@camada/node 0.3.2 → 0.4.0

package/README.md

@@ -89,7 +89,7 @@ carries one of four actions:
 |---|---|---|
 | `skip` | passes the request | nothing |
 | `block` | `403` before your app | `blk: "rule"`, `rl: "<rule id>"` |
-| `challenge` | serves the proof-of-work page (`challenge: false` opts out) | `blk: "challenge"` |
+| `challenge` | serves the proof-of-work page to page loads (`challenge: false` opts out). A non-HTML request (fetch/XHR/API) is not challenged: it reaches your app with `x-camada-challenge: 1` on the response | page: `blk: "challenge"`; non-HTML: its normal event plus `chs: 1` (never sampled out or excluded) |
 | `warn` | passes the request and marks it for the analyst | `wrn: "<rule id>"` |
 
 A skip rule also carries a *record matches* flag, which only the analyst reads: a recorded skip
@@ -140,6 +140,40 @@ fire on your app's own truth instead of path heuristics:
 | `payment_failed` / `payment_succeeded` | a payment authorisation settled |
 | `coupon_failed` | a promo/voucher code was rejected |
 
+## TLS fingerprint behind Cloudflare
+
+Node has no TLS handshake to read, but Cloudflare does. Set `CAMADA_TLSX_HEADER=x-camada-tlsx`
+(or `createCamada({ tlsxHeader: 'x-camada-tlsx' })`) and add a Transform Rule that sets it:
+*Rules > Transform Rules > Modify Request Header*, "Set dynamic", header `x-camada-tlsx`, value
+`cf.tls_client_extensions_sha1`, on every request. The rule is required and must **set**
+(overwrite) the header: without it a client-sent `x-camada-tlsx` passes through Cloudflare
+untouched. The value feeds the same matcher as `@camada/hono`'s `request.cf.tlsClientExtensionsSha1`:
+the snapshot's `tls` entries block with `x-block-reason: tls`, and `tlsx is` / `is_in` rule
+conditions apply.
+
+This needs Cloudflare to connect to the app directly. The header is believed only in `cidrs` mode,
+when the socket peer is a non-loopback address inside Cloudflare's ranges, because anyone else can
+write it:
+
+```
+CAMADA_TRUSTED_PROXY=cidrs:173.245.48.0/20,103.21.244.0/22,…   # Cloudflare's published ranges
+CAMADA_TLSX_HEADER=x-camada-tlsx
+```
+
+Every range in `CAMADA_TRUSTED_PROXY=cidrs:…` is trusted to write the header, the same trust it gets
+for `X-Forwarded-For`, so list only Cloudflare's ranges there. A non-Cloudflare proxy range (a docker
+bridge, an internal load balancer) would let anyone who reaches that proxy set the fingerprint.
+
+Behind a local reverse proxy (nginx or Caddy on loopback) or a cloudflared tunnel the peer is
+loopback, so the header is not read and `tlsx` conditions fail open; `X-Forwarded-For` is never
+consulted. The same holds in `none`, `hops` or `vercel` mode, from any other peer, with no readable
+peer (unix listeners included), or with a malformed value (over 128 characters, outside
+`[A-Za-z0-9+/=_-]`, or a repeated header). The Transform Rule must overwrite the header on every
+request: on a request it skips, a client-sent value passes through. The same trusted value is sent
+to camada as `tlsx` on request events (pass, block, challenge and upgrade rows); node never adds it
+to `track()` rows or the beacon relay, and a value that failed the checks above is never sent. The
+analyst uses it to group traffic by TLS fingerprint and to recommend or block rare fingerprints.
+
 ## WebSockets
 
