@camada/sveltekit 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 camada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,176 @@
+# @camada/sveltekit
+
+camada for [SvelteKit](https://svelte.dev/docs/kit) as a `handle` hook: enforces the tenant
+snapshot inline (your ordered custom rules, then block, allow, challenge), serves a first-party
+proof-of-work challenge page and beacon, records the outcomes your actions know (`track()`), and
+ships wire events off the response path — through `waitUntil` on Cloudflare, in the background
+on Node. Fails open by design — a camada outage or bug never 5xxes your app.
+
+Not yet on npm — consumed via a `file:` dependency from a sibling checkout.
+
+## Quickstart
+
+```ts
+// src/hooks.server.ts
+import { camada } from '@camada/sveltekit';
+
+export const handle = camada();   // reads CAMADA_KEY / CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL from the env
+```
+
+With other hooks, put it first so a blocked request never reaches them:
+
+```ts
+import { sequence } from '@sveltejs/kit/hooks';
+export const handle = sequence(camada(), auth, i18n);
+```
+
+Env (printed by camada onboarding / `npm run seed` in dev):
+
+```
+CAMADA_KEY=<ingest_token>.<snap_token>
+CAMADA_INGEST_URL=http://localhost:8787        # dev only; defaults to production ingest
+```
+
+On adapter-node that is `process.env`; on adapter-cloudflare it is the Worker bindings
+(`event.platform.env`), read per request. Both are merged, and an app that reads its own config
+can pass the values instead:
+
+```ts
+export const handle = camada({ key: MY_KEY, ingestUrl: MY_INGEST });
+```
+
+Call `camada()` once, at module scope. Engines are cached per resolved configuration inside the
+handle, so a Worker isolate serving several tenants never enforces one tenant's snapshot on
+another, nor signs its cookies with another's secret. Without `CAMADA_KEY` the handle is inert
+(one log line, no requests, no enforcement), so an unprovisioned environment behaves exactly as
+if camada were not installed.
+
+## What it does per request
+
+1. Refreshes the snapshot off-path (lazy mode by default — no interval timers, so the handle is
+   safe on edge and serverless adapters; `mode: 'timer'` polls on an unref'd interval for a
+   long-lived adapter-node process). Every poll and event batch carries
+   `x-camada-sdk: @camada/sveltekit/<version>`, and polls ask for snapshot v5 — the container
+   that carries your ordered custom rules.
+2. Resolves the client from `event.getClientAddress()` — the address your adapter vouches for
+   (adapter-node honours its `ADDRESS_HEADER` / `XFF_DEPTH`, adapter-cloudflare reads
+   `cf-connecting-ip`) — falling back to `X-Forwarded-For` only under your tenant's
+   trusted-proxy config. A client header alone is never the ip. When the adapter has no address
+   (prerendering) the ip is null: ip rules and the challenge stand down, the event still ships —
+   so a `vite build` with prerendered routes ships one first-visit page event per route from the
+   build machine; set `CAMADA_DISABLED=1` in the build env to suppress them. A server-side
+   `event.fetch` to the app's own routes (`isSubRequest`) is left alone: one page view is one
+   event, and the page-level verdict is not re-applied to your own `load()`.
+3. Runs your ordered custom rules, then the allow, block and challenge lists.
+4. **Block** → `403` with `x-block-reason` before `resolve()`; the event still ships, with
+   `st: 403` and `blk: <reason>` so the analyst counts SDK blocks apart from your own 403s.
+5. **Skip** → a skip rule or the allow list wins over a wider block.
+6. **Challenge** → a `403` proof-of-work page (HTML navigations) or `403 {"error":"challenge_required"}`
+   (everything else); `POST /__camada/challenge` verifies the solution, sets `_cch` and 302s back.
+7. Otherwise `resolve(event)` runs, and the settled response ships one batched, redacted event
+   with its real status (Authorization and Cookie values never leave the process; credential-looking
+   query values are scrubbed — see `@camada/core`).
