@gradial/aci 0.1.42 → 0.1.44

package/dist/providers/s3.js

@@ -1,4 +1,6 @@
 import crypto from 'node:crypto';
+import { GetObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { awsCredentialsProvider } from '@vercel/oidc-aws-credentials-provider';
 import { FragmentNotFoundError, LayoutNotFoundError, PageNotFoundError } from '../content/provider.js';
 import { normalizeRoute } from '../content/routes.js';
 // ---------------------------------------------------------------------------
@@ -7,8 +9,10 @@ import { normalizeRoute } from '../content/routes.js';
 export class S3ContentProvider {
     config;
     #manifest;
-    constructor(config = {}) {
+    #client;
+    constructor(config = {}, client) {
         this.config = resolveS3Config(config);
+        this.#client = client || oidcS3Client(this.config);
     }
     async listRoutes() {
         const manifest = await this.manifest();
@@ -83,24 +87,18 @@ export class S3ContentProvider {
         return await this.#manifest;
     }
     async fetchRaw(key) {
-        return await getS3Raw(key, this.config);
+        return await getS3Raw(key, this.config, this.#client);
     }
     async getJSON(key) {
-        return await getS3JSON(joinKey(this.config.keyPrefix, key), this.config);
+        return await getS3JSON(joinKey(this.config.keyPrefix, key), this.config, this.#client);
     }
 }
 // ---------------------------------------------------------------------------
 // S3 fetch with AWS SigV4 signing
 // ---------------------------------------------------------------------------
-export async function getS3JSON(key, config) {
+export async function getS3JSON(key, config, client) {
     const startTime = Date.now();
-    const url = s3ObjectURL(config, key);
-    const signedHeaders = signedS3Headers('GET', url, config);
-    const res = await fetch(url, {
-        method: 'GET',
-        headers: signedHeaders,
-        cache: 'no-store'
-    });
+    const res = await getS3Raw(key, config, client);
     const duration = Date.now() - startTime;
     console.log(`[ACI S3] GET ${key} - ${res.status} in ${duration}ms`);
     if (!res.ok) {
@@ -108,7 +106,9 @@ export async function getS3JSON(key, config) {
     }
     return (await res.json());
 }
-export async function getS3Raw(key, config) {
+export async function getS3Raw(key, config, client) {
+    if (client)
+        return await getS3RawWithClient(key, config, client);
     const url = s3ObjectURL(config, key);
     const signedHeaders = signedS3Headers('GET', url, config);
     return await fetch(url, {
@@ -122,20 +122,90 @@ export async function getS3Raw(key, config) {
 // ---------------------------------------------------------------------------
 function resolveS3Config(config) {
     const resolved = {
-        bucket: config.bucket || process.env.ACI_S3_BUCKET || '',
-        keyPrefix: config.keyPrefix || process.env.ACI_S3_KEY_PREFIX || '',
-        region: config.region || process.env.AWS_REGION || 'us-east-1',
-        accessKeyId: config.accessKeyId || process.env.AWS_ACCESS_KEY_ID || '',
-        secretAccessKey: config.secretAccessKey || process.env.AWS_SECRET_ACCESS_KEY || '',
-        sessionToken: config.sessionToken || process.env.AWS_SESSION_TOKEN || '',
-        endpoint: trimSlash(config.endpoint || process.env.ACI_S3_ENDPOINT || '')
+        bucket: configuredValue(config.bucket, process.env.ACI_S3_BUCKET),
+        keyPrefix: configuredValue(config.keyPrefix, process.env.ACI_S3_KEY_PREFIX),
+        region: configuredValue(config.region, process.env.AWS_REGION) || 'us-east-1',
+        accessKeyId: configuredValue(config.accessKeyId, process.env.AWS_ACCESS_KEY_ID),
+        secretAccessKey: configuredValue(config.secretAccessKey, process.env.AWS_SECRET_ACCESS_KEY),
+        sessionToken: configuredValue(config.sessionToken, process.env.AWS_SESSION_TOKEN),
+        roleArn: configuredValue(config.roleArn, process.env.AWS_ROLE_ARN),
+        endpoint: trimSlash(configuredValue(config.endpoint, process.env.ACI_S3_ENDPOINT))
     };
-    for (const key of ['bucket', 'accessKeyId', 'secretAccessKey']) {
-        if (!resolved[key])
