@gradial/aci 0.1.42 → 0.1.44

package/dist/next/middleware.js

@@ -1,14 +1,40 @@
 import { NextResponse } from 'next/server.js';
 import { getUncachedEdgeConfigValue } from './edge-config.js';
 import { PREVIEW_TOKEN_COOKIE, PREVIEW_RELEASE_COOKIE, extractPreviewToken, resolvePreviewContext, createPreviewCookies, previewSignKey, } from '../preview/core.js';
-import { CONTENT_PATH_CACHE_PARAM, resolvePersonalizationRequest, } from './personalization-host.js';
+import { CONTENT_PATH_HEADER, CONTENT_PATH_CACHE_PARAM, resolvePersonalizationRequest, } from './personalization-host.js';
 const RELEASE_SCOPED_PREFIX = '/__r';
+const FRAMEWORK_ORIGIN_AUTH_HEADER = 'x-gradial-framework-origin-auth';
+const FRAMEWORK_SITE_ID_HEADER = 'x-baremetal-site-id';
+const FRAMEWORK_RELEASE_ID_HEADER = 'x-baremetal-release-id';
+const FRAMEWORK_CONTENT_REF_HEADER = 'x-aci-content-ref';
+const FRAMEWORK_CONTENT_BASE_URL_HEADER = 'x-baremetal-content-base-url';
+const textEncoder = new TextEncoder();
 const CMS_ASSET_PATHS = new Set(['/robots.txt', '/sitemap.xml']);
+const FRAMEWORK_RUNTIME_PATHS = new Set(['/favicon.ico', '/_health']);
+const FRAMEWORK_RUNTIME_PREFIXES = [
+    '/_next',
+    '/api',
+    '/collect',
+    '/gradial/assets',
+    '/.gradial-dam',
+];
 const PUBLIC_PATHS = new Set(typeof __ACI_PUBLIC_PATHS__ !== 'undefined' ? __ACI_PUBLIC_PATHS__ : []);
 const PASSTHROUGH_ROUTES = (typeof __ACI_PASSTHROUGH_ROUTES__ !== 'undefined' ? __ACI_PASSTHROUGH_ROUTES__ : []);
 export function createGradialMiddleware(config = {}) {
     return async function middleware(request) {
         const url = request.nextUrl;
+        const frameworkDispatch = await resolveFrameworkDispatch(request, config);
+        if (frameworkDispatch.kind === 'rejected') {
+            return frameworkDispatch.response;
+        }
+        // The outer framework proxy authenticates every request with reserved
+        // dispatch headers, including Next/API/static runtime paths. Match those
+        // paths so the handoff is validated and reserved headers are stripped.
+        // Document rewrites retain only the validated, canonical content-path
+        // query because Vercel uses it as the selected payload's cache identity.
+        if (isFrameworkRuntimePath(url.pathname)) {
+            return passThroughResponse(request, frameworkDispatch);
+        }
         // ?leave_preview=1 → clear cookies, redirect to clean URL
         if (url.searchParams.get('leave_preview') === '1') {
             const cleanUrl = new URL(url.pathname, url.origin);
@@ -18,13 +44,13 @@ export function createGradialMiddleware(config = {}) {
             return response;
         }
         if (PUBLIC_PATHS.has(url.pathname)) {
-            return NextResponse.next();
+            return passThroughResponse(request, frameworkDispatch);
         }
         if (CMS_ASSET_PATHS.has(url.pathname)) {
-            return NextResponse.next();
+            return passThroughResponse(request, frameworkDispatch);
         }
         if (isPassthroughRoute(url.pathname)) {
-            return NextResponse.next();
+            return passThroughResponse(request, frameworkDispatch);
         }
         // Block direct access to /__r/... — only middleware rewrites may use it.
         if (isReleaseScopedPath(url.pathname, RELEASE_SCOPED_PREFIX)) {
@@ -33,6 +59,14 @@ export function createGradialMiddleware(config = {}) {
                 headers: { 'Cache-Control': 'private, no-store' },
             });
         }
+        if (frameworkDispatch.kind === 'trusted') {
+            const response = rewriteToReleaseScopedPath(request, frameworkDispatch.releaseId, false, {
+                contentPath: frameworkDispatch.contentPath,
+                requestHeaders: frameworkRequestHeaders(request, frameworkDispatch.contentPath),
+            });
+            enforceCookieCacheRule(response);
+            return response;
+        }
         // Try preview token first; if valid, use that release.
         // If no token or invalid, fall through to active release from edge config.