 Node hands an upgrade request (a WebSocket handshake) to the server's `'upgrade'` listeners,
@@ -174,8 +208,10 @@ handshake your library then rejects still ships `st: 101`.
 - The challenge page sends its own `Content-Security-Policy` allowing only its inline script and
   style by `sha256` hash, and drops any `Content-Security-Policy(-Report-Only)` set before it.
 - Enforcement scope at this position: IP, path, user-agent and request-header conditions. ASN,
-  country and TLS-fingerprint conditions can't be evaluated in-app and fail open (a rule that
-  needs one never matches here; run `@camada/hono` on Cloudflare Workers for those).
+  country conditions can't be evaluated in-app and fail open (a rule that needs one never
+  matches here; run `@camada/hono` on Cloudflare Workers for those). TLS-fingerprint conditions
+  match only with the opt-in `CAMADA_TLSX_HEADER` (see "TLS fingerprint behind Cloudflare");
+  without it they fail open too.
 - `await camada.stop()` in your own graceful shutdown stops polling and the event queue. It
   returns a promise that settles once queued rows (a drain in flight, or rows held by an ingest
   429) are sent, or counted as dropped if the send fails; it never rejects.

package/dist/{camada-CFmJTruP.d.cts → camada-DuHQ4sLn.d.cts}

@@ -9,6 +9,7 @@ interface ResolvedEnv {
     snapshotUrl: string;
     serverless: boolean;
     trustedProxy: TrustedProxyConfig | null;
+    tlsxHeader: string | null;
 }
 /** Returns null (SDK stays disabled, one log line) rather than throwing on bad config. */
 declare function resolveEnv(env?: Record<string, string | undefined>): ResolvedEnv | null;
@@ -20,6 +21,7 @@ interface CamadaOptions {
     scriptPath?: string;
     fpPath?: string;
     challenge?: boolean;
+    tlsxHeader?: string;
     challengePath?: string;
     snapshotVersion?: SnapshotVersion;
     /** With CAMADA_SERVERLESS=1: handed every per-request event flush and snapshot refresh, so the
@@ -39,6 +41,7 @@ declare class Camada {
     private readonly scriptPathSet;
     private readonly kit;
     private readonly envSource;
+    private readonly tlsxHeader;
     private readonly waitUntil?;
     constructor(opts?: CamadaOptions);
     get disabled(): boolean;
@@ -50,6 +53,14 @@ declare class Camada {
      *  unidentifiable: the walk would believe whatever the client wrote. So: null, the stance every
      *  ip-bound feature already takes (no ip rules, no challenge). */
     private clientIp;
+    /** The TLS fingerprint Cloudflare (a Transform Rule) put in the opt-in header, or null. Trusted only
+     *  in `cidrs` mode and only when the socket peer itself is a NON-loopback address core's cidrs walk
+     *  trusts, i.e. Cloudflare connects to the app directly. A loopback peer (a local reverse proxy or
+     *  cloudflared) is never trusted and X-Forwarded-For is never consulted, so the header is not read
+     *  and tlsx conditions fail open. Trust is core's isTrustedPeer, the same first-hop test the cidrs
+     *  walk uses. No readable peer (unix listener included) -> null, since core's no-peer walk would
+     *  trust everyone. */
+    private tlsxOf;
     /** Where the challenge form posts: under the mount prefix, so it reaches camada, unless the
      *  path was configured explicitly. */
     private challengeAction;
@@ -62,6 +73,11 @@ declare class Camada {
     /** True when camada fully handled the request. Synchronous; never throws. */
     handle(req: IncomingMessage, res: ServerResponse): boolean;
     private handleInner;
+    /** Mints the request's rid and session (setting the cookie on a first visit), records them on
+     *  `req.camada` and sets `x-rid`. handle() and serveChallenge() (when handle() did not run) share it. */
+    private begin;
+    /** Installs the response-finish hook that ships the request's normal capture event. */
+    private hookCapture;
     private buildEvent;
     /** Reads the beacon POST (≤32 KB), answers 204 immediately, and queues the beacon as a `sig: 1`
      *  row with the trusted-proxy-resolved client IP: it rides the next event batch, so the analyst
@@ -70,7 +86,7 @@ declare class Camada {
      *  stream: its `req.body` is used instead, and the request is answered either way. */
     private relayBeacon;
     private challengePassed;
-    /** 403 + the proof-of-work page (HTML navigations) or 403 JSON (everything else), plus the
+    /** 403 + the proof-of-work page (HTML navigations only), plus the
      *  `blk: "challenge"` event — a served challenge is reported like a block (contract §D2). */
     private serveChallengeInner;
     /** The request's existing session, so challenge rows join the session that produced them. */
@@ -91,7 +107,8 @@ declare class Camada {
     private shipUpgrade;
     /** Serve the challenge for this request on demand — for a route the app wants to gate itself
      *  (the example's /challenge-me). Returns false when the client already holds a valid `_cch`,
-     *  so the caller renders its own page. */
+     *  so the caller renders its own page. A non-HTML request is never challenged: it gets the
+     *  `x-camada-challenge: 1` header and a `chs: 1` event, and false, so the app answers. */
     serveChallenge(req: IncomingMessage, res: ServerResponse): boolean;
     /** For HTML templates: the first-party beacon tag with the request's rid. */
     scriptTag(req: IncomingMessage): string;

