@camada/sveltekit 0.1.0 → 0.1.2

package/README.md

@@ -6,7 +6,9 @@ proof-of-work challenge page and beacon, records the outcomes your actions know
 ships wire events off the response path — through `waitUntil` on Cloudflare, in the background
 on Node. Fails open by design — a camada outage or bug never 5xxes your app.
 
-Not yet on npm — consumed via a `file:` dependency from a sibling checkout.
+```sh
+npm install @camada/sveltekit
+```
 
 ## Quickstart
 

package/dist/index.cjs

@@ -44,7 +44,7 @@ var import_iife_string = __toESM(require("@camada/browser/iife-string"), 1);
 
 // package.json
 var name = "@camada/sveltekit";
-var version = "0.1.0";
+var version = "0.1.2";
 
 // src/version.ts
 var SDK_ID = `${name}/${version}`;
@@ -85,19 +85,14 @@ function camada(opts = {}) {
     const vars = r.vars;
     (0, import_core.guarded)(() => {
       event.locals[VAR] = vars;
-      if (vars.sessionCookie && vars.sid) {
-        event.cookies.set(import_fetch.SESSION_COOKIE, vars.sid, {
-          path: "/",
-          maxAge: import_fetch.SESSION_MAX_AGE,
-          httpOnly: true,
-          sameSite: "lax",
-          secure: new URL(event.request.url).protocol === "https:"
-        });
-      }
     }, void 0);
     const res = await resolve(event);
-    cam.after(event.request, vars, res.status);
-    return res;
+    const out = (0, import_core.guarded)(() => vars.sessionCookie ? (0, import_fetch.withSetCookie)(res, vars.sessionCookie) : res, res);
+    if (out.headers.has("etag")) {
+      cam.after(event.request, vars, out.status);
+      return (0, import_core.guarded)(() => (0, import_fetch.withRid)(out, vars), out);
+    }
+    return cam.finish(event.request, vars, out);
   };
 }
 var track = (event, et, data) => (0, import_fetch.track)(slotOf(event), et, data);

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/sveltekit — the one-line install for a SvelteKit app, in src/hooks.server.ts:\n//   export const handle = camada();   // env: CAMADA_KEY (+ CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL in dev)\n//   scriptTag(event)                  // the first-party beacon, returned from a load() into the page\n//   track(event, 'login_failed', { user })   // an outcome the wire cannot show\nexport { camada, track, scriptTag, resetCamada, type CamadaSvelteKitOptions, type CamadaSvelteKitVars } from './camada.js';\n","// @camada/sveltekit — the `handle` hook that binds @camada/core/fetch to a SvelteKit app. The\n// pipeline (verdict, block, challenge, beacon, the event) lives in core; this file only says what\n// SvelteKit knows: the adapter-resolved client address, the per-request env and execution context\n// an edge adapter hands over, the cookie API, and `event.locals` as the per-request slot.\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport { guarded, TAP_SVELTEKIT } from '@camada/core';\nimport { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaSvelteKitOptions = FetchCamadaOptions;\nexport type CamadaSvelteKitVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.locals\nconst instances = new Set<FetchCamada>();\n\ntype Env = Record<string, string | undefined>;\n\n/** What adapter-cloudflare puts on `event.platform`; every field is optional because other adapters put nothing there. */\ninterface CfPlatform {\n  env?: Env;\n  context?: { waitUntil(p: Promise<unknown>): void };\n  cf?: { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string };\n}\n\nconst slotOf = (event: RequestEvent): FetchVars | undefined =>\n  guarded(() => (event.locals as Record<string, unknown>)[VAR] as FetchVars | undefined, undefined);\n\n/** Everything the runtime vouches for. Nothing here is read from a client header. */\nfunction contextOf(event: RequestEvent): FetchRequestContext {\n  const platform = event.platform as CfPlatform | undefined;\n  // process.env on adapter-node (and nodejs_compat Workers), the bindings on adapter-cloudflare;\n  // a binding can be a KV namespace, so the merge is guarded and core reads only CAMADA_* keys.\n  const env = guarded<Env>(() => ({ ...