         const preview = await resolvePreviewFromRequest(request, config);
@@ -105,7 +139,12 @@ export function createGradialMiddleware(config = {}) {
                 });
             }
         }
-        const response = rewriteToReleaseScopedPath(request, releaseId, Boolean(preview?.isPreview), personalization);
+        const response = rewriteToReleaseScopedPath(request, releaseId, Boolean(preview?.isPreview), personalization
+            ? {
+                contentPath: personalization.contentPath,
+                requestHeaders: personalization.requestHeaders,
+            }
+            : undefined);
         // Persist preview token as cookie so navigation stays in preview
         if (preview?.token && preview.isPreview) {
             for (const cookie of createPreviewCookies(preview.token, releaseId)) {
@@ -144,15 +183,15 @@ export function enforceCookieCacheRule(response) {
     response.headers.delete('CDN-Cache-Control');
     response.headers.delete('Vercel-CDN-Cache-Control');
 }
-function rewriteToReleaseScopedPath(request, releaseId, isPreview, personalization) {
+function rewriteToReleaseScopedPath(request, releaseId, isPreview, options) {
     const rewriteURL = new URL(request.url);
     rewriteURL.pathname = releaseScopedPath(RELEASE_SCOPED_PREFIX, releaseId, request.nextUrl.pathname);
     rewriteURL.searchParams.delete(CONTENT_PATH_CACHE_PARAM);
-    if (personalization?.contentPath) {
-        rewriteURL.searchParams.set(CONTENT_PATH_CACHE_PARAM, personalization.contentPath);
+    if (options?.contentPath) {
+        rewriteURL.searchParams.set(CONTENT_PATH_CACHE_PARAM, options.contentPath);
     }
-    const response = personalization
-        ? NextResponse.rewrite(rewriteURL, { request: { headers: personalization.requestHeaders } })
+    const response = options?.requestHeaders
+        ? NextResponse.rewrite(rewriteURL, { request: { headers: options.requestHeaders } })
         : NextResponse.rewrite(rewriteURL);
     if (isPreview) {
         response.headers.set('Cache-Control', 'private, no-store');
@@ -164,6 +203,113 @@ function rewriteToReleaseScopedPath(request, releaseId, isPreview, personalizati
     }
     return response;
 }
+async function resolveFrameworkDispatch(request, config) {
+    // The outer edge has already minted identity and selected a release/payload.
+    // A trusted handoff must use that exact decision; falling through would mint
+    // a second identity and may select a different experiment arm.
+    const originAuth = request.headers.get(FRAMEWORK_ORIGIN_AUTH_HEADER);
+    const forwardedSiteId = request.headers.get(FRAMEWORK_SITE_ID_HEADER);
+    const forwardedReleaseId = request.headers.get(FRAMEWORK_RELEASE_ID_HEADER);
+    const forwardedContentRef = request.headers.get(FRAMEWORK_CONTENT_REF_HEADER);
+    const contentPathValues = request.nextUrl.searchParams.getAll(CONTENT_PATH_CACHE_PARAM);
+    const hasReservedDispatch = originAuth !== null
+        || forwardedSiteId !== null
+        || forwardedReleaseId !== null
+        || forwardedContentRef !== null
+        || request.headers.has(FRAMEWORK_CONTENT_BASE_URL_HEADER)
+        || request.headers.has(CONTENT_PATH_HEADER)
+        || contentPathValues.length > 0;
+    if (!hasReservedDispatch) {
+        return { kind: 'direct' };
+    }
+    const expectedOriginAuth = config.frameworkOriginAuthToken
+        || process.env.ACI_FRAMEWORK_ORIGIN_AUTH_TOKEN
+        || '';
+    if (!expectedOriginAuth
+        || originAuth === null
+        || !(await secureStringEqual(expectedOriginAuth, originAuth))) {
+        return rejectedFrameworkDispatch(403, 'framework dispatch forbidden');
+    }
+    if (!forwardedSiteId || !forwardedReleaseId) {
+        return rejectedFrameworkDispatch(400, 'invalid framework dispatch');
+    }
+    const expectedSiteId = siteIdForConfig(config);
+    if (!expectedSiteId || forwardedSiteId !== expectedSiteId) {
+        return rejectedFrameworkDispatch(403, 'framework dispatch forbidden');
+    }
+    if (forwardedContentRef === null && contentPathValues.length === 0) {