+
+A first visit gets the shared `_sfp` session cookie through `event.cookies.set()` — SvelteKit
+adds the header to whatever `resolve()` returns, so a `redirect()` or a raw `Response` passes
+through untouched.
+
+## Options
+
+| option | default | meaning |
+|---|---|---|
+| `key` | `env.CAMADA_KEY` | `<ingest_token>.<snap_token>`; without it the handle is inert |
+| `ingestUrl` | `env.CAMADA_INGEST_URL` | ingest base; batches go to `<ingestUrl>/e` |
+| `snapshotUrl` | `<ingestUrl>/snapshot` | snapshot endpoint |
+| `trustedProxy` | server config | `none` / `vercel` / `hops:N` / `cidrs:a,b`, or the parsed object |
+| `challenge` | `true` | serve the proof-of-work page for `challenge` verdicts |
+| `challengePath` | `/__camada/challenge` | where that page posts its solution |
+| `snapshotVersion` | `5` | `4` drops the custom rules, `3` the allow/challenge sides too |
+| `scriptPath` | `/_cam/b.js` | where the first-party beacon script is served |
+| `fpPath` | `/_cam/fp` | where that script posts the beacon; keep it in `scriptPath`'s directory |
+| `mode` | `lazy` (or `timer`) | `timer` polls the snapshot on an unref'd interval (long-lived process); `lazy` refreshes it per request off-path. `CAMADA_SERVERLESS=1` forces `lazy` |
+| `env` | `process.env` + `platform.env` | overrides the host env (tests, and apps that read config themselves) |
+
+`CAMADA_CHALLENGE=0` in the env switches the challenge off without a code change.
+
+`CAMADA_DISABLED=1` in the env switches everything off, checked per request.
+
+## The first-party beacon
+
+Bots that never run JavaScript are the cheapest to catch. Return the tag from a server `load`
+and put it in the page's `<head>`; the handle does the rest:
+
+```ts
+// src/routes/+page.server.ts
+import { scriptTag } from '@camada/sveltekit';
+export const load = (event) => ({ camada: scriptTag(event) });
+```
+
+```svelte
+<!-- src/routes/+page.svelte -->
+<script>
+  let { data } = $props();
+</script>
+<svelte:head>{@html data.camada}</svelte:head>
+```
+
+`scriptTag(event)` returns `<script src="/_cam/b.js?r=<rid>" async></script>` — the `rid` is this
+request's event id, so the analyst joins the beacon to the page view. The handle serves the
+script at `GET /_cam/b.js` (cacheable, 1 h) and relays `POST /_cam/fp` (≤ 32 KB, answers 204)
+onto the event batch as a `sig: 1` row stamped with the client ip camada resolved — never the
+one the body claims. Both endpoints sit behind the verdict: a blocked client gets 403 there too.
+The tag is `''` when camada is off for the request or the project turned the beacon off in its
+settings, and the endpoints stand down with it.
