@gradial/aci 0.1.41 → 0.1.43

package/dist/next/vercel-s3-personalization.js

@@ -0,0 +1,574 @@
+import { GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, } from '@aws-sdk/client-s3';
+import { awsCredentialsProvider } from '@vercel/oidc-aws-credentials-provider';
+import { getUncachedEdgeConfigValue } from './edge-config.js';
+import { IdentityErasureFencedError } from './personalization-host.js';
+const ENVELOPE_DIGEST_METADATA_KEY = 'aci-envelope-sha256';
+const COLLECTION_GATE_ETAG_METADATA_KEY = 'aci-collection-gate-etag';
+const COLLECTION_GATE_STATE_METADATA_KEY = 'aci-collection-gate-state';
+const COLLECTION_GATE_OWNER_METADATA_KEY = 'aci-collection-gate-owner';
+const COLLECTION_GATE_DIGEST_METADATA_KEY = 'aci-collection-gate-envelope-sha256';
+const COLLECTION_GATE_PREFIX = 'audience/collection-gate';
+const COLLECTION_WRITE_TIMEOUT_MS = 2 * 60 * 1000;
+const COLLECTION_GATE_RETRY_MS = 25;
+const COLLECTION_GATE_ATTEMPTS = 80;
+const MAX_LAKE_OBJECT_RECORDS = 100;
+const MAX_LAKE_OBJECT_WRITE_BYTES = 1024 * 1024;
+const SHA256_HEX = /^[0-9a-f]{64}$/i;
+const textEncoder = new TextEncoder();
+export class EnvelopeIDCollisionError extends Error {
+    key;
+    existingDigest;
+    incomingDigest;
+    name = 'EnvelopeIDCollisionError';
+    constructor(key, existingDigest, incomingDigest) {
+        super(`envelope ID collision at ${key}`);
+        this.key = key;
+        this.existingDigest = existingDigest;
+        this.incomingDigest = incomingDigest;
+    }
+}
+/**
+ * Node-only Vercel collection adapter for audience lake objects and signed
+ * claims. The EdgeRouter never receives this adapter or AWS credentials.
+ * Production construction exchanges the Vercel workload OIDC token for
+ * scoped AWS credentials; no long-lived AWS keys are read.
+ */
+export class VercelS3PersonalizationStore {
+    config;
+    client;
+    constructor(config, client) {
+        this.config = config;
+        if (client) {
+            this.client = client;
+            return;
+        }
+        const roleArn = config.roleArn?.trim() || '';
+        if (!roleArn) {
+            throw new Error('AWS role ARN is required for the Vercel S3 personalization store');
+        }
+        const s3Config = {
+            region: config.region,
+            endpoint: config.endpoint,
+            forcePathStyle: config.forcePathStyle,
+            credentials: awsCredentialsProvider({
+                roleArn,
+                clientConfig: { region: config.region },
+            }),
+        };
+        this.client = new S3Client(s3Config);
+    }
+    async readClaims(siteId, namespace, identityHash) {
+        const key = joinKey(this.config.claimsKeyPrefix || 'audience/claims/v1', requiredSegment(identityHash, 'identity hash').slice(0, 2).toLowerCase(), requiredSegment(siteId, 'site id'), requiredSegment(namespace, 'identity namespace').toLowerCase(), `${requiredSegment(identityHash, 'identity hash').toLowerCase()}.json`);
+        const body = await this.readObject(this.config.eventsBucket, key);
+        if (body === null)
+            return null;
+        const envelope = JSON.parse(body);
+        if (envelope.schemaVersion !== 1 || !envelope.signedValue?.trim()) {
+            throw new Error(`invalid claims envelope at ${key}`);
+        }
+        if (envelope.expiresAt && Date.parse(envelope.expiresAt) <= Date.now())
+            return null;
+        return envelope.signedValue;
+    }
+    async appendEnvelope(write) {
+        const digest = write.digest.trim().toLowerCase();
+        if (!SHA256_HEX.test(digest)) {