package/dist/{camada-CFmJTruP.d.ts → camada-DuHQ4sLn.d.ts}

@@ -9,6 +9,7 @@ interface ResolvedEnv {
     snapshotUrl: string;
     serverless: boolean;
     trustedProxy: TrustedProxyConfig | null;
+    tlsxHeader: string | null;
 }
 /** Returns null (SDK stays disabled, one log line) rather than throwing on bad config. */
 declare function resolveEnv(env?: Record<string, string | undefined>): ResolvedEnv | null;
@@ -20,6 +21,7 @@ interface CamadaOptions {
     scriptPath?: string;
     fpPath?: string;
     challenge?: boolean;
+    tlsxHeader?: string;
     challengePath?: string;
     snapshotVersion?: SnapshotVersion;
     /** With CAMADA_SERVERLESS=1: handed every per-request event flush and snapshot refresh, so the
@@ -39,6 +41,7 @@ declare class Camada {
     private readonly scriptPathSet;
     private readonly kit;
     private readonly envSource;
+    private readonly tlsxHeader;
     private readonly waitUntil?;
     constructor(opts?: CamadaOptions);
     get disabled(): boolean;
@@ -50,6 +53,14 @@ declare class Camada {
      *  unidentifiable: the walk would believe whatever the client wrote. So: null, the stance every
      *  ip-bound feature already takes (no ip rules, no challenge). */
     private clientIp;
+    /** The TLS fingerprint Cloudflare (a Transform Rule) put in the opt-in header, or null. Trusted only
+     *  in `cidrs` mode and only when the socket peer itself is a NON-loopback address core's cidrs walk
+     *  trusts, i.e. Cloudflare connects to the app directly. A loopback peer (a local reverse proxy or
+     *  cloudflared) is never trusted and X-Forwarded-For is never consulted, so the header is not read
+     *  and tlsx conditions fail open. Trust is core's isTrustedPeer, the same first-hop test the cidrs
+     *  walk uses. No readable peer (unix listener included) -> null, since core's no-peer walk would
+     *  trust everyone. */
+    private tlsxOf;
     /** Where the challenge form posts: under the mount prefix, so it reaches camada, unless the
      *  path was configured explicitly. */
     private challengeAction;
@@ -62,6 +73,11 @@ declare class Camada {
     /** True when camada fully handled the request. Synchronous; never throws. */
     handle(req: IncomingMessage, res: ServerResponse): boolean;
     private handleInner;
+    /** Mints the request's rid and session (setting the cookie on a first visit), records them on
+     *  `req.camada` and sets `x-rid`. handle() and serveChallenge() (when handle() did not run) share it. */
+    private begin;
+    /** Installs the response-finish hook that ships the request's normal capture event. */
+    private hookCapture;
     private buildEvent;
     /** Reads the beacon POST (≤32 KB), answers 204 immediately, and queues the beacon as a `sig: 1`
      *  row with the trusted-proxy-resolved client IP: it rides the next event batch, so the analyst
@@ -70,7 +86,7 @@ declare class Camada {
      *  stream: its `req.body` is used instead, and the request is answered either way. */
     private relayBeacon;
     private challengePassed;
-    /** 403 + the proof-of-work page (HTML navigations) or 403 JSON (everything else), plus the
+    /** 403 + the proof-of-work page (HTML navigations only), plus the
      *  `blk: "challenge"` event — a served challenge is reported like a block (contract §D2). */
     private serveChallengeInner;
     /** The request's existing session, so challenge rows join the session that produced them. */
@@ -91,7 +107,8 @@ declare class Camada {
     private shipUpgrade;
     /** Serve the challenge for this request on demand — for a route the app wants to gate itself
      *  (the example's /challenge-me). Returns false when the client already holds a valid `_cch`,
-     *  so the caller renders its own page. */
+     *  so the caller renders its own page. A non-HTML request is never challenged: it gets the
+     *  `x-camada-challenge: 1` header and a `chs: 1` event, and false, so the app answers. */
     serveChallenge(req: IncomingMessage, res: ServerResponse): boolean;
     /** For HTML templates: the first-party beacon tag with the request's rid. */
     scriptTag(req: IncomingMessage): string;