-            throw new Error(`S3 config missing ${key}`);
+    if (!resolved.bucket)
+        throw new Error('S3 config missing bucket');
+    if (!resolved.roleArn) {
+        if (resolved.accessKeyId && !resolved.secretAccessKey) {
+            throw new Error('S3 config missing secretAccessKey');
+        }
+        if (!resolved.accessKeyId && resolved.secretAccessKey) {
+            throw new Error('S3 config missing accessKeyId');
+        }
+        if (!resolved.accessKeyId) {
+            throw new Error('S3 config missing credential mode: set AWS_ROLE_ARN or both AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY');
+        }
     }
     return resolved;
 }
+function oidcS3Client(config) {
+    if (!config.roleArn)
+        return undefined;
+    return new S3Client({
+        region: config.region,
+        ...(config.endpoint ? {
+            endpoint: config.endpoint,
+            forcePathStyle: true,
+        } : {}),
+        credentials: awsCredentialsProvider({
+            roleArn: config.roleArn,
+            clientConfig: { region: config.region },
+        }),
+    });
+}
+async function getS3RawWithClient(key, config, client) {
+    try {
+        const output = await client.send(new GetObjectCommand({
+            Bucket: config.bucket,
+            Key: key,
+        }));
+        if (!output.Body?.transformToWebStream) {
+            throw new Error(`S3 GET ${key} returned an unsupported object body`);
+        }
+        const headers = new Headers();
+        if (output.ContentType)
+            headers.set('content-type', output.ContentType);
+        if (output.ContentLength !== undefined) {
+            headers.set('content-length', String(output.ContentLength));
+        }
+        if (output.ETag)
+            headers.set('etag', output.ETag);
+        if (output.LastModified) {
+            headers.set('last-modified', output.LastModified.toUTCString());
+        }
+        return new Response(output.Body.transformToWebStream(), {
+            status: 200,
+            headers,
+        });
+    }
+    catch (error) {
+        const status = s3ErrorStatus(error);
+        if (status) {
+            return new Response(error instanceof Error ? error.message : String(error), { status });
+        }
+        throw new Error(`S3 GET ${key} failed`, { cause: error });
+    }
+}
+function s3ErrorStatus(error) {
+    if (!error || typeof error !== 'object')
+        return undefined;
+    const status = error
+        .$metadata?.httpStatusCode;
+    return typeof status === 'number' && status >= 400 && status <= 599
+        ? status
+        : undefined;
+}
+function configuredValue(configured, environment) {
+    return (configured === undefined ? environment : configured)?.trim() || '';
+}
 function s3ObjectURL(config, key) {
     const encodedKey = encodeKey(key);
     if (config.endpoint) {

package/dist/testing/conformance/checks.js

@@ -278,7 +278,37 @@ export function checkMiddleware(ctx) {
     // the SDK's canonical value. Next.js requires config.matcher to be
     // statically analyzable, so importing the matcher from the SDK breaks the
     // build. Instead the template inlines the value and this check detects drift.
-    const canonicalMatcher = "['/((?!_next(?:/|$)|api(?:/|$)|favicon\\\\.ico$|\\\\.gradial-dam(?:/|$)).*)']";
+    const canonicalMatcher = String.raw `[
+    '/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)',
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-gradial-framework-origin-auth' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-site-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-release-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-ref' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-content-base-url' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-path' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'query', key: '__aci_content_path' }],
+    },
+  ]`;
     // Check for actual import/usage of aciMiddlewareMatcher (not just a mention
     // in a comment). Look for `matcher: aciMiddlewareMatcher` or
     // `import { ... aciMiddlewareMatcher ... }`.