(globalThis as { process?: { env?: Env } }).process?.env, ...platform?.env }), {});\n  let peer: string | null = null;\n  try { peer = event.getClientAddress(); } catch { /* prerendering, or an adapter with no socket: nothing vouched for */ }\n  const exec = platform?.context;\n  const cf = platform?.cf;\n  return {\n    peer, env,\n    waitUntil: exec ? (p) => exec.waitUntil(p) : undefined,\n    asn: cf?.asn ?? null,\n    country: cf?.country ?? null,\n    tlsx: cf?.tlsClientExtensionsSha1 ?? null,\n    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.\n    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n  };\n}\n\n/**\n * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a\n * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from\n * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.\n */\nexport function camada(opts: CamadaSvelteKitOptions = {}): Handle {\n  const cam = createFetchCamada({ tap: TAP_SVELTEKIT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the handle may run on edge/serverless\n  instances.add(cam);\n  return async ({ event, resolve }) => {\n    // A server-side `event.fetch` to the app's own routes runs the handle again on a fresh event\n    // with no user-agent or accept: one page view is one event, and the page-level verdict must\n    // not be re-applied to the server's own load().\n    if (event.isSubRequest) return resolve(event);\n    const r = await cam.before(event.request, contextOf(event));\n    if (!r) return resolve(event);\n    if (r.response) return r.response;\n    const vars = r.vars;\n    guarded(() => {\n      (event.locals as Record<string, unknown>)[VAR] = vars;\n      // The framework cookie API: SvelteKit adds the header to whatever resolve() returns, so a\n      // redirect or an immutable Response needs no rebuilding here.\n      if (vars.sessionCookie && vars.sid) {\n        event.cookies.set(SESSION_COOKIE, vars.sid, {\n          path: '/', maxAge: SESSION_MAX_AGE, httpOnly: true, sameSite: 'lax', secure: new URL(event.request.url).protocol === 'https:',\n        });\n      }\n    }, undefined);\n    const res = await resolve(event);\n    cam.after(event.request, vars, res.status);\n    return res;\n  };\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,\n * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier\n * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.\n */\nexport const track = (event: RequestEvent, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: RequestEvent): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine of every handle this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/sveltekit\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for SvelteKit (hooks.server.ts handle): snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping on Cloudflare\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"@sveltejs/kit\": \">=2\"\n  },\n  \"devDependencies\": {\n    \"@sveltejs/kit\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"svelte\": \"^5.0.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vite\": \"^8.0.0\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,kBAAuC;AACvC,mBAAwM;AACxM,yBAAiB;;;ACNf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFUxC,IAAM,MAAM;AACZ,IAAM,YAAY,oBAAI,IAAiB;AAWvC,IAAM,SAAS,CAAC,cACd,qBAAQ,MAAO,MAAM,OAAmC,GAAG,GAA4B,MAAS;AAGlG,SAAS,UAAU,OAA0C;AAC3D,QAAM,WAAW,MAAM;AAGvB,QAAM,UAAM,qBAAa,OAAO,EAAE,GAAI,WAA2C,SAAS,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC;AACtH,MAAI,OAAsB;AAC1B,MAAI;AAAE,WAAO,MAAM,iBAAiB;AAAA,EAAG,QAAQ;AAAA,EAAwE;AACvH,QAAM,OAAO,UAAU;AACvB,QAAM,KAAK,UAAU;AACrB,SAAO;AAAA,IACL;AAAA,IAAM;AAAA,IACN,WAAW,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;AAAA,IAC7C,KAAK,IAAI,OAAO;AAAA,IAChB,SAAS,IAAI,WAAW;AAAA,IACxB,MAAM,IAAI,2BAA2B;AAAA;AAAA,IAErC,aAAa,IAAI,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,EAC5E;AACF;AAOO,SAAS,OAAO,OAA+B,CAAC,GAAW;AAChE,QAAM,UAAM,gCAAkB,EAAE,KAAK,2BAAe,KAAK,QAAQ,yBAAAA,QAAK,GAAG,IAAI;AAC7E,YAAU,IAAI,GAAG;AACjB,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AAInC,QAAI,MAAM,aAAc,QAAO,QAAQ,KAAK;AAC5C,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,SAAS,UAAU,KAAK,CAAC;AAC1D,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK;AAC5B,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,6BAAQ,MAAM;AACZ,MAAC,MAAM,OAAmC,GAAG,IAAI;AAGjD,UAAI,KAAK,iBAAiB,KAAK,KAAK;AAClC,cAAM,QAAQ,IAAI,6BAAgB,KAAK,KAAK;AAAA,UAC1C,MAAM;AAAA,UAAK,QAAQ;AAAA,UAAiB,UAAU;AAAA,UAAM,UAAU;AAAA,UAAO,QAAQ,IAAI,IAAI,MAAM,QAAQ,GAAG,EAAE,aAAa;AAAA,QACvH,CAAC;AAAA,MACH;AAAA,IACF,GAAG,MAAS;AACZ,UAAM,MAAM,MAAM,QAAQ,KAAK;AAC/B,QAAI,MAAM,MAAM,SAAS,MAAM,IAAI,MAAM;AACzC,WAAO;AAAA,EACT;AACF;AAOO,IAAM,QAAQ,CAAC,OAAqB,IAAY,aAA4C,aAAAC,OAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAG7H,IAAM,YAAY,CAAC,cAAgC,aAAAC,WAAc,OAAO,KAAK,CAAC;AAG9E,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":["iife","coreTrack","coreScriptTag"]}