+
+## App-context events
+
+The wire shows a `POST /login`; only your action knows whether it failed. Tell camada:
+
+```ts
+// src/routes/login/+page.server.ts
+import { fail, redirect } from '@sveltejs/kit';
+import { track } from '@camada/sveltekit';
+
+export const actions = {
+  default: async (event) => {
+    const form = await event.request.formData();
+    const ok = await signIn(form);
+    if (!ok) { track(event, 'login_failed', { user: String(form.get('email')) }); return fail(401); }   // await optional
+    redirect(303, '/');
+  },
+};
+```
+
+`track(event, name, { user? })` ships `{ et, uid, rid, sid, ip, ts }` joined to this request's
+event. The user identifier is HMAC-hashed in-process with the ingest token — the raw value never
+leaves the process. It never throws and is a no-op where the handle did not run. The event name
+is free-form; the analyst's rules read this vocabulary:
+
+| event | when |
+|---|---|
+| `login_failed` / `login_succeeded` | a credential check settled |
+| `signup` | an account was created |
+| `password_reset` | a reset was requested |
+| `mfa_failed` | a second factor was rejected |
+| `payment_failed` / `payment_succeeded` | a charge settled |
+| `coupon_failed` | a promo code was rejected |
+
+## What this tap can see
+
+This is the in-app position: the beacon, the client hints the browser sends, the real status
+your routes answered, the `_sfp` session, and the app context `track()` adds. What SvelteKit
+vouches for depends on the adapter. `getClientAddress()` is the one address the handle trusts;
+on adapter-cloudflare `event.platform.cf` also supplies `asn`, `country`,
+`tlsClientExtensionsSha1` and `httpProtocol`: the handle evaluates ASN, country and
+TLS-fingerprint rules on them locally and stamps `asn`, `cc`, `tlsx` and the visitor's own
+protocol on the event, but the analyst's capability mask for `sdk-sveltekit` does not credit
+them (it is one mask for every adapter), so rules on those conditions are reported as not
+enforceable by this SDK and the shipped facts are enrichment only. On adapter-node and the
+other adapters none of those exist — the request arrives as a `Request` with no connection
+facts, no client protocol, and headers already normalised — so those rules do not fire and the
+analyst never scores their absence as evidence. No forwarded header is ever read for any of them.
+
+## Fail open
+
+Every entry point runs inside camada's guard. A dead ingest, a corrupt snapshot, a bug in this
+package: telemetry is lost, the request is not.

package/dist/index.cjs

@@ -0,0 +1,115 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name2 in all)
+    __defProp(target, name2, { get: all[name2], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  camada: () => camada,
+  resetCamada: () => resetCamada,
+  scriptTag: () => scriptTag,
+  track: () => track
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/camada.ts
+var import_core = require("@camada/core");
+var import_fetch = require("@camada/core/fetch");
+var import_iife_string = __toESM(require("@camada/browser/iife-string"), 1);
+
+// package.json
+var name = "@camada/sveltekit";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var VAR = "__camada";
+var instances = /* @__PURE__ */ new Set();
+var slotOf = (event) => (0, import_core.guarded)(() => event.locals[VAR], void 0);
+function contextOf(event) {
+  const platform = event.platform;
+  const env = (0, import_core.guarded)(() => ({ ...globalThis.process?.env, ...platform?.env }), {});
+  let peer = null;
+  try {
+    peer = event.getClientAddress();
+  } catch {
+  }
+  const exec = platform?.context;
+  const cf = platform?.cf;
+  return {
+    peer,
+    env,
+    waitUntil: exec ? (p) => exec.waitUntil(p) : void 0,
+    asn: cf?.asn ?? null,
+    country: cf?.country ?? null,
+    tlsx: cf?.tlsClientExtensionsSha1 ?? null,
+    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.
+    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\//i, "") : null
+  };
+}
+function camada(opts = {}) {
+  const cam = (0, import_fetch.createFetchCamada)({ tap: import_core.TAP_SVELTEKIT, sdk: SDK_ID, iife: import_iife_string.default }, opts);
+  instances.add(cam);
+  return async ({ event, resolve }) => {
+    if (event.isSubRequest) return resolve(event);
