@gradial/aci 0.1.42 → 0.1.43

package/dist/next/envelope-digest.d.ts

@@ -0,0 +1,21 @@
+export interface EnvelopeDigestInput {
+    siteId: string;
+    acceptedBody: Uint8Array;
+    identity: {
+        namespace: string;
+        hash: string;
+    };
+    consent: {
+        version: number;
+        purposes: readonly string[];
+        grantedAt?: string;
+        source?: string;
+    };
+}
+/**
+ * Computes the cross-runtime digest used to distinguish an identical
+ * envelope retry from reuse of the same envelope ID with different accepted
+ * inputs. Every field is framed with an unsigned 8-byte big-endian length so
+ * concatenation cannot create ambiguous inputs.
+ */
+export declare function computeEnvelopeDigest(input: EnvelopeDigestInput): Promise<string>;

package/dist/next/envelope-digest.js

@@ -0,0 +1,58 @@
+const ENVELOPE_DIGEST_ALGORITHM = 'aci-envelope-digest-v1';
+const RFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.(\d{1,9}))?(Z|[+-]\d{2}:\d{2})$/;
+const encoder = new TextEncoder();
+const CONSENT_EDGE_WHITESPACE = /^[\t\n\v\f\r ]+|[\t\n\v\f\r ]+$/g;
+/**
+ * Computes the cross-runtime digest used to distinguish an identical
+ * envelope retry from reuse of the same envelope ID with different accepted
+ * inputs. Every field is framed with an unsigned 8-byte big-endian length so
+ * concatenation cannot create ambiguous inputs.
+ */
+export async function computeEnvelopeDigest(input) {
+    if (!Number.isInteger(input.consent.version)) {
+        throw new Error('consent version must be an integer');
+    }
+    const purposes = input.consent.purposes
+        .map((purpose) => trimConsentWhitespace(purpose).toLowerCase())
+        .sort();
+    const fields = [
+        encoder.encode(ENVELOPE_DIGEST_ALGORITHM),
+        encoder.encode(input.siteId.trim()),
+        input.acceptedBody,
+        encoder.encode(input.identity.namespace.trim()),
+        encoder.encode(input.identity.hash.trim()),
+        encoder.encode(String(input.consent.version)),
+        encoder.encode(String(purposes.length)),
+        ...purposes.map((purpose) => encoder.encode(purpose)),
+        encoder.encode(canonicalGrantedAt(input.consent.grantedAt || '')),
+        encoder.encode(trimConsentWhitespace(input.consent.source || '')),
+    ];
+    const byteLength = fields.reduce((total, field) => total + 8 + field.byteLength, 0);
+    const framed = new Uint8Array(byteLength);
+    const view = new DataView(framed.buffer);
+    let offset = 0;
+    for (const field of fields) {
+        view.setBigUint64(offset, BigInt(field.byteLength), false);
+        offset += 8;
+        framed.set(field, offset);
+        offset += field.byteLength;
+    }
+    const digest = await globalThis.crypto.subtle.digest('SHA-256', framed);
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+function canonicalGrantedAt(value) {
+    const clean = trimConsentWhitespace(value);
+    if (!clean)
+        return '';
+    const match = RFC3339.exec(clean);
+    const epochMillis = Date.parse(clean);
+    if (!match || Number.isNaN(epochMillis)) {
+        throw new Error('consent grantedAt must be an RFC3339 timestamp');
+    }
+    const fraction = (match[7] || '').replace(/0+$/, '');
+    const seconds = new Date(epochMillis).toISOString().slice(0, 19);
+    return `${seconds}${fraction ? `.${fraction}` : ''}Z`;
+}
+function trimConsentWhitespace(value) {
+    return value.replace(CONSENT_EDGE_WHITESPACE, '');
+}