+{"version":3,"sources":["../src/index.ts","../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/sveltekit — the one-line install for a SvelteKit app, in src/hooks.server.ts:\n//   export const handle = camada();   // env: CAMADA_KEY (+ CAMADA_INGEST_URL / CAMADA_SNAPSHOT_URL in dev)\n//   scriptTag(event)                  // the first-party beacon, returned from a load() into the page\n//   track(event, 'login_failed', { user })   // an outcome the wire cannot show\nexport { camada, track, scriptTag, resetCamada, type CamadaSvelteKitOptions, type CamadaSvelteKitVars } from './camada.js';\n","// @camada/sveltekit — the `handle` hook that binds @camada/core/fetch to a SvelteKit app. The\n// pipeline (verdict, block, challenge, beacon, the event) lives in core; this file only says what\n// SvelteKit knows: the adapter-resolved client address, the per-request env and execution context\n// an edge adapter hands over, the cookie API, and `event.locals` as the per-request slot.\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport { guarded, TAP_SVELTEKIT } from '@camada/core';\nimport { createFetchCamada, withRid, withSetCookie, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaSvelteKitOptions = FetchCamadaOptions;\nexport type CamadaSvelteKitVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.locals\nconst instances = new Set<FetchCamada>();\n\ntype Env = Record<string, string | undefined>;\n\n/** What adapter-cloudflare puts on `event.platform`; every field is optional because other adapters put nothing there. */\ninterface CfPlatform {\n  env?: Env;\n  context?: { waitUntil(p: Promise<unknown>): void };\n  cf?: { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string };\n}\n\nconst slotOf = (event: RequestEvent): FetchVars | undefined =>\n  guarded(() => (event.locals as Record<string, unknown>)[VAR] as FetchVars | undefined, undefined);\n\n/** Everything the runtime vouches for. Nothing here is read from a client header. */\nfunction contextOf(event: RequestEvent): FetchRequestContext {\n  const platform = event.platform as CfPlatform | undefined;\n  // process.env on adapter-node (and nodejs_compat Workers), the bindings on adapter-cloudflare;\n  // a binding can be a KV namespace, so the merge is guarded and core reads only CAMADA_* keys.\n  const env = guarded<Env>(() => ({ ...(globalThis as { process?: { env?: Env } }).process?.env, ...platform?.env }), {});\n  let peer: string | null = null;\n  try { peer = event.getClientAddress(); } catch { /* prerendering, or an adapter with no socket: nothing vouched for */ }\n  const exec = platform?.context;\n  const cf = platform?.cf;\n  return {\n    peer, env,\n    waitUntil: exec ? (p) => exec.waitUntil(p) : undefined,\n    asn: cf?.asn ?? null,\n    country: cf?.country ?? null,\n    tlsx: cf?.tlsClientExtensionsSha1 ?? null,\n    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.\n    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n  };\n}\n\n/**\n * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a\n * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from\n * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.\n */\nexport function camada(opts: CamadaSvelteKitOptions = {}): Handle {\n  const cam = createFetchCamada({ tap: TAP_SVELTEKIT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the handle may run on edge/serverless\n  instances.add(cam);\n  return async ({ event, resolve }) => {\n    // A server-side `event.fetch` to the app's own routes runs the handle again on a fresh event\n    // with no user-agent or accept: one page view is one event, and the page-level verdict must\n    // not be re-applied to the server's own load().\n    if (event.isSubRequest) return resolve(event);\n    const r = await cam.before(event.request, contextOf(event));\n    if (!r) return resolve(event);\n    if (r.response) return r.response;\n    const vars = r.vars;\n    guarded(() => { (event.locals as Record<string, unknown>)[VAR] = vars; }, undefined);\n    // The _sfp cookie rides the response, not `event.cookies.set`: SvelteKit appends those in place\n    // after resolve(), which throws on an immutable Response (a `fetch()` result, `Response.redirect()`).