@gradial/aci 0.1.35 → 0.1.36

package/dist/next/middleware.d.ts

@@ -1,6 +1,13 @@
 import { type NextRequest } from 'next/server.js';
 export interface GradialMiddlewareConfig {
-    siteId: string;
+    /**
+     * Site identity for this deployment. Env-injected identity is valid —
+     * the platform sets ACI_SITE_ID per deployment, so passing a bare
+     * `process.env.ACI_SITE_ID` (which types as `string | undefined`) is
+     * supported. A missing value 500s cleanly at runtime
+     * ("ACI site id is not configured").
+     */
+    siteId: string | undefined;
     edgeConfig?: string;
     previewSignKey?: string;
     deploymentId?: string;

package/dist/next/middleware.js

@@ -186,7 +186,7 @@ async function activeReleaseFromEdgeConfig(config) {
     return clampRelease(active.releaseId, active.sequence || 0, compatibility);
 }
 function siteIdForConfig(config) {
-    return config.siteId;
+    return config.siteId ?? '';
 }
 async function getEdgeConfigJSON(edgeConfig, key) {
     const value = await getEdgeConfigValue(edgeConfig, key);

package/dist/testing/conformance/checks.js

@@ -89,6 +89,19 @@ function walkFiles(dir, predicate) {
 // ---------------------------------------------------------------------------
 export function checkConfig(ctx) {
     const results = [];
+    // Env-only site identity: in siteIdMode 'env' the platform owns tenant
+    // identity (terraform injects ACI_SITE_ID per deployment), so .aci.yaml
+    // must not carry a siteId at all — a leftover label pins the repo to one
+    // site and drifts silently from the deployed identity.
+    if (ctx.siteIdMode === 'env') {
+        const aciYaml = readTextFile(join(ctx.rootDir, '.aci.yaml'));
+        if (aciYaml !== null) {
+            const pinsSiteId = /^siteId\s*:/m.test(aciYaml);
+            results.push(!pinsSiteId
+                ? ok('config', '.aci.yaml does not pin a siteId (env-only identity)')
+                : fail('config', '.aci.yaml does not pin a siteId (env-only identity)', '.aci.yaml declares siteId but this repo uses siteIdMode "env": the platform owns site identity (ACI_SITE_ID is injected per deployment), so the manifest must not pin a site — delete the siteId line'));
+        }
+    }
     if (ctx.framework === 'next') {
         const configFile = findFirstExisting(ctx.rootDir, [
             'next.config.ts',
@@ -242,13 +255,65 @@ export function checkMiddleware(ctx) {
     results.push(usesSDKMiddleware
         ? ok('middleware', 'middleware uses createGradialMiddleware', rel)
         : fail('middleware', 'middleware uses createGradialMiddleware', rel + ' should use createGradialMiddleware from @gradial/aci/next/middleware'));
-    // Check if siteId is configured as a literal (no env var indirection)
-    if (ctx.siteId) {
-        const hasSiteIdLiteral = middlewareFile.content.includes(`siteId`) &&
-            !middlewareFile.content.includes('process.env');
-        results.push(hasSiteIdLiteral
-            ? ok('middleware', 'middleware configures siteId (literal)', rel)
-            : fail('middleware', 'middleware configures siteId (literal)', rel + ' should pass a literal siteId string to createGradialMiddleware (no env var indirection)'));
+    // Check that the siteId passed to createGradialMiddleware is canonical.
+    // Accepted forms depend on ctx.siteIdMode (default 'literal'):
+    //
+    // 'literal':
+    //   (a) a string literal exactly equal to ctx.siteId (the tenant's
+    //       canonical site id) — this is what the template stamps;
+    //   (b) process.env.ACI_SITE_ID || '<literal>' (or ?? instead of ||)
+    //       where the literal default is exactly ctx.siteId — the
+    //       multi-tenant/dev-mirror form: the deployment env supplies the
+    //       per-tenant identity, the default keeps local dev correct.
+    //
+    // 'env' (tenant-agnostic repos deployed to multiple sites): the ONLY
+    //   accepted form is exactly `siteId: process.env.ACI_SITE_ID`. The
+    //   platform owns tenant identity — terraform sets ACI_SITE_ID on every
+    //   deployment — and the runtime 500s cleanly if it is missing, so any
+    //   literal, fallback (|| / ??), other env var name, or computed
+    //   expression fails.
+    //
+    // Anything else (placeholder literal, wrong/missing default, other env
+    // var names, computed expressions) fails: a wrong siteId means the edge
+    // release-pointer key never matches and every live route 503s.
+    const siteIdMode = ctx.siteIdMode ?? 'literal';
+    if (siteIdMode === 'env') {
+        const label = 'middleware configures canonical siteId';
+        // Narrow the search to the createGradialMiddleware call when present so
+        // an unrelated siteId reference elsewhere in the file can't satisfy us.
+        const callIdx = middlewareFile.content.indexOf('createGradialMiddleware(');
+        const region = callIdx >= 0 ? middlewareFile.content.slice(callIdx) : middlewareFile.content;
+        // Exactly `siteId: process.env.ACI_SITE_ID` followed by the end of the
+        // property (`,` or `}`) — same object-property shape the literal-mode
+        // regexes target, but with nothing allowed after the env access.
+        const bareEnv = /siteId\s*:\s*process\.env\.ACI_SITE_ID\s*(?=[,}])/.test(region);
+        results.push(bareEnv
+            ? ok('middleware', label, `${rel} (env-only siteId)`)
+            : fail('middleware', label, `${rel}: middleware must read siteId only from process.env.ACI_SITE_ID (no literal or fallback) — the platform owns tenant identity and injects ACI_SITE_ID per deployment`));
+    }
+    else if (ctx.siteId) {
+        const label = 'middleware configures canonical siteId';
+        const expected = ctx.siteId;
+        const acceptedForms = `accepted forms: siteId: '${expected}' or ` +
+            `siteId: process.env.ACI_SITE_ID || '${expected}' (?? also accepted)`;
+        // Narrow the search to the createGradialMiddleware call when present so
+        // an unrelated siteId reference elsewhere in the file can't satisfy us.
+        const callIdx = middlewareFile.content.indexOf('createGradialMiddleware(');
+        const region = callIdx >= 0 ? middlewareFile.content.slice(callIdx) : middlewareFile.content;
+        // Form (b): process.env.ACI_SITE_ID || '<default>' (or ??).
+        const envMatch = region.match(/siteId\s*:\s*process\.env\.ACI_SITE_ID\s*(?:\|\||\?\?)\s*(['"`])((?:(?!\1).)*)\1/);
+        // Form (a): bare string literal (single/double quotes or backticks).
+        const literalMatch = region.match(/siteId\s*:\s*(['"`])((?:(?!\1).)*)\1/);
+        const configured = envMatch ? envMatch[2] : literalMatch ? literalMatch[2] : null;
+        if (configured === expected) {
+            results.push(ok('middleware', label, `${rel} (${envMatch ? 'env with canonical default' : 'canonical literal'})`));
+        }
+        else if (configured !== null) {
+            results.push(fail('middleware', label, `${rel}: siteId ${envMatch ? 'default ' : ''}is '${configured}' but the canonical site id is '${expected}'; ${acceptedForms}`));
+        }
+        else {
+            results.push(fail('middleware', label, `${rel}: siteId passed to createGradialMiddleware is not an accepted form (placeholder/computed expressions, other env vars, and process.env.ACI_SITE_ID without a literal default all fail); ${acceptedForms}`));
+        }
     }
     // Check that the middleware matcher is inlined (not imported) and matches
     // the SDK's canonical value. Next.js requires config.matcher to be

