@camada/nuxt 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 camada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,158 @@
+# @camada/nuxt
+
+camada for [Nuxt](https://nuxt.com) as h3 server middleware: enforces the tenant snapshot inline
+(your ordered custom rules, then block, allow, challenge), serves a first-party proof-of-work
+challenge page and beacon, records the outcomes your server routes know (`track()`), and ships
+one wire event per request with the status your app really answered. Fails open by design — a
+camada outage or bug never 5xxes your app.
+
+Not yet on npm — consumed via a `file:` dependency from a sibling checkout.
+
+## Quickstart
+
+Two files under `server/`:
+
+```ts
+// server/middleware/camada.ts
+import { camada } from '@camada/nuxt';
+export default camada();   // reads CAMADA_KEY / CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL from process.env
+```
+
+```ts
+// server/plugins/camada.ts
+import { camadaNitroPlugin } from '@camada/nuxt';
+export default camadaNitroPlugin();   // puts the beacon tag in every rendered <head>
+```
+
+Env (printed by camada onboarding / `npm run seed` in dev):
+
+```
+CAMADA_KEY=<ingest_token>.<snap_token>
+CAMADA_INGEST_URL=http://localhost:8787        # dev only; defaults to production ingest
+```
+
+An app that reads its own config can pass the values instead:
+
+```ts
+export default camada({ key: MY_KEY, ingestUrl: MY_INGEST });
+```
+
+The middleware is built once per `camada()` call and keeps one engine per resolved
+configuration. Without `CAMADA_KEY` it is inert (one log line, no requests, no enforcement),
+so an unprovisioned environment behaves exactly as if camada were not installed.
+
+## What it does per request
+
+1. Refreshes the snapshot off-path (lazy mode by default: no interval timers, so the same
+   build runs on a Node server and on an edge preset). Every poll and event batch carries
+   `x-camada-sdk: @camada/nuxt/<version>`, and polls ask for snapshot v5 — the container that
+   carries your ordered custom rules.
+2. Resolves the client from the peer h3 vouches for — `getRequestIP(event)`: the socket
+   address, or the `clientAddress` a Nitro preset stamped on the context — combined with
+   `X-Forwarded-For` only under your tenant's trusted-proxy config. A bare header
+   (`x-forwarded-for`, `cf-connecting-ip`, `x-real-ip`) never becomes the client on its own.
+3. Runs your ordered custom rules, then the allow, block and challenge lists.
+4. **Block** → `403` with `x-block-reason` before your route; the event still ships, with
+   `st: 403` and `blk: <reason>` so the analyst counts SDK blocks apart from your own 403s.
+5. **Challenge** → a `403` proof-of-work page for HTML navigations, `403 {"error":
+   "challenge_required"}` for anything else; the solution posts to `/__camada/challenge`,
+   which sets `_cch` and 302s back.
+6. Otherwise the request falls through to your routes and pages. The event ships on the
+   response's `finish` with the real `statusCode` — a Node response, or the mock a web preset
+   provides; `st` is null only for an event without a response object at all. Your own
+   `readBody()` still sees the request body (the middleware hands h3 the stream it built), and
+   Nitro's internal `event.$fetch` / `useFetch` during SSR is left to the outer request (found on the
+   inner request's `__unenv__` context; a bare `$fetch` with no event is a request of its own): one page view
+   is one event.
+
+A first visit is given the shared `_sfp` session cookie through h3's `setCookie` before your
+handler runs (`HttpOnly; SameSite=Lax; Path=/; Max-Age=30d`, `Secure` when the request URL is
+https), so a redirect from your own handler carries it too. An existing session is never
+overwritten.
+
+## Options
+
+| option | default | meaning |
+|---|---|---|
+| `key` | `env.CAMADA_KEY` | `<ingest_token>.<snap_token>`; without it the middleware is inert |
+| `ingestUrl` | `env.CAMADA_INGEST_URL` | ingest base; batches go to `<ingestUrl>/e` |
+| `snapshotUrl` | `<ingestUrl>/snapshot` | snapshot endpoint |
+| `trustedProxy` | server config | `none` / `vercel` / `hops:N` / `cidrs:a,b`, or the parsed object |
+| `challenge` | `true` | serve the proof-of-work page for `challenge` verdicts |
+| `challengePath` | `/__camada/challenge` | where that page posts its solution |
+| `snapshotVersion` | `5` | `4` drops the custom rules, `3` the allow/challenge sides too |
+| `scriptPath` | `/_cam/b.js` | where the first-party beacon script is served |
+| `fpPath` | `/_cam/fp` | where that script posts the beacon; keep it in `scriptPath`'s directory |
+| `mode` | `lazy` (or `timer`) | `timer` polls the snapshot on an unref'd interval (long-lived process); `lazy` refreshes it per request off-path. `CAMADA_SERVERLESS=1` forces `lazy` |
+| `env` | `process.env` | overrides the process env (tests, and apps that read config themselves) |
+
+`CAMADA_CHALLENGE=0` switches the challenge off without a code change.
