD,MAAI,CAAC,KAAM,QAAO,QAAQ,QAAQ;AAClC,QAAM,IAAI,aAAa,YAAY;AACjC,UAAM,MAAM,MAAM,OAAO,MAAM,WAAW,KAAK,MAAM,KAAK,IAAI,IAAI,WAAW,IAAI;AACjF,SAAK,KAAK,KAAK,EAAE,KAAK,UAAU,IAAI,OAAO,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,EAAE,GAAG,KAAK,SAAS;AAAA,EAC7H,GAAG,MAAS;AACZ,OAAK,UAAU,CAAC;AAChB,SAAO;AACT;AAGO,SAAS,UAAU,GAAoB;AAC5C,SAAO,QAAQ,MAAM;AACnB,UAAM,OAAO,SAAS,CAAC;AACvB,QAAI,CAAC,QAAQ,CAAC,cAAc,KAAK,GAAG,EAAG,QAAO;AAC9C,WAAO,gBAAgB,KAAK,UAAU,MAAM,KAAK,GAAG;AAAA,EACtD,GAAG,EAAE;AACP;;;ACjDE,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AJgBxC,IAAM,yBAAyB;AAC/B,IAAM,cAAc;AACpB,IAAM,UAAU;AAChB,IAAM,SAAS,KAAK;AACpB,IAAM,iBAAiB;AACvB,IAAM,kBAAkB;AACxB,IAAM,WAAW,IAAI;AACrB,IAAM,UAAU,IAAI,YAAY;AAehC,IAAM,UAAU,oBAAI,IAAoB;AAGjC,SAAS,cAAoB;AAClC,aAAW,KAAK,QAAQ,OAAO,GAAG;AAAE,MAAE,KAAK,KAAK;AAAG,MAAE,MAAM,KAAK;AAAA,EAAG;AACnE,UAAQ,MAAM;AAChB;AAEA,SAAS,OAAO,MAAyB,QAA2D;AAClG,QAAM,MAAM,WAAW,MAAM,MAAM;AACnC,MAAI,CAAC,KAAK;AACR,mBAAe,IAAI,MAAM,8CAAyC,CAAC;AACnE,WAAO;AAAA,EACT;AACA,QAAM,kBAAkB,KAAK,mBAAmB;AAChD,QAAM,KAAK,GAAG,IAAI,WAAW,IAAI,IAAI,SAAS,IAAI,IAAI,WAAW,IAAI,eAAe;AACpF,QAAM,SAAS,QAAQ,IAAI,EAAE;AAC7B,MAAI,OAAQ,QAAO;AACnB,QAAM,WAAW,KAAK,YAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AACnE,QAAM,SAAiB;AAAA,IACrB;AAAA,IACA,MAAM,IAAI,eAAe;AAAA,MACvB,KAAK,IAAI;AAAA,MAAa,OAAO,IAAI;AAAA,MAAW,MAAM;AAAA,MAAQ,KAAK;AAAA,MAC/D;AAAA,MAAiB,GAAG;AAAA,IACtB,CAAC;AAAA,IACD,OAAO,IAAI,WAAW,EAAE,KAAK,IAAI,WAAW,OAAO,IAAI,aAAa,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC9F,KAAK,qBAAqB,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,EAClD;AACA,UAAQ,IAAI,IAAI,MAAM;AACtB,SAAO;AACT;AAEA,IAAM,cAAc,CAAC,QAAgBC,UAAgC;AACnE,QAAM,MAAM,OAAO;AACnB,QAAM,IAAI,IAAI,QAAQ,OAAOA,QAAO,GAAG;AACvC,MAAI,MAAM,GAAI,QAAO;AACrB,QAAM,QAAQ,IAAIA,MAAK,SAAS;AAChC,QAAM,IAAI,IAAI,QAAQ,KAAK,KAAK;AAChC,SAAO,IAAI,MAAM,OAAO,MAAM,KAAK,SAAY,CAAC;AAClD;AAGA,IAAM,OAAO,CAAC,QAA4B,IAAmC,MAAM,CAAC;AAEpF,IAAM,eAAe,CAAC,MACpB,EAAE,IAAI,gBAAgB,EAAE,KAAK,QAAQ,iBAAiB;AAMxD,IAAM,WAAW,CAAC,GAAW,QAAgC;AAC3D,QAAM,KAAM,IAAmC;AAC/C,QAAM,SAAS,KAAK,IAAI,QAAQ,IAAI,kBAAkB,IAAI;AAC1D,SAAO,UAAU,gBAAgB,MAAM,IAAI,QAAQ,IAAI,iBAAiB,GAAG,aAAa,CAAC,CAAC;AAC5F;AAUA,SAAS,gBAAgB,GAAW,KAA4B;AAC9D,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAC7C,SAAO,EAAE,KAAK,MAAM,IAAI,UAAU,IAAI,KAAK,GAAG,GAAG,IAAI,SAAS,GAAG,GAAG,GAAG,KAAK,YAAY,SAAS,cAAc,EAAE;AACnH;AAEA,SAAS,WACP,KAAc,MAAc,OAAe,IAAmB,KAC9D,MAAc,OAAO,WAAW,GAAG,aAAa,OACrC;AACX,QAAM,UAAmC,CAAC;AAC1C,MAAI,QAAQ,QAAQ,CAAC,GAAG,MAAM,QAAQ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAClD,QAAM,KAAK,KAAK,GAAG;AACnB,QAAM,KAAK;AAAA,IACT;AAAA,MACE,QAAQ,IAAI;AAAA,MAAQ,MAAM,IAAI,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,IAAI,GAAG,EAAE;AAAA,MAAM;AAAA,MAAM;AAAA,MAAO;AAAA,MAAS;AAAA;AAAA;AAAA;AAAA,MAIlG,aAAa,GAAG,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,IAC3E;AAAA,IACA,EAAE,KAAKC,WAAU,KAAK,KAAK,WAAW;AAAA,EACxC;AACA,MAAI,GAAG,IAAK,IAAG,MAAM,GAAG;AACxB,MAAI,GAAG,QAAS,IAAG,KAAK,GAAG;AAC3B,MAAI,GAAG,wBAAyB,IAAG,OAAO,GAAG;AAC7C,SAAO;AACT;AAGO,SAAS,KAAK,GAAW,IAAa,WAA4B;AACvE,IAAE,MAAM,KAAK,EAAE;AACf,IAAE,MAAM,MAAM,SAAS;AACzB;AAGA,eAAe,YAAY,KAAa,KAAc,IAAmB,WAAyC;AAChH,QAAM,YAAY,MAAM,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAW,EAAE,CAAC;AACpG,MAAI,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC,IAAI,OAAQ,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACjG,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,QAAQ,OAAO,IAAI,EAAE,aAAa,OAAQ,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACvF,MAAI;AACJ,MAAI;AAAE,aAAS,KAAK,MAAM,IAAI;AAAA,EAAG,QAAQ;AAAE,WAAO,UAAU;AAAA,EAAG;AAC/D,MAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,UAAU;AAErF,OAAK,KAAK,EAAE,GAAI,QAAoC,KAAK,GAAG,IAAI,KAAKA,UAAS,GAAG,SAAS;AAC1F,SAAO,UAAU;AACnB;AAEO,SAAS,OAAO,OAA0B,CAAC,GAAsB;AACtE,QAAM,gBAAgB,KAAK,iBAAiB;AAC5C,QAAM,aAAa,KAAK,cAAc;AACtC,QAAM,SAAS,KAAK,UAAU;AAE9B,SAAO,eAAe,WAAW,GAAY,MAAsC;AAGjF,UAAM,MAAMC,SAAQ,OAAO,EAAE,GAAI,EAAE,KAAwD,GAAG,KAAK,IAAI,IAAI,CAAC,CAAuC;AACnJ,UAAM,MAAMA,SAAQ,MAAO,IAAI,oBAAoB,MAAM,OAAO,OAAO,MAAM,GAAG,GAAI,IAAI;AACxF,QAAI,CAAC,IAAK,QAAO,KAAK;AAEtB,UAAM,cAAc,KAAK,cAAc,SAAS,IAAI,qBAAqB;AAEzE,UAAM,YAAuB,CAAC,MAAM;AAClC,UAAI;AAAE,UAAE,cAAc,UAAU,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAqD;AAAA,IACnG;AAIA,QAAI,WAA0B;AAG9B,QAAI,OAA0B;AAC9B,QAAI,aAAa;AAEjB,UAAM,SAAS,MAAMC,cAAa,YAAsC;AACtE,UAAI,KAAK,YAAY,SAAS;AAE9B,YAAM,MAAM,EAAE,IAAI;AAClB,YAAM,EAAE,KAAK,MAAM,IAAI,IAAI,IAAI,IAAI,gBAAgB,KAAK,GAAG;AAE3D,YAAM,IAAI,IAAI,KAAK,QAAQ;AAAA,QACzB