+        return {
+            kind: 'trusted',
+            releaseId: forwardedReleaseId,
+            contentPath: '',
+        };
+    }
+    if (!forwardedContentRef
+        || contentPathValues.length !== 1
+        || contentPathValues[0] !== forwardedContentRef) {
+        return rejectedFrameworkDispatch(400, 'invalid framework dispatch');
+    }
+    return {
+        kind: 'trusted',
+        releaseId: forwardedReleaseId,
+        contentPath: forwardedContentRef,
+    };
+}
+function passThroughResponse(request, frameworkDispatch) {
+    if (frameworkDispatch.kind !== 'trusted') {
+        return NextResponse.next();
+    }
+    if (frameworkDispatch.contentPath) {
+        return new Response('invalid framework dispatch', {
+            status: 400,
+            headers: { 'Cache-Control': 'private, no-store' },
+        });
+    }
+    return NextResponse.next({
+        request: {
+            headers: sanitizedFrameworkRequestHeaders(request),
+        },
+    });
+}
+function frameworkRequestHeaders(request, contentPath) {
+    const requestHeaders = sanitizedFrameworkRequestHeaders(request);
+    if (contentPath) {
+        requestHeaders.set(CONTENT_PATH_HEADER, contentPath);
+    }
+    return requestHeaders;
+}
+function sanitizedFrameworkRequestHeaders(request) {
+    const requestHeaders = new Headers(request.headers);
+    requestHeaders.delete(FRAMEWORK_ORIGIN_AUTH_HEADER);
+    requestHeaders.delete(FRAMEWORK_SITE_ID_HEADER);
+    requestHeaders.delete(FRAMEWORK_RELEASE_ID_HEADER);
+    requestHeaders.delete(FRAMEWORK_CONTENT_REF_HEADER);
+    requestHeaders.delete(FRAMEWORK_CONTENT_BASE_URL_HEADER);
+    requestHeaders.delete(CONTENT_PATH_HEADER);
+    return requestHeaders;
+}
+function rejectedFrameworkDispatch(status, message) {
+    return {
+        kind: 'rejected',
+        response: new Response(message, {
+            status,
+            headers: { 'Cache-Control': 'private, no-store' },
+        }),
+    };
+}
+async function secureStringEqual(expected, actual) {
+    const [expectedDigest, actualDigest] = await Promise.all([
+        crypto.subtle.digest('SHA-256', textEncoder.encode(expected)),
+        crypto.subtle.digest('SHA-256', textEncoder.encode(actual)),
+    ]);
+    const expectedBytes = new Uint8Array(expectedDigest);
+    const actualBytes = new Uint8Array(actualDigest);
+    let different = 0;
+    for (let index = 0; index < expectedBytes.length; index += 1) {
+        different |= expectedBytes[index] ^ actualBytes[index];
+    }
+    return different === 0;
+}
 function isReleaseScopedPath(pathname, prefix) {
     return pathname === prefix || pathname.startsWith(`${prefix}/`);
 }
@@ -296,6 +442,12 @@ function edgeKeySegment(value) {
 function isPassthroughRoute(pathname) {
     return PASSTHROUGH_ROUTES.some((route) => routeMatches(pathname, route));
 }
+function isFrameworkRuntimePath(pathname) {
+    if (FRAMEWORK_RUNTIME_PATHS.has(pathname)) {
+        return true;
+    }
+    return FRAMEWORK_RUNTIME_PREFIXES.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`));
+}
 function routeMatches(pathname, route) {
     const cleanPath = normalizeRoutePath(pathname);
     const cleanRoute = normalizeRoutePath(route);
@@ -320,6 +472,34 @@ function normalizeRoutePath(value) {
 }
 export const aciMiddlewareMatcher = [
     '/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)',
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-gradial-framework-origin-auth' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-baremetal-site-id' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-baremetal-release-id' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-aci-content-ref' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-baremetal-content-base-url' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'header', key: 'x-aci-content-path' }],
+    },
+    {
+        source: '/:path*',
+        has: [{ type: 'query', key: '__aci_content_path' }],
+    },
 ];
 export const config = {
     runtime: 'nodejs',