+
+`CAMADA_DISABLED=1` switches everything off, checked per request.
+
+## The first-party beacon
+
+Bots that never run JavaScript are the cheapest to catch. The Nitro plugin above pushes the tag
+into the `<head>` Nuxt renders; a server route that writes its own HTML uses the helper:
+
+```ts
+import { scriptTag } from '@camada/nuxt';
+
+export default defineEventHandler((event) => `<html><head>${scriptTag(event)}</head><body>…</body></html>`);
+```
+
+`scriptTag(event)` returns `<script src="/_cam/b.js?r=<rid>" async></script>` — the `rid` is this
+request's event id, so the analyst joins the beacon to the page view. The middleware serves the
+script at `GET /_cam/b.js` (cacheable, 1 h) and relays `POST /_cam/fp` (≤ 32 KB, answers 204)
+onto the event batch as a `sig: 1` row stamped with the client ip camada resolved — never the
+one the body claims. Both endpoints sit behind the verdict: a blocked client gets 403 there
+too. The tag is `''` where the middleware did not run or the project turned the beacon off in
+its settings, and the endpoints stand down with it.
+
+## App-context events
+
+The wire shows a `POST /api/login`; only your route knows whether it failed. Tell camada:
+
+```ts
+// server/api/login.post.ts
+import { track } from '@camada/nuxt';
+
+export default defineEventHandler(async (event) => {
+  const { email, password } = await readBody(event);
+  const ok = await signIn(email, password);
+  if (!ok) track(event, 'login_failed', { user: email });   // await optional
+  setResponseStatus(event, ok ? 200 : 401);
+  return ok ? { ok } : 'Invalid credentials';
+});
+```
+
+`track(event, name, { user? })` ships `{ et, uid, rid, sid, ip, ts }` joined to this request's
+event. The user identifier is HMAC-hashed in-process with the ingest token — the raw value never
+leaves the process. It never throws and is a no-op where the middleware did not run. The event
+name is free-form; the analyst's rules read this vocabulary:
+
+| event | when |
+|---|---|
+| `login_failed` / `login_succeeded` | a credential check settled |
+| `signup` | an account was created |
+| `password_reset` | a reset was requested |
+| `mfa_failed` | a second factor was rejected |
+| `payment_failed` / `payment_succeeded` | a charge settled |
+| `coupon_failed` | a promo code was rejected |
+
+## What this tap can see
+
+This is the in-app position: the beacon, the client hints the browser sends, the status your
+app answered, the session, and the outcomes your routes report. h3 vouches for the peer
+address (the socket, or a preset's `clientAddress`) and for nothing about the connection
+beyond it: no ASN, country or TLS fingerprint, so rules on those conditions do not enforce here
+(the analyst knows that from the tap's capability mask, `sdk-nuxt`, and never scores their
+absence as evidence). The protocol on the event is `null` — h3 does not see the client's own —
+and the one forwarded header h3 does honour is `x-forwarded-proto`, which decides only whether
+the session cookie is marked `Secure`. Node normalises header order, so the raw-wire-order
+signal is not available either.
+
+## Fail open
+
+Every entry point runs inside camada's guard. A dead ingest, a corrupt snapshot, a bug in this
+package: telemetry is lost, the request is not.

package/dist/index.cjs

@@ -0,0 +1,120 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  camada: () => camada,
+  camadaNitroPlugin: () => camadaNitroPlugin,
+  resetCamada: () => resetCamada,
+  scriptTag: () => scriptTag,
+  track: () => track
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/camada.ts
+var import_h3 = require("h3");
+var import_core = require("@camada/core");
+var import_fetch = require("@camada/core/fetch");
+var import_iife_string = __toESM(require("@camada/browser/iife-string"), 1);
+
+// package.json
+var name = "@camada/nuxt";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var VAR = "__camada";
+var instances = /* @__PURE__ */ new Set();
+var slotOf = (event) => (0, import_core.guarded)(() => {
+  const own = event.context[VAR];
+  if (own) return own;
+  const outer = event.node?.req?.__unenv__;
+  return outer?.[VAR];
+}, void 0);
+function camada(opts = {}) {
+  const cam = (0, import_fetch.createFetchCamada)({ tap: import_core.TAP_NUXT, sdk: SDK_ID, iife: import_iife_string.default }, opts);
+  instances.add(cam);
+  return (0, import_h3.defineEventHandler)(async (event) => {
+    if (slotOf(event)) return;
+    const req = (0, import_core.guarded)(() => (0, import_h3.toWebRequest)(event), null);
+    if (!req) return;
+    if (req.body) event._requestBody = req.body;
+    const ctx = {
+      // The socket address (or what the host preset stamped as clientAddress); never
+      // X-Forwarded-For here, core resolves that under the trusted-proxy rules.