+    const r = await cam.before(event.request, contextOf(event));
+    if (!r) return resolve(event);
+    if (r.response) return r.response;
+    const vars = r.vars;
+    (0, import_core.guarded)(() => {
+      event.locals[VAR] = vars;
+      if (vars.sessionCookie && vars.sid) {
+        event.cookies.set(import_fetch.SESSION_COOKIE, vars.sid, {
+          path: "/",
+          maxAge: import_fetch.SESSION_MAX_AGE,
+          httpOnly: true,
+          sameSite: "lax",
+          secure: new URL(event.request.url).protocol === "https:"
+        });
+      }
+    }, void 0);
+    const res = await resolve(event);
+    cam.after(event.request, vars, res.status);
+    return res;
+  };
+}
+var track = (event, et, data) => (0, import_fetch.track)(slotOf(event), et, data);
+var scriptTag = (event) => (0, import_fetch.scriptTag)(slotOf(event));
+function resetCamada() {
+  for (const cam of instances) cam.reset();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  camada,
+  resetCamada,
+  scriptTag,
+  track
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/sveltekit — the one-line install for a SvelteKit app, in src/hooks.server.ts:\n//   export const handle = camada();   // env: CAMADA_KEY (+ CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL in dev)\n//   scriptTag(event)                  // the first-party beacon, returned from a load() into the page\n//   track(event, 'login_failed', { user })   // an outcome the wire cannot show\nexport { camada, track, scriptTag, resetCamada, type CamadaSvelteKitOptions, type CamadaSvelteKitVars } from './camada.js';\n","// @camada/sveltekit — the `handle` hook that binds @camada/core/fetch to a SvelteKit app. The\n// pipeline (verdict, block, challenge, beacon, the event) lives in core; this file only says what\n// SvelteKit knows: the adapter-resolved client address, the per-request env and execution context\n// an edge adapter hands over, the cookie API, and `event.locals` as the per-request slot.\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport { guarded, TAP_SVELTEKIT } from '@camada/core';\nimport { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaSvelteKitOptions = FetchCamadaOptions;\nexport type CamadaSvelteKitVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.locals\nconst instances = new Set<FetchCamada>();\n\ntype Env = Record<string, string | undefined>;\n\n/** What adapter-cloudflare puts on `event.platform`; every field is optional because other adapters put nothing there. */\ninterface CfPlatform {\n  env?: Env;\n  context?: { waitUntil(p: Promise<unknown>): void };\n  cf?: { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string };\n}\n\nconst slotOf = (event: RequestEvent): FetchVars | undefined =>\n  guarded(() => (event.locals as Record<string, unknown>)[VAR] as FetchVars | undefined, undefined);\n\n/** Everything the runtime vouches for. Nothing here is read from a client header. */\nfunction contextOf(event: RequestEvent): FetchRequestContext {\n  const platform = event.platform as CfPlatform | undefined;\n  // process.env on adapter-node (and nodejs_compat Workers), the bindings on adapter-cloudflare;\n  // a binding can be a KV namespace, so the merge is guarded and core reads only CAMADA_* keys.\n  const env = guarded<Env>(() => ({ ...(globalThis as { process?: { env?: Env } }).process?.env, ...platform?.env }), {});\n  let peer: string | null = null;\n  try { peer = event.getClientAddress(); } catch { /* prerendering, or an adapter with no socket: nothing vouched for */ }\n  const exec = platform?.context;\n  const cf = platform?.cf;\n  return {\n    peer, env,\n    waitUntil: exec ? (p) => exec.waitUntil(p) : undefined,\n    asn: cf?.asn ?? null,\n    country: cf?.country ?? null,\n    tlsx: cf?.tlsClientExtensionsSha1 ?? null,\n    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.\n    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n  };\n}\n\n/**\n * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a\n * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from\n * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.