@gradial/aci 0.1.41 → 0.1.42

package/dist/next/collect-route.js

@@ -0,0 +1,351 @@
+import { MAX_BATCH_EVENTS } from '../collect/batcher.js';
+import { consentSignals, identityHashHex, parseCookieHeader, verifyClaims, verifyIdentityCookie, } from './personalization-host.js';
+const MAX_COLLECT_BODY_BYTES = 64 * 1024;
+const DEFAULT_RETENTION_SECONDS = 13 * 30 * 24 * 60 * 60;
+const FORBIDDEN_FIELDS = new Set(['aciid', 'audienceids', 'segmentids', 'traits', 'identity']);
+const ULID = /^[0-7][0-9A-HJKMNP-TV-Z]{25}$/i;
+const UTM_KEYS = ['source', 'medium', 'campaign', 'term', 'content', 'id'];
+function identityHashShard(identityHash) {
+    const hash = identityHash.trim().toLowerCase();
+    if (hash.length < 2)
+        throw new Error('identity hash is too short');
+    return hash.slice(0, 2);
+}
+export function createPersonalizationCollectRoute(config) {
+    return async function collect(request) {
+        if (request.method === 'OPTIONS')
+            return new Response(null, { status: 204 });
+        if (request.method !== 'POST')
+            return new Response(null, { status: 405, headers: { allow: 'POST, OPTIONS' } });
+        const bytes = new Uint8Array(await request.arrayBuffer());
+        if (bytes.byteLength > MAX_COLLECT_BODY_BYTES)
+            return new Response(null, { status: 413 });
+        let events;
+        try {
+            const envelope = bytes.byteLength === 0 ? { events: [] } : JSON.parse(new TextDecoder().decode(bytes));
+            if (!Array.isArray(envelope.events))
+                throw new CollectValidationError('events must be an array');
+            // The TS runtime has no cross-instance quota checker (Go's REQ-14/
+            // REQ-20 guard); the 64KiB body cap plus this per-batch event cap and
+            // the platform WAF are the abuse bounds. The cap is the client
+            // batcher's MAX_BATCH_EVENTS — one constant, both sides of the wire.
+            if (envelope.events.length > MAX_BATCH_EVENTS)
+                throw new CollectValidationError('too many events in one batch');
+            events = envelope.events;
+            for (const event of events)
+                validateEvent(event);
+        }
+        catch (error) {
+            return validationResponse(error);
+        }
+        const cookies = parseCookieHeader(request.headers.get('cookie'));
+        const signals = consentSignals(request, cookies);
+        const rawIdentity = await verifyIdentityCookie(cookies.get('aci_id') || '', config.identityKeys);
+        const now = (config.now ?? (() => new Date()))();
+        const secure = config.secureCookies ?? new URL(request.url).protocol === 'https:';
+        const responseHeaders = new Headers({ 'cache-control': 'no-store', 'content-type': 'application/json' });
+        try {
+            // Withdrawal EVIDENCE (anonymous-experiments REQ-6): a signature-
+            // verified aci_claims cookie proves prior identity-tier state exists
+            // to suppress. Never-consented visitors present no verifiable claims
+            // and stay measurement-only.
+            const evidence = rawIdentity
+                ? await verifyClaims(cookies.get('aci_claims') || '', config.claimsKeys || {}, now) !== null
+                : false;
+            const putSuppression = async (trigger) => {
+                const hash = await identityHashHex('aci_id', rawIdentity);
+                await config.store.putSuppression(`audience/suppression/${identityHashShard(hash)}/${config.siteId}/aci_id/${hash}/${trigger}.json`, { schemaVersion: 1, trigger, observedAt: now.toISOString() });
+            };
+            if (signals.privacyDenied) {
+                if (rawIdentity && evidence) {
+                    await putSuppression('gpc');
+                }
+                if (cookies.has('aci_claims'))
+                    appendCookie(responseHeaders, expiredClaimsCookie(secure));
+                return accepted(responseHeaders);
+            }
+            if (!rawIdentity)
+                return accepted(responseHeaders);
+            // Measurement tier (anonymous-experiments REQ-5): a verified aci_id
+            // stores events even without a personalization grant — the snapshot
+            // records what was (not) granted. An explicit denial with verified
+            // evidence is an observed withdrawal; measurement storage continues.