+      peer: (0, import_core.guarded)(() => (0, import_h3.getRequestIP)(event) ?? null, null),
+      env: globalThis.process?.env
+    };
+    const r = await cam.before(req, ctx);
+    if (!r) return;
+    if (r.response) return r.response;
+    const vars = r.vars;
+    event.context[VAR] = vars;
+    const res = event.node?.res;
+    if (vars.sessionCookie && vars.sid && res) {
+      const sid = vars.sid;
+      (0, import_core.guarded)(() => (0, import_h3.setCookie)(event, import_fetch.SESSION_COOKIE, sid, {
+        path: "/",
+        maxAge: import_fetch.SESSION_MAX_AGE,
+        httpOnly: true,
+        sameSite: "lax",
+        secure: new URL(req.url).protocol === "https:"
+      }), void 0);
+    }
+    if (typeof res?.once === "function") res.once("finish", () => cam.after(req, vars, res.statusCode));
+    else cam.after(req, vars, null);
+  });
+}
+var track = (event, et, data) => (0, import_fetch.track)(slotOf(event), et, data);
+var scriptTag = (event) => (0, import_fetch.scriptTag)(slotOf(event));
+function resetCamada() {
+  for (const c of instances) c.reset();
+}
+
+// src/nitro.ts
+function camadaNitroPlugin() {
+  return (nitroApp) => {
+    nitroApp.hooks.hook("render:html", (html, { event }) => {
+      const tag = scriptTag(event);
+      if (tag) html.head.push(tag);
+    });
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  camada,
+  camadaNitroPlugin,
+  resetCamada,
+  scriptTag,
+  track
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/camada.ts","../package.json","../src/version.ts","../src/nitro.ts"],"sourcesContent":["// @camada/nuxt — the two-file install for a Nuxt app (any Nitro preset with an h3 event):\n//   server/middleware/camada.ts:  export default camada();   // env: CAMADA_KEY (+ CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL in dev)\n//   server/plugins/camada.ts:     export default camadaNitroPlugin();   // the first-party beacon in every rendered <head>\n//   track(event, 'login_failed', { user })   // an outcome the wire cannot show, from a server route\nexport { camada, track, scriptTag, resetCamada, type CamadaNuxtOptions, type CamadaNuxtVars } from './camada.js';\nexport { camadaNitroPlugin, type NitroAppLike } from './nitro.js';\n","// @camada/nuxt — the h3 binding over @camada/core/fetch. The pipeline (verdict, block,\n// challenge, beacon endpoints, the wire event) lives in core; this file only says what h3 knows:\n// the Web Request, the socket peer, the process env, and when the response has settled.\nimport { defineEventHandler, getRequestIP, setCookie, toWebRequest, type EventHandler, type H3Event } from 'h3';\nimport { guarded, TAP_NUXT } from '@camada/core';\nimport { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaNuxtOptions = FetchCamadaOptions;\nexport type CamadaNuxtVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.context\n\n// Every instance this module built, so a test or a hot reload can stop them all at once.\nconst instances = new Set<FetchCamada>();\n\n/** Reads the slot without trusting the event shape: a stub or a foreign event must not throw.\n *  An inner event Nitro made for `event.$fetch` / SSR `useFetch` carries the outer event's context\n *  on its mock request (`req.__unenv__`; Nitro copies only `_platform` and `waitUntil` into the\n *  inner context), so the outer request's vars are found there — the page's own rid and session. */\nconst slotOf = (event: H3Event): FetchVars | undefined =>\n  guarded(() => {\n    const own = event.context[VAR] as FetchVars | undefined;\n    if (own) return own;\n    const outer = (event.node?.req as { __unenv__?: Record<string, unknown> } | undefined)?.__unenv__;\n    return outer?.[VAR] as FetchVars | undefined;\n  }, undefined);\n\n/**\n * The server middleware: `export default camada()` in `server/middleware/camada.ts`. Reads\n * `CAMADA_KEY` / `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL` from `process.env`; without a key\n * it is inert. Returns a web Response where camada answers (block, challenge, the beacon\n * endpoints) and falls through otherwise.\n */\nexport function camada(opts: CamadaNuxtOptions = {}): EventHandler {\n  const cam = createFetchCamada({ tap: TAP_NUXT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the middleware may run on an edge preset\n  instances.add(cam);\n  return defineEventHandler(async (event) => {\n    // Nitro's own `event.$fetch` / SSR `useFetch` re-enters the h3 app for the same page view,\n    // already captured on the outer request (a bare `$fetch` with no event is a request of its own).\n    if (slotOf(event)) return;\n    const req = guarded(() => toWebRequest(event), null);\n    if (!req) return;   // an event h3 cannot express as a Request is not ours to break\n    // Building the Request puts a Node request body into a web stream; hand that stream back to\n    // h3 so the app's readBody() reads the same bytes rather than an already-drained socket.\n    if (req.body) event._requestBody = req.body;\n    const ctx: FetchRequestContext = {\n      // The socket address (or what the host preset stamped as clientAddress); never\n      // X-Forwarded-For here, core resolves that under the trusted-proxy rules.\n      peer: guarded(() => getRequestIP(event) ?? null, null),\n      env: globalThis.process?.env,\n    };\n    const r = await cam.before(req, ctx);\n    if (!r) return;\n    if (r.response) return r.response;\n    const vars = r.vars;\n    event.context[VAR] = vars;\n    const res = event.node?.res;\n    // Set before the app runs so a handler's own redirect carries the session too; core only\n    // hands a cookie for a new session, so an existing `_sfp` is never overwritten. h3 1.x\n    // writes cookies through node.res, so an event without one gets no session, quietly.\n    if (vars.sessionCookie && vars.sid && res) {\n      const sid = vars.sid;\n      guarded(() => setCookie(event, SESSION_COOKIE, sid, {\n        path: '/', maxAge: SESSION_MAX_AGE, httpOnly: true, sameSite: 'lax', secure: new URL(req.url).protocol === 'https:',\n      }), undefined);\n    }\n    // Ship with the real status once the response has settled — a Node response, or the mock a\n    // web preset provides. An event with no response object at all ships now, with st null.\n    if (typeof res?.once === 'function') res.once('finish', () => cam.after(req, vars, res.statusCode));\n    else cam.after(req, vars, null);\n  });\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,\n * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`\n * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event\n * through its rid and session; the user identifier is HMAC-hashed in-process. Never throws, and\n * a silent no-op where the middleware did not run.\n */\nexport const track = (event: H3Event, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The `<script>` tag for an HTML response — `''` where the middleware did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: H3Event): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine behind every `camada()` this module created. */\nexport function resetCamada(): void {\n  for (const c of instances) c.reset();\n}\n","{\n  \"name\": \"@camada/nuxt\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Nuxt (h3 server middleware): snapshot enforcement, first-party challenge and beacon, track() outcomes, events shipped with the settled status\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"h3\": \"^1.12.0\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^22.10.0\",\n    \"h3\": \"^1.15.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n","// The Nitro side of the beacon: Nuxt renders `<head>` through the `render:html` hook, so the\n// tag goes in there rather than in every page. Typed structurally so this package never\n// depends on nitropack — the plugin file is `export default camadaNitroPlugin()`.\nimport type { H3Event } from 'h3';\nimport { scriptTag } from './camada.js';\n\nexport interface NitroAppLike { hooks: { hook(name: string, fn: (...a: any[]) => void): void } }\ninterface RenderHtml { head: string[] }\n\n/** `server/plugins/camada.ts`: pushes this request's beacon tag into the rendered `<head>`; nothing where the middleware did not run. */\nexport function camadaNitroPlugin(): (nitroApp: NitroAppLike) => void {\n  return (nitroApp) => {\n    nitroApp.hooks.hook('render:html', (html: RenderHtml, { event }: { event: H3Event }) => {\n      const tag = scriptTag(event);\n      if (tag) html.head.push(tag);\n    });\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACGA,gBAA2G;AAC3G,kBAAkC;AAClC,mBAAwM;AACxM,yBAAiB;;;ACLf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFSxC,IAAM,MAAM;AAGZ,IAAM,YAAY,oBAAI,IAAiB;AAMvC,IAAM,SAAS,CAAC,cACd,qBAAQ,MAAM;AACZ,QAAM,MAAM,MAAM,QAAQ,GAAG;AAC7B,MAAI,IAAK,QAAO;AAChB,QAAM,QAAS,MAAM,MAAM,KAA6D;AACxF,SAAO,QAAQ,GAAG;AACpB,GAAG,MAAS;AAQP,SAAS,OAAO,OAA0B,CAAC,GAAiB;AACjE,QAAM,UAAM,gCAAkB,EAAE,KAAK,sBAAU,KAAK,QAAQ,yBAAAA,QAAK,GAAG,IAAI;AACxE,YAAU,IAAI,GAAG;AACjB,aAAO,8BAAmB,OAAO,UAAU;AAGzC,QAAI,OAAO,KAAK,EAAG;AACnB,UAAM,UAAM,qBAAQ,UAAM,wBAAa,KAAK,GAAG,IAAI;AACnD,QAAI,CAAC,IAAK;AAGV,QAAI,IAAI,KAAM,OAAM,eAAe,IAAI;AACvC,UAAM,MAA2B;AAAA;AAAA;AAAA,MAG/B,UAAM,qBAAQ,UAAM,wBAAa,KAAK,KAAK,MAAM,IAAI;AAAA,MACrD,KAAK,WAAW,SAAS;AAAA,IAC3B;AACA,UAAM,IAAI,MAAM,IAAI,OAAO,KAAK,GAAG;AACnC,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,UAAM,QAAQ,GAAG,IAAI;AACrB,UAAM,MAAM,MAAM,MAAM;AAIxB,QAAI,KAAK,iBAAiB,KAAK,OAAO,KAAK;AACzC,YAAM,MAAM,KAAK;AACjB,+BAAQ,UAAM,qBAAU,OAAO,6BAAgB,KAAK;AAAA,QAClD,MAAM;AAAA,QAAK,QAAQ;AAAA,QAAiB,UAAU;AAAA,QAAM,UAAU;AAAA,QAAO,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa;AAAA,MAC7G,CAAC,GAAG,MAAS;AAAA,IACf;AAGA,QAAI,OAAO,KAAK,SAAS,WAAY,KAAI,KAAK,UAAU,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC;AAAA,QAC7F,KAAI,MAAM,KAAK,MAAM,IAAI;AAAA,EAChC,CAAC;AACH;AASO,IAAM,QAAQ,CAAC,OAAgB,IAAY,aAA4C,aAAAC,OAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAGxH,IAAM,YAAY,CAAC,cAA2B,aAAAC,WAAc,OAAO,KAAK,CAAC;AAGzE,SAAS,cAAoB;AAClC,aAAW,KAAK,UAAW,GAAE,MAAM;AACrC;;;AGhFO,SAAS,oBAAsD;AACpE,SAAO,CAAC,aAAa;AACnB,aAAS,MAAM,KAAK,eAAe,CAAC,MAAkB,EAAE,MAAM,MAA0B;AACtF,YAAM,MAAM,UAAU,KAAK;AAC3B,UAAI,IAAK,MAAK,KAAK,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH;AACF;","names":["iife","coreTrack","coreScriptTag"]}

package/dist/index.d.cts

@@ -0,0 +1,36 @@
+import { EventHandler, H3Event } from 'h3';
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+type CamadaNuxtOptions = FetchCamadaOptions;
+type CamadaNuxtVars = FetchVars;
+/**
+ * The server middleware: `export default camada()` in `server/middleware/camada.ts`. Reads
+ * `CAMADA_KEY` / `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL` from `process.env`; without a key
+ * it is inert. Returns a web Response where camada answers (block, challenge, the beacon
+ * endpoints) and falls through otherwise.
+ */
+declare function camada(opts?: CamadaNuxtOptions): EventHandler;
+/**
+ * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,
+ * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`
+ * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event
+ * through its rid and session; the user identifier is HMAC-hashed in-process. Never throws, and
+ * a silent no-op where the middleware did not run.
+ */
+declare const track: (event: H3Event, et: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The `<script>` tag for an HTML response — `''` where the middleware did not run or the tenant turned the beacon off. */
+declare const scriptTag: (event: H3Event) => string;
+/** Test/reset hook: stops and drops every engine behind every `camada()` this module created. */
+declare function resetCamada(): void;
+
+interface NitroAppLike {
+    hooks: {
+        hook(name: string, fn: (...a: any[]) => void): void;
+    };
+}
+/** `server/plugins/camada.ts`: pushes this request's beacon tag into the rendered `<head>`; nothing where the middleware did not run. */
+declare function camadaNitroPlugin(): (nitroApp: NitroAppLike) => void;
+
+export { type CamadaNuxtOptions, type CamadaNuxtVars, type NitroAppLike, camada, camadaNitroPlugin, resetCamada, scriptTag, track };

package/dist/index.d.ts

@@ -0,0 +1,36 @@
+import { EventHandler, H3Event } from 'h3';
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+type CamadaNuxtOptions = FetchCamadaOptions;
+type CamadaNuxtVars = FetchVars;
+/**
+ * The server middleware: `export default camada()` in `server/middleware/camada.ts`. Reads
+ * `CAMADA_KEY` / `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL` from `process.env`; without a key
+ * it is inert. Returns a web Response where camada answers (block, challenge, the beacon
+ * endpoints) and falls through otherwise.
+ */
+declare function camada(opts?: CamadaNuxtOptions): EventHandler;
+/**
+ * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,
+ * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`
+ * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event
+ * through its rid and session; the user identifier is HMAC-hashed in-process. Never throws, and
+ * a silent no-op where the middleware did not run.
+ */
+declare const track: (event: H3Event, et: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The `<script>` tag for an HTML response — `''` where the middleware did not run or the tenant turned the beacon off. */
+declare const scriptTag: (event: H3Event) => string;
+/** Test/reset hook: stops and drops every engine behind every `camada()` this module created. */
+declare function resetCamada(): void;
+
+interface NitroAppLike {
+    hooks: {
+        hook(name: string, fn: (...a: any[]) => void): void;
+    };
+}
+/** `server/plugins/camada.ts`: pushes this request's beacon tag into the rendered `<head>`; nothing where the middleware did not run. */
+declare function camadaNitroPlugin(): (nitroApp: NitroAppLike) => void;
+
+export { type CamadaNuxtOptions, type CamadaNuxtVars, type NitroAppLike, camada, camadaNitroPlugin, resetCamada, scriptTag, track };

package/dist/index.js

@@ -0,0 +1,79 @@
+// src/camada.ts
+import { defineEventHandler, getRequestIP, setCookie, toWebRequest } from "h3";
+import { guarded, TAP_NUXT } from "@camada/core";
+import { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag } from "@camada/core/fetch";
+import iife from "@camada/browser/iife-string";
+
+// package.json
+var name = "@camada/nuxt";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var VAR = "__camada";
+var instances = /* @__PURE__ */ new Set();
+var slotOf = (event) => guarded(() => {
+  const own = event.context[VAR];
+  if (own) return own;
+  const outer = event.node?.req?.__unenv__;
+  return outer?.[VAR];
+}, void 0);
+function camada(opts = {}) {
+  const cam = createFetchCamada({ tap: TAP_NUXT, sdk: SDK_ID, iife }, opts);
+  instances.add(cam);
+  return defineEventHandler(async (event) => {
+    if (slotOf(event)) return;
+    const req = guarded(() => toWebRequest(event), null);
+    if (!req) return;
+    if (req.body) event._requestBody = req.body;
+    const ctx = {
+      // The socket address (or what the host preset stamped as clientAddress); never
+      // X-Forwarded-For here, core resolves that under the trusted-proxy rules.
+      peer: guarded(() => getRequestIP(event) ?? null, null),
+      env: globalThis.process?.env
+    };
+    const r = await cam.before(req, ctx);
+    if (!r) return;
+    if (r.response) return r.response;
+    const vars = r.vars;
+    event.context[VAR] = vars;
+    const res = event.node?.res;
+    if (vars.sessionCookie && vars.sid && res) {
+      const sid = vars.sid;
+      guarded(() => setCookie(event, SESSION_COOKIE, sid, {
+        path: "/",
+        maxAge: SESSION_MAX_AGE,
+        httpOnly: true,
+        sameSite: "lax",
+        secure: new URL(req.url).protocol === "https:"
+      }), void 0);
+    }
+    if (typeof res?.once === "function") res.once("finish", () => cam.after(req, vars, res.statusCode));
+    else cam.after(req, vars, null);
+  });
+}
+var track = (event, et, data) => coreTrack(slotOf(event), et, data);
+var scriptTag = (event) => coreScriptTag(slotOf(event));
+function resetCamada() {
+  for (const c of instances) c.reset();
+}
+
+// src/nitro.ts
+function camadaNitroPlugin() {
+  return (nitroApp) => {
+    nitroApp.hooks.hook("render:html", (html, { event }) => {
+      const tag = scriptTag(event);
+      if (tag) html.head.push(tag);
+    });
+  };
+}
+export {
+  camada,
+  camadaNitroPlugin,
+  resetCamada,
+  scriptTag,
+  track
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/camada.ts","../package.json","../src/version.ts","../src/nitro.ts"],"sourcesContent":["// @camada/nuxt — the h3 binding over @camada/core/fetch. The pipeline (verdict, block,\n// challenge, beacon endpoints, the wire event) lives in core; this file only says what h3 knows:\n// the Web Request, the socket peer, the process env, and when the response has settled.\nimport { defineEventHandler, getRequestIP, setCookie, toWebRequest, type EventHandler, type H3Event } from 'h3';\nimport { guarded, TAP_NUXT } from '@camada/core';\nimport { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaNuxtOptions = FetchCamadaOptions;\nexport type CamadaNuxtVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.context\n\n// Every instance this module built, so a test or a hot reload can stop them all at once.