\n    // withSetCookie copies such a response; the hook sees it, so the 500 never happens.\n    const res = await resolve(event);\n    // SvelteKit swaps a 200 carrying an etag for a bodiless 304 after this hook when the client's\n    // If-None-Match matches, dropping the body unread: waiting on it would never ship, so an\n    // etagged response ships now even when it is an event stream. (That 304 is built by SvelteKit\n    // from a fixed header allow-list, so it carries no x-rid; the hook cannot change that.)\n    const out = guarded(() => (vars.sessionCookie ? withSetCookie(res, vars.sessionCookie) : res), res);\n    if (out.headers.has('etag')) { cam.after(event.request, vars, out.status); return guarded(() => withRid(out, vars), out); }\n    return cam.finish(event.request, vars, out);   // an SSE body ships once it has gone out; anything else ships now, untouched\n  };\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,\n * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier\n * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.\n */\nexport const track = (event: RequestEvent, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: RequestEvent): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine of every handle this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/sveltekit\",\n  \"version\": \"0.1.2\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for SvelteKit (hooks.server.ts handle): snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping on Cloudflare\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"@sveltejs/kit\": \">=2\"\n  },\n  \"devDependencies\": {\n    \"@sveltejs/kit\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"svelte\": \"^5.0.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vite\": \"^8.0.0\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,kBAAuC;AACvC,mBAA+L;AAC/L,yBAAiB;;;ACNf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFUxC,IAAM,MAAM;AACZ,IAAM,YAAY,oBAAI,IAAiB;AAWvC,IAAM,SAAS,CAAC,cACd,qBAAQ,MAAO,MAAM,OAAmC,GAAG,GAA4B,MAAS;AAGlG,SAAS,UAAU,OAA0C;AAC3D,QAAM,WAAW,MAAM;AAGvB,QAAM,UAAM,qBAAa,OAAO,EAAE,GAAI,WAA2C,SAAS,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC;AACtH,MAAI,OAAsB;AAC1B,MAAI;AAAE,WAAO,MAAM,iBAAiB;AAAA,EAAG,QAAQ;AAAA,EAAwE;AACvH,QAAM,OAAO,UAAU;AACvB,QAAM,KAAK,UAAU;AACrB,SAAO;AAAA,IACL;AAAA,IAAM;AAAA,IACN,WAAW,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;AAAA,IAC7C,KAAK,IAAI,OAAO;AAAA,IAChB,SAAS,IAAI,WAAW;AAAA,IACxB,MAAM,IAAI,2BAA2B;AAAA;AAAA,IAErC,aAAa,IAAI,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,EAC5E;AACF;AAOO,SAAS,OAAO,OAA+B,CAAC,GAAW;AAChE,QAAM,UAAM,gCAAkB,EAAE,KAAK,2BAAe,KAAK,QAAQ,yBAAAA,QAAK,GAAG,IAAI;AAC7E,YAAU,IAAI,GAAG;AACjB,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AAInC,QAAI,MAAM,aAAc,QAAO,QAAQ,KAAK;AAC5C,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,SAAS,UAAU,KAAK,CAAC;AAC1D,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK;AAC5B,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,6BAAQ,MAAM;AAAE,MAAC,MAAM,OAAmC,GAAG,IAAI;AAAA,IAAM,GAAG,MAAS;AAInF,UAAM,MAAM,MAAM,QAAQ,KAAK;AAK/B,UAAM,UAAM,qBAAQ,MAAO,KAAK,oBAAgB,4BAAc,KAAK,KAAK,aAAa,IAAI,KAAM,GAAG;AAClG,QAAI,IAAI,QAAQ,IAAI,MAAM,GAAG;AAAE,UAAI,MAAM,MAAM,SAAS,MAAM,IAAI,MAAM;AAAG,iBAAO,qBAAQ,UAAM,sBAAQ,KAAK,IAAI,GAAG,GAAG;AAAA,IAAG;AAC1H,WAAO,IAAI,OAAO,MAAM,SAAS,MAAM,GAAG;AAAA,EAC5C;AACF;AAOO,IAAM,QAAQ,CAAC,OAAqB,IAAY,aAA4C,aAAAC,OAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAG7H,IAAM,YAAY,CAAC,cAAgC,aAAAC,WAAc,OAAO,KAAK,CAAC;AAG9E,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":["iife","coreTrack","coreScriptTag"]}

package/dist/index.js

@@ -1,11 +1,11 @@
 // src/camada.ts
 import { guarded, TAP_SVELTEKIT } from "@camada/core";
-import { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag } from "@camada/core/fetch";
+import { createFetchCamada, withRid, withSetCookie, track as coreTrack, scriptTag as coreScriptTag } from "@camada/core/fetch";
 import iife from "@camada/browser/iife-string";
 
 // package.json
 var name = "@camada/sveltekit";
-var version = "0.1.0";
+var version = "0.1.2";
 
 // src/version.ts