package/dist/{chunk-V3UWO5OT.js → chunk-44FSZJ5F.js}

@@ -16,6 +16,7 @@ import {
   EventQueue,
   buildWireEvent,
   resolveClientIp,
+  isTrustedPeer,
   hashUserId,
   guarded,
   logRateLimited,
@@ -23,12 +24,18 @@ import {
   safeReturnTo,
   wantsHtml,
   CHALLENGE_COOKIE,
-  TAP_NODE
+  TAP_NODE,
+  REQUEST_ROW_KEYS
 } from "@camada/core";
+import { isIP } from "net";
 import iife from "@camada/browser/iife-string";
 
 // src/env.ts
 import { parseKey, parseTrustedProxyEnv } from "@camada/core";
+function parseTlsxHeader(raw) {
+  const n = (raw ?? "").trim().toLowerCase();
+  return /^[a-z0-9!#$%&'*+.^_`|~-]+$/.test(n) ? n : null;
+}
 function resolveEnv(env = process.env) {
   const key = parseKey(env.CAMADA_KEY);
   const ingestToken = key?.ingestToken ?? env.CAMADA_TOKEN;
@@ -42,7 +49,8 @@ function resolveEnv(env = process.env) {
     secret: env.CAMADA_KEY || `${ingestToken}.${snapToken}`,
     snapshotUrl: env.CAMADA_SNAPSHOT_URL || `${ingestUrl}/snapshot`,
     serverless: env.CAMADA_SERVERLESS === "1",
-    trustedProxy: parseTrustedProxyEnv(env.CAMADA_TRUSTED_PROXY)
+    trustedProxy: parseTrustedProxyEnv(env.CAMADA_TRUSTED_PROXY),
+    tlsxHeader: parseTlsxHeader(env.CAMADA_TLSX_HEADER)
   };
 }
 
@@ -110,13 +118,9 @@ function writeChallengePage(res, o) {
   });
   res.end(challengePage(o));
 }
-function writeChallengeJson(res) {
-  res.writeHead(403, { "content-type": "application/json", "cache-control": "no-store", "x-camada-challenge": "1" });
-  res.end('{"error":"challenge_required"}');
-}
 
 // package.json
-var version = "0.3.2";
+var version = "0.4.0";
 var name = "@camada/node";
 