\nconst instances = new Set<FetchCamada>();\n\n/** Reads the slot without trusting the event shape: a stub or a foreign event must not throw.\n *  An inner event Nitro made for `event.$fetch` / SSR `useFetch` carries the outer event's context\n *  on its mock request (`req.__unenv__`; Nitro copies only `_platform` and `waitUntil` into the\n *  inner context), so the outer request's vars are found there — the page's own rid and session. */\nconst slotOf = (event: H3Event): FetchVars | undefined =>\n  guarded(() => {\n    const own = event.context[VAR] as FetchVars | undefined;\n    if (own) return own;\n    const outer = (event.node?.req as { __unenv__?: Record<string, unknown> } | undefined)?.__unenv__;\n    return outer?.[VAR] as FetchVars | undefined;\n  }, undefined);\n\n/**\n * The server middleware: `export default camada()` in `server/middleware/camada.ts`. Reads\n * `CAMADA_KEY` / `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL` from `process.env`; without a key\n * it is inert. Returns a web Response where camada answers (block, challenge, the beacon\n * endpoints) and falls through otherwise.\n */\nexport function camada(opts: CamadaNuxtOptions = {}): EventHandler {\n  const cam = createFetchCamada({ tap: TAP_NUXT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the middleware may run on an edge preset\n  instances.add(cam);\n  return defineEventHandler(async (event) => {\n    // Nitro's own `event.$fetch` / SSR `useFetch` re-enters the h3 app for the same page view,\n    // already captured on the outer request (a bare `$fetch` with no event is a request of its own).\n    if (slotOf(event)) return;\n    const req = guarded(() => toWebRequest(event), null);\n    if (!req) return;   // an event h3 cannot express as a Request is not ours to break\n    // Building the Request puts a Node request body into a web stream; hand that stream back to\n    // h3 so the app's readBody() reads the same bytes rather than an already-drained socket.\n    if (req.body) event._requestBody = req.body;\n    const ctx: FetchRequestContext = {\n      // The socket address (or what the host preset stamped as clientAddress); never\n      // X-Forwarded-For here, core resolves that under the trusted-proxy rules.\n      peer: guarded(() => getRequestIP(event) ?? null, null),\n      env: globalThis.process?.env,\n    };\n    const r = await cam.before(req, ctx);\n    if (!r) return;\n    if (r.response) return r.response;\n    const vars = r.vars;\n    event.context[VAR] = vars;\n    const res = event.node?.res;\n    // Set before the app runs so a handler's own redirect carries the session too; core only\n    // hands a cookie for a new session, so an existing `_sfp` is never overwritten. h3 1.x\n    // writes cookies through node.res, so an event without one gets no session, quietly.\n    if (vars.sessionCookie && vars.sid && res) {\n      const sid = vars.sid;\n      guarded(() => setCookie(event, SESSION_COOKIE, sid, {\n        path: '/', maxAge: SESSION_MAX_AGE, httpOnly: true, sameSite: 'lax', secure: new URL(req.url).protocol === 'https:',\n      }), undefined);\n    }\n    // Ship with the real status once the response has settled — a Node response, or the mock a\n    // web preset provides. An event with no response object at all ships now, with st null.\n    if (typeof res?.once === 'function') res.once('finish', () => cam.after(req, vars, res.statusCode));\n    else cam.after(req, vars, null);\n  });\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show: `login_failed`, `login_succeeded`,\n * `signup`, `password_reset`, `mfa_failed`, `payment_failed`, `payment_succeeded`, `coupon_failed`\n * (free-form; that vocabulary is what the analyst's rules read). Joined to this request's event\n * through its rid and session; the user identifier is HMAC-hashed in-process. Never throws, and\n * a silent no-op where the middleware did not run.