+            const personalization = signals.allowsIdentityTier;
+            if (!personalization && signals.hasConsent && evidence) {
+                await putSuppression('withdrawal');
+            }
+            const identityHash = await identityHashHex('aci_id', rawIdentity);
+            for (const event of events) {
+                const normalized = normalizeEvent(event, now);
+                const collectedAt = now.toISOString();
+                const expiresAt = new Date(now.getTime() + (config.retentionSeconds ?? DEFAULT_RETENTION_SECONDS) * 1000).toISOString();
+                const key = `audience/first-party/${identityHashShard(identityHash)}/${config.siteId}/aci_id/${identityHash}/${normalized.eventId}.json`;
+                await config.store.appendEvent(key, {
+                    schemaVersion: 1,
+                    eventId: normalized.eventId,
+                    eventName: normalized.eventName,
+                    eventCategory: normalized.eventCategory,
+                    siteId: config.siteId,
+                    identity: { namespace: 'aci_id', hash: identityHash },
+                    // Go decodes `t` as time.Time and CANNOT parse an empty string —
+                    // an empty-t record permanently poisons that identity's
+                    // classification and DSAR reads. Omit t unless a real timestamp
+                    // was observed (legacy bare tokens have none).
+                    consent: signals.snapshot
+                        ? {
+                            v: signals.snapshot.version,
+                            p: signals.snapshot.purposes,
+                            ...(signals.snapshot.grantedAt ? { t: signals.snapshot.grantedAt } : {}),
+                            ...(signals.snapshot.source ? { src: signals.snapshot.source } : {}),
+                        }
+                        : { v: 0, p: [] },
+                    ...(normalized.properties ? { properties: normalized.properties } : {}),
+                    page: normalized.page,
+                    ...(normalized.utm ? { utm: normalized.utm } : {}),
+                    ...(normalized.viewport ? { viewport: normalized.viewport } : {}),
+                    ...(normalized.experiment ? { experiment: normalized.experiment } : {}),
+                    occurredAt: normalized.occurredAt,
+                    collectedAt,
+                    expiresAt,
+                });
+            }
+            if (personalization) {
+                const claims = await config.store.readClaims(config.siteId, 'aci_id', identityHash);
+                if (claims)
+                    appendCookie(responseHeaders, claimsCookie(claims, secure));
+                else if (cookies.has('aci_claims'))
+                    appendCookie(responseHeaders, expiredClaimsCookie(secure));
+            }
+            else if (cookies.has('aci_claims')) {
+                // Claims are personalization; a non-granting touch expires them.
+                appendCookie(responseHeaders, expiredClaimsCookie(secure));
+            }
+            return accepted(responseHeaders);
+        }
+        catch {
+            return Response.json({ error: 'internal error', status: 500 }, { status: 500, headers: { 'cache-control': 'no-store' } });
+        }
+    };
+}
+function validateEvent(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        throw new CollectValidationError('event must be an object');
+    for (const key of Object.keys(value)) {
+        if (FORBIDDEN_FIELDS.has(key.toLowerCase()))
+            throw new CollectValidationError(`field ${key} is not allowed on the public collect route`);
+    }
+    if (typeof value.eventId !== 'string' || !ULID.test(value.eventId.trim()))
+        throw new CollectValidationError('eventId must be a valid ULID');
+    if (typeof value.eventName !== 'string')
+        throw new CollectValidationError('event name is required');
+    normalizeEventName(value.eventName);
+    for (const field of ['url', 'referrer', 'title', 'path']) {
+        if (value[field] !== undefined && typeof value[field] !== 'string')
+            throw new CollectValidationError(`${field} must be a string`);
+    }
+    if (value.properties !== undefined && (!value.properties || typeof value.properties !== 'object' || Array.isArray(value.properties))) {
+        throw new CollectValidationError('properties must be an object');
+    }
+    if (value.properties !== undefined)