package/dist/next/personalization-host.d.ts

@@ -1,4 +1,5 @@
 import { type PersonalizationExperiment } from '../edge/personalization-core.js';
+import { type PortableConsentSnapshot } from '../consent/portable-envelope.js';
 export declare const CONTENT_PATH_HEADER = "x-aci-content-path";
 export declare const CONTENT_PATH_CACHE_PARAM = "__aci_content_path";
 export interface EdgeDispatch {
@@ -37,6 +38,19 @@ export interface EdgeRouteManifest {
     notFoundPage?: string;
     errorPage?: string;
 }
+export interface PersonalizationEnvelopeWrite {
+    key: string;
+    envelopeId: string;
+    siteId: string;
+    identityNamespace: string;
+    identityHash: string;
+    records: readonly unknown[];
+    digest: string;
+}
+export declare class IdentityErasureFencedError extends Error {
+    readonly name = "IdentityErasureFencedError";
+    constructor();
+}
 /** Immutable release routing state read by an EdgeRouter. */
 export interface PersonalizationRouteStore {
     readEdgeManifest(releaseId: string): Promise<EdgeRouteManifest | null>;
@@ -44,7 +58,7 @@ export interface PersonalizationRouteStore {
 /** Customer-owned collection state. This is deliberately not an EdgeRouter dependency. */
 export interface PersonalizationCollectionStore {
     readClaims(siteId: string, namespace: string, identityHash: string): Promise<string | null>;
-    appendEvent(key: string, record: unknown): Promise<void>;
+    appendEnvelope(write: PersonalizationEnvelopeWrite): Promise<void>;
     putSuppression(key: string, record: unknown): Promise<void>;
 }
 /** @deprecated Use the narrower router or collection store at each boundary. */
@@ -91,12 +105,7 @@ export interface PersonalizationResolution {
     };
     cookies: CookieMutation[];
 }
-export interface ConsentSnapshot {
-    version: number;
-    purposes: string[];
-    grantedAt: string;
-    source?: string;
-}
+export type ConsentSnapshot = PortableConsentSnapshot;
 interface ClaimsPayload {
     aud?: string[];
     seg?: string[];