package/dist/next/middleware.d.ts

@@ -6,6 +6,8 @@ export interface GradialMiddlewareConfig {
     previewSignKey?: string;
     deploymentId?: string;
     deploymentProtectionBypass?: string;
+    /** Site-scoped token shared only with the outer ACI framework proxy. */
+    frameworkOriginAuthToken?: string;
     personalization?: Omit<PersonalizationHostConfig, 'siteId'> & {
         siteId?: string;
     };
@@ -19,8 +21,20 @@ export declare function createGradialMiddleware(config?: GradialMiddlewareConfig
  * cache-keyed query parameter, not in cookies.
  */
 export declare function enforceCookieCacheRule(response: NextResponse): void;
-export declare const aciMiddlewareMatcher: string[];
+export declare const aciMiddlewareMatcher: (string | {
+    source: string;
+    has: {
+        type: string;
+        key: string;
+    }[];
+})[];
 export declare const config: {
     runtime: string;
-    matcher: string[];
+    matcher: (string | {
+        source: string;
+        has: {
+            type: string;
+            key: string;
+        }[];
+    })[];
 };

package/dist/next/middleware.js

@@ -1,14 +1,40 @@
 import { NextResponse } from 'next/server.js';
 import { getUncachedEdgeConfigValue } from './edge-config.js';
 import { PREVIEW_TOKEN_COOKIE, PREVIEW_RELEASE_COOKIE, extractPreviewToken, resolvePreviewContext, createPreviewCookies, previewSignKey, } from '../preview/core.js';
-import { CONTENT_PATH_CACHE_PARAM, resolvePersonalizationRequest, } from './personalization-host.js';
+import { CONTENT_PATH_HEADER, CONTENT_PATH_CACHE_PARAM, resolvePersonalizationRequest, } from './personalization-host.js';
 const RELEASE_SCOPED_PREFIX = '/__r';
+const FRAMEWORK_ORIGIN_AUTH_HEADER = 'x-gradial-framework-origin-auth';
+const FRAMEWORK_SITE_ID_HEADER = 'x-baremetal-site-id';
+const FRAMEWORK_RELEASE_ID_HEADER = 'x-baremetal-release-id';
+const FRAMEWORK_CONTENT_REF_HEADER = 'x-aci-content-ref';
+const FRAMEWORK_CONTENT_BASE_URL_HEADER = 'x-baremetal-content-base-url';
+const textEncoder = new TextEncoder();
 const CMS_ASSET_PATHS = new Set(['/robots.txt', '/sitemap.xml']);
+const FRAMEWORK_RUNTIME_PATHS = new Set(['/favicon.ico', '/_health']);
+const FRAMEWORK_RUNTIME_PREFIXES = [
+    '/_next',
+    '/api',
+    '/collect',
+    '/gradial/assets',
+    '/.gradial-dam',
+];
 const PUBLIC_PATHS = new Set(typeof __ACI_PUBLIC_PATHS__ !== 'undefined' ? __ACI_PUBLIC_PATHS__ : []);
 const PASSTHROUGH_ROUTES = (typeof __ACI_PASSTHROUGH_ROUTES__ !== 'undefined' ? __ACI_PASSTHROUGH_ROUTES__ : []);
 export function createGradialMiddleware(config = {}) {
     return async function middleware(request) {
         const url = request.nextUrl;
+        const frameworkDispatch = await resolveFrameworkDispatch(request, config);
+        if (frameworkDispatch.kind === 'rejected') {
+            return frameworkDispatch.response;
+        }
+        // The outer framework proxy authenticates every request with reserved
+        // dispatch headers, including Next/API/static runtime paths. Match those
+        // paths so the handoff is validated and reserved headers are stripped.
+        // Document rewrites retain only the validated, canonical content-path
+        // query because Vercel uses it as the selected payload's cache identity.
+        if (isFrameworkRuntimePath(url.pathname)) {
+            return passThroughResponse(request, frameworkDispatch);
+        }
         // ?leave_preview=1 → clear cookies, redirect to clean URL
         if (url.searchParams.get('leave_preview') === '1') {
             const cleanUrl = new URL(url.pathname, url.origin);
@@ -18,13 +44,13 @@ export function createGradialMiddleware(config = {}) {
             return response;
         }
         if (PUBLIC_PATHS.has(url.pathname)) {
-            return NextResponse.next();
+            return passThroughResponse(request, frameworkDispatch);
         }
         if (CMS_ASSET_PATHS.has(url.pathname)) {
-            return NextResponse.next();
+            return passThroughResponse(request, frameworkDispatch);
         }
         if (isPassthroughRoute(url.pathname)) {
-            return NextResponse.next();
+            return passThroughResponse(request, frameworkDispatch);
         }
         // Block direct access to /__r/... — only middleware rewrites may use it.
         if (isReleaseScopedPath(url.pathname, RELEASE_SCOPED_PREFIX)) {
