@gradial/aci 0.1.38 → 0.1.39

package/dist/next/middleware.d.ts

@@ -1,19 +1,11 @@
 import { type NextRequest } from 'next/server.js';
 export interface GradialMiddlewareConfig {
-    /**
-     * Site identity for this deployment. Env-injected identity is valid —
-     * the platform sets ACI_SITE_ID per deployment, so passing a bare
-     * `process.env.ACI_SITE_ID` (which types as `string | undefined`) is
-     * supported. A missing value 500s cleanly at runtime
-     * ("ACI site id is not configured").
-     */
-    siteId: string | undefined;
     edgeConfig?: string;
     previewSignKey?: string;
     deploymentId?: string;
     deploymentProtectionBypass?: string;
 }
-export declare function createGradialMiddleware(config: GradialMiddlewareConfig): (request: NextRequest) => Promise<Response>;
+export declare function createGradialMiddleware(config?: GradialMiddlewareConfig): (request: NextRequest) => Promise<Response>;
 export declare const aciMiddlewareMatcher: string[];
 export declare const config: {
     matcher: string[];

package/dist/next/middleware.js

@@ -10,7 +10,7 @@ const PASSTHROUGH_ROUTES = (typeof __ACI_PASSTHROUGH_ROUTES__ !== 'undefined' ?
 const ASSET_PREFIX = typeof __ACI_ASSET_PREFIX__ !== 'undefined'
     ? __ACI_ASSET_PREFIX__
     : '/.gradial-dam';
-export function createGradialMiddleware(config) {
+export function createGradialMiddleware(config = {}) {
     return async function middleware(request) {
         const url = request.nextUrl;
         // ?leave_preview=1 → clear cookies, redirect to clean URL
@@ -185,8 +185,8 @@ async function activeReleaseFromEdgeConfig(config) {
         return active.releaseId;
     return clampRelease(active.releaseId, active.sequence || 0, compatibility);
 }
-function siteIdForConfig(config) {
-    return config.siteId ?? '';
+function siteIdForConfig(_config) {
+    return process.env.ACI_SITE_ID || '';
 }
 async function getEdgeConfigJSON(edgeConfig, key) {
     const value = await getEdgeConfigValue(edgeConfig, key);