+        sanitizeProperties(value.properties, 'properties', 0);
+    if (value.occurredAt !== undefined && (typeof value.occurredAt !== 'string' || Number.isNaN(Date.parse(value.occurredAt)))) {
+        throw new CollectValidationError('occurredAt must be an RFC3339 timestamp');
+    }
+    if (value.utm !== undefined && (!value.utm || typeof value.utm !== 'object' || Array.isArray(value.utm))) {
+        throw new CollectValidationError('utm must be an object');
+    }
+    normalizeViewport(value.viewport);
+    normalizeExperiment(value.experiment);
+}
+function normalizeEvent(event, now) {
+    const [eventName, eventCategory] = normalizeEventName(String(event.eventName));
+    const rawURL = typeof event.url === 'string' ? event.url.trim() : '';
+    const pageURL = sanitizeURL(rawURL, 'url');
+    const referrer = sanitizeURL(typeof event.referrer === 'string' ? event.referrer.trim() : '', 'referrer');
+    const parsedURL = rawURL ? new URL(rawURL, 'https://aci.invalid') : null;
+    let path = typeof event.path === 'string' ? event.path.trim() : parsedURL?.pathname || '';
+    if (path && !path.startsWith('/'))
+        path = `/${path}`;
+    const utm = normalizeUTM(event.utm, parsedURL);
+    const occurredAt = typeof event.occurredAt === 'string' && !Number.isNaN(Date.parse(event.occurredAt))
+        ? new Date(event.occurredAt).toISOString()
+        : now.toISOString();
+    return {
+        eventId: String(event.eventId).trim().toUpperCase(),
+        eventName,
+        eventCategory,
+        occurredAt,
+        properties: event.properties === undefined ? undefined : sanitizeProperties(event.properties, 'properties', 0),
+        page: {
+            ...(pageURL ? { url: pageURL } : {}),
+            ...(referrer ? { referrer } : {}),
+            ...(typeof event.title === 'string' && event.title.trim() ? { title: event.title.trim() } : {}),
+            ...(path ? { path } : {}),
+        },
+        utm,
+        viewport: normalizeViewport(event.viewport),
+        experiment: normalizeExperiment(event.experiment),
+    };
+}
+function normalizeEventName(value) {
+    const name = value.trim().toLowerCase();
+    if (!name || name.length > 128 || /[\s/\\]/.test(name))
+        throw new CollectValidationError('event name must be dot-delimited');
+    const rum = new Set(['rum.page_view', 'rum.link_click', 'rum.variation_view', 'rum.web_vital']);
+    const experiment = new Set(['experiment.exposure', 'experiment.conversion', 'experiment.engagement']);
+    if (rum.has(name))
+        return [name, 'rum'];
+    if (experiment.has(name))
+        return [name, 'experiment'];
+    if (name.startsWith('custom.') && name.length > 'custom.'.length)
+        return [name, 'custom'];
+    throw new CollectValidationError('event name must be one of the supported rum.* or experiment.* events, or use the custom.* namespace');
+}
+function sanitizeURL(value, field) {
+    if (!value)
+        return '';
+    if (value.length > 2048)
+        throw new CollectValidationError(`${field} is too long`);
+    let parsed;
+    try {
+        parsed = new URL(value, 'https://aci.invalid');
+    }
+    catch {
+        throw new CollectValidationError(`${field} is invalid`);
+    }
+    if (!['http:', 'https:'].includes(parsed.protocol))
+        throw new CollectValidationError(`${field} scheme is not allowed`);
+    parsed.search = '';
+    parsed.hash = '';
+    if (parsed.origin === 'https://aci.invalid')
+        return parsed.pathname;
+    return parsed.toString().replace(/\/$/, parsed.pathname === '/' ? '/' : '');
+}
+function normalizeUTM(value, url) {
+    const source = value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+    const out = {};
+    for (const key of UTM_KEYS) {
+        const raw = source[key] ?? source[`utm_${key}`] ?? url?.searchParams.get(`utm_${key}`);
+        if (typeof raw === 'string' && raw.trim())
+            out[key] = raw.trim();
+    }
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function sanitizeProperties(value, field, depth) {
+    if (depth > 4)
+        throw new CollectValidationError(`${field} is nested too deeply`);
+    if (value === null || typeof value === 'boolean' || typeof value === 'number')
+        return value;
+    if (typeof value === 'string')
+        return sanitizeString(value, field, 2048);
+    if (Array.isArray(value)) {
+        if (value.length > 32)