;AAAA,QAAI;AAAA,QAAM,IAAI,IAAI,QAAQ,IAAI,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,QAI1C,QAAQ,CAAC,MAAM,IAAI,QAAQ,IAAI,CAAC;AAAA,QAChC,KAAK,GAAG,OAAO;AAAA,QAAM,SAAS,GAAG,WAAW;AAAA,QAAM,MAAM,GAAG,2BAA2B;AAAA,MACxF,CAAC;AACD,iBAAW,EAAE,OAAO,EAAE,QAAQ,OAAO;AAErC,UAAI,EAAE,OAAO;AACX,cAAM,KAAK,WAAW,KAAK,MAAM,IAAI,QAAQ,IAAI,GAAG;AACpD,WAAG,KAAK;AACR,WAAG,MAAM,EAAE;AACX,YAAI,EAAE,KAAM,IAAG,KAAK,EAAE;AACtB,aAAK,KAAK,IAAI,SAAS;AACvB,cAAM,UAAkC;AAAA,UACtC,gBAAgB;AAAA,UAAc,kBAAkB,OAAO,EAAE,UAAU,EAAE;AAAA,UAAG,mBAAmB,EAAE,WAAW;AAAA,QAC1G;AACA,YAAI,EAAE,KAAM,SAAQ,cAAc,IAAI,EAAE;AACxC,eAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,MAC3D;AAIA,UAAI,eAAe,IAAI;AAErB,YAAI,IAAI,WAAW,UAAU,SAAS,cAAe,QAAO,OAAO,KAAK,KAAK,IAAI,KAAK,eAAe,SAAS;AAC9G,cAAM,QAAQ,YAAY,IAAI,QAAQ,IAAI,QAAQ,KAAK,IAAI,gBAAgB;AAC3E,YAAI,EAAE,aAAa,CAAE,MAAM,IAAI,IAAI,WAAW,IAAI,KAAK,IAAI,GAAG,KAAK,GAAI;AACrE,iBAAO,MAAM,KAAK,KAAK,IAAI,KAAK,eAAe,OAAO,IAAI,QAAQ,SAAS;AAAA,QAC7E;AAAA,MACF;AAIA,UAAI,cAAc,GAAG,GAAG;AACtB,YAAI,IAAI,WAAW,SAAS,SAAS,YAAY;AAC/C,iBAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,0BAA0B,iBAAiB,uBAAuB,EAAE,CAAC;AAAA,QAC3I;AACA,YAAI,IAAI,WAAW,UAAU,SAAS,OAAQ,QAAO,YAAY,KAAK,KAAK,IAAI,SAAS;AAAA,MAC1F;AAKA,mBAAa,CAAC;AACd,aAAO,EAAE,KAAK,KAAK,OAAO,WAAW,GAAG,KAAK,OAAO,OAAO,WAAW,GAAG,IAAI,WAAW,WAAW;AACnG,QAAE,IAAI,KAAK,IAAI;AACf,aAAO;AAAA,IACT,GAAG,IAAI;AAEP,QAAI,OAAQ,QAAO;AAEnB,UAAM,KAAK;AAIX,IAAAD,SAAQ,MAAM;AACZ,UAAI,CAAC,QAAQ,CAAC,WAAY;AAC1B,YAAM,SAAS,IAAI,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,aAAa,WAAW,aAAa;AAC3E,QAAE,IAAI,QAAQ,OAAO,cAAc,GAAG,cAAc,IAAI,KAAK,GAAG,qBAAqB,eAAe,2BAA2B,MAAM,EAAE;AAAA,IACzI,GAAG,MAAS;AAIZ,SAAKC,cAAa,YAAY;AAC5B,YAAM,MAAM,EAAE,IAAI;AAClB,YAAM,EAAE,KAAK,MAAM,GAAG,IAAI,gBAAgB,KAAK,GAAG;AAClD,YAAM,MAAM,IAAI,KAAK;AACrB,WAAK,KAAK,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,EAAG;AAC1D,UAAI,KAAK,OAAO,MAAM,KAAK,UAAU,GAAI;AAEzC,YAAM,KAAK,WAAW,KAAK,MAAM,IAAI,QAAQ,IAAI,MAAM,OAAO,MAAM,MAAM,KAAK,UAAU;AACzF,SAAG,KAAK,EAAE,IAAI;AACd,UAAI,SAAU,IAAG,MAAM;AACvB,WAAK,KAAK,IAAI,SAAS;AAAA,IACzB,GAAG,MAAS;AAAA,EACd;AACF;AAGA,eAAe,MAAM,KAAa,KAAc,IAAY,KAAoB,QAAgB,QAAgB,WAAyC;AACvJ,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,KAAK,WAAW,KAAK,IAAI,UAAU,IAAI,QAAQ,IAAI,GAAG;AAC5D,KAAG,KAAK;AACR,KAAG,MAAM;AACT,OAAK,KAAK,IAAI,SAAS;AAEvB,MAAI,CAAC,UAAU,IAAI,QAAQ,IAAI,QAAQ,GAAG,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC5E,WAAO,IAAI,SAAS,kCAAkC;AAAA,MACpD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oBAAoB,iBAAiB,YAAY,sBAAsB,IAAI;AAAA,IACxG,CAAC;AAAA,EACH;AACA,QAAM,OAAO,cAAc,EAAE,OAAO,MAAM,IAAI,IAAI,MAAM,IAAI,KAAK,IAAI,CAAC,GAAG,QAAQ,IAAI,aAAa,MAAM,EAAE,CAAC;AAC3G,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,4BAA4B,iBAAiB,YAAY,sBAAsB,IAAI;AAAA,EAChH,CAAC;AACH;AAGA,eAAe,OAAO,KAAa,KAAc,IAAY,KAAoB,QAAgB,WAAyC;AACxI,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAG3B,MAAI,OAAO,IAAI,QAAQ,IAAI,gBAAgB,CAAC,IAAI,SAAU,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACnG,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,KAAK,SAAS,SAAU,QAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AACrE,QAAM,OAAO,cAAc,IAAI;AAC/B,QAAM,KAAK,aAAa,KAAK,EAAE;AAC/B,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,CAAE,MAAM,IAAI,IAAI,OAAO,IAAI,KAAK,KAAK,OAAO,KAAK,QAAQ,GAAI;AAC/D,UAAM,OAAO,cAAc,EAAE,OAAO,MAAM,IAAI,IAAI,MAAM,IAAI,GAAG,GAAG,QAAQ,GAAG,CAAC;AAC9E,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,4BAA4B,iBAAiB,WAAW,EAAE,CAAC;AAAA,EACjI;AACA,QAAM,KAAK,WAAW,KAAK,IAAI,UAAU,IAAI,IAAI,GAAG;AACpD,KAAG,KAAK;AACR,KAAG,KAAK;AACR,OAAK,KAAK,IAAI,SAAS;AACvB,SAAO,IAAI,SAAS,MAAM;AAAA,IACxB,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,UAAU;AAAA,MACV,cAAc,gBAAgB,MAAM,IAAI,IAAI,MAAM,IAAI,GAAG,GAAG,IAAI,aAAa,QAAQ;AAAA,MACrF,iBAAiB;AAAA,IACnB;AAAA,EACF,CAAC;AACH;","names":["guardedAsync","guarded","TAP_HONO","name","TAP_HONO","guarded","guardedAsync"]}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@camada/hono",
+  "version": "0.3.0",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "description": "camada SDK for Hono on Cloudflare Workers: snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@camada/core": "^0.3.0",
+    "@camada/browser": "^0.2.0"
+  },
+  "peerDependencies": {
+    "hono": ">=4"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/camada-app/camada-hono.git"
+  },
+  "homepage": "https://github.com/camada-app/camada-hono#readme",
+  "bugs": {
+    "url": "https://github.com/camada-app/camada-hono/issues"
+  }
+}