 var SDK_ID = `${name}/${version}`;
@@ -46,19 +46,14 @@ function camada(opts = {}) {
     const vars = r.vars;
     guarded(() => {
       event.locals[VAR] = vars;
-      if (vars.sessionCookie && vars.sid) {
-        event.cookies.set(SESSION_COOKIE, vars.sid, {
-          path: "/",
-          maxAge: SESSION_MAX_AGE,
-          httpOnly: true,
-          sameSite: "lax",
-          secure: new URL(event.request.url).protocol === "https:"
-        });
-      }
     }, void 0);
     const res = await resolve(event);
-    cam.after(event.request, vars, res.status);
-    return res;
+    const out = guarded(() => vars.sessionCookie ? withSetCookie(res, vars.sessionCookie) : res, res);
+    if (out.headers.has("etag")) {
+      cam.after(event.request, vars, out.status);
+      return guarded(() => withRid(out, vars), out);
+    }
+    return cam.finish(event.request, vars, out);
   };
 }
 var track = (event, et, data) => coreTrack(slotOf(event), et, data);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/sveltekit — the `handle` hook that binds @camada/core/fetch to a SvelteKit app. The\n// pipeline (verdict, block, challenge, beacon, the event) lives in core; this file only says what\n// SvelteKit knows: the adapter-resolved client address, the per-request env and execution context\n// an edge adapter hands over, the cookie API, and `event.locals` as the per-request slot.\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport { guarded, TAP_SVELTEKIT } from '@camada/core';\nimport { createFetchCamada, SESSION_COOKIE, SESSION_MAX_AGE, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaSvelteKitOptions = FetchCamadaOptions;\nexport type CamadaSvelteKitVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.locals\nconst instances = new Set<FetchCamada>();\n\ntype Env = Record<string, string | undefined>;\n\n/** What adapter-cloudflare puts on `event.platform`; every field is optional because other adapters put nothing there. */\ninterface CfPlatform {\n  env?: Env;\n  context?: { waitUntil(p: Promise<unknown>): void };\n  cf?: { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string };\n}\n\nconst slotOf = (event: RequestEvent): FetchVars | undefined =>\n  guarded(() => (event.locals as Record<string, unknown>)[VAR] as FetchVars | undefined, undefined);\n\n/** Everything the runtime vouches for. Nothing here is read from a client header. */\nfunction contextOf(event: RequestEvent): FetchRequestContext {\n  const platform = event.platform as CfPlatform | undefined;\n  // process.env on adapter-node (and nodejs_compat Workers), the bindings on adapter-cloudflare;\n  // a binding can be a KV namespace, so the merge is guarded and core reads only CAMADA_* keys.\n  const env = guarded<Env>(() => ({ ...(globalThis as { process?: { env?: Env } }).process?.env, ...platform?.env }), {});\n  let peer: string | null = null;\n  try { peer = event.getClientAddress(); } catch { /* prerendering, or an adapter with no socket: nothing vouched for */ }\n  const exec = platform?.context;\n  const cf = platform?.cf;\n  return {\n    peer, env,\n    waitUntil: exec ? (p) => exec.waitUntil(p) : undefined,\n    asn: cf?.asn ?? null,\n    country: cf?.country ?? null,\n    tlsx: cf?.tlsClientExtensionsSha1 ?? null,\n    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.\n    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n  };\n}\n\n/**\n * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a\n * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from\n * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.\n */\nexport function camada(opts: CamadaSvelteKitOptions = {}): Handle {\n  const cam = createFetchCamada({ tap: TAP_SVELTEKIT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the handle may run on edge/serverless\n  instances.add(cam);\n  return async ({ event, resolve }) => {\n    // A server-side `event.fetch` to the app's own routes runs the handle again on a fresh event\n    // with no user-agent or accept: one page view is one event, and the page-level verdict must\n    // not be re-applied to the server's own load().\n    if (event.isSubRequest) return resolve(event);\n    const r = await cam.before(event.request, contextOf(event));\n    if (!r) return resolve(event);\n    if (r.response) return r.response;\n    const vars = r.vars;\n    guarded(() => {\n      (event.locals as Record<string, unknown>)[VAR] = vars;\n      // The framework cookie API: SvelteKit adds the header to whatever resolve() returns, so a\n      // redirect or an immutable Response needs no rebuilding here.\n      if (vars.sessionCookie && vars.sid) {\n        event.cookies.set(SESSION_COOKIE, vars.sid, {\n          path: '/', maxAge: SESSION_MAX_AGE, httpOnly: true, sameSite: 'lax', secure: new URL(event.request.url).protocol === 'https:',\n        });\n      }\n    }, undefined);\n    const res = await resolve(event);\n    cam.after(event.request, vars, res.status);\n    return res;\n  };\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,\n * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier\n * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.\n */\nexport const track = (event: RequestEvent, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: RequestEvent): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine of every handle this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/sveltekit\",\n  \"version\": \"0.1.0\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for SvelteKit (hooks.server.ts handle): snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping on Cloudflare\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"@sveltejs/kit\": \">=2\"\n  },\n  \"devDependencies\": {\n    \"@sveltejs/kit\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"svelte\": \"^5.0.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vite\": \"^8.0.0\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";AAKA,SAAS,SAAS,qBAAqB;AACvC,SAAS,mBAAmB,gBAAgB,iBAAiB,SAAS,WAAW,aAAa,qBAA0G;AACxM,OAAO,UAAU;;;ACNf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFUxC,IAAM,MAAM;AACZ,IAAM,YAAY,oBAAI,IAAiB;AAWvC,IAAM,SAAS,CAAC,UACd,QAAQ,MAAO,MAAM,OAAmC,GAAG,GAA4B,MAAS;AAGlG,SAAS,UAAU,OAA0C;AAC3D,QAAM,WAAW,MAAM;AAGvB,QAAM,MAAM,QAAa,OAAO,EAAE,GAAI,WAA2C,SAAS,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC;AACtH,MAAI,OAAsB;AAC1B,MAAI;AAAE,WAAO,MAAM,iBAAiB;AAAA,EAAG,QAAQ;AAAA,EAAwE;AACvH,QAAM,OAAO,UAAU;AACvB,QAAM,KAAK,UAAU;AACrB,SAAO;AAAA,IACL;AAAA,IAAM;AAAA,IACN,WAAW,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;AAAA,IAC7C,KAAK,IAAI,OAAO;AAAA,IAChB,SAAS,IAAI,WAAW;AAAA,IACxB,MAAM,IAAI,2BAA2B;AAAA;AAAA,IAErC,aAAa,IAAI,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,EAC5E;AACF;AAOO,SAAS,OAAO,OAA+B,CAAC,GAAW;AAChE,QAAM,MAAM,kBAAkB,EAAE,KAAK,eAAe,KAAK,QAAQ,KAAK,GAAG,IAAI;AAC7E,YAAU,IAAI,GAAG;AACjB,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AAInC,QAAI,MAAM,aAAc,QAAO,QAAQ,KAAK;AAC5C,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,SAAS,UAAU,KAAK,CAAC;AAC1D,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK;AAC5B,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,YAAQ,MAAM;AACZ,MAAC,MAAM,OAAmC,GAAG,IAAI;AAGjD,UAAI,KAAK,iBAAiB,KAAK,KAAK;AAClC,cAAM,QAAQ,IAAI,gBAAgB,KAAK,KAAK;AAAA,UAC1C,MAAM;AAAA,UAAK,QAAQ;AAAA,UAAiB,UAAU;AAAA,UAAM,UAAU;AAAA,UAAO,QAAQ,IAAI,IAAI,MAAM,QAAQ,GAAG,EAAE,aAAa;AAAA,QACvH,CAAC;AAAA,MACH;AAAA,IACF,GAAG,MAAS;AACZ,UAAM,MAAM,MAAM,QAAQ,KAAK;AAC/B,QAAI,MAAM,MAAM,SAAS,MAAM,IAAI,MAAM;AACzC,WAAO;AAAA,EACT;AACF;AAOO,IAAM,QAAQ,CAAC,OAAqB,IAAY,SAA4C,UAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAG7H,IAAM,YAAY,CAAC,UAAgC,cAAc,OAAO,KAAK,CAAC;AAG9E,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":[]}
+{"version":3,"sources":["../src/camada.ts","../package.json","../src/version.ts"],"sourcesContent":["// @camada/sveltekit — the `handle` hook that binds @camada/core/fetch to a SvelteKit app. The\n// pipeline (verdict, block, challenge, beacon, the event) lives in core; this file only says what\n// SvelteKit knows: the adapter-resolved client address, the per-request env and execution context\n// an edge adapter hands over, the cookie API, and `event.locals` as the per-request slot.