package/dist/testing/conformance/checks.js

@@ -89,17 +89,25 @@ function walkFiles(dir, predicate) {
 // ---------------------------------------------------------------------------
 export function checkConfig(ctx) {
     const results = [];
-    // Env-only site identity: in siteIdMode 'env' the platform owns tenant
-    // identity (terraform injects ACI_SITE_ID per deployment), so .aci.yaml
-    // must not carry a siteId at all — a leftover label pins the repo to one
-    // site and drifts silently from the deployed identity.
-    if (ctx.siteIdMode === 'env') {
+    // Validate .aci.yaml siteId: when ctx.siteId is provided, verify it matches;
+    // when not provided, verify .aci.yaml does not pin a siteId at all.
+    {
         const aciYaml = readTextFile(join(ctx.rootDir, '.aci.yaml'));
         if (aciYaml !== null) {
-            const pinsSiteId = /^siteId\s*:/m.test(aciYaml);
-            results.push(!pinsSiteId
-                ? ok('config', '.aci.yaml does not pin a siteId (env-only identity)')
-                : fail('config', '.aci.yaml does not pin a siteId (env-only identity)', '.aci.yaml declares siteId but this repo uses siteIdMode "env": the platform owns site identity (ACI_SITE_ID is injected per deployment), so the manifest must not pin a site — delete the siteId line'));
+            const siteIdMatch = aciYaml.match(/^siteId\s*:\s*["']?([^"'\n]+)["']?\s*$/m);
+            if (ctx.siteId) {
+                const declared = siteIdMatch ? siteIdMatch[1].trim() : null;
+                results.push(declared === ctx.siteId
+                    ? ok('config', '.aci.yaml siteId matches expected value')
+                    : fail('config', '.aci.yaml siteId matches expected value', declared
+                        ? `.aci.yaml siteId is '${declared}' but expected '${ctx.siteId}'`
+                        : `.aci.yaml is missing siteId (expected '${ctx.siteId}')`));
+            }
+            else {
+                results.push(!siteIdMatch
+                    ? ok('config', '.aci.yaml does not pin a siteId')
+                    : fail('config', '.aci.yaml does not pin a siteId', '.aci.yaml declares siteId but no expected value was provided — either pass siteId to the preset or remove it from .aci.yaml'));
+            }
         }
     }
     if (ctx.framework === 'next') {
@@ -255,65 +263,16 @@ export function checkMiddleware(ctx) {
     results.push(usesSDKMiddleware
         ? ok('middleware', 'middleware uses createGradialMiddleware', rel)
         : fail('middleware', 'middleware uses createGradialMiddleware', rel + ' should use createGradialMiddleware from @gradial/aci/next/middleware'));
-    // Check that the siteId passed to createGradialMiddleware is canonical.
-    // Accepted forms depend on ctx.siteIdMode (default 'literal'):
-    //
-    // 'literal':
-    //   (a) a string literal exactly equal to ctx.siteId (the tenant's
-    //       canonical site id) — this is what the template stamps;
-    //   (b) process.env.ACI_SITE_ID || '<literal>' (or ?? instead of ||)
-    //       where the literal default is exactly ctx.siteId — the
-    //       multi-tenant/dev-mirror form: the deployment env supplies the
-    //       per-tenant identity, the default keeps local dev correct.
-    //
-    // 'env' (tenant-agnostic repos deployed to multiple sites): the ONLY
-    //   accepted form is exactly `siteId: process.env.ACI_SITE_ID`. The
-    //   platform owns tenant identity — terraform sets ACI_SITE_ID on every
-    //   deployment — and the runtime 500s cleanly if it is missing, so any
-    //   literal, fallback (|| / ??), other env var name, or computed
-    //   expression fails.
-    //
-    // Anything else (placeholder literal, wrong/missing default, other env
-    // var names, computed expressions) fails: a wrong siteId means the edge
-    // release-pointer key never matches and every live route 503s.
-    const siteIdMode = ctx.siteIdMode ?? 'literal';
-    if (siteIdMode === 'env') {
-        const label = 'middleware configures canonical siteId';
-        // Narrow the search to the createGradialMiddleware call when present so
-        // an unrelated siteId reference elsewhere in the file can't satisfy us.
-        const callIdx = middlewareFile.content.indexOf('createGradialMiddleware(');
-        const region = callIdx >= 0 ? middlewareFile.content.slice(callIdx) : middlewareFile.content;
-        // Exactly `siteId: process.env.ACI_SITE_ID` followed by the end of the
-        // property (`,` or `}`) — same object-property shape the literal-mode
-        // regexes target, but with nothing allowed after the env access.
-        const bareEnv = /siteId\s*:\s*process\.env\.ACI_SITE_ID\s*(?=[,}])/.test(region);
-        results.push(bareEnv
-            ? ok('middleware', label, `${rel} (env-only siteId)`)
-            : fail('middleware', label, `${rel}: middleware must read siteId only from process.env.ACI_SITE_ID (no literal or fallback) — the platform owns tenant identity and injects ACI_SITE_ID per deployment`));
-    }
-    else if (ctx.siteId) {
-        const label = 'middleware configures canonical siteId';
-        const expected = ctx.siteId;
-        const acceptedForms = `accepted forms: siteId: '${expected}' or ` +
-            `siteId: process.env.ACI_SITE_ID || '${expected}' (?? also accepted)`;
-        // Narrow the search to the createGradialMiddleware call when present so
-        // an unrelated siteId reference elsewhere in the file can't satisfy us.
+    // Middleware must NOT pass a siteId — the SDK reads process.env.ACI_SITE_ID
+    // internally. Any siteId arg is stale config that should be removed.
+    {
+        const label = 'middleware does not pass siteId';
         const callIdx = middlewareFile.content.indexOf('createGradialMiddleware(');
         const region = callIdx >= 0 ? middlewareFile.content.slice(callIdx) : middlewareFile.content;
-        // Form (b): process.env.ACI_SITE_ID || '<default>' (or ??).
-        const envMatch = region.match(/siteId\s*:\s*process\.env\.ACI_SITE_ID\s*(?:\|\||\?\?)\s*(['"`])((?:(?!\1).)*)\1/);
-        // Form (a): bare string literal (single/double quotes or backticks).
-        const literalMatch = region.match(/siteId\s*:\s*(['"`])((?:(?!\1).)*)\1/);
-        const configured = envMatch ? envMatch[2] : literalMatch ? literalMatch[2] : null;
-        if (configured === expected) {
-            results.push(ok('middleware', label, `${rel} (${envMatch ? 'env with canonical default' : 'canonical literal'})`));
-        }
-        else if (configured !== null) {
-            results.push(fail('middleware', label, `${rel}: siteId ${envMatch ? 'default ' : ''}is '${configured}' but the canonical site id is '${expected}'; ${acceptedForms}`));
-        }
-        else {
-            results.push(fail('middleware', label, `${rel}: siteId passed to createGradialMiddleware is not an accepted form (placeholder/computed expressions, other env vars, and process.env.ACI_SITE_ID without a literal default all fail); ${acceptedForms}`));
-        }
+        const passesSiteId = /siteId\s*:/.test(region);
+        results.push(!passesSiteId
+            ? ok('middleware', label, rel)
+            : fail('middleware', label, `${rel}: remove siteId from createGradialMiddleware() — the SDK reads process.env.ACI_SITE_ID internally; the platform injects it per deployment`));
     }
     // Check that the middleware matcher is inlined (not imported) and matches
     // the SDK's canonical value. Next.js requires config.matcher to be