 // src/version.ts
@@ -127,6 +131,12 @@ var SESSION_COOKIE = "_sfp";
 var SCRIPT_PATH = "/_cam/b.js";
 var FP_PATH = "/_cam/fp";
 var FP_MAX = 32 * 1024;
+function isLoopbackPeer(peer) {
+  const k = isIP(peer);
+  if (k === 4) return peer.startsWith("127.");
+  return k !== 6 || peer === "::1" || /^::ffff:127\./i.test(peer);
+}
+var TLSX_RE = /^[A-Za-z0-9+/=_-]+$/;
 var ATTACHED = /* @__PURE__ */ Symbol.for("camada.attached");
 var headerReader = (req) => (name2) => {
   const v = req.headers[name2];
@@ -136,6 +146,7 @@ var splitUrl = (raw) => {
   const qi = raw.indexOf("?");
   return qi === -1 ? { path: raw, query: "" } : { path: raw.slice(0, qi), query: raw.slice(qi) };
 };
+var isPage = (req) => wantsHtml(req.headers.accept ?? null, req.headers["sec-fetch-dest"] ?? null);
 function pathAndQuery(req) {
   return splitUrl(req.originalUrl || req.url || "/");
 }
@@ -173,6 +184,27 @@ function keepSessionCookie(res, cookie) {
   };
   res.setHeader("set-cookie", cookie);
 }
+var NO_STORE_HEADERS = ["cache-control", "cdn-cache-control", "surrogate-control", "cloudflare-cdn-cache-control", "vercel-cdn-cache-control", "netlify-cdn-cache-control"];
+function signal(res) {
+  const set = res.setHeader, writeHead = res.writeHead;
+  const isNoStore = (n) => typeof n === "string" && NO_STORE_HEADERS.includes(n.toLowerCase());
+  const strip = (h) => {
+    if (Array.isArray(h)) {
+      if (h.length && Array.isArray(h[0])) return h.filter((p) => !isNoStore(p[0]));
+      const out = [];
+      for (let i = 0; i < h.length; i += 2) if (!isNoStore(h[i])) out.push(h[i], h[i + 1]);
+      return out;
+    }
+    if (h && typeof h === "object") return Object.fromEntries(Object.entries(h).filter(([k]) => !isNoStore(k)));
+    return h;
+  };
+  res.writeHead = function(status, ...rest) {
+    if (!this.headersSent) for (const h of NO_STORE_HEADERS) set.call(this, h, "no-store");
+    return writeHead.call(this, status, ...rest.map(strip));
+  };
+  res.setHeader("x-camada-challenge", "1");
+  for (const h of NO_STORE_HEADERS) res.setHeader(h, "no-store");
+}
 var Camada = class {
   env;
   snap = null;
@@ -187,6 +219,7 @@ var Camada = class {
   scriptPathSet;
   kit = null;
   envSource;
+  tlsxHeader;
   waitUntil;
   constructor(opts = {}) {
     this.envSource = opts.env ?? process.env;
@@ -199,6 +232,7 @@ var Camada = class {
     this.challengePathSet = opts.challengePath != null;
     this.scriptPathSet = opts.scriptPath != null;
     this.env = resolveEnv(this.envSource);
+    this.tlsxHeader = parseTlsxHeader(opts.tlsxHeader) ?? this.env?.tlsxHeader ?? null;
     if (!this.env) return;
     if (this.envSource.CAMADA_DISABLED === "1") return;
     this.snap = new SnapshotClient({
@@ -232,6 +266,24 @@ var Camada = class {
     if (!peer && req.socket && !onUnixListener(req.socket)) return null;
     return resolveClientIp(peer ?? null, req.headers["x-forwarded-for"], this.trustedProxy());
   }
+  /** The TLS fingerprint Cloudflare (a Transform Rule) put in the opt-in header, or null. Trusted only
+   *  in `cidrs` mode and only when the socket peer itself is a NON-loopback address core's cidrs walk
+   *  trusts, i.e. Cloudflare connects to the app directly. A loopback peer (a local reverse proxy or
+   *  cloudflared) is never trusted and X-Forwarded-For is never consulted, so the header is not read
+   *  and tlsx conditions fail open. Trust is core's isTrustedPeer, the same first-hop test the cidrs
+   *  walk uses. No readable peer (unix listener included) -> null, since core's no-peer walk would
+   *  trust everyone. */
+  tlsxOf(req) {
+    const header = this.tlsxHeader;
+    if (!header) return null;
+    const v = headerReader(req)(header);
+    if (v == null || v.length > 128 || !TLSX_RE.test(v)) return null;
+    const cfg = this.trustedProxy();
+    const peer = req.socket?.remoteAddress;
+    if (cfg?.mode !== "cidrs" || !peer) return null;
+    if (isLoopbackPeer(peer)) return null;
+    return isTrustedPeer(peer, cfg) ? v : null;
+  }