+            throw new CollectValidationError(`${field} has too many values`);
+        return value.map((item, index) => sanitizeProperties(item, `${field}[${index}]`, depth + 1));
+    }
+    if (typeof value !== 'object')
+        throw new CollectValidationError(`${field} has unsupported value type`);
+    const entries = Object.entries(value);
+    if (entries.length > 64)
+        throw new CollectValidationError(`${field} has too many keys`);
+    const sanitized = {};
+    for (const [rawKey, item] of entries) {
+        const key = sanitizeString(rawKey, `${field} key`, 256);
+        if (!key)
+            throw new CollectValidationError(`${field} contains an empty key`);
+        if (secretLikeKey(key))
+            throw new CollectValidationError(`${field} contains a sensitive key`);
+        sanitized[key] = sanitizeProperties(item, `${field}.${key}`, depth + 1);
+    }
+    return sanitized;
+}
+function secretLikeKey(key) {
+    const normalized = key.toLowerCase().replace(/[-. ]/g, '_');
+    const compact = normalized.replace(/_/g, '');
+    const normalizedMarkers = [
+        'authorization', 'access_token', 'refresh_token', 'id_token', 'api_key',
+        'private_key', 'secret', 'password', 'passwd', 'credential', 'cookie', 'set_cookie',
+    ];
+    const compactMarkers = [
+        'authorization', 'accesstoken', 'refreshtoken', 'idtoken', 'apikey',
+        'privatekey', 'secret', 'password', 'passwd', 'credential', 'cookie', 'setcookie',
+    ];
+    return normalizedMarkers.some((marker) => normalized.includes(marker))
+        || compactMarkers.some((marker) => compact.includes(marker));
+}
+function sanitizeString(value, field, limit) {
+    const clean = value.trim();
+    if (clean.length > limit)
+        throw new CollectValidationError(`${field} is too long`);
+    if (/[\u0000-\u001F\u007F-\u009F]/u.test(clean))
+        throw new CollectValidationError(`${field} contains control characters`);
+    return clean;
+}
+function normalizeViewport(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'object' || Array.isArray(value))
+        throw new CollectValidationError('viewport is invalid');
+    const viewport = value;
+    const width = viewport.width ?? 0;
+    const height = viewport.height ?? 0;
+    if (!Number.isInteger(width) || !Number.isInteger(height) || Number(width) < 0 || Number(height) < 0 || Number(width) > 20_000 || Number(height) > 20_000) {
+        throw new CollectValidationError('viewport is invalid');
+    }
+    if (width === 0 && height === 0)
+        return undefined;
+    return { width: Number(width), height: Number(height) };
+}
+function normalizeExperiment(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== 'object' || Array.isArray(value))
+        throw new CollectValidationError('experiment is invalid');
+    const source = value;
+    const experimentId = shortOptionalString(source.experimentId, 'experiment.experimentId');
+    const armId = shortOptionalString(source.armId, 'experiment.armId');
+    const allocationVersion = shortOptionalString(source.allocationVersion, 'experiment.allocationVersion');
+    const goalId = shortOptionalString(source.goalId, 'experiment.goalId');
+    const bucket = source.assignmentBucket;
+    if (!experimentId && !armId && !allocationVersion && !goalId && bucket === undefined)
+        return undefined;
+    if (!experimentId)
+        throw new CollectValidationError('experiment.experimentId is required when experiment context is present');
+    if (!armId)
+        throw new CollectValidationError('experiment.armId is required when experiment context is present');
+    if (bucket !== undefined && (!Number.isInteger(bucket) || Number(bucket) < 0 || Number(bucket) > 9999)) {
+        throw new CollectValidationError('experiment.assignmentBucket must be between 0 and 9999');
+    }
+    return {
+        experimentId,
+        armId,
+        ...(allocationVersion ? { allocationVersion } : {}),
+        ...(goalId ? { goalId } : {}),
+        ...(bucket !== undefined ? { assignmentBucket: bucket } : {}),
+    };
+}
+function shortOptionalString(value, field) {
+    if (value === undefined || value === null)
+        return '';
+    if (typeof value !== 'string')
+        throw new CollectValidationError(`${field} must be a string`);
+    return sanitizeString(value, field, 128);
+}
+function accepted(headers) {
+    return new Response('{"accepted":true}', { status: 202, headers });
+}
+function validationResponse(error) {