+            throw new Error('envelope digest must be a SHA-256 hex value');
+        }
+        if (!Array.isArray(write.records) ||
+            write.records.length === 0 ||
+            write.records.length > MAX_LAKE_OBJECT_RECORDS ||
+            write.records.some((record) => !record ||
+                typeof record !== 'object' ||
+                Array.isArray(record) ||
+                record.schemaVersion !== 2)) {
+            throw new Error(`envelope records must be a schemaVersion-2 array with 1-${MAX_LAKE_OBJECT_RECORDS} entries`);
+        }
+        const body = JSON.stringify(write.records);
+        const bodyBytes = textEncoder.encode(body).byteLength;
+        if (bodyBytes > MAX_LAKE_OBJECT_WRITE_BYTES) {
+            throw new Error(`serialized envelope is ${bodyBytes} bytes, maximum ${MAX_LAKE_OBJECT_WRITE_BYTES}`);
+        }
+        const key = cleanKey(write.key);
+        const gate = await this.acquireCollectionGate(write, digest);
+        const input = {
+            Bucket: this.config.eventsBucket,
+            Key: key,
+            Body: body,
+            ContentType: 'application/json',
+            IfNoneMatch: '*',
+            Metadata: {
+                [ENVELOPE_DIGEST_METADATA_KEY]: digest,
+                [COLLECTION_GATE_ETAG_METADATA_KEY]: gate.etag,
+            },
+        };
+        if (gate.resumedUncertain) {
+            return this.settleResumedEnvelope(input.Key, digest, gate);
+        }
+        let operationError;
+        let settled = false;
+        try {
+            await this.sendWithWriteDeadline(new PutObjectCommand(input));
+            settled = true;
+        }
+        catch (error) {
+            if (!isConditionalConflict(error)) {
+                // Unknown write outcome: retain state=collecting without expiry.
+                // A retry is HEAD-only and cannot release until this exact write is
+                // visible with the authorizing generation metadata.
+                throw error;
+            }
+            // S3 can report 409 for two concurrent conditional writes even when
+            // neither write has committed yet. Confirm the object before treating
+            // the conflict as the idempotent duplicate case.
+            let head;
+            try {
+                head = await this.client.send(new HeadObjectCommand({ Bucket: input.Bucket, Key: input.Key }));
+            }
+            catch (headError) {
+                // The conditional outcome remains unknown; retain the collecting
+                // generation exactly like an unclassified PUT failure.
+                throw new Error(`conditional envelope write conflicted before ${input.Key} was stored`, { cause: headError });
+            }
+            const existingDigest = envelopeDigestMetadata(head.Metadata);
+            const existingGateETag = metadataValue(head.Metadata, COLLECTION_GATE_ETAG_METADATA_KEY);
+            settled = true;
+            if (existingDigest === digest && (existingGateETag === gate.etag || gate.claimedFromOpen)) {
+                // Identical retry. A resumed uncertain generation must match the
+                // exact authorizing gate ETag; a gate claimed from open may observe
+                // an object already settled by the prior open generation.
+            }
+            else if (existingDigest !== digest) {
+                operationError = new EnvelopeIDCollisionError(input.Key, existingDigest, digest);
+            }
+            else {
+                // Keep the resumed generation collecting: the object cannot prove
+                // it was authorized by this uncertain writer.
+                throw new Error(`envelope at ${input.Key} does not match resumed collection-gate generation ${gate.etag}`);
+            }
+        }
+        if (!settled)
+            throw new Error(`envelope write did not settle at ${input.Key}`);
+        try {
+            await this.releaseCollectionGate(gate);
+        }
+        catch (releaseError) {
+            if (operationError) {
+                throw new AggregateError([operationError, releaseError], 'envelope operation and collection-gate release both failed');
+            }
+            throw releaseError;
+        }
+        if (operationError)
+            throw operationError;
+    }
+    async putSuppression(key, record) {
+        await this.client.send(new PutObjectCommand({
+            Bucket: this.config.eventsBucket,
+            Key: cleanKey(key),
+            Body: JSON.stringify(record),
+            ContentType: 'application/json',
+        }));
+    }
+    async acquireCollectionGate(write, requestedDigest) {
+        const siteId = requiredSegment(write.siteId, 'site id');
+        const namespace = requiredSegment(write.identityNamespace, 'identity namespace').toLowerCase();
+        const identityHash = requiredIdentityHash(write.identityHash);
+        const owner = requiredEnvelopeId(write.envelopeId);
+        const digest = requiredDigest(requestedDigest);
+        const key = joinKey(COLLECTION_GATE_PREFIX, identityHash.slice(0, 2), siteId, namespace, `${identityHash}.json`);
+        for (let attempt = 0; attempt < COLLECTION_GATE_ATTEMPTS; attempt += 1) {
+            const collecting = {
+                schemaVersion: 1,
+                state: 'collecting',
+                owner,
+                digest,
+            };
+            try {
+                const etag = await this.putCollectionGate(key, collecting);
+                return {
+                    key,
+                    etag,
+                    owner,
+                    digest,
+                    claimedFromOpen: false,
+                    resumedUncertain: false,
+                };
+            }
+            catch (error) {
+                if (!isConditionalConflict(error))
+                    throw new Error(`create collection gate ${key}`, { cause: error });
+            }
+            const current = await this.readCollectionGate(key);
+            if (current.record.state === 'erased')
+                throw new IdentityErasureFencedError();
+            if (current.record.state === 'collecting') {
+                const currentOwner = requiredEnvelopeId(current.record.owner || '');
+                const currentDigest = requiredDigest(current.record.digest || '');
+                if (currentOwner === owner) {
+                    if (currentDigest !== digest) {
+                        throw new EnvelopeIDCollisionError(key, currentDigest, digest);
+                    }
+                    return {
+                        key,
+                        etag: current.etag,
+                        owner,
+                        digest,
+                        claimedFromOpen: false,
+                        resumedUncertain: true,
+                    };
+                }
+                const settled = await this.collectionGenerationSettled(siteId, namespace, identityHash, currentOwner, currentDigest, current.etag);
+                if (settled) {
+                    await this.releaseCollectionGate({
+                        key,
+                        etag: current.etag,
+                        owner: currentOwner,
+                        digest: currentDigest,
+                        claimedFromOpen: false,
+                        resumedUncertain: true,
+                    });
+                    continue;
+                }
+                await delay(COLLECTION_GATE_RETRY_MS);
+                continue;
+            }
+            else if (current.record.state !== 'open') {
+                throw new Error(`collection gate ${key} has unknown state ${String(current.record.state)}`);
+            }
+            try {
+                const etag = await this.putCollectionGate(key, collecting, current.etag);
+                return {
+                    key,
+                    etag,
+                    owner,
+                    digest,
+                    claimedFromOpen: true,
+                    resumedUncertain: false,
+                };
+            }
+            catch (error) {
+                if (!isConditionalConflict(error))
+                    throw new Error(`claim collection gate ${key}`, { cause: error });
+            }
+            await delay(COLLECTION_GATE_RETRY_MS);
+        }
+        throw new Error(`collection gate is busy at ${key}`);
+    }
+    async releaseCollectionGate(lease) {
+        try {
+            await this.putCollectionGate(lease.key, { schemaVersion: 1, state: 'open' }, lease.etag);
+            return;
+        }
+        catch (error) {
+            let current;
+            try {
+                current = await this.readCollectionGate(lease.key);
+            }
+            catch (readError) {
+                throw new AggregateError([error, readError], `release collection gate and reconcile state failed at ${lease.key}`);
+            }
+            if (current.record.state === 'open')