@@ -33,6 +59,14 @@ export function createGradialMiddleware(config = {}) {
                 headers: { 'Cache-Control': 'private, no-store' },
             });
         }
+        if (frameworkDispatch.kind === 'trusted') {
+            const response = rewriteToReleaseScopedPath(request, frameworkDispatch.releaseId, false, {
+                contentPath: frameworkDispatch.contentPath,
+                requestHeaders: frameworkRequestHeaders(request, frameworkDispatch.contentPath),
+            });
+            enforceCookieCacheRule(response);
+            return response;
+        }
         // Try preview token first; if valid, use that release.
         // If no token or invalid, fall through to active release from edge config.
         const preview = await resolvePreviewFromRequest(request, config);
@@ -105,7 +139,12 @@ export function createGradialMiddleware(config = {}) {
                 });
             }
         }
-        const response = rewriteToReleaseScopedPath(request, releaseId, Boolean(preview?.isPreview), personalization);
+        const response = rewriteToReleaseScopedPath(request, releaseId, Boolean(preview?.isPreview), personalization
+            ? {
+                contentPath: personalization.contentPath,
+                requestHeaders: personalization.requestHeaders,
+            }
+            : undefined);
         // Persist preview token as cookie so navigation stays in preview
         if (preview?.token && preview.isPreview) {
             for (const cookie of createPreviewCookies(preview.token, releaseId)) {
@@ -144,15 +183,15 @@ export function enforceCookieCacheRule(response) {
     response.headers.delete('CDN-Cache-Control');
     response.headers.delete('Vercel-CDN-Cache-Control');
 }
-function rewriteToReleaseScopedPath(request, releaseId, isPreview, personalization) {
+function rewriteToReleaseScopedPath(request, releaseId, isPreview, options) {
     const rewriteURL = new URL(request.url);
     rewriteURL.pathname = releaseScopedPath(RELEASE_SCOPED_PREFIX, releaseId, request.nextUrl.pathname);
     rewriteURL.searchParams.delete(CONTENT_PATH_CACHE_PARAM);
-    if (personalization?.contentPath) {
-        rewriteURL.searchParams.set(CONTENT_PATH_CACHE_PARAM, personalization.contentPath);
+    if (options?.contentPath) {
+        rewriteURL.searchParams.set(CONTENT_PATH_CACHE_PARAM, options.contentPath);
     }
-    const response = personalization
-        ? NextResponse.rewrite(rewriteURL, { request: { headers: personalization.requestHeaders } })
+    const response = options?.requestHeaders
+        ? NextResponse.rewrite(rewriteURL, { request: { headers: options.requestHeaders } })
         : NextResponse.rewrite(rewriteURL);
     if (isPreview) {
         response.headers.set('Cache-Control', 'private, no-store');
@@ -164,6 +203,113 @@ function rewriteToReleaseScopedPath(request, releaseId, isPreview, personalizati
     }
     return response;
 }
+async function resolveFrameworkDispatch(request, config) {
+    // The outer edge has already minted identity and selected a release/payload.
+    // A trusted handoff must use that exact decision; falling through would mint
+    // a second identity and may select a different experiment arm.
+    const originAuth = request.headers.get(FRAMEWORK_ORIGIN_AUTH_HEADER);
+    const forwardedSiteId = request.headers.get(FRAMEWORK_SITE_ID_HEADER);
+    const forwardedReleaseId = request.headers.get(FRAMEWORK_RELEASE_ID_HEADER);
+    const forwardedContentRef = request.headers.get(FRAMEWORK_CONTENT_REF_HEADER);
+    const contentPathValues = request.nextUrl.searchParams.getAll(CONTENT_PATH_CACHE_PARAM);
+    const hasReservedDispatch = originAuth !== null
+        || forwardedSiteId !== null
+        || forwardedReleaseId !== null
+        || forwardedContentRef !== null
+        || request.headers.has(FRAMEWORK_CONTENT_BASE_URL_HEADER)
+        || request.headers.has(CONTENT_PATH_HEADER)
+        || contentPathValues.length > 0;
+    if (!hasReservedDispatch) {
+        return { kind: 'direct' };
+    }
+    const expectedOriginAuth = config.frameworkOriginAuthToken
+        || process.env.ACI_FRAMEWORK_ORIGIN_AUTH_TOKEN
+        || '';
+    if (!expectedOriginAuth
+        || originAuth === null
+        || !(await secureStringEqual(expectedOriginAuth, originAuth))) {
+        return rejectedFrameworkDispatch(403, 'framework dispatch forbidden');
+    }