\n */\nexport function camada(opts: CamadaSvelteKitOptions = {}): Handle {\n  const cam = createFetchCamada({ tap: TAP_SVELTEKIT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the handle may run on edge/serverless\n  instances.add(cam);\n  return async ({ event, resolve }) => {\n    // A server-side `event.fetch` to the app's own routes runs the handle again on a fresh event\n    // with no user-agent or accept: one page view is one event, and the page-level verdict must\n    // not be re-applied to the server's own load().\n    if (event.isSubRequest) return resolve(event);\n    const r = await cam.before(event.request, contextOf(event));\n    if (!r) return resolve(event);\n    if (r.response) return r.response;\n    const vars = r.vars;\n    guarded(() => {\n      (event.locals as Record<string, unknown>)[VAR] = vars;\n      // The framework cookie API: SvelteKit adds the header to whatever resolve() returns, so a\n      // redirect or an immutable Response needs no rebuilding here.\n      if (vars.sessionCookie && vars.sid) {\n        event.cookies.set(SESSION_COOKIE, vars.sid, {\n          path: '/', maxAge: SESSION_MAX_AGE, httpOnly: true, sameSite: 'lax', secure: new URL(event.request.url).protocol === 'https:',\n        });\n      }\n    }, undefined);\n    const res = await resolve(event);\n    cam.after(event.request, vars, res.status);\n    return res;\n  };\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,\n * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier\n * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.\n */\nexport const track = (event: RequestEvent, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: RequestEvent): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine of every handle this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/sveltekit\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for SvelteKit (hooks.server.ts handle): snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping on Cloudflare\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"@sveltejs/kit\": \">=2\"\n  },\n  \"devDependencies\": {\n    \"@sveltejs/kit\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"svelte\": \"^5.0.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vite\": \"^8.0.0\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,kBAAuC;AACvC,mBAAwM;AACxM,yBAAiB;;;ACNf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFUxC,IAAM,MAAM;AACZ,IAAM,YAAY,oBAAI,IAAiB;AAWvC,IAAM,SAAS,CAAC,cACd,qBAAQ,MAAO,MAAM,OAAmC,GAAG,GAA4B,MAAS;AAGlG,SAAS,UAAU,OAA0C;AAC3D,QAAM,WAAW,MAAM;AAGvB,QAAM,UAAM,qBAAa,OAAO,EAAE,GAAI,WAA2C,SAAS,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC;AACtH,MAAI,OAAsB;AAC1B,MAAI;AAAE,WAAO,MAAM,iBAAiB;AAAA,EAAG,QAAQ;AAAA,EAAwE;AACvH,QAAM,OAAO,UAAU;AACvB,QAAM,KAAK,UAAU;AACrB,SAAO;AAAA,IACL;AAAA,IAAM;AAAA,IACN,WAAW,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;AAAA,IAC7C,KAAK,IAAI,OAAO;AAAA,IAChB,SAAS,IAAI,WAAW;AAAA,IACxB,MAAM,IAAI,2BAA2B;AAAA;AAAA,IAErC,aAAa,IAAI,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,EAC5E;AACF;AAOO,SAAS,OAAO,OAA+B,CAAC,GAAW;AAChE,QAAM,UAAM,gCAAkB,EAAE,KAAK,2BAAe,KAAK,QAAQ,yBAAAA,QAAK,GAAG,IAAI;AAC7E,YAAU,IAAI,GAAG;AACjB,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AAInC,QAAI,MAAM,aAAc,QAAO,QAAQ,KAAK;AAC5C,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,SAAS,UAAU,KAAK,CAAC;AAC1D,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK;AAC5B,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,6BAAQ,MAAM;AACZ,MAAC,MAAM,OAAmC,GAAG,IAAI;AAGjD,UAAI,KAAK,iBAAiB,KAAK,KAAK;AAClC,cAAM,QAAQ,IAAI,6BAAgB,KAAK,KAAK;AAAA,UAC1C,MAAM;AAAA,UAAK,QAAQ;AAAA,UAAiB,UAAU;AAAA,UAAM,UAAU;AAAA,UAAO,QAAQ,IAAI,IAAI,MAAM,QAAQ,GAAG,EAAE,aAAa;AAAA,QACvH,CAAC;AAAA,MACH;AAAA,IACF,GAAG,MAAS;AACZ,UAAM,MAAM,MAAM,QAAQ,KAAK;AAC/B,QAAI,MAAM,MAAM,SAAS,MAAM,IAAI,MAAM;AACzC,WAAO;AAAA,EACT;AACF;AAOO,IAAM,QAAQ,CAAC,OAAqB,IAAY,aAA4C,aAAAC,OAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAG7H,IAAM,YAAY,CAAC,cAAgC,aAAAC,WAAc,OAAO,KAAK,CAAC;AAG9E,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":["iife","coreTrack","coreScriptTag"]}

package/dist/index.d.cts

@@ -0,0 +1,25 @@
+import { Handle, RequestEvent } from '@sveltejs/kit';
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+type CamadaSvelteKitOptions = FetchCamadaOptions;
+type CamadaSvelteKitVars = FetchVars;
+/**
+ * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a
+ * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from
+ * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.