package/dist/testing/conformance/preset.js

@@ -58,6 +58,7 @@ export function runConformanceChecks(options) {
         framework: options.framework,
         siteId: options.siteId,
         rootDir: options.rootDir || process.cwd(),
+        siteIdMode: options.siteIdMode || 'literal',
     };
     const checks = resolveChecks(options.checks);
     const allResults = checks.flatMap((name) => {
@@ -84,6 +85,7 @@ export function conformancePreset(options) {
             framework: options.framework,
             siteId: options.siteId,
             rootDir: options.rootDir || process.cwd(),
+            siteIdMode: options.siteIdMode || 'literal',
         };
         for (const checkName of checks) {
             await t.test(checkName, () => {

package/dist/testing/conformance/types.d.ts

@@ -16,6 +16,21 @@ export interface ConformancePresetOptions {
     siteId: string;
     /** Root directory of the site project. Defaults to process.cwd(). */
     rootDir?: string;
+    /**
+     * How the middleware is expected to obtain its siteId. Defaults to 'literal'.
+     *
+     * - 'literal': the middleware passes the canonical siteId as a string
+     *   literal (or `process.env.ACI_SITE_ID || '<canonical>'` / `??` with the
+     *   canonical literal as the default). This is what the template stamps for
+     *   single-tenant repos.
+     * - 'env': the middleware must read siteId ONLY from the environment —
+     *   exactly `siteId: process.env.ACI_SITE_ID`, with no literal default, no
+     *   `||`/`??` fallback, no other env var names, and no computed
+     *   expressions. Use this for tenant-agnostic repos deployed to multiple
+     *   sites (the platform owns tenant identity and injects ACI_SITE_ID per
+     *   deployment; a missing env produces a clean 500 at runtime).
+     */
+    siteIdMode?: 'literal' | 'env';
     /**
      * Which checks to run. Defaults to all checks.
      * Pass an array to run only those checks, or an object to enable/disable individually.
@@ -42,4 +57,6 @@ export interface ConformanceContext {
     framework: ConformanceFramework;
     siteId: string;
     rootDir: string;
+    /** See ConformancePresetOptions.siteIdMode. Defaults to 'literal'. */
+    siteIdMode?: 'literal' | 'env';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradial/aci",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -127,12 +127,12 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@gradial/aci-cli-darwin-arm64": "0.1.35",
-    "@gradial/aci-cli-darwin-x64": "0.1.35",
-    "@gradial/aci-cli-linux-arm64": "0.1.35",
-    "@gradial/aci-cli-linux-x64": "0.1.35",
-    "@gradial/aci-cli-win32-arm64": "0.1.35",
-    "@gradial/aci-cli-win32-x64": "0.1.35"
+    "@gradial/aci-cli-darwin-arm64": "0.1.36",
+    "@gradial/aci-cli-darwin-x64": "0.1.36",
+    "@gradial/aci-cli-linux-arm64": "0.1.36",
+    "@gradial/aci-cli-linux-x64": "0.1.36",
+    "@gradial/aci-cli-win32-arm64": "0.1.36",
+    "@gradial/aci-cli-win32-x64": "0.1.36"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",