+    if (!forwardedSiteId || !forwardedReleaseId) {
+        return rejectedFrameworkDispatch(400, 'invalid framework dispatch');
+    }
+    const expectedSiteId = siteIdForConfig(config);
+    if (!expectedSiteId || forwardedSiteId !== expectedSiteId) {
+        return rejectedFrameworkDispatch(403, 'framework dispatch forbidden');
+    }
+    if (forwardedContentRef === null && contentPathValues.length === 0) {
+        return {
+            kind: 'trusted',
+            releaseId: forwardedReleaseId,
+            contentPath: '',
+        };
+    }
+    if (!forwardedContentRef
+        || contentPathValues.length !== 1
+        || contentPathValues[0] !== forwardedContentRef) {
+        return rejectedFrameworkDispatch(400, 'invalid framework dispatch');
+    }
+    return {
+        kind: 'trusted',
+        releaseId: forwardedReleaseId,
+        contentPath: forwardedContentRef,
+    };
+}
+function passThroughResponse(request, frameworkDispatch) {
+    if (frameworkDispatch.kind !== 'trusted') {
+        return NextResponse.next();
+    }
+    if (frameworkDispatch.contentPath) {
+        return new Response('invalid framework dispatch', {
+            status: 400,
+            headers: { 'Cache-Control': 'private, no-store' },
+        });
+    }
+    return NextResponse.next({
+        request: {
+            headers: sanitizedFrameworkRequestHeaders(request),
+        },
+    });
+}
+function frameworkRequestHeaders(request, contentPath) {
+    const requestHeaders = sanitizedFrameworkRequestHeaders(request);
+    if (contentPath) {
+        requestHeaders.set(CONTENT_PATH_HEADER, contentPath);
+    }
+    return requestHeaders;
+}
+function sanitizedFrameworkRequestHeaders(request) {
+    const requestHeaders = new Headers(request.headers);
+    requestHeaders.delete(FRAMEWORK_ORIGIN_AUTH_HEADER);
+    requestHeaders.delete(FRAMEWORK_SITE_ID_HEADER);
+    requestHeaders.delete(FRAMEWORK_RELEASE_ID_HEADER);
+    requestHeaders.delete(FRAMEWORK_CONTENT_REF_HEADER);
+    requestHeaders.delete(FRAMEWORK_CONTENT_BASE_URL_HEADER);
+    requestHeaders.delete(CONTENT_PATH_HEADER);
+    return requestHeaders;
+}
+function rejectedFrameworkDispatch(status, message) {
+    return {
+        kind: 'rejected',
+        response: new Response(message, {
+            status,
+            headers: { 'Cache-Control': 'private, no-store' },
+        }),
+    };
+}
+async function secureStringEqual(expected, actual) {
+    const [expectedDigest, actualDigest] = await Promise.all([
+        crypto.subtle.digest('SHA-256', textEncoder.encode(expected)),
+        crypto.subtle.digest('SHA-256', textEncoder.encode(actual)),
+    ]);
+    const expectedBytes = new Uint8Array(expectedDigest);
+    const actualBytes = new Uint8Array(actualDigest);
+    let different = 0;
+    for (let index = 0; index < expectedBytes.length; index += 1) {
+        different |= expectedBytes[index] ^ actualBytes[index];
+    }
+    return different === 0;
+}
 function isReleaseScopedPath(pathname, prefix) {
     return pathname === prefix || pathname.startsWith(`${prefix}/`);
 }
@@ -296,6 +442,12 @@ function edgeKeySegment(value) {
 function isPassthroughRoute(pathname) {
     return PASSTHROUGH_ROUTES.some((route) => routeMatches(pathname, route));
 }
+function isFrameworkRuntimePath(pathname) {
+    if (FRAMEWORK_RUNTIME_PATHS.has(pathname)) {
+        return true;
+    }
+    return FRAMEWORK_RUNTIME_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
 function routeMatches(pathname, route) {
     const cleanPath = normalizeRoutePath(pathname);
     const cleanRoute = normalizeRoutePath(route);
@@ -320,6 +472,34 @@ function normalizeRoutePath(value) {
 }
 export const aciMiddlewareMatcher = [
     '/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)',
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-gradial-framework-origin-auth' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-baremetal-site-id' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-baremetal-release-id' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-aci-content-ref' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-baremetal-content-base-url' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-aci-content-path' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'query', key: '__aci_content_path' }],
+    },
 ];
 export const config = {
     runtime: 'nodejs',