package/dist/next/personalization-host.js

@@ -1,9 +1,16 @@
 import { resolvePersonalizationDecision, } from '../edge/personalization-core.js';
+import { parsePortableConsentEnvelope, portableConsentAllowsPersonalization, trimPortableConsentWhitespace, } from '../consent/portable-envelope.js';
 const DEFAULT_IDENTITY_TTL_SECONDS = 90 * 24 * 60 * 60;
 const DEFAULT_CLAIMS_TTL_SECONDS = 24 * 60 * 60;
 const textEncoder = new TextEncoder();
 export const CONTENT_PATH_HEADER = 'x-aci-content-path';
 export const CONTENT_PATH_CACHE_PARAM = '__aci_content_path';
+export class IdentityErasureFencedError extends Error {
+    name = 'IdentityErasureFencedError';
+    constructor() {
+        super('identity collection is fenced by erasure');
+    }
+}
 export async function resolvePersonalizationRequest(request, releaseId, config) {
     const requestHeaders = new Headers(request.headers);
     const cookies = parseCookieHeader(request.headers.get('cookie'));
@@ -85,9 +92,13 @@ export function consentSignals(request, cookies) {
     const privacyDenied = request.headers.get('sec-gpc')?.trim() === '1'
         || request.headers.get('dnt')?.trim() === '1'
         || ['deny', 'opt-out', 'off'].includes((request.headers.get('x-gradial-privacy-override') || '').trim().toLowerCase());
-    const raw = request.headers.get('x-aci-consent') || cookies.get('aci_consent') || '';
-    const snapshot = parseConsent(raw);
-    const allows = snapshot?.purposes.some((purpose) => purpose.toLowerCase() === 'personalization') || false;
+    const headerConsent = request.headers.get('x-aci-consent');
+    const hasHeaderConsent = trimPortableConsentWhitespace(headerConsent || '') !== '';
+    const raw = hasHeaderConsent
+        ? headerConsent
+        : cookies.get('aci_consent') || '';
+    const snapshot = parsePortableConsentEnvelope(raw, !hasHeaderConsent);
+    const allows = portableConsentAllowsPersonalization(snapshot);
     return {
         hasConsent: snapshot !== null,
         snapshot,
@@ -124,36 +135,6 @@ export async function sha256Hex(value) {
 export async function identityHashHex(namespace, value) {
     return sha256Hex(`${namespace.trim().toLowerCase()}\x00${value.trim()}`);
 }
-function parseConsent(raw) {
-    let decoded = raw.trim();
-    if (!decoded)
-        return null;
-    try {
-        decoded = decodeURIComponent(decoded);
-    }
-    catch {
-        // Evaluate the original value.
-    }
-    const legacy = new Set(['true', 'all', 'granted', 'yes', 'personalization', 'personalized']);
-    if (legacy.has(decoded.toLowerCase())) {
-        return { version: 0, purposes: ['personalization'], grantedAt: '' };
-    }
-    try {
-        const parsed = JSON.parse(decoded);
-        if (!Number.isInteger(parsed.v) || !Array.isArray(parsed.p) || !parsed.p.every((item) => typeof item === 'string') || typeof parsed.t !== 'string') {
-            return null;
-        }
-        return {
-            version: parsed.v,
-            purposes: parsed.p,
-            grantedAt: parsed.t,
-            source: typeof parsed.src === 'string' ? parsed.src : undefined,
-        };
-    }
-    catch {
-        return null;
-    }
-}
 function matchRoute(pathname, manifest) {
     const normalized = normalizePath(pathname);
     if (manifest.routes[normalized])

package/dist/next/server.d.ts

@@ -9,6 +9,7 @@ export interface FetchConfig {
     accessKeyId?: string;
     secretAccessKey?: string;
     sessionToken?: string;
+    roleArn?: string;
     endpoint?: string;
     releaseId?: string;
     edgeConfig?: string;

package/dist/next/server.js

@@ -135,6 +135,7 @@ export async function getReleaseAssetResponse(releaseId, assetPath, config = {})
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     const key = joinKey(provider.config.keyPrefix, 'assets', clean);
@@ -179,6 +180,7 @@ export async function getDamAssetResponse(assetPath, config = {}) {
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     const key = joinKey(provider.config.keyPrefix, clean);
@@ -235,6 +237,7 @@ async function resolveS3Provider(config) {
         accessKeyId: config.accessKeyId,
         secretAccessKey: config.secretAccessKey,
         sessionToken: config.sessionToken,
+        roleArn: config.roleArn,
         endpoint: config.endpoint,
     });
     // Pre-warm the manifest with cached version

package/dist/next/vercel-collect-sdk-route.d.ts

@@ -0,0 +1,27 @@
+export interface VercelCollectSDKRouteConfig {
+    siteId: string;
+    edgeConfig: string;
+    region: string;
+    roleArn: string;
+    hostingBucket: string;
+    hostingKeyPrefix?: string;
+}
+export interface VercelCollectSDKRouteDependencies {
+    s3Client?: VercelCollectSDKS3Client;
+    readEdgeConfig?: (connection: string, key: string) => Promise<unknown>;
+    onError?: (error: unknown) => void;
+}
+export interface VercelCollectSDKS3Client {
+    send(command: {
+        input: unknown;
+    }): Promise<unknown>;
+}
+export type VercelCollectSDKRoute = (request: Request) => Promise<Response>;
+/**
+ * Creates the Node-only stable collect-SDK route used by ACI's injected
+ * Vercel Function. The provider pointer selects the immutable release on every
+ * uncached invocation, so an old code deployment remains correct while a
+ * canonical activation converges through Edge Config and deployment promotion.
+ */
+export declare function createVercelCollectSDKRoute(input: VercelCollectSDKRouteConfig, dependencies?: VercelCollectSDKRouteDependencies): VercelCollectSDKRoute;
+export declare function createVercelCollectSDKRouteFromEnv(env?: Record<string, string | undefined>, dependencies?: VercelCollectSDKRouteDependencies): VercelCollectSDKRoute;