\nimport type { Handle, RequestEvent } from '@sveltejs/kit';\nimport { guarded, TAP_SVELTEKIT } from '@camada/core';\nimport { createFetchCamada, withRid, withSetCookie, track as coreTrack, scriptTag as coreScriptTag, type FetchCamada, type FetchCamadaOptions, type FetchRequestContext, type FetchVars } from '@camada/core/fetch';\nimport iife from '@camada/browser/iife-string';\nimport { SDK_ID } from './version.js';\n\nexport type CamadaSvelteKitOptions = FetchCamadaOptions;\nexport type CamadaSvelteKitVars = FetchVars;\n\nconst VAR = '__camada';   // private: track() and scriptTag() are the API, not event.locals\nconst instances = new Set<FetchCamada>();\n\ntype Env = Record<string, string | undefined>;\n\n/** What adapter-cloudflare puts on `event.platform`; every field is optional because other adapters put nothing there. */\ninterface CfPlatform {\n  env?: Env;\n  context?: { waitUntil(p: Promise<unknown>): void };\n  cf?: { asn?: number; country?: string; tlsClientExtensionsSha1?: string; httpProtocol?: string };\n}\n\nconst slotOf = (event: RequestEvent): FetchVars | undefined =>\n  guarded(() => (event.locals as Record<string, unknown>)[VAR] as FetchVars | undefined, undefined);\n\n/** Everything the runtime vouches for. Nothing here is read from a client header. */\nfunction contextOf(event: RequestEvent): FetchRequestContext {\n  const platform = event.platform as CfPlatform | undefined;\n  // process.env on adapter-node (and nodejs_compat Workers), the bindings on adapter-cloudflare;\n  // a binding can be a KV namespace, so the merge is guarded and core reads only CAMADA_* keys.\n  const env = guarded<Env>(() => ({ ...(globalThis as { process?: { env?: Env } }).process?.env, ...platform?.env }), {});\n  let peer: string | null = null;\n  try { peer = event.getClientAddress(); } catch { /* prerendering, or an adapter with no socket: nothing vouched for */ }\n  const exec = platform?.context;\n  const cf = platform?.cf;\n  return {\n    peer, env,\n    waitUntil: exec ? (p) => exec.waitUntil(p) : undefined,\n    asn: cf?.asn ?? null,\n    country: cf?.country ?? null,\n    tlsx: cf?.tlsClientExtensionsSha1 ?? null,\n    // The connection terminates at Cloudflare, so `cf.httpProtocol` is the visitor's own hop.\n    httpVersion: cf?.httpProtocol ? cf.httpProtocol.replace(/^HTTP\\//i, '') : null,\n  };\n}\n\n/**\n * The `handle` for `src/hooks.server.ts`: `export const handle = camada()`, or first in a\n * `sequence()`. Reads `CAMADA_KEY` (+ `CAMADA_INGEST_URL` / `CAMADA_SNAPSHOT_URL`) from\n * `process.env` or the Cloudflare bindings; inert without a key. One pipeline per call.\n */\nexport function camada(opts: CamadaSvelteKitOptions = {}): Handle {\n  const cam = createFetchCamada({ tap: TAP_SVELTEKIT, sdk: SDK_ID, iife }, opts);   // mode defaults to lazy in core: the handle may run on edge/serverless\n  instances.add(cam);\n  return async ({ event, resolve }) => {\n    // A server-side `event.fetch` to the app's own routes runs the handle again on a fresh event\n    // with no user-agent or accept: one page view is one event, and the page-level verdict must\n    // not be re-applied to the server's own load().\n    if (event.isSubRequest) return resolve(event);\n    const r = await cam.before(event.request, contextOf(event));\n    if (!r) return resolve(event);\n    if (r.response) return r.response;\n    const vars = r.vars;\n    guarded(() => { (event.locals as Record<string, unknown>)[VAR] = vars; }, undefined);\n    // The _sfp cookie rides the response, not `event.cookies.set`: SvelteKit appends those in place\n    // after resolve(), which throws on an immutable Response (a `fetch()` result, `Response.redirect()`).\n    // withSetCookie copies such a response; the hook sees it, so the 500 never happens.\n    const res = await resolve(event);\n    // SvelteKit swaps a 200 carrying an etag for a bodiless 304 after this hook when the client's\n    // If-None-Match matches, dropping the body unread: waiting on it would never ship, so an\n    // etagged response ships now even when it is an event stream. (That 304 is built by SvelteKit\n    // from a fixed header allow-list, so it carries no x-rid; the hook cannot change that.)\n    const out = guarded(() => (vars.sessionCookie ? withSetCookie(res, vars.sessionCookie) : res), res);\n    if (out.headers.has('etag')) { cam.after(event.request, vars, out.status); return guarded(() => withRid(out, vars), out); }\n    return cam.finish(event.request, vars, out);   // an SSE body ships once it has gone out; anything else ships now, untouched\n  };\n}\n\n/**\n * Records an outcome the app knows and the wire cannot show (`login_failed`, `signup`,\n * `payment_failed`, ...), joined to this request's event by rid and session. The user identifier\n * is HMAC-hashed in-process. Never throws; a no-op where the handle did not run for this event.