+ */
+declare function camada(opts?: CamadaSvelteKitOptions): Handle;
+/**
+ * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,
+ * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier
+ * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.
+ */
+declare const track: (event: RequestEvent, et: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */
+declare const scriptTag: (event: RequestEvent) => string;
+/** Test/reset hook: stops and drops every engine of every handle this module created. */
+declare function resetCamada(): void;
+
+export { type CamadaSvelteKitOptions, type CamadaSvelteKitVars, camada, resetCamada, scriptTag, track };

package/dist/index.d.ts

@@ -0,0 +1,25 @@
+import { Handle, RequestEvent } from '@sveltejs/kit';
+import { FetchCamadaOptions, FetchVars } from '@camada/core/fetch';
+
+type CamadaSvelteKitOptions = FetchCamadaOptions;
+type CamadaSvelteKitVars = FetchVars;
+/**
+ * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a
+ * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from
+ * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.
+ */
+declare function camada(opts?: CamadaSvelteKitOptions): Handle;
+/**
+ * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,
+ * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier
+ * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.
+ */
+declare const track: (event: RequestEvent, et: string, data?: {
+    user?: string;
+}) => Promise<void>;
+/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */
+declare const scriptTag: (event: RequestEvent) => string;
+/** Test/reset hook: stops and drops every engine of every handle this module created. */
+declare function resetCamada(): void;
+
+export { type CamadaSvelteKitOptions, type CamadaSvelteKitVars, camada, resetCamada, scriptTag, track };

package/dist/index.js

@@ -0,0 +1,75 @@
+// src/camada.ts
+import { guarded, TAP_SVELTEKIT } from "@camada/core";
+import { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag } from "@camada/core/fetch";
+import iife from "@camada/browser/iife-string";
+
+// package.json
+var name = "@camada/sveltekit";
+var version = "0.1.0";
+
+// src/version.ts
+var SDK_ID = `${name}/${version}`;
+
+// src/camada.ts
+var VAR = "__camada";
+var instances = /* @__PURE__ */ new Set();
+var slotOf = (event) => guarded(() => event.locals[VAR], void 0);
+function contextOf(event) {
+  const platform = event.platform;
+  const env = guarded(() => ({ ...globalThis.process?.env, ...platform?.env }), {});
+  let peer = null;
+  try {
+    peer = event.getClientAddress();
+  } catch {
+  }
+  const exec = platform?.context;
+  const cf = platform?.cf;
+  return {
+    peer,
+    env,
+    waitUntil: exec ? (p) => exec.waitUntil(p) : void 0,
+    asn: cf?.asn ?? null,
+    country: cf?.country ?? null,
+    tlsx: cf?.tlsClientExtensionsSha1 ?? null,
+    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.