package/dist/next/personalization-host.d.ts

@@ -1,4 +1,5 @@
 import { type PersonalizationExperiment } from '../edge/personalization-core.js';
+import { type PortableConsentSnapshot } from '../consent/portable-envelope.js';
 export declare const CONTENT_PATH_HEADER = "x-aci-content-path";
 export declare const CONTENT_PATH_CACHE_PARAM = "__aci_content_path";
 export interface EdgeDispatch {
@@ -37,6 +38,19 @@ export interface EdgeRouteManifest {
     notFoundPage?: string;
     errorPage?: string;
 }
+export interface PersonalizationEnvelopeWrite {
+    key: string;
+    envelopeId: string;
+    siteId: string;
+    identityNamespace: string;
+    identityHash: string;
+    records: readonly unknown[];
+    digest: string;
+}
+export declare class IdentityErasureFencedError extends Error {
+    readonly name = "IdentityErasureFencedError";
+    constructor();
+}
 /** Immutable release routing state read by an EdgeRouter. */
 export interface PersonalizationRouteStore {
     readEdgeManifest(releaseId: string): Promise<EdgeRouteManifest | null>;
@@ -44,7 +58,7 @@ export interface PersonalizationRouteStore {
 /** Customer-owned collection state. This is deliberately not an EdgeRouter dependency. */
 export interface PersonalizationCollectionStore {
     readClaims(siteId: string, namespace: string, identityHash: string): Promise<string | null>;
-    appendEvent(key: string, record: unknown): Promise<void>;
+    appendEnvelope(write: PersonalizationEnvelopeWrite): Promise<void>;
     putSuppression(key: string, record: unknown): Promise<void>;
 }
 /** @deprecated Use the narrower router or collection store at each boundary. */
@@ -91,12 +105,7 @@ export interface PersonalizationResolution {
     };
     cookies: CookieMutation[];
 }
-export interface ConsentSnapshot {
-    version: number;
-    purposes: string[];
-    grantedAt: string;
-    source?: string;
-}
+export type ConsentSnapshot = PortableConsentSnapshot;
 interface ClaimsPayload {
     aud?: string[];
     seg?: string[];