   /** Where the challenge form posts: under the mount prefix, so it reaches camada, unless the
    *  path was configured explicitly. */
   challengeAction(req) {
@@ -269,7 +321,7 @@ var Camada = class {
     const { path, query } = pathAndQuery(req);
     const ip = this.clientIp(req);
     req.camadaPrefix = mountPrefix(req);
-    const v = this.snap.verdict({ ip, path, ua: req.headers["user-agent"], header: headerReader(req) });
+    const v = this.snap.verdict({ ip, path, ua: req.headers["user-agent"], header: headerReader(req), tlsx: this.tlsxOf(req) });
     if (v.block) {
       const headers = { "x-block-reason": v.reason ?? "", "x-block-version": v.version ?? "", "content-type": "text/plain", "cache-control": "no-store" };
       if (v.rule) headers["x-block-rule"] = v.rule;
@@ -288,8 +340,11 @@ var Camada = class {
         return true;
       }
       if (v.challenge && !this.challengePassed(req, ip)) {
-        this.serveChallengeInner(req, res, ip, path + query);
-        return true;
+        if (isPage(req)) {
+          this.serveChallengeInner(req, res, ip, path + query);
+          return true;
+        }
+        req.camadaSignalled = true;
       }
     }
     if (this.beaconEnabled()) {
@@ -303,50 +358,64 @@ var Camada = class {
         return true;
       }
     }
+    const { rid, sid, ns: newSession } = this.begin(req, res, ip, t0, v.warn ? v.rule : void 0);
+    if (req.camadaSignalled) signal(res);
+    const cfg = this.snap.config;
+    const excluded = (cfg?.exclude || []).some((x) => path.startsWith(x));
+    if (req.camadaSignalled || !excluded && Math.random() < (cfg?.sample ?? 1)) {
+      this.hookCapture(req, res, path, query, ip, { rid, sid, newSession, t0 });
+    }
+    return false;
+  }
+  /** Mints the request's rid and session (setting the cookie on a first visit), records them on
+   *  `req.camada` and sets `x-rid`. handle() and serveChallenge() (when handle() did not run) share it. */
+  begin(req, res, ip, t0, wrn) {
     const rid = randomUUID();
     let sid = cookieValue(req.headers.cookie || "", SESSION_COOKIE);
-    const newSession = !sid;
+    const ns = !sid;
     if (!sid) {
       sid = randomUUID();
       const https = req.socket.encrypted || req.headers["x-forwarded-proto"] === "https";
       keepSessionCookie(res, `${SESSION_COOKIE}=${sid}; Path=/; Max-Age=2592000; HttpOnly; SameSite=Lax${https ? "; Secure" : ""}`);
     }
-    req.camada = { rid, ip, sid };
     res.setHeader("x-rid", rid);
-    const cfg = this.snap.config;
-    const excluded = (cfg?.exclude || []).some((x) => path.startsWith(x));
-    if (!excluded && Math.random() < (cfg?.sample ?? 1)) {
-      let shipped = false;
-      req.camadaOpen = true;
-      const ship = () => guarded(() => {
-        req.camadaOpen = false;
-        if (shipped) return;
-        shipped = true;
-        if (req.camadaChallenged) {
-          if (this.env?.serverless) this.flushFor(req);
-          return;
-        }
-        const ev = this.buildEvent(req, path, query, ip, { rid, sid, newSession });
-        ev.ts = t0;
-        ev.st = res.statusCode;
-        ev.dur = Date.now() - t0;
-        if (req.route?.path) ev.rt = String(req.route.path);
-        if (v.warn && v.rule) ev.wrn = v.rule;
-        this.enqueue(ev, req);
-      }, void 0);
-      res.once("finish", ship);
-      res.once("close", ship);
-    }
-    return false;
+    return req.camada = { rid, ip, sid, ns, t0, wrn };
+  }
+  /** Installs the response-finish hook that ships the request's normal capture event. */
+  hookCapture(req, res, path, query, ip, o) {
+    let shipped = false;
+    req.camadaOpen = true;
+    const ship = () => guarded(() => {
+      req.camadaOpen = false;
+      if (shipped) return;
+      shipped = true;
+      if (req.camadaChallenged) {
+        if (this.env?.serverless) this.flushFor(req);
+        return;
+      }
+      const ev = this.buildEvent(req, path, query, ip, o);
+      ev.ts = o.t0;
+      ev.st = res.statusCode;
+      ev.dur = Date.now() - o.t0;