package/dist/next/vercel-collect-sdk-route.js

@@ -0,0 +1,205 @@
+import { createHash } from 'node:crypto';
+import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { awsCredentialsProvider } from '@vercel/oidc-aws-credentials-provider';
+import { getUncachedEdgeConfigValue } from './edge-config.js';
+const SHA256_HEX = /^[0-9a-f]{64}$/;
+/**
+ * Creates the Node-only stable collect-SDK route used by ACI's injected
+ * Vercel Function. The provider pointer selects the immutable release on every
+ * uncached invocation, so an old code deployment remains correct while a
+ * canonical activation converges through Edge Config and deployment promotion.
+ */
+export function createVercelCollectSDKRoute(input, dependencies = {}) {
+    const config = validateConfig(input);
+    const readEdgeConfig = dependencies.readEdgeConfig || getUncachedEdgeConfigValue;
+    const client = dependencies.s3Client || new S3Client({
+        region: config.region,
+        credentials: awsCredentialsProvider({
+            roleArn: config.roleArn,
+            clientConfig: { region: config.region },
+        }),
+    });
+    const onError = dependencies.onError || ((error) => {
+        console.error('[ACI collect SDK] route failed', error);
+    });
+    return async (request) => {
+        const method = request.method.toUpperCase();
+        if (method !== 'GET' && method !== 'HEAD') {
+            return new Response('method not allowed', {
+                status: 405,
+                headers: {
+                    Allow: 'GET, HEAD',
+                    'Cache-Control': 'private, no-store',
+                },
+            });
+        }
+        try {
+            const active = parseActiveReleasePointer(await readEdgeConfig(config.edgeConfig, activeReleaseKey(config.siteId)));
+            const projection = parseProjection(await readEdgeConfig(config.edgeConfig, edgeRoutesKey(config.siteId, active.releaseId)));
+            if (projection.siteId !== config.siteId || projection.releaseId !== active.releaseId) {
+                throw new Error(`collect SDK projection identity mismatch: got ${projection.siteId}/${projection.releaseId}, `
+                    + `want ${config.siteId}/${active.releaseId}`);
+            }
+            if (!Object.prototype.hasOwnProperty.call(projection, 'collectSdk')) {
+                return new Response(method === 'HEAD' ? null : 'collect SDK is not enabled for this release', {
+                    status: 404,
+                    headers: { 'Cache-Control': 'no-store' },
+                });
+            }
+            const entry = validateCollectSDKEntry(projection.collectSdk);
+            const body = await readSDKObject(client, config.hostingBucket, joinKey(config.hostingKeyPrefix, 'releases', active.releaseId, entry.path));
+            const actualHash = createHash('sha256').update(body).digest('hex');
+            if (actualHash !== entry.hash) {
+                throw new Error(`collect SDK digest mismatch: got ${actualHash}, want ${entry.hash}`);
+            }
+            const etag = `"${entry.hash}"`;
+            const headers = new Headers({
+                'Content-Type': 'text/javascript; charset=utf-8',
+                'Cache-Control': 'public, max-age=300, must-revalidate',
+                ETag: etag,
+            });
+            if (ifNoneMatchSatisfied(request.headers.get('if-none-match'), etag)) {
+                return new Response(null, { status: 304, headers });
+            }
+            headers.set('Content-Length', String(body.byteLength));
+            const responseBody = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength);
+            return new Response(method === 'HEAD' ? null : responseBody, { status: 200, headers });
+        }
+        catch (error) {
+            onError(error);
+            return new Response(method === 'HEAD' ? null : 'collect SDK is temporarily unavailable', {
+                status: 503,
+                headers: { 'Cache-Control': 'private, no-store' },
+            });
+        }
+    };
+}
+export function createVercelCollectSDKRouteFromEnv(env = process.env, dependencies = {}) {
+    try {
+        return createVercelCollectSDKRoute({
+            siteId: requiredEnv(env, 'ACI_SITE_ID'),
+            edgeConfig: requiredEnv(env, 'EDGE_CONFIG'),
+            region: env.AWS_REGION || env.AWS_DEFAULT_REGION || '',
+            roleArn: requiredEnv(env, 'AWS_ROLE_ARN'),
+            hostingBucket: requiredEnv(env, 'HOSTING_BUCKET'),
+            hostingKeyPrefix: env.HOSTING_KEY_PREFIX || env.GRADIAL_S3_KEY_PREFIX,
+        }, dependencies);
+    }
+    catch (error) {
+        (dependencies.onError || ((value) => {
