@gradial/aci 0.1.30 → 0.1.33

package/dist/next/middleware.js

@@ -2,9 +2,15 @@ import { NextResponse } from 'next/server.js';
 import { getUncachedEdgeConfigValue } from './edge-config.js';
 import { PREVIEW_TOKEN_COOKIE, PREVIEW_RELEASE_COOKIE, extractPreviewToken, resolvePreviewContext, createPreviewCookies, previewSignKey, } from '../preview/core.js';
 const RELEASE_SCOPED_PREFIX = '/__r';
+// CMS document paths (robots.txt, sitemap.xml) pass through the middleware
+// and are served by Next.js rewrites configured in withAci().
+const CMS_DOCUMENT_PATHS = new Set(['/robots.txt', '/sitemap.xml']);
 const PUBLIC_PATHS = new Set(typeof __ACI_PUBLIC_PATHS__ !== 'undefined' ? __ACI_PUBLIC_PATHS__ : []);
 const PASSTHROUGH_ROUTES = (typeof __ACI_PASSTHROUGH_ROUTES__ !== 'undefined' ? __ACI_PASSTHROUGH_ROUTES__ : []);
-export function createGradialMiddleware(config = {}) {
+const ASSET_PREFIX = typeof __ACI_ASSET_PREFIX__ !== 'undefined'
+    ? __ACI_ASSET_PREFIX__
+    : '/.gradial-dam';
+export function createGradialMiddleware(config) {
     return async function middleware(request) {
         const url = request.nextUrl;
         // ?leave_preview=1 → clear cookies, redirect to clean URL
@@ -18,6 +24,14 @@ export function createGradialMiddleware(config = {}) {
         if (PUBLIC_PATHS.has(url.pathname)) {
             return NextResponse.next();
         }
+        if (CMS_DOCUMENT_PATHS.has(url.pathname)) {
+            return NextResponse.next();
+        }
+        // DAM asset requests are NOT release-scoped; they rewrite to S3 via
+        // withAci() rewrites. Pass them through so the rewrite fires.
+        if (isAssetPath(url.pathname)) {
+            return NextResponse.next();
+        }
         if (isPassthroughRoute(url.pathname)) {
             return NextResponse.next();
         }
@@ -31,11 +45,24 @@ export function createGradialMiddleware(config = {}) {
         // Try preview token first; if valid, use that release.
         // If no token or invalid, fall through to active release from edge config.
         const preview = await resolvePreviewFromRequest(request, config);
+        // Local file-backed development has no release-indexed artifact tree. A
+        // valid preview token is still useful there—it proves signing, expiry, and
+        // cookie propagation—but rewriting to /__r/{releaseId}/{path} would create
+        // a path the file provider cannot serve. Keep the public route and mark
+        // the response private, matching preview's cache semantics.
+        if (process.env.ACI_CONTENT_PROVIDER === 'file') {
+            const response = NextResponse.next();
+            const previewReleaseID = preview?.releaseId;
+            if (preview?.token && preview.isPreview && previewReleaseID) {
+                response.headers.set('Cache-Control', 'private, no-store');
+                for (const cookie of createPreviewCookies(preview.token, previewReleaseID)) {
+                    response.cookies.set(cookie.name, cookie.value, cookie.options);
+                }
+            }
+            return response;
+        }
         const releaseId = preview?.releaseId || await activeReleaseFromEdgeConfig(config);
         if (!releaseId) {
-            if (process.env.ACI_CONTENT_PROVIDER === 'file') {
-                return NextResponse.next();
-            }
             if (!siteIdForConfig(config)) {
                 return new Response('ACI site id is not configured', {
                     status: 500,
@@ -61,7 +88,7 @@ export function createGradialMiddleware(config = {}) {
             return response;
         }
         // Rewrite public URL to release-scoped internal path for CDN cache isolation.
-        // Each release gets a unique URL (/__r/{releaseId}/routes/...) so the CDN
+        // Each release gets a unique URL (/__r/{releaseId}/...) so the CDN
         // cache key is per-release. New release = new URL = cache miss = fresh content.
         const response = rewriteToReleaseScopedPath(request, releaseId, Boolean(preview?.isPreview));
         // Persist preview token as cookie so navigation stays in preview
@@ -159,7 +186,7 @@ async function activeReleaseFromEdgeConfig(config) {
     return clampRelease(active.releaseId, active.sequence || 0, compatibility);
 }
 function siteIdForConfig(config) {
-    return config.siteId || process.env.ACI_SITE_ID || '';
+    return config.siteId;
 }
 async function getEdgeConfigJSON(edgeConfig, key) {
     const value = await getEdgeConfigValue(edgeConfig, key);
@@ -216,6 +243,9 @@ function clampRelease(activeReleaseId, activeSequence, compatibility) {
 function edgeKeySegment(value) {
     return value.replace(/[^A-Za-z0-9_-]/g, '_');
 }
+function isAssetPath(pathname) {
+    return pathname === ASSET_PREFIX || pathname.startsWith(`${ASSET_PREFIX}/`);
+}
 function isPassthroughRoute(pathname) {
     return PASSTHROUGH_ROUTES.some((route) => routeMatches(pathname, route));
 }
@@ -241,6 +271,9 @@ function normalizeRoutePath(value) {
     const pathname = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
     return pathname.replace(/\/{2,}/g, '/').replace(/\/$/, '') || '/';
 }
+export const aciMiddlewareMatcher = [
+    '/((?!_next(?:/|$)|api(?:/|$)|favicon\\.ico$|\\.gradial-dam(?:/|$)).*)',
+];
 export const config = {
-    matcher: ['/((?!_next(?:/|$)|api(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)'],
+    matcher: aciMiddlewareMatcher,
 };

package/dist/next/page.d.ts

@@ -30,11 +30,19 @@ export interface CreatePageOptions {
  * When the site config enables personalization, the page tree also carries
  * the collect script tag exactly once per page (design/04 contract tag).
  *
- * Release-scoped routes: when the middleware rewrites a public URL to
- * `/__r/{releaseId}/routes/{path}`, the catch-all slug becomes
- * `['__r', releaseId, 'routes', ...pathSegments]`. createPage detects this
- * prefix, extracts the releaseId, and passes it to the content loader. This
- * gives each release a unique CDN cache key without a separate route folder.
+ * Release-scoped routes (production): the middleware rewrites a public URL
+ * to `/__r/{releaseId}/routes/{path}`. The optional catch-all `[[...slug]]`
+ * receives `['__r', releaseId, 'routes', ...pathSegments]`. createPage
+ * extracts the releaseId and passes it to the content loader, giving
+ * each release a unique CDN cache key without a separate route folder.
+ * The `routes` namespace segment leaves room for future siblings under
+ * the release prefix (e.g. `/__r/{releaseId}/assets/*`).
+ *
+ * Dev pass-through (ACI_CONTENT_PROVIDER=file): the middleware passes
+ * requests through unrewritten, so `/` arrives with an empty/undefined
+ * slug and `/about` arrives as `['about']`. The optional catch-all
+ * `[[...slug]]` handles both cases. No releaseId is present; the file
+ * provider serves content directly from disk.
  *
  * Layout slots: createPage loads the page's layout, iterates all slots, and
  * fills each from the page's regions. If a slot is empty, it falls back to