+                return;
+            if (current.record.state === 'erased')
+                throw new IdentityErasureFencedError();
+            if (current.record.state === 'collecting' && current.etag !== lease.etag) {
+                return;
+            }
+            throw error;
+        }
+    }
+    async settleResumedEnvelope(key, digest, gate) {
+        for (let attempt = 0; attempt < COLLECTION_GATE_ATTEMPTS; attempt += 1) {
+            let head;
+            try {
+                head = await this.client.send(new HeadObjectCommand({ Bucket: this.config.eventsBucket, Key: key }));
+            }
+            catch (error) {
+                if (isNotFound(error)) {
+                    await delay(COLLECTION_GATE_RETRY_MS);
+                    continue;
+                }
+                throw new Error(`verify uncertain envelope ${key}; collection gate remains busy`, { cause: error });
+            }
+            const existingDigest = envelopeDigestMetadata(head.Metadata);
+            const existingGateETag = metadataValue(head.Metadata, COLLECTION_GATE_ETAG_METADATA_KEY);
+            if (existingDigest !== digest) {
+                throw new EnvelopeIDCollisionError(key, existingDigest, digest);
+            }
+            if (existingGateETag !== gate.etag) {
+                throw new Error(`envelope at ${key} does not match resumed collection-gate generation ${gate.etag}`);
+            }
+            await this.releaseCollectionGate(gate);
+            return;
+        }
+        throw new Error(`uncertain envelope ${key} is not yet visible; collection gate remains busy`);
+    }
+    async collectionGenerationSettled(siteId, namespace, identityHash, owner, digest, gateETag) {
+        const key = joinKey('audience/first-party', identityHash.slice(0, 2), siteId, namespace, identityHash, `${owner}.json`);
+        let head;
+        try {
+            head = await this.client.send(new HeadObjectCommand({ Bucket: this.config.eventsBucket, Key: key }));
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return false;
+            throw new Error(`verify collecting generation object ${key}`, { cause: error });
+        }
+        const existingDigest = envelopeDigestMetadata(head.Metadata);
+        const existingGateETag = metadataValue(head.Metadata, COLLECTION_GATE_ETAG_METADATA_KEY);
+        if (existingDigest !== digest || existingGateETag !== gateETag) {
+            throw new Error(`collecting generation object ${key} has mismatched proof metadata`);
+        }
+        return true;
+    }
+    async putCollectionGate(key, record, ifMatch) {
+        const metadata = {
+            [COLLECTION_GATE_STATE_METADATA_KEY]: record.state,
+        };
+        if (record.owner)
+            metadata[COLLECTION_GATE_OWNER_METADATA_KEY] = record.owner;
+        if (record.digest)
+            metadata[COLLECTION_GATE_DIGEST_METADATA_KEY] = record.digest;
+        const output = await this.client.send(new PutObjectCommand({
+            Bucket: this.config.eventsBucket,
+            Key: cleanKey(key),
+            Body: JSON.stringify(record),
+            ContentType: 'application/json',
+            Metadata: metadata,
+            ...(ifMatch ? { IfMatch: ifMatch } : { IfNoneMatch: '*' }),
+        }));
+        const etag = output.ETag?.trim() || '';
+        if (!etag)
+            throw new Error(`collection gate PUT returned no ETag at ${key}`);
+        return etag;
+    }
+    async readCollectionGate(key) {
+        let output;
+        try {
+            output = await this.client.send(new HeadObjectCommand({ Bucket: this.config.eventsBucket, Key: cleanKey(key) }));
+        }
+        catch (error) {
+            throw new Error(`head collection gate ${key}`, { cause: error });
+        }
+        const etag = output.ETag?.trim() || '';
+        if (!etag)
+            throw new Error(`collection gate ${key} has no ETag`);
+        const metadata = lowerCaseMetadata(output.Metadata);
+        return {
+            etag,
+            record: {
+                schemaVersion: 1,
+                state: metadata[COLLECTION_GATE_STATE_METADATA_KEY],
+                owner: metadata[COLLECTION_GATE_OWNER_METADATA_KEY],
+                digest: metadata[COLLECTION_GATE_DIGEST_METADATA_KEY],
+            },
+        };
+    }
+    async sendWithWriteDeadline(command) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.writeTimeoutMs());
+        try {
+            return await this.client.send(command, { abortSignal: controller.signal });
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+    writeTimeoutMs() {
+        return positiveDuration(this.config.collectionWriteTimeoutMs, COLLECTION_WRITE_TIMEOUT_MS);
+    }
+    async readObject(bucket, key) {
+        try {
+            const output = await this.client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+            if (!output.Body)
+                throw new Error(`empty object body at ${key}`);
+            if (typeof output.Body.transformToString === 'function')
+                return await output.Body.transformToString();
+            throw new Error(`unsupported object body at ${key}`);
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw error;
+        }
+    }
+}
+/**
+ * Edge Config is the provider projection for immutable release routing state.
+ * This tiny store is safe in Next middleware: it only fetches the route
+ * projection and never reads S3, claims, or event data.
+ */
+export class VercelEdgeConfigRouteStore {
+    edgeConfig;
+    siteId;
+    constructor(edgeConfig, siteId) {
+        this.edgeConfig = edgeConfig;
+        this.siteId = siteId;
+    }
+    async readEdgeManifest(releaseId) {
+        const value = await getUncachedEdgeConfigValue(this.edgeConfig, edgeRoutesKey(this.siteId, releaseId));
+        if (!value)
+            return null;
+        if (typeof value === 'string')
+            return JSON.parse(value);
+        return value;
+    }
+}
+export function createVercelS3PersonalizationStore(config) {
+    return new VercelS3PersonalizationStore(config);
+}
+/**
+ * Builds the EdgeRouter configuration used by Next middleware. It deliberately
+ * has no AWS/S3 configuration: its only remote dependency is the provider's
+ * Edge Config projection.
+ */
+export function createVercelPersonalizationFromEnv(env = process.env) {
+    if (env.ACI_PERSONALIZATION_HOST_ENABLED !== 'true')
+        return undefined;
+    const siteId = requiredEnv(env, 'ACI_SITE_ID');
+    const edgeConfig = requiredEnv(env, 'EDGE_CONFIG');
+    const currentKID = env.ACI_IDENTITY_KID || env.AUDIENCE_IDENTITY_COOKIE_KID || 'v1';
+    const currentSecret = env.ACI_IDENTITY_SECRET || env.AUDIENCE_IDENTITY_COOKIE_SECRET || '';
+    if (!currentSecret)
+        throw new Error('ACI_IDENTITY_SECRET is required when ACI_PERSONALIZATION_HOST_ENABLED=true');
+    const previousKID = env.ACI_IDENTITY_KID_PREVIOUS || env.AUDIENCE_IDENTITY_COOKIE_KID_PREVIOUS || '';
+    const previousSecret = env.ACI_IDENTITY_SECRET_PREVIOUS || env.AUDIENCE_IDENTITY_COOKIE_SECRET_PREVIOUS || '';
+    if ((previousKID === '') !== (previousSecret === '')) {
+        throw new Error('previous identity kid and secret must be configured together');
+    }
+    const identityKeys = {
+        current: { kid: currentKID, secret: currentSecret },
+        ...(previousKID ? { previous: { kid: previousKID, secret: previousSecret } } : {}),
+    };
+    return {
+        siteId,
+        store: new VercelEdgeConfigRouteStore(edgeConfig, siteId),
+        identityKeys,
+        claimsKeys: {
+            [currentKID]: currentSecret,
+            ...(previousKID ? { [previousKID]: previousSecret } : {}),
+        },
+        secureCookies: env.AUDIENCE_IDENTITY_COOKIE_SECURE !== 'false',
+    };
+}
+/** Builds the Node.js `/collect` configuration. This is the only Vercel
+ * application runtime that receives data-plane storage configuration, and it
+ * fails closed unless the exact-project AWS workload role is configured. */
+export function createVercelCollectionFromEnv(env = process.env) {
+    if (env.ACI_PERSONALIZATION_HOST_ENABLED !== 'true')
+        return undefined;
+    const siteId = requiredEnv(env, 'ACI_SITE_ID');
+    const region = env.AWS_REGION || env.AWS_DEFAULT_REGION || '';
+    if (!region)
+        throw new Error('AWS_REGION is required for the Vercel /collect route');
+    const roleArn = requiredEnv(env, 'AWS_ROLE_ARN');