+    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\//i, "") : null
+  };
+}
+function camada(opts = {}) {
+  const cam = createFetchCamada({ tap: TAP_SVELTEKIT, sdk: SDK_ID, iife }, opts);
+  instances.add(cam);
+  return async ({ event, resolve }) => {
+    if (event.isSubRequest) return resolve(event);
+    const r = await cam.before(event.request, contextOf(event));
+    if (!r) return resolve(event);
+    if (r.response) return r.response;
+    const vars = r.vars;
+    guarded(() => {
+      event.locals[VAR] = vars;
+      if (vars.sessionCookie && vars.sid) {
+        event.cookies.set(SESSION_COOKIE, vars.sid, {
+          path: "/",
+          maxAge: SESSION_MAX_AGE,
+          httpOnly: true,
+          sameSite: "lax",
+          secure: new URL(event.request.url).protocol === "https:"
+        });
+      }
+    }, void 0);
+    const res = await resolve(event);
+    cam.after(event.request, vars, res.status);
+    return res;
+  };
+}
+var track = (event, et, data) => coreTrack(slotOf(event), et, data);
+var scriptTag = (event) => coreScriptTag(slotOf(event));
+function resetCamada() {
+  for (const cam of instances) cam.reset();
+}
+export {
+  camada,
+  resetCamada,
+  scriptTag,
+  track
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/sveltekit — the `handle` hook that binds @camada/core/fetch to a SvelteKit app. The\n// pipeline (verdict, block, challenge, beacon, the event) lives in core; this file only says what\n// SvelteKit knows: the adapter-resolved client address, the per-request env and execution context\n// an edge adapter hands over, the cookie API, and `event.locals` as the per-request slot.\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport { guarded, TAP_SVELTEKIT } from '@camada/core';\nimport { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaSvelteKitOptions = FetchCamadaOptions;\nexport type CamadaSvelteKitVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.locals\nconst instances = new Set<FetchCamada>();\n\ntype Env = Record<string, string | undefined>;\n\n/** What adapter-cloudflare puts on `event.platform`; every field is optional because other adapters put nothing there. */\ninterface CfPlatform {\n  env?: Env;\n  context?: { waitUntil(p: Promise<unknown>): void };\n  cf?: { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string };\n}\n\nconst slotOf = (event: RequestEvent): FetchVars | undefined =>\n  guarded(() => (event.locals as Record<string, unknown>)[VAR] as FetchVars | undefined, undefined);\n\n/** Everything the runtime vouches for. Nothing here is read from a client header. */\nfunction contextOf(event: RequestEvent): FetchRequestContext {\n  const platform = event.platform as CfPlatform | undefined;\n  // process.env on adapter-node (and nodejs_compat Workers), the bindings on adapter-cloudflare;\n  // a binding can be a KV namespace, so the merge is guarded and core reads only CAMADA_* keys.\n  const env = guarded<Env>(() => ({ ...(globalThis as { process?: { env?: Env } }).process?.env, ...platform?.env }), {});\n  let peer: string | null = null;\n  try { peer = event.getClientAddress(); } catch { /* prerendering, or an adapter with no socket: nothing vouched for */ }\n  const exec = platform?.context;\n  const cf = platform?.cf;\n  return {\n    peer, env,\n    waitUntil: exec ? (p) => exec.waitUntil(p) : undefined,\n    asn: cf?.asn ?? null,\n    country: cf?.country ?? null,\n    tlsx: cf?.tlsClientExtensionsSha1 ?? null,\n    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.\n    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n  };\n}\n\n/**\n * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a\n * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from\n * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.\n */\nexport function camada(opts: CamadaSvelteKitOptions = {}): Handle {\n  const cam = createFetchCamada({ tap: TAP_SVELTEKIT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the handle may run on edge/serverless\n  instances.add(cam);\n  return async ({ event, resolve }) => {\n    // A server-side `event.fetch` to the app's own routes runs the handle again on a fresh event\n    // with no user-agent or accept: one page view is one event, and the page-level verdict must\n    // not be re-applied to the server's own load().