+      if (req.route?.path) ev.rt = String(req.route.path);
+      if (req.camada?.wrn) ev.wrn = req.camada.wrn;
+      if (req.camadaSignalled) ev.chs = 1;
+      this.enqueue(ev, req);
+    }, void 0);
+    res.once("finish", ship);
+    res.once("close", ship);
   }
   buildEvent(req, path, query, ip, o) {
     const raw = req.rawHeaders || [];
     const headers = [];
     for (let i = 0; i + 1 < raw.length; i += 2) headers.push([raw[i], raw[i + 1]]);
-    return buildWireEvent(
+    const ev = buildWireEvent(
       { method: req.method || "GET", host: req.headers.host || "", path, query, headers, ip, httpVersion: req.httpVersion },
       { tap: TAP_NODE, rid: o.rid, sid: o.sid, newSession: o.newSession }
     );
+    const tlsx = this.tlsxOf(req);
+    if (tlsx) ev.tlsx = tlsx;
+    return ev;
   }
   /** Reads the beacon POST (≤32 KB), answers 204 immediately, and queues the beacon as a `sig: 1`
    *  row with the trusted-proxy-resolved client IP: it rides the next event batch, so the analyst
@@ -358,7 +427,9 @@ var Camada = class {
       res.writeHead(204, { "cache-control": "no-store" });
       res.end();
       if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) || Buffer.isBuffer(parsed)) return;
-      this.enqueue({ ...parsed, sig: 1, ip, tap: TAP_NODE });
+      const row = { ...parsed, sig: 1, ip, tap: TAP_NODE, rts: Date.now() };
+      for (const k of REQUEST_ROW_KEYS) delete row[k];
+      this.enqueue(row);
     };
     const fromText = (text) => {
       try {
@@ -402,15 +473,11 @@ var Camada = class {
   challengePassed(req, ip) {
     return !!this.kit?.tokenValid(ip, Date.now(), cookieValue(req.headers.cookie || "", CHALLENGE_COOKIE));
   }
-  /** 403 + the proof-of-work page (HTML navigations) or 403 JSON (everything else), plus the
+  /** 403 + the proof-of-work page (HTML navigations only), plus the
    *  `blk: "challenge"` event — a served challenge is reported like a block (contract §D2). */
   serveChallengeInner(req, res, ip, target) {
     const to = safeReturnTo(target);
-    if (wantsHtml(req.headers.accept ?? null, req.headers["sec-fetch-dest"] ?? null)) {
-      writeChallengePage(res, { nonce: this.kit.nonce(ip, Date.now()), action: this.challengeAction(req), to });
-    } else {
-      writeChallengeJson(res);
-    }
+    writeChallengePage(res, { nonce: this.kit.nonce(ip, Date.now()), action: this.challengeAction(req), to });
     guarded(() => {
       const qi = target.indexOf("?");
       const ev = this.buildEvent(
@@ -492,14 +559,25 @@ var Camada = class {
   }
   /** Serve the challenge for this request on demand — for a route the app wants to gate itself
    *  (the example's /challenge-me). Returns false when the client already holds a valid `_cch`,
-   *  so the caller renders its own page. */
+   *  so the caller renders its own page. A non-HTML request is never challenged: it gets the
+   *  `x-camada-challenge: 1` header and a `chs: 1` event, and false, so the app answers. */
   serveChallenge(req, res) {
     return guarded(() => {
       if (this.disabled || !this.kit || !this.queue) return false;
       const ip = this.clientIp(req);
       if (!ip || this.challengePassed(req, ip)) return false;
-      req.camadaChallenged = true;
-      const { path, query } = pathAndQuery(req);
+      const r = req;
+      const { path, query } = pathAndQuery(r);
+      if (!isPage(r)) {
+        if (!r.camadaSignalled) signal(res);
+        r.camadaSignalled = true;
+        if (r.camadaOpen === void 0) {
+          const c = r.camada ?? this.begin(r, res, ip, Date.now());
+          this.hookCapture(r, res, path, query, ip, { rid: c.rid, sid: c.sid, newSession: c.ns, t0: c.t0 });
+        }
+        return false;
+      }
+      r.camadaChallenged = true;
       this.serveChallengeInner(req, res, ip, path + query);
       return true;
     }, false);
@@ -577,4 +655,4 @@ export {
   configure,
   index_default
 };
-//# sourceMappingURL=chunk-V3UWO5OT.js.map
+//# sourceMappingURL=chunk-44FSZJ5F.js.map