+    const currentKID = env.ACI_IDENTITY_KID || env.AUDIENCE_IDENTITY_COOKIE_KID || 'v1';
+    const currentSecret = env.ACI_IDENTITY_SECRET || env.AUDIENCE_IDENTITY_COOKIE_SECRET || '';
+    if (!currentSecret)
+        throw new Error('ACI_IDENTITY_SECRET is required for the Vercel /collect route');
+    const previousKID = env.ACI_IDENTITY_KID_PREVIOUS || env.AUDIENCE_IDENTITY_COOKIE_KID_PREVIOUS || '';
+    const previousSecret = env.ACI_IDENTITY_SECRET_PREVIOUS || env.AUDIENCE_IDENTITY_COOKIE_SECRET_PREVIOUS || '';
+    if ((previousKID === '') !== (previousSecret === '')) {
+        throw new Error('previous identity kid and secret must be configured together');
+    }
+    const identityKeys = {
+        current: { kid: currentKID, secret: currentSecret },
+        ...(previousKID ? { previous: { kid: previousKID, secret: previousSecret } } : {}),
+    };
+    return {
+        siteId,
+        store: createVercelS3PersonalizationStore({
+            region,
+            roleArn,
+            hostingBucket: requiredEnv(env, 'HOSTING_BUCKET'),
+            eventsBucket: requiredEnv(env, 'EVENTS_BUCKET'),
+            hostingKeyPrefix: env.HOSTING_KEY_PREFIX,
+            claimsKeyPrefix: env.AUDIENCE_CLAIMS_S3_PREFIX,
+        }),
+        identityKeys,
+        claimsKeys: {
+            [currentKID]: currentSecret,
+            ...(previousKID ? { [previousKID]: previousSecret } : {}),
+        },
+        secureCookies: env.AUDIENCE_IDENTITY_COOKIE_SECURE !== 'false',
+    };
+}
+function requiredSegment(value, label) {
+    const clean = cleanKey(value);
+    if (!clean || clean.includes('/'))
+        throw new Error(`${label} is required and must be one path segment`);
+    return clean;
+}
+function requiredIdentityHash(value) {
+    const hash = requiredSegment(value, 'identity hash').toLowerCase();
+    if (!/^[0-9a-f]{2,}$/.test(hash))
+        throw new Error('identity hash must be lowercase hexadecimal');
+    return hash;
+}
+function requiredEnvelopeId(value) {
+    const envelopeId = requiredSegment(value, 'envelope id').toUpperCase();
+    if (!/^[0-7][0-9A-HJKMNP-TV-Z]{25}$/.test(envelopeId)) {
+        throw new Error('envelope id must be a normalized ULID');
+    }
+    return envelopeId;
+}
+function requiredDigest(value) {
+    const digest = value.trim().toLowerCase();
+    if (!SHA256_HEX.test(digest)) {
+        throw new Error('envelope digest must be a SHA-256 hex value');
+    }
+    return digest;
+}
+function requiredEnv(env, name) {
+    const value = env[name]?.trim() || '';
+    if (!value)
+        throw new Error(`${name} is required when ACI_PERSONALIZATION_HOST_ENABLED=true`);
+    return value;
+}
+function cleanKey(value) {
+    return (value || '').trim().replace(/^\/+|\/+$/g, '');
+}
+function joinKey(...parts) {
+    return parts.map(cleanKey).filter(Boolean).join('/');
+}
+function edgeRoutesKey(siteId, releaseId) {
+    return `edgeRoutes_${edgeKeySegment(siteId)}_${edgeKeySegment(releaseId)}`;
+}
+function edgeKeySegment(value) {
+    return value.replace(/[^A-Za-z0-9_-]/g, '_');
+}
+function isNotFound(error) {
+    const value = error;
+    return value?.$metadata?.httpStatusCode === 404 || value?.name === 'NoSuchKey' || value?.name === 'NotFound';