package/dist/next/page.js

@@ -1,7 +1,7 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { notFound } from 'next/navigation.js';
 import { Fragment } from 'react';
-import { PageNotFoundError, routeFromNextParams, getRenderInput, getLayout, getFragment, } from './server.js';
+import { PageNotFoundError, getRenderInput, getLayout, getFragment, } from './server.js';
 import { routeMetadataForContent, resolveSlots, } from '../content/index.js';
 import { renderBlocks } from './render.js';
 import { CollectScript } from './collect-script.js';
@@ -25,11 +25,19 @@ import { CollectScript } from './collect-script.js';
  * When the site config enables personalization, the page tree also carries
  * the collect script tag exactly once per page (design/04 contract tag).
  *
- * Release-scoped routes: when the middleware rewrites a public URL to
- * `/__r/{releaseId}/routes/{path}`, the catch-all slug becomes
- * `['__r', releaseId, 'routes', ...pathSegments]`. createPage detects this
- * prefix, extracts the releaseId, and passes it to the content loader. This
- * gives each release a unique CDN cache key without a separate route folder.
+ * Release-scoped routes (production): the middleware rewrites a public URL
+ * to `/__r/{releaseId}/routes/{path}`. The optional catch-all `[[...slug]]`
+ * receives `['__r', releaseId, 'routes', ...pathSegments]`. createPage
+ * extracts the releaseId and passes it to the content loader, giving
+ * each release a unique CDN cache key without a separate route folder.
+ * The `routes` namespace segment leaves room for future siblings under
+ * the release prefix (e.g. `/__r/{releaseId}/assets/*`).
+ *
+ * Dev pass-through (ACI_CONTENT_PROVIDER=file): the middleware passes
+ * requests through unrewritten, so `/` arrives with an empty/undefined
+ * slug and `/about` arrives as `['about']`. The optional catch-all
+ * `[[...slug]]` handles both cases. No releaseId is present; the file
+ * provider serves content directly from disk.
  *
  * Layout slots: createPage loads the page's layout, iterates all slots, and
  * fills each from the page's regions. If a slot is empty, it falls back to
@@ -87,26 +95,43 @@ export function createPage(registry, options) {
     };
 }
 /**
- * Resolves the logical route and optional releaseId from Next.js catch-all
- * params. When the middleware rewrites to /__r/{releaseId}/routes/{path},
- * the slug is ['__r', releaseId, 'routes', ...pathSegments]. Otherwise the
- * slug is treated as the public route directly.
+ * Resolves the logical route and releaseId from Next.js catch-all params.
+ *
+ * Two shapes are supported:
+ *
+ * 1. **Rewritten (production):** middleware rewrites a public URL to
+ *    `/__r/{releaseId}/routes/{path}`, so slug is
+ *    `['__r', releaseId, 'routes', ...pathSegments]`. The releaseId is
+ *    extracted; the remaining segments form the content route. The `routes`
+ *    segment is the namespace for page routes (siblings like `assets/` live
+ *    under the same release prefix).
+ *
+ * 2. **Dev pass-through (ACI_CONTENT_PROVIDER=file):** middleware passes
+ *    requests through unrewritten, so the slug is the raw public path
+ *    segments (possibly empty/undefined for `/`). No releaseId is present;
+ *    the file provider serves content from disk.
  */
 async function resolveRouteAndRelease(params) {
     const resolved = await params;
-    const slug = resolved?.slug;
-    if (slug && slug.length >= 3 && slug[0] === '__r' && slug[2] === 'routes') {
+    const slug = resolved.slug ?? [];
+    if (slug.length >= 2 && slug[0] === '__r') {
         const releaseId = decodeURIComponent(slug[1]);
         if (!releaseId || releaseId.includes('/') || releaseId === '.' || releaseId === '..') {
             return { route: '/' };
         }
-        const pathSegments = slug.slice(3);
-        if (pathSegments.length === 0)
+        // Skip the 'routes' namespace segment when present.
+        const rest = slug.length >= 3 && slug[2] === 'routes' ? slug.slice(3) : slug.slice(2);
+        if (rest.length === 0)
             return { route: '/', releaseId };
-        if (pathSegments.some((s) => s === '' || s === '.' || s === '..'))
+        if (rest.some((s) => s === '' || s === '.' || s === '..'))
             return { route: '/' };
-        return { route: `/${pathSegments.join('/')}/`, releaseId };
+        return { route: `/${rest.join('/')}/`, releaseId };
     }
-    const route = await routeFromNextParams(params);
+    const route = routeFromSlug(slug);
     return { route };
 }
+function routeFromSlug(slug) {
+    if (slug.length === 0)
+        return '/';
+    return `/${slug.join('/')}/`;
+}

package/dist/next/server.d.ts

@@ -34,7 +34,7 @@ export declare function getRoutes(config?: FetchConfig): Promise<string[]>;
 export declare function getRenderInput<TPage, TSite extends SiteConfig = SiteConfig>(route?: string, config?: FetchConfig): Promise<ServerRenderInput<TPage, TSite>>;
 export declare function getPageRuntimeRenderInput(): Promise<RenderInput | null>;
 export { isPreviewMode } from './preview-mode.js';
-export declare function routeFromNextParams(params?: Promise<{
+export declare function routeFromNextParams(params: Promise<{
     slug?: string[];
 }> | {
     slug?: string[];