\n */\nexport const track = (event: RequestEvent, et: string, data?: { user?: string }): Promise<void> => coreTrack(slotOf(event), et, data);\n\n/** The beacon `<script>` tag for this request's page; `''` where the handle did not run or the tenant turned the beacon off. */\nexport const scriptTag = (event: RequestEvent): string => coreScriptTag(slotOf(event));\n\n/** Test/reset hook: stops and drops every engine of every handle this module created. */\nexport function resetCamada(): void {\n  for (const cam of instances) cam.reset();\n}\n","{\n  \"name\": \"@camada/sveltekit\",\n  \"version\": \"0.1.2\",\n  \"license\": \"MIT\",\n  \"type\": \"module\",\n  \"engines\": {\n    \"node\": \">=20\"\n  },\n  \"files\": [\n    \"dist\",\n    \"README.md\",\n    \"LICENSE\"\n  ],\n  \"scripts\": {\n    \"build\": \"tsup\",\n    \"dev\": \"tsup --watch\",\n    \"test\": \"vitest run\",\n    \"check\": \"tsc --noEmit\"\n  },\n  \"description\": \"camada SDK for SvelteKit (hooks.server.ts handle): snapshot enforcement, first-party challenge and beacon, track() outcomes, waitUntil-flushed event shipping on Cloudflare\",\n  \"exports\": {\n    \".\": {\n      \"types\": \"./dist/index.d.ts\",\n      \"import\": \"./dist/index.js\",\n      \"require\": \"./dist/index.cjs\"\n    }\n  },\n  \"main\": \"./dist/index.cjs\",\n  \"module\": \"./dist/index.js\",\n  \"types\": \"./dist/index.d.ts\",\n  \"dependencies\": {\n    \"@camada/core\": \"file:../camada-core\",\n    \"@camada/browser\": \"file:../camada-browser\"\n  },\n  \"peerDependencies\": {\n    \"@sveltejs/kit\": \">=2\"\n  },\n  \"devDependencies\": {\n    \"@sveltejs/kit\": \"^2.0.0\",\n    \"@types/node\": \"^22.10.0\",\n    \"svelte\": \"^5.0.0\",\n    \"tsup\": \"^8.3.5\",\n    \"typescript\": \"^5.7.2\",\n    \"vite\": \"^8.0.0\",\n    \"vitest\": \"^3.0.0\"\n  }\n}\n","// The SDK's wire identity (SDK-03): x-camada-sdk: <package>/<version>. Named JSON imports are\n// inlined and tree-shaken by tsup at build, so dist carries two literals — no runtime fs read.\nimport { name, version } from '../package.json';\nexport const SDK_ID = `${name}/${version}`;\n"],"mappings":";AAKA,SAAS,SAAS,qBAAqB;AACvC,SAAS,mBAAmB,SAAS,eAAe,SAAS,WAAW,aAAa,qBAA0G;AAC/L,OAAO,UAAU;;;ACNf,WAAQ;AACR,cAAW;;;ACCN,IAAM,SAAS,GAAG,IAAI,IAAI,OAAO;;;AFUxC,IAAM,MAAM;AACZ,IAAM,YAAY,oBAAI,IAAiB;AAWvC,IAAM,SAAS,CAAC,UACd,QAAQ,MAAO,MAAM,OAAmC,GAAG,GAA4B,MAAS;AAGlG,SAAS,UAAU,OAA0C;AAC3D,QAAM,WAAW,MAAM;AAGvB,QAAM,MAAM,QAAa,OAAO,EAAE,GAAI,WAA2C,SAAS,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,CAAC;AACtH,MAAI,OAAsB;AAC1B,MAAI;AAAE,WAAO,MAAM,iBAAiB;AAAA,EAAG,QAAQ;AAAA,EAAwE;AACvH,QAAM,OAAO,UAAU;AACvB,QAAM,KAAK,UAAU;AACrB,SAAO;AAAA,IACL;AAAA,IAAM;AAAA,IACN,WAAW,OAAO,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI;AAAA,IAC7C,KAAK,IAAI,OAAO;AAAA,IAChB,SAAS,IAAI,WAAW;AAAA,IACxB,MAAM,IAAI,2BAA2B;AAAA;AAAA,IAErC,aAAa,IAAI,eAAe,GAAG,aAAa,QAAQ,YAAY,EAAE,IAAI;AAAA,EAC5E;AACF;AAOO,SAAS,OAAO,OAA+B,CAAC,GAAW;AAChE,QAAM,MAAM,kBAAkB,EAAE,KAAK,eAAe,KAAK,QAAQ,KAAK,GAAG,IAAI;AAC7E,YAAU,IAAI,GAAG;AACjB,SAAO,OAAO,EAAE,OAAO,QAAQ,MAAM;AAInC,QAAI,MAAM,aAAc,QAAO,QAAQ,KAAK;AAC5C,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,SAAS,UAAU,KAAK,CAAC;AAC1D,QAAI,CAAC,EAAG,QAAO,QAAQ,KAAK;AAC5B,QAAI,EAAE,SAAU,QAAO,EAAE;AACzB,UAAM,OAAO,EAAE;AACf,YAAQ,MAAM;AAAE,MAAC,MAAM,OAAmC,GAAG,IAAI;AAAA,IAAM,GAAG,MAAS;AAInF,UAAM,MAAM,MAAM,QAAQ,KAAK;AAK/B,UAAM,MAAM,QAAQ,MAAO,KAAK,gBAAgB,cAAc,KAAK,KAAK,aAAa,IAAI,KAAM,GAAG;AAClG,QAAI,IAAI,QAAQ,IAAI,MAAM,GAAG;AAAE,UAAI,MAAM,MAAM,SAAS,MAAM,IAAI,MAAM;AAAG,aAAO,QAAQ,MAAM,QAAQ,KAAK,IAAI,GAAG,GAAG;AAAA,IAAG;AAC1H,WAAO,IAAI,OAAO,MAAM,SAAS,MAAM,GAAG;AAAA,EAC5C;AACF;AAOO,IAAM,QAAQ,CAAC,OAAqB,IAAY,SAA4C,UAAU,OAAO,KAAK,GAAG,IAAI,IAAI;AAG7H,IAAM,YAAY,CAAC,UAAgC,cAAc,OAAO,KAAK,CAAC;AAG9E,SAAS,cAAoB;AAClC,aAAW,OAAO,UAAW,KAAI,MAAM;AACzC;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camada/sveltekit",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "license": "MIT",
   "type": "module",
   "engines": {
@@ -23,8 +23,8 @@
   "module": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@camada/core": "^0.3.0",
-    "@camada/browser": "^0.2.0"
+    "@camada/core": "^0.5.0",
+    "@camada/browser": "^0.3.0"
   },
   "peerDependencies": {
     "@sveltejs/kit": ">=2"