+            console.error('[ACI collect SDK] configuration failed', value);
+        }))(error);
+        return async (request) => new Response(request.method.toUpperCase() === 'HEAD' ? null : 'collect SDK is temporarily unavailable', { status: 503, headers: { 'Cache-Control': 'private, no-store' } });
+    }
+}
+function validateConfig(input) {
+    const siteId = requiredPathSegment(input.siteId, 'ACI site ID');
+    const edgeConfig = input.edgeConfig.trim();
+    const region = input.region.trim();
+    const roleArn = input.roleArn.trim();
+    const hostingBucket = input.hostingBucket.trim();
+    if (!edgeConfig)
+        throw new Error('Edge Config connection is required');
+    if (!region)
+        throw new Error('AWS region is required');
+    if (!roleArn)
+        throw new Error('AWS role ARN is required');
+    if (!hostingBucket)
+        throw new Error('hosting bucket is required');
+    return {
+        siteId,
+        edgeConfig,
+        region,
+        roleArn,
+        hostingBucket,
+        hostingKeyPrefix: cleanKey(input.hostingKeyPrefix || ''),
+    };
+}
+function parseActiveReleasePointer(value) {
+    const parsed = parseRecord(value, 'active release pointer');
+    return { releaseId: requiredPathSegment(parsed.releaseId || '', 'active release ID') };
+}
+function parseProjection(value) {
+    const parsed = parseRecord(value, 'collect SDK route projection');
+    const projection = {
+        releaseId: requiredPathSegment(parsed.releaseId || '', 'projection release ID'),
+        siteId: requiredPathSegment(parsed.siteId || '', 'projection site ID'),
+    };
+    if (Object.prototype.hasOwnProperty.call(parsed, 'collectSdk')) {
+        projection.collectSdk = parsed.collectSdk;
+    }
+    return projection;
+}
+function parseRecord(value, label) {
+    const parsed = typeof value === 'string' ? JSON.parse(value) : value;
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new Error(`${label} is unavailable or malformed`);
+    }
+    return parsed;
+}
+function validateCollectSDKEntry(value) {
+    const entry = parseRecord(value, 'collect SDK metadata');
+    if (typeof entry.hash !== 'string' || typeof entry.path !== 'string') {
+        throw new Error('collect SDK metadata must contain string hash and path fields');
+    }
+    const hash = entry.hash.trim().toLowerCase();
+    const path = cleanKey(entry.path);
+    if (!SHA256_HEX.test(hash))
+        throw new Error('collect SDK hash must be lowercase SHA-256');
+    const expectedPath = `_aci/aci.${hash}.js`;
+    if (path !== expectedPath || path !== entry.path) {
+        throw new Error(`collect SDK path ${JSON.stringify(entry.path)} must equal ${JSON.stringify(expectedPath)}`);
+    }
+    return { hash, path };
+}
+async function readSDKObject(client, bucket, key) {
+    const output = await client.send(new GetObjectCommand({ Bucket: bucket, Key: key }));
+    if (output.Body?.transformToByteArray)
+        return await output.Body.transformToByteArray();
+    if (output.Body?.transformToString) {
+        return new TextEncoder().encode(await output.Body.transformToString());
+    }
+    throw new Error(`collect SDK object ${key} returned an unsupported body`);
+}
+function ifNoneMatchSatisfied(value, etag) {
+    const header = (value || '').trim();
+    if (!header)
+        return false;
+    if (header === '*')
+        return true;
+    return header.split(',').some((candidate) => {
+        const normalized = candidate.trim().replace(/^W\//, '');
+        return normalized === etag;
+    });
+}
+function activeReleaseKey(siteId) {
+    return `activeRelease_${edgeKeySegment(siteId)}`;
+}
+function edgeRoutesKey(siteId, releaseId) {
+    return `edgeRoutes_${edgeKeySegment(siteId)}_${edgeKeySegment(releaseId)}`;
+}
+function edgeKeySegment(value) {
+    return value.replace(/[^A-Za-z0-9_-]/g, '_');
+}
+function requiredPathSegment(value, label) {
+    const clean = value.trim();
+    if (!clean || clean === '.' || clean === '..' || clean.includes('/') || clean.includes('\\')) {
+        throw new Error(`${label} is required and must be one path segment`);
+    }
+    return clean;
+}
+function cleanKey(value) {
+    const segments = value.replaceAll('\\', '/').split('/').filter((segment) => segment && segment !== '.');
+    if (segments.some((segment) => segment === '..'))
+        throw new Error('S3 key traversal is not allowed');
+    return segments.join('/');
+}
+function joinKey(...parts) {
+    return parts.map((part) => cleanKey(part || '')).filter(Boolean).join('/');
+}
+function requiredEnv(env, key) {
+    const value = env[key]?.trim() || '';
+    if (!value)
+        throw new Error(`${key} is required for the Vercel collect SDK route`);
+    return value;
+}