\n */\nexport const track = (event: H3Event, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The `<script>` tag for an HTML response — `''` where the middleware did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: H3Event): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine behind every `camada()` this module created. */\nexport function resetCamada(): void {\n  for (const c of instances) c.reset();\n}\n","{\n  \"name\": \"@camada/nuxt\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for Nuxt (h3 server middleware): snapshot enforcement, first-party challenge and beacon, track() outcomes, events shipped with the settled status\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"h3\": \"^1.12.0\"\n  },\n  \"devDependencies\": {\n    \"@types/node\": \"^22.10.0\",\n    \"h3\": \"^1.15.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n","// The Nitro side of the beacon: Nuxt renders `<head>` through the `render:html` hook, so the\n// tag goes in there rather than in every page. Typed structurally so this package never\n// depends on nitropack — the plugin file is `export default camadaNitroPlugin()`.\nimport type { H3Event } from 'h3';\nimport { scriptTag } from './camada.js';\n\nexport interface NitroAppLike { hooks: { hook(name: string, fn: (...a: any[]) => void): void } }\ninterface RenderHtml { head: string[] }\n\n/** `server/plugins/camada.ts`: pushes this request's beacon tag into the rendered `<head>`; nothing where the middleware did not run. */\nexport function camadaNitroPlugin(): (nitroApp: NitroAppLike) => void {\n  return (nitroApp) => {\n    nitroApp.hooks.hook('render:html', (html: RenderHtml, { event }: { event: H3Event }) => {\n      const tag = scriptTag(event);\n      if (tag) html.head.push(tag);\n    });\n  };\n}\n"],"mappings":";AAGA,SAAS,oBAAoB,cAAc,WAAW,oBAAqD;AAC3G,SAAS,SAAS,gBAAgB;AAClC,SAAS,mBAAmB,gBAAgB,iBAAiB,SAAS,WAAW,aAAa,qBAA0G;AACxM,OAAO,UAAU;;;ACLf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFSxC,IAAM,MAAM;AAGZ,IAAM,YAAY,oBAAI,IAAiB;AAMvC,IAAM,SAAS,CAAC,UACd,QAAQ,MAAM;AACZ,QAAM,MAAM,MAAM,QAAQ,GAAG;AAC7B,MAAI,IAAK,QAAO;AAChB,QAAM,QAAS,MAAM,MAAM,KAA6D;AACxF,SAAO,QAAQ,GAAG;AACpB,GAAG,MAAS;AAQP,SAAS,OAAO,OAA0B,CAAC,GAAiB;AACjE,QAAM,MAAM,kBAAkB,EAAE,KAAK,UAAU,KAAK,QAAQ,KAAK,GAAG,IAAI;AACxE,YAAU,IAAI,GAAG;AACjB,SAAO,mBAAmB,OAAO,UAAU;AAGzC,QAAI,OAAO,KAAK,EAAG;AACnB,UAAM,MAAM,QAAQ,MAAM,aAAa,KAAK,GAAG,IAAI;AACnD,QAAI,CAAC,IAAK;AAGV,QAAI,IAAI,KAAM,OAAM,eAAe,IAAI;AACvC,UAAM,MAA2B;AAAA;AAAA;AAAA,MAG/B,MAAM,QAAQ,MAAM,aAAa,KAAK,KAAK,MAAM,IAAI;AAAA,MACrD,KAAK,WAAW,SAAS;AAAA,IAC3B;AACA,UAAM,IAAI,MAAM,IAAI,OAAO,KAAK,GAAG;AACnC,QAAI,CAAC,EAAG;AACR,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,UAAM,QAAQ,GAAG,IAAI;AACrB,UAAM,MAAM,MAAM,MAAM;AAIxB,QAAI,KAAK,iBAAiB,KAAK,OAAO,KAAK;AACzC,YAAM,MAAM,KAAK;AACjB,cAAQ,MAAM,UAAU,OAAO,gBAAgB,KAAK;AAAA,QAClD,MAAM;AAAA,QAAK,QAAQ;AAAA,QAAiB,UAAU;AAAA,QAAM,UAAU;AAAA,QAAO,QAAQ,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa;AAAA,MAC7G,CAAC,GAAG,MAAS;AAAA,IACf;AAGA,QAAI,OAAO,KAAK,SAAS,WAAY,KAAI,KAAK,UAAU,MAAM,IAAI,MAAM,KAAK,MAAM,IAAI,UAAU,CAAC;AAAA,QAC7F,KAAI,MAAM,KAAK,MAAM,IAAI;AAAA,EAChC,CAAC;AACH;AASO,IAAM,QAAQ,CAAC,OAAgB,IAAY,SAA4C,UAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAGxH,IAAM,YAAY,CAAC,UAA2B,cAAc,OAAO,KAAK,CAAC;AAGzE,SAAS,cAAoB;AAClC,aAAW,KAAK,UAAW,GAAE,MAAM;AACrC;;;AGhFO,SAAS,oBAAsD;AACpE,SAAO,CAAC,aAAa;AACnB,aAAS,MAAM,KAAK,eAAe,CAAC,MAAkB,EAAE,MAAM,MAA0B;AACtF,YAAM,MAAM,UAAU,KAAK;AAC3B,UAAI,IAAK,MAAK,KAAK,KAAK,GAAG;AAAA,IAC7B,CAAC;AAAA,EACH;AACF;","names":[]}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@camada/nuxt",
+  "version": "0.1.0",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "description": "camada SDK for Nuxt (h3 server middleware): snapshot enforcement, first-party challenge and beacon, track() outcomes, events shipped with the settled status",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@camada/core": "^0.3.0",
+    "@camada/browser": "^0.2.0"
+  },
+  "peerDependencies": {
+    "h3": "^1.12.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/camada-app/camada-nuxt.git"
+  },
+  "homepage": "https://github.com/camada-app/camada-nuxt#readme",
+  "bugs": {
+    "url": "https://github.com/camada-app/camada-nuxt/issues"
+  }
+}