+}
+function isConditionalConflict(error) {
+    const value = error;
+    return value?.$metadata?.httpStatusCode === 409
+        || value?.$metadata?.httpStatusCode === 412
+        || value?.name === 'ConditionalRequestConflict'
+        || value?.name === 'PreconditionFailed';
+}
+function envelopeDigestMetadata(metadata) {
+    return metadataValue(metadata, ENVELOPE_DIGEST_METADATA_KEY).toLowerCase();
+}
+function metadataValue(metadata, want) {
+    for (const [key, value] of Object.entries(metadata || {})) {
+        if (key.toLowerCase() === want) {
+            return value.trim();
+        }
+    }
+    return '';
+}
+function lowerCaseMetadata(metadata) {
+    return Object.fromEntries(Object.entries(metadata || {}).map(([key, value]) => [key.toLowerCase(), value.trim()]));
+}
+function positiveDuration(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    if (!Number.isFinite(value) || value <= 0)
+        throw new Error('collection gate durations must be positive');
+    return value;
+}
+async function delay(milliseconds) {
+    await new Promise((resolve) => setTimeout(resolve, milliseconds));
+}

package/dist/providers/s3.d.ts

@@ -6,19 +6,34 @@ export interface S3ContentProviderConfig {
     accessKeyId?: string;
     secretAccessKey?: string;
     sessionToken?: string;
+    roleArn?: string;
     endpoint?: string;
 }
-type ResolvedS3Config = Required<S3ContentProviderConfig>;
+type ResolvedS3Config = {
+    bucket: string;
+    keyPrefix: string;
+    region: string;
+    accessKeyId: string;
+    secretAccessKey: string;
+    sessionToken: string;
+    roleArn: string;
+    endpoint: string;
+};
+export interface S3CommandClient {
+    send(command: {
+        input: unknown;
+    }): Promise<any>;
+}
 export declare class S3ContentProvider implements ContentProvider {
     #private;
     readonly config: ResolvedS3Config;
-    constructor(config?: S3ContentProviderConfig);
+    constructor(config?: S3ContentProviderConfig, client?: S3CommandClient);
     listRoutes(): Promise<RouteEntry[]>;
     getSiteConfig<T = unknown>(): Promise<T>;
     getPage<T = unknown>(route: string): Promise<T>;
     /**
      * getPageByRef serves the exact payload the edge selected (the
-     * X-Baremetal-Function-Ref contract): base page or variant. Only refs the
+     * X-Aci-Content-Ref contract): base page or variant. Only refs the
      * release manifest declares are served — the header names published
      * content, it cannot address arbitrary keys.
      */
@@ -29,6 +44,6 @@ export declare class S3ContentProvider implements ContentProvider {
     fetchRaw(key: string): Promise<Response>;
     private getJSON;
 }
-export declare function getS3JSON<T>(key: string, config: ResolvedS3Config): Promise<T>;
-export declare function getS3Raw(key: string, config: ResolvedS3Config): Promise<Response>;
+export declare function getS3JSON<T>(key: string, config: ResolvedS3Config, client?: S3CommandClient): Promise<T>;
+export declare function getS3Raw(key: string, config: ResolvedS3Config, client?: S3CommandClient): Promise<Response>;
 export {};