package/dist/testing/conformance/preset.js

@@ -56,11 +56,8 @@ function resolveChecks(input) {
 export function runConformanceChecks(options) {
     const ctx = {
         framework: options.framework,
-        // 'env' mode carries no site identity in the repo; checks never compare
-        // against a value, so the context uses the empty string.
         siteId: options.siteId ?? '',
         rootDir: options.rootDir || process.cwd(),
-        siteIdMode: options.siteIdMode || 'literal',
     };
     const checks = resolveChecks(options.checks);
     const allResults = checks.flatMap((name) => {
@@ -85,11 +82,8 @@ export function conformancePreset(options) {
     test('ACI conformance', async (t) => {
         const ctx = {
             framework: options.framework,
-            // 'env' mode carries no site identity in the repo; checks never compare
-            // against a value, so the context uses the empty string.
             siteId: options.siteId ?? '',
             rootDir: options.rootDir || process.cwd(),
-            siteIdMode: options.siteIdMode || 'literal',
         };
         for (const checkName of checks) {
             await t.test(checkName, () => {

package/dist/testing/conformance/types.d.ts

@@ -8,10 +8,27 @@
 export type ConformanceFramework = 'next' | 'astro';
 /** Individual check names that can be enabled/disabled. */
 export type ConformanceCheckName = 'config' | 'registry' | 'pageEntry' | 'middleware' | 'noFileContentProvider' | 'noCustomContent' | 'noLegacyAssetRoute' | 'buildSucceeds' | 'contentCompile' | 'sdkVersion';
-/** Options common to both siteId modes. */
-export interface ConformancePresetCommonOptions {
+/**
+ * Options for the conformance preset.
+ *
+ * Middleware must always read siteId from `process.env.ACI_SITE_ID` — the
+ * platform owns tenant identity and injects it per deployment. Literals,
+ * fallbacks (`||`/`??`), and other env var names all fail. A missing env
+ * produces a clean 500 at runtime.
+ *
+ * `siteId` is optional — when provided, .aci.yaml's siteId is validated
+ * against it. When omitted, the check verifies .aci.yaml does not pin a
+ * siteId at all.
+ */
+export interface ConformancePresetOptions {
     /** Framework the site uses. */
     framework: ConformanceFramework;
+    /**
+     * Expected canonical siteId in .aci.yaml. When provided, the config check
+     * verifies .aci.yaml declares this exact value. When omitted, the config
+     * check verifies .aci.yaml does NOT declare a siteId.
+     */
+    siteId?: string;
     /** Root directory of the site project. Defaults to process.cwd(). */
     rootDir?: string;
     /**
@@ -20,36 +37,6 @@ export interface ConformancePresetCommonOptions {
      */
     checks?: ConformanceCheckName[] | Partial<Record<ConformanceCheckName, boolean>>;
 }
-/**
- * Options for the conformance preset.
- *
- * The siteId requirement is keyed off `siteIdMode` (defaults to 'literal'):
- *
- * - 'literal': `siteId` is REQUIRED — it is the tenant's canonical site id,
- *   and the middleware must pass it as a string literal (or
- *   `process.env.ACI_SITE_ID || '<canonical>'` / `??` with the canonical
- *   literal as the default). This is what the template stamps for
- *   single-tenant repos.
- * - 'env': `siteId` is FORBIDDEN — tenant-agnostic repos deployed to
- *   multiple sites have no site identity in the repo at all. The middleware
- *   must read siteId ONLY from the environment — exactly
- *   `siteId: process.env.ACI_SITE_ID`, with no literal default, no
- *   `||`/`??` fallback, no other env var names, and no computed
- *   expressions — and `.aci.yaml` must not pin a siteId. The platform owns
- *   tenant identity and injects ACI_SITE_ID per deployment; a missing env
- *   produces a clean 500 at runtime.
- */
-export type ConformancePresetOptions = ConformancePresetCommonOptions & ({
-    /** See ConformancePresetOptions: 'literal' expects a canonical siteId in the repo. */
-    siteIdMode?: 'literal';
-    /** Expected canonical siteId value (verified in config and middleware). */
-    siteId: string;
-} | {
-    /** See ConformancePresetOptions: 'env' means the repo carries no site identity. */
-    siteIdMode: 'env';
-    /** Forbidden in env mode — the repo must not carry a site identity. */
-    siteId?: never;
-});
 /** Result of a single conformance check. */
 export interface ConformanceCheckResult {
     name: ConformanceCheckName;
@@ -68,12 +55,7 @@ export type ConformanceCheckFn = (ctx: ConformanceContext) => ConformanceCheckRe
 /** Context passed to each check function. */
 export interface ConformanceContext {
     framework: ConformanceFramework;
-    /**
-     * Canonical siteId in 'literal' mode; '' in 'env' mode (no site identity
-     * in the repo — env-mode checks never compare against a value).
-     */
+    /** Canonical siteId from options, or '' when not provided. */
     siteId: string;
     rootDir: string;
-    /** See ConformancePresetOptions.siteIdMode. Defaults to 'literal'. */
-    siteIdMode?: 'literal' | 'env';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradial/aci",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -127,12 +127,12 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@gradial/aci-cli-darwin-arm64": "0.1.38",
-    "@gradial/aci-cli-darwin-x64": "0.1.38",
-    "@gradial/aci-cli-linux-arm64": "0.1.38",
-    "@gradial/aci-cli-linux-x64": "0.1.38",
-    "@gradial/aci-cli-win32-arm64": "0.1.38",
-    "@gradial/aci-cli-win32-x64": "0.1.38"
+    "@gradial/aci-cli-darwin-arm64": "0.1.39",
+    "@gradial/aci-cli-darwin-x64": "0.1.39",
+    "@gradial/aci-cli-linux-arm64": "0.1.39",
+    "@gradial/aci-cli-linux-x64": "0.1.39",
+    "@gradial/aci-cli-win32-arm64": "0.1.39",
+    "@gradial/aci-cli-win32-x64": "0.1.39"
   },
   "scripts": {
     "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",

package/templates/nextjs/template/src/middleware.ts.tmpl

@@ -1,8 +1,6 @@
 import { createGradialMiddleware } from '@gradial/aci/next/middleware';
 
-export default createGradialMiddleware({
-  siteId: '{{siteName}}',
-});
+export default createGradialMiddleware();
 
 // The matcher value below is inlined for Next.js static analysis compatibility.
 // Source of truth: aciMiddlewareMatcher from '@gradial/aci/next/middleware'.

package/templates/nextjs/template/tests/conformance.test.ts.tmpl

@@ -10,3 +10,4 @@ conformancePreset({
   framework: 'next',
   siteId: '{{siteName}}',
 });
+