+    const message = error instanceof CollectValidationError ? error.message : 'invalid JSON body';
+    return Response.json({ error: message, status: 400 }, { status: 400, headers: { 'cache-control': 'no-store' } });
+}
+function claimsCookie(value, secure) {
+    return `aci_claims=${value}; Path=/; HttpOnly; SameSite=Lax; Max-Age=86400${secure ? '; Secure' : ''}`;
+}
+function expiredClaimsCookie(secure) {
+    return `aci_claims=; Path=/; HttpOnly; SameSite=Lax; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT${secure ? '; Secure' : ''}`;
+}
+function appendCookie(headers, cookie) {
+    headers.append('set-cookie', cookie);
+}
+class CollectValidationError extends Error {
+}

package/dist/next/index.d.ts

@@ -6,3 +6,4 @@ export { getSiteConfig, getFragment, getLayout, getPage, getRenderInput, routeFr
 export { PageNotFoundError, FragmentNotFoundError, LayoutNotFoundError } from './server.js';
 export { CollectScript, type CollectScriptProps } from './collect-script.js';
 export { aciMiddlewareMatcher } from './middleware.js';
+export { AssignmentsScript, type AssignmentsScriptProps } from './assignments-script.js';

package/dist/next/index.js

@@ -6,3 +6,4 @@ export { getSiteConfig, getFragment, getLayout, getPage, getRenderInput, routeFr
 export { PageNotFoundError, FragmentNotFoundError, LayoutNotFoundError } from './server.js';
 export { CollectScript } from './collect-script.js';
 export { aciMiddlewareMatcher } from './middleware.js';
+export { AssignmentsScript } from './assignments-script.js';

package/dist/next/middleware.d.ts

@@ -1,12 +1,26 @@
-import { type NextRequest } from 'next/server.js';
+import { NextResponse, type NextRequest } from 'next/server.js';
+import { type PersonalizationHostConfig } from './personalization-host.js';
 export interface GradialMiddlewareConfig {
+    siteId?: string;
     edgeConfig?: string;
     previewSignKey?: string;
     deploymentId?: string;
     deploymentProtectionBypass?: string;
+    personalization?: Omit<PersonalizationHostConfig, 'siteId'> & {
+        siteId?: string;
+    };
 }
 export declare function createGradialMiddleware(config?: GradialMiddlewareConfig): (request: NextRequest) => Promise<Response>;
+/**
+ * Any response that writes a cookie is per-visitor and must never enter a
+ * shared cache (anonymous-experiments REQ-3(a)): a CDN-cached Set-Cookie
+ * replays one visitor's identity/claims to everyone under that cache key.
+ * Per-variant CACHING itself stays legitimate — the variant travels in the
+ * cache-keyed query parameter, not in cookies.
+ */
+export declare function enforceCookieCacheRule(response: NextResponse): void;
 export declare const aciMiddlewareMatcher: string[];
 export declare const config: {
+    runtime: string;
     matcher: string[];
 };

package/dist/next/middleware.js

@@ -1,15 +1,11 @@
 import { NextResponse } from 'next/server.js';
 import { getUncachedEdgeConfigValue } from './edge-config.js';
 import { PREVIEW_TOKEN_COOKIE, PREVIEW_RELEASE_COOKIE, extractPreviewToken, resolvePreviewContext, createPreviewCookies, previewSignKey, } from '../preview/core.js';
+import { CONTENT_PATH_CACHE_PARAM, resolvePersonalizationRequest, } from './personalization-host.js';
 const RELEASE_SCOPED_PREFIX = '/__r';
-// CMS document paths (robots.txt, sitemap.xml) pass through the middleware
-// and are served by Next.js rewrites configured in withAci().
-const CMS_DOCUMENT_PATHS = new Set(['/robots.txt', '/sitemap.xml']);
+const CMS_ASSET_PATHS = new Set(['/robots.txt', '/sitemap.xml']);
 const PUBLIC_PATHS = new Set(typeof __ACI_PUBLIC_PATHS__ !== 'undefined' ? __ACI_PUBLIC_PATHS__ : []);
 const PASSTHROUGH_ROUTES = (typeof __ACI_PASSTHROUGH_ROUTES__ !== 'undefined' ? __ACI_PASSTHROUGH_ROUTES__ : []);
-const ASSET_PREFIX = typeof __ACI_ASSET_PREFIX__ !== 'undefined'
-    ? __ACI_ASSET_PREFIX__
-    : '/.gradial-dam';
 export function createGradialMiddleware(config = {}) {
     return async function middleware(request) {
         const url = request.nextUrl;
@@ -24,12 +20,7 @@ export function createGradialMiddleware(config = {}) {
         if (PUBLIC_PATHS.has(url.pathname)) {
             return NextResponse.next();
         }
-        if (CMS_DOCUMENT_PATHS.has(url.pathname)) {
-            return NextResponse.next();
-        }
-        // DAM asset requests are NOT release-scoped; they rewrite to S3 via
-        // withAci() rewrites. Pass them through so the rewrite fires.