package/dist/next/server.js

@@ -10,6 +10,9 @@ export async function getPage(route = '', config = {}) {
     if (runtimeInput)
         return runtimeInput.page;
     const provider = await resolveProviderWithFallback(config);
+    const variantPage = await pageFromFunctionRef(provider);
+    if (variantPage !== null)
+        return variantPage;
     return await provider.getPage(route);
 }
 export async function getSiteConfig(config = {}) {
@@ -53,7 +56,7 @@ export async function getRenderInput(route = '/', config = {}) {
     // Cache shared resources (manifest, siteConfig) but not per-page content
     // Page-level caching is handled by CDN
     const [page, siteConfig] = await Promise.all([
-        provider.getPage(route),
+        pageFromFunctionRef(provider).then((variantPage) => variantPage ?? provider.getPage(route)),
         getCachedSiteConfig(provider),
     ]);
     return {
@@ -73,23 +76,44 @@ export async function getPageRuntimeRenderInput() {
         return null;
     }
 }
+// The personalization edge proxies framework-origin requests with
+// X-Baremetal-Function-Ref naming the exact page payload its decision
+// selected (base or variant). When present, the SSR render must use that
+// payload — otherwise every visitor gets the base page and edge decisioning
+// is cosmetic. The S3 provider only serves refs the release manifest
+// declares.
+const BAREMETAL_FUNCTION_REF_HEADER = 'x-baremetal-function-ref';
+async function pageFromFunctionRef(provider) {
+    if (!(provider instanceof S3ContentProvider))
+        return null;
+    let ref = '';
+    try {
+        const current = await headers();
+        ref = (current.get(BAREMETAL_FUNCTION_REF_HEADER) || '').trim();
+    }
+    catch {
+        return null;
+    }
+    if (!ref)
+        return null;
+    return await provider.getPageByRef(ref);
+}
 export { isPreviewMode } from './preview-mode.js';
 export async function routeFromNextParams(params) {
-    if (!params)
-        return '/';
     const resolved = await params;
-    if (!resolved.slug || resolved.slug.length === 0)
+    const slug = resolved.slug ?? [];
+    if (slug.length === 0)
         return '/';
-    return `/${resolved.slug.join('/')}/`;
+    return `/${slug.join('/')}/`;
 }
 export async function generateStaticParams() {
     const { FileContentProvider } = await import('../providers/file.js');
     const provider = new FileContentProvider();
     const routes = await provider.listRoutes();
-    return routes
-        .filter((entry) => entry.path !== '/')
-        .map((entry) => ({
-        slug: entry.path.replace(/^\/|\/$/g, '').split('/'),
+    return routes.map((entry) => ({
+        slug: entry.path === '/'
+            ? ['index']
+            : entry.path.replace(/^\/|\/$/g, '').split('/'),
     }));
 }
 export class ReleaseAssetNotFoundError extends Error {

package/dist/providers/s3.d.ts

@@ -16,6 +16,13 @@ export declare class S3ContentProvider implements ContentProvider {
     listRoutes(): Promise<RouteEntry[]>;
     getSiteConfig<T = unknown>(): Promise<T>;
     getPage<T = unknown>(route: string): Promise<T>;
+    /**
+     * getPageByRef serves the exact payload the edge selected (the
+     * X-Baremetal-Function-Ref contract): base page or variant. Only refs the
+     * release manifest declares are served — the header names published
+     * content, it cannot address arbitrary keys.
+     */
+    getPageByRef<T = unknown>(payloadRef: string): Promise<T>;
     getFragment<T = unknown>(id: string): Promise<T>;
     getLayout<T = unknown>(name: string): Promise<T>;
     manifest(): Promise<CompiledManifest>;

package/dist/providers/s3.js

@@ -32,6 +32,26 @@ export class S3ContentProvider {
             throw new PageNotFoundError(route, error);
         }
     }
+    /**
+     * getPageByRef serves the exact payload the edge selected (the
+     * X-Baremetal-Function-Ref contract): base page or variant. Only refs the
+     * release manifest declares are served — the header names published
+     * content, it cannot address arbitrary keys.
+     */
+    async getPageByRef(payloadRef) {
+        const manifest = await this.manifest();
+        const known = Object.values(manifest.routes).some((entry) => entry.payloadRef === payloadRef ||
+            Object.values(entry.variants ?? {}).some((variant) => variant.payloadRef === payloadRef));
+        if (!known) {
+            throw new PageNotFoundError(payloadRef);
+        }
+        try {
+            return await this.getJSON(payloadRef);
+        }
+        catch (error) {
+            throw new PageNotFoundError(payloadRef, error);
+        }
+    }
     async getFragment(id) {
         const manifest = await this.manifest();
         const entry = manifest.fragments[id];

package/dist/testing/conformance/checks.d.ts

@@ -0,0 +1,12 @@
+import type { ConformanceCheckResult, ConformanceCheckName, ConformanceContext } from './types.js';
+export declare function checkConfig(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkRegistry(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkPageEntry(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkMiddleware(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkNoFileContentProvider(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkNoCustomContent(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkNoLegacyAssetRoute(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkBuildSucceeds(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkContentCompile(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare function checkSdkVersion(ctx: ConformanceContext): ConformanceCheckResult[];
+export declare const CHECK_REGISTRY: Record<ConformanceCheckName, (ctx: ConformanceContext) => ConformanceCheckResult[]>;