package/dist/next/vercel-personalization.d.ts

@@ -1,3 +1,4 @@
-export { CONTENT_PATH_CACHE_PARAM, CONTENT_PATH_HEADER, resolvePersonalizationRequest, type EdgeRouteManifest, type PersonalizationBlobStore, type PersonalizationCollectionStore, type PersonalizationHostConfig, type PersonalizationRouteStore, type PersonalizationResolution, } from './personalization-host.js';
 export { createPersonalizationCollectRoute, type PersonalizationCollectRouteConfig, } from './collect-route.js';
-export { createVercelPersonalizationFromEnv, createVercelCollectionFromEnv, VercelEdgeConfigRouteStore, createVercelS3PersonalizationStore, VercelS3PersonalizationStore, type VercelS3PersonalizationConfig, } from './vercel-s3-personalization.js';
+export { computeEnvelopeDigest, type EnvelopeDigestInput, } from './envelope-digest.js';
+export { CONTENT_PATH_CACHE_PARAM, CONTENT_PATH_HEADER, IdentityErasureFencedError, resolvePersonalizationRequest, type EdgeRouteManifest, type PersonalizationBlobStore, type PersonalizationCollectionStore, type PersonalizationEnvelopeWrite, type PersonalizationHostConfig, type PersonalizationRouteStore, type PersonalizationResolution, } from './personalization-host.js';
+export { createVercelPersonalizationFromEnv, createVercelCollectionFromEnv, VercelEdgeConfigRouteStore, createVercelS3PersonalizationStore, EnvelopeIDCollisionError, VercelS3PersonalizationStore, type VercelS3PersonalizationConfig, } from './vercel-s3-personalization.js';

package/dist/next/vercel-personalization.js

@@ -1,3 +1,4 @@
-export { CONTENT_PATH_CACHE_PARAM, CONTENT_PATH_HEADER, resolvePersonalizationRequest, } from './personalization-host.js';
 export { createPersonalizationCollectRoute, } from './collect-route.js';
-export { createVercelPersonalizationFromEnv, createVercelCollectionFromEnv, VercelEdgeConfigRouteStore, createVercelS3PersonalizationStore, VercelS3PersonalizationStore, } from './vercel-s3-personalization.js';
+export { computeEnvelopeDigest, } from './envelope-digest.js';
+export { CONTENT_PATH_CACHE_PARAM, CONTENT_PATH_HEADER, IdentityErasureFencedError, resolvePersonalizationRequest, } from './personalization-host.js';
+export { createVercelPersonalizationFromEnv, createVercelCollectionFromEnv, VercelEdgeConfigRouteStore, createVercelS3PersonalizationStore, EnvelopeIDCollisionError, VercelS3PersonalizationStore, } from './vercel-s3-personalization.js';