\n    if (event.isSubRequest) return resolve(event);\n    const r = await cam.before(event.request, contextOf(event));\n    if (!r) return resolve(event);\n    if (r.response) return r.response;\n    const vars = r.vars;\n    guarded(() => {\n      (event.locals as Record<string, unknown>)[VAR] = vars;\n      // The framework cookie API: SvelteKit adds the header to whatever resolve() returns, so a\n      // redirect or an immutable Response needs no rebuilding here.\n      if (vars.sessionCookie && vars.sid) {\n        event.cookies.set(SESSION_COOKIE, vars.sid, {\n          path: '/', maxAge: SESSION_MAX_AGE, httpOnly: true, sameSite: 'lax', secure: new URL(event.request.url).protocol === 'https:',\n        });\n      }\n    }, undefined);\n    const res = await resolve(event);\n    cam.after(event.request, vars, res.status);\n    return res;\n  };\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,\n * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier\n * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.\n */\nexport const track = (event: RequestEvent, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: RequestEvent): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine of every handle this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/sveltekit\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for SvelteKit (hooks.server.ts handle): snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping on Cloudflare\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"@sveltejs/kit\": \">=2\"\n  },\n  \"devDependencies\": {\n    \"@sveltejs/kit\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"svelte\": \"^5.0.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vite\": \"^8.0.0\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";AAKA,SAAS,SAAS,qBAAqB;AACvC,SAAS,mBAAmB,gBAAgB,iBAAiB,SAAS,WAAW,aAAa,qBAA0G;AACxM,OAAO,UAAU;;;ACNf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFUxC,IAAM,MAAM;AACZ,IAAM,YAAY,oBAAI,IAAiB;AAWvC,IAAM,SAAS,CAAC,UACd,QAAQ,MAAO,MAAM,OAAmC,GAAG,GAA4B,MAAS;AAGlG,SAAS,UAAU,OAA0C;AAC3D,QAAM,WAAW,MAAM;AAGvB,QAAM,MAAM,QAAa,OAAO,EAAE,GAAI,WAA2C,SAAS,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC;AACtH,MAAI,OAAsB;AAC1B,MAAI;AAAE,WAAO,MAAM,iBAAiB;AAAA,EAAG,QAAQ;AAAA,EAAwE;AACvH,QAAM,OAAO,UAAU;AACvB,QAAM,KAAK,UAAU;AACrB,SAAO;AAAA,IACL;AAAA,IAAM;AAAA,IACN,WAAW,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;AAAA,IAC7C,KAAK,IAAI,OAAO;AAAA,IAChB,SAAS,IAAI,WAAW;AAAA,IACxB,MAAM,IAAI,2BAA2B;AAAA;AAAA,IAErC,aAAa,IAAI,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,EAC5E;AACF;AAOO,SAAS,OAAO,OAA+B,CAAC,GAAW;AAChE,QAAM,MAAM,kBAAkB,EAAE,KAAK,eAAe,KAAK,QAAQ,KAAK,GAAG,IAAI;AAC7E,YAAU,IAAI,GAAG;AACjB,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AAInC,QAAI,MAAM,aAAc,QAAO,QAAQ,KAAK;AAC5C,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,SAAS,UAAU,KAAK,CAAC;AAC1D,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK;AAC5B,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,YAAQ,MAAM;AACZ,MAAC,MAAM,OAAmC,GAAG,IAAI;AAGjD,UAAI,KAAK,iBAAiB,KAAK,KAAK;AAClC,cAAM,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AAAA,UAC1C,MAAM;AAAA,UAAK,QAAQ;AAAA,UAAiB,UAAU;AAAA,UAAM,UAAU;AAAA,UAAO,QAAQ,IAAI,IAAI,MAAM,QAAQ,GAAG,EAAE,aAAa;AAAA,QACvH,CAAC;AAAA,MACH;AAAA,IACF,GAAG,MAAS;AACZ,UAAM,MAAM,MAAM,QAAQ,KAAK;AAC/B,QAAI,MAAM,MAAM,SAAS,MAAM,IAAI,MAAM;AACzC,WAAO;AAAA,EACT;AACF;AAOO,IAAM,QAAQ,CAAC,OAAqB,IAAY,SAA4C,UAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAG7H,IAAM,YAAY,CAAC,UAAgC,cAAc,OAAO,KAAK,CAAC;AAG9E,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":[]}

package/package.json

@@ -0,0 +1,40 @@
+{
+  "name": "@camada/sveltekit",
+  "version": "0.1.0",
+  "license": "MIT",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "description": "camada SDK for SvelteKit (hooks.server.ts handle): snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping on Cloudflare",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "dependencies": {
+    "@camada/core": "^0.3.0",
+    "@camada/browser": "^0.2.0"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": ">=2"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/camada-app/camada-sveltekit.git"
+  },
+  "homepage": "https://github.com/camada-app/camada-sveltekit#readme",
+  "bugs": {
+    "url": "https://github.com/camada-app/camada-sveltekit/issues"
+  }
+}