package/dist/next/personalization-host.js

@@ -1,9 +1,16 @@
 import { resolvePersonalizationDecision, } from '../edge/personalization-core.js';
+import { parsePortableConsentEnvelope, portableConsentAllowsPersonalization, trimPortableConsentWhitespace, } from '../consent/portable-envelope.js';
 const DEFAULT_IDENTITY_TTL_SECONDS = 90 * 24 * 60 * 60;
 const DEFAULT_CLAIMS_TTL_SECONDS = 24 * 60 * 60;
 const textEncoder = new TextEncoder();
 export const CONTENT_PATH_HEADER = 'x-aci-content-path';
 export const CONTENT_PATH_CACHE_PARAM = '__aci_content_path';
+export class IdentityErasureFencedError extends Error {
+    name = 'IdentityErasureFencedError';
+    constructor() {
+        super('identity collection is fenced by erasure');
+    }
+}
 export async function resolvePersonalizationRequest(request, releaseId, config) {
     const requestHeaders = new Headers(request.headers);
     const cookies = parseCookieHeader(request.headers.get('cookie'));
@@ -85,9 +92,13 @@ export function consentSignals(request, cookies) {
     const privacyDenied = request.headers.get('sec-gpc')?.trim() === '1'
         || request.headers.get('dnt')?.trim() === '1'
         || ['deny', 'opt-out', 'off'].includes((request.headers.get('x-gradial-privacy-override') || '').trim().toLowerCase());
-    const raw = request.headers.get('x-aci-consent') || cookies.get('aci_consent') || '';
-    const snapshot = parseConsent(raw);
-    const allows = snapshot?.purposes.some((purpose) => purpose.toLowerCase() === 'personalization') || false;
+    const headerConsent = request.headers.get('x-aci-consent');
+    const hasHeaderConsent = trimPortableConsentWhitespace(headerConsent || '') !== '';
+    const raw = hasHeaderConsent
+        ? headerConsent
+        : cookies.get('aci_consent') || '';
+    const snapshot = parsePortableConsentEnvelope(raw, !hasHeaderConsent);
+    const allows = portableConsentAllowsPersonalization(snapshot);
     return {
         hasConsent: snapshot !== null,
         snapshot,
@@ -124,36 +135,6 @@ export async function sha256Hex(value) {
 export async function identityHashHex(namespace, value) {
     return sha256Hex(`${namespace.trim().toLowerCase()}\x00${value.trim()}`);
 }
-function parseConsent(raw) {
-    let decoded = raw.trim();
-    if (!decoded)
-        return null;
-    try {
-        decoded = decodeURIComponent(decoded);
-    }
-    catch {
-        // Evaluate the original value.
-    }
-    const legacy = new Set(['true', 'all', 'granted', 'yes', 'personalization', 'personalized']);
-    if (legacy.has(decoded.toLowerCase())) {
-        return { version: 0, purposes: ['personalization'], grantedAt: '' };
-    }
-    try {
-        const parsed = JSON.parse(decoded);
-        if (!Number.isInteger(parsed.v) || !Array.isArray(parsed.p) || !parsed.p.every((item) => typeof item === 'string') || typeof parsed.t !== 'string') {
-            return null;
-        }
-        return {
-            version: parsed.v,
-            purposes: parsed.p,
-            grantedAt: parsed.t,
-            source: typeof parsed.src === 'string' ? parsed.src : undefined,
-        };
-    }
-    catch {
-        return null;
-    }
-}
 function matchRoute(pathname, manifest) {
     const normalized = normalizePath(pathname);
     if (manifest.routes[normalized])

package/dist/next/server.d.ts

@@ -9,6 +9,7 @@ export interface FetchConfig {
     accessKeyId?: string;
     secretAccessKey?: string;
     sessionToken?: string;
+    roleArn?: string;
     endpoint?: string;
     releaseId?: string;
     edgeConfig?: string;

package/dist/next/server.js

@@ -135,6 +135,7 @@ export async function getReleaseAssetResponse(releaseId, assetPath, config = {})
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     const key = joinKey(provider.config.keyPrefix, 'assets', clean);
@@ -179,6 +180,7 @@ export async function getDamAssetResponse(assetPath, config = {}) {
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     const key = joinKey(provider.config.keyPrefix, clean);
@@ -235,6 +237,7 @@ async function resolveS3Provider(config) {
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     // Pre-warm the manifest with cached version

package/dist/next/vercel-collect-sdk-route.d.ts

@@ -0,0 +1,27 @@
+export interface VercelCollectSDKRouteConfig {
+    siteId: string;
+    edgeConfig: string;
+    region: string;
+    roleArn: string;
+    hostingBucket: string;
+    hostingKeyPrefix?: string;
+}
+export interface VercelCollectSDKRouteDependencies {
+    s3Client?: VercelCollectSDKS3Client;
+    readEdgeConfig?: (connection: string, key: string) => Promise<unknown>;
+    onError?: (error: unknown) => void;
+}
+export interface VercelCollectSDKS3Client {
+    send(command: {
+        input: unknown;
+    }): Promise<unknown>;
+}
+export type VercelCollectSDKRoute = (request: Request) => Promise<Response>;
+/**
+ * Creates the Node-only stable collect-SDK route used by ACI's injected
+ * Vercel Function. The provider pointer selects the immutable release on every
+ * uncached invocation, so an old code deployment remains correct while a
+ * canonical activation converges through Edge Config and deployment promotion.
+ */
+export declare function createVercelCollectSDKRoute(input: VercelCollectSDKRouteConfig, dependencies?: VercelCollectSDKRouteDependencies): VercelCollectSDKRoute;
+export declare function createVercelCollectSDKRouteFromEnv(env?: Record<string, string | undefined>, dependencies?: VercelCollectSDKRouteDependencies): VercelCollectSDKRoute;