-        if (isAssetPath(url.pathname)) {
+        if (CMS_ASSET_PATHS.has(url.pathname)) {
             return NextResponse.next();
         }
         if (isPassthroughRoute(url.pathname)) {
@@ -47,7 +38,7 @@ export function createGradialMiddleware(config = {}) {
         const preview = await resolvePreviewFromRequest(request, config);
         // Local file-backed development has no release-indexed artifact tree. A
         // valid preview token is still useful there—it proves signing, expiry, and
-        // cookie propagation—but rewriting to /__r/{releaseId}/{path} would create
+        // cookie propagation—but rewriting to /__r/{release}/routes would create
         // a path the file provider cannot serve. Keep the public route and mark
         // the response private, matching preview's cache semantics.
         if (process.env.ACI_CONTENT_PROVIDER === 'file') {
@@ -59,6 +50,7 @@ export function createGradialMiddleware(config = {}) {
                     response.cookies.set(cookie.name, cookie.value, cookie.options);
                 }
             }
+            enforceCookieCacheRule(response);
             return response;
         }
         const releaseId = preview?.releaseId || await activeReleaseFromEdgeConfig(config);
@@ -85,25 +77,83 @@ export function createGradialMiddleware(config = {}) {
                     response.cookies.set(cookie.name, cookie.value, cookie.options);
                 }
             }
+            enforceCookieCacheRule(response);
             return response;
         }
         // Rewrite public URL to release-scoped internal path for CDN cache isolation.
-        // Each release gets a unique URL (/__r/{releaseId}/...) so the CDN
+        // Each release gets a unique URL (/__r/{releaseId}/routes/...) so the CDN
         // cache key is per-release. New release = new URL = cache miss = fresh content.
-        const response = rewriteToReleaseScopedPath(request, releaseId, Boolean(preview?.isPreview));
+        let personalization;
+        if (config.personalization) {
+            const siteId = config.personalization.siteId || siteIdForConfig(config);
+            if (!siteId) {
+                return new Response('ACI site id is not configured', {
+                    status: 500,
+                    headers: { 'Cache-Control': 'private, no-store' },
+                });
+            }
+            try {
+                personalization = await resolvePersonalizationRequest(request, releaseId, {
+                    ...config.personalization,
+                    siteId,
+                });
+            }
+            catch {
+                return new Response('personalization artifacts unavailable', {
+                    status: 503,
+                    headers: { 'Cache-Control': 'private, no-store' },
+                });
+            }
+        }
+        const response = rewriteToReleaseScopedPath(request, releaseId, Boolean(preview?.isPreview), personalization);
         // Persist preview token as cookie so navigation stays in preview
         if (preview?.token && preview.isPreview) {
             for (const cookie of createPreviewCookies(preview.token, releaseId)) {
                 response.cookies.set(cookie.name, cookie.value, cookie.options);
             }
         }
+        if (personalization) {
+            for (const cookie of personalization.cookies) {
+                response.cookies.set(cookie.name, cookie.value, cookie.options);
+            }
+            if (personalization.variantKey) {
+                response.headers.set('X-ACI-Variant-Key', personalization.variantKey);
+            }
+            if (personalization.experiment) {
+                response.headers.set('X-ACI-Experiment-ID', personalization.experiment.id);
+                response.headers.set('X-ACI-Experiment-Arm', personalization.experiment.arm);
+                response.headers.set('X-ACI-Experiment-Allocation-Version', personalization.experiment.allocationVersion);
+            }
+        }
+        enforceCookieCacheRule(response);
         return response;
     };
 }
-function rewriteToReleaseScopedPath(request, releaseId, isPreview) {
+/**
+ * Any response that writes a cookie is per-visitor and must never enter a
+ * shared cache (anonymous-experiments REQ-3(a)): a CDN-cached Set-Cookie
+ * replays one visitor's identity/claims to everyone under that cache key.
+ * Per-variant CACHING itself stays legitimate — the variant travels in the
+ * cache-keyed query parameter, not in cookies.
+ */
+export function enforceCookieCacheRule(response) {
+    if (response.cookies.getAll().length === 0) {
+        return;
+    }
+    response.headers.set('Cache-Control', 'private, no-store');
+    response.headers.delete('CDN-Cache-Control');
+    response.headers.delete('Vercel-CDN-Cache-Control');
+}
+function rewriteToReleaseScopedPath(request, releaseId, isPreview, personalization) {
     const rewriteURL = new URL(request.url);
     rewriteURL.pathname = releaseScopedPath(RELEASE_SCOPED_PREFIX, releaseId, request.nextUrl.pathname);
-    const response = NextResponse.rewrite(rewriteURL);
+    rewriteURL.searchParams.delete(CONTENT_PATH_CACHE_PARAM);
+    if (personalization?.contentPath) {
+        rewriteURL.searchParams.set(CONTENT_PATH_CACHE_PARAM, personalization.contentPath);
+    }
+    const response = personalization
+        ? NextResponse.rewrite(rewriteURL, { request: { headers: personalization.requestHeaders } })
+        : NextResponse.rewrite(rewriteURL);
     if (isPreview) {
         response.headers.set('Cache-Control', 'private, no-store');
     }
@@ -185,8 +235,8 @@ async function activeReleaseFromEdgeConfig(config) {
         return active.releaseId;
     return clampRelease(active.releaseId, active.sequence || 0, compatibility);
 }
-function siteIdForConfig(_config) {
-    return process.env.ACI_SITE_ID || '';
+function siteIdForConfig(config) {
+    return config.siteId || process.env.ACI_SITE_ID || '';
 }
 async function getEdgeConfigJSON(edgeConfig, key) {
     const value = await getEdgeConfigValue(edgeConfig, key);
@@ -243,13 +293,6 @@ function clampRelease(activeReleaseId, activeSequence, compatibility) {
 function edgeKeySegment(value) {
     return value.replace(/[^A-Za-z0-9_-]/g, '_');
 }
-function isAssetPath(pathname) {
-    if (pathname === ASSET_PREFIX || pathname.startsWith(`${ASSET_PREFIX}/`))
-        return true;
-    if (pathname.startsWith('/gradial/assets/'))
-        return true;
-    return false;
-}
 function isPassthroughRoute(pathname) {
     return PASSTHROUGH_ROUTES.some((route) => routeMatches(pathname, route));
 }
@@ -276,8 +319,9 @@ function normalizeRoutePath(value) {
     return pathname.replace(/\/{2,}/g, '/').replace(/\/$/, '') || '/';
 }
 export const aciMiddlewareMatcher = [
-    '/((?!_next(?:/|$)|api(?:/|$)|favicon\\.ico$|\\.gradial-dam(?:/|$)).*)',
+    '/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)',
 ];
 export const config = {
+    runtime: 'nodejs',
     matcher: aciMiddlewareMatcher,
 };

package/dist/next/page.js

@@ -4,6 +4,7 @@ import { Fragment } from 'react';
 import { PageNotFoundError, getRenderInput, getLayout, getFragment, } from './server.js';
 import { routeMetadataForContent, resolveSlots, } from '../content/index.js';
 import { renderBlocks } from './render.js';
+import { AssignmentsScript } from './assignments-script.js';
 import { CollectScript } from './collect-script.js';
 /**
  * Creates the catch-all route handler for a Next.js ACI site.
@@ -80,7 +81,7 @@ export function createPage(registry, options) {
                 }
                 return (_jsx(Fragment, { children: renderedBlocks }, slot.name));
             }));
-            return (_jsxs(_Fragment, { children: [renderedSlots.filter(Boolean), _jsx(CollectScript, { siteConfig: input.siteConfig })] }));
+            return (_jsxs(_Fragment, { children: [renderedSlots.filter(Boolean), _jsx(AssignmentsScript, { page: input.page }), _jsx(CollectScript, { siteConfig: input.siteConfig })] }));
         }
         catch (error) {
             if (error instanceof PageNotFoundError)