@@ -289,9 +319,9 @@ export function checkMiddleware(ctx) {
     }
     else {
         // Verify the inlined value matches the SDK canonical
-        const matcherMatch = middlewareFile.content.match(/matcher\s*:\s*(\[.*?\])/s);
-        if (matcherMatch) {
-            const normalizedInlined = matcherMatch[1].replace(/\s+/g, '');
+        const matcherLiteral = extractArrayPropertyLiteral(middlewareFile.content, 'matcher');
+        if (matcherLiteral) {
+            const normalizedInlined = matcherLiteral.replace(/\s+/g, '');
             const normalizedCanonical = canonicalMatcher.replace(/\s+/g, '');
             results.push(normalizedInlined === normalizedCanonical
                 ? ok('middleware', 'middleware matcher matches SDK canonical', rel)
@@ -303,6 +333,47 @@ export function checkMiddleware(ctx) {
     }
     return results;
 }
+function extractArrayPropertyLiteral(content, propertyName) {
+    const property = new RegExp(`\\b${propertyName}\\s*:`).exec(content);
+    if (!property)
+        return null;
+    const start = content.indexOf('[', property.index + property[0].length);
+    if (start < 0)
+        return null;
+    let depth = 0;
+    let quote = '';
+    let escaped = false;
+    for (let index = start; index < content.length; index += 1) {
+        const character = content[index];
+        if (quote) {
+            if (escaped) {
+                escaped = false;
+            }
+            else if (character === '\\') {
+                escaped = true;
+            }
+            else if (character === quote) {
+                quote = '';
+            }
+            continue;
+        }
+        if (character === "'" || character === '"' || character === '`') {
+            quote = character;
+            continue;
+        }
+        if (character === '[') {
+            depth += 1;
+            continue;
+        }
+        if (character === ']') {
+            depth -= 1;
+            if (depth === 0) {
+                return content.slice(start, index + 1);
+            }
+        }
+    }
+    return null;
+}
 // ---------------------------------------------------------------------------
 // Check: noFileContentProvider — no direct FileContentProvider imports in app code
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,11 @@
 {
   "name": "@gradial/aci",
-  "version": "0.1.42",
+  "version": "0.1.44",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/gradial/bare-metal-go.git",
+    "directory": "packages/sdk"
+  },
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -72,6 +77,11 @@
       "import": "./dist/next/vercel-personalization.js",
       "default": "./dist/next/vercel-personalization.js"
     },
+    "./next/vercel-collect-sdk-route": {
+      "types": "./dist/next/vercel-collect-sdk-route.d.ts",
+      "import": "./dist/next/vercel-collect-sdk-route.js",
+      "default": "./dist/next/vercel-collect-sdk-route.js"
+    },
     "./next/asset-route": {
       "types": "./dist/next/asset-route.d.ts",
       "import": "./dist/next/asset-route.js",
@@ -103,6 +113,15 @@
       "import": "./dist/testing/conformance/index.js"
     }
   },
+  "scripts": {
+    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json && node scripts/build-collect.mjs",
+    "test": "node --import tsx --test \"src/**/*.test.ts\"",
+    "build:collect": "node scripts/build-collect.mjs",
+    "build:cli": "cd ../.. && ./scripts/build-cli.sh",
+    "generate-starters": "cd ../.. && tsx scripts/generate-starters.ts",
+    "compile-registry": "tsx src/cli/compile-registry.mjs",
+    "prepack": "npm run generate-starters && npm run build && node scripts/ensure-bin-modes.mjs"
+  },
   "dependencies": {
     "@aws-sdk/client-s3": "^3.883.0",
     "@vercel/oidc-aws-credentials-provider": "^3.3.0",
@@ -145,19 +164,11 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@gradial/aci-cli-darwin-arm64": "0.1.41",
-    "@gradial/aci-cli-darwin-x64": "0.1.41",
-    "@gradial/aci-cli-linux-arm64": "0.1.41",
-    "@gradial/aci-cli-linux-x64": "0.1.41",
-    "@gradial/aci-cli-win32-arm64": "0.1.41",
-    "@gradial/aci-cli-win32-x64": "0.1.41"
-  },
-  "scripts": {
-    "build": "node -e \"require('node:fs').rmSync('dist', { recursive: true, force: true })\" && tsc -p tsconfig.json",
-    "test": "node --import tsx --test \"src/**/*.test.ts\"",
-    "build:collect": "node scripts/build-collect.mjs",
-    "build:cli": "cd ../.. && ./scripts/build-cli.sh",
-    "generate-starters": "cd ../.. && tsx scripts/generate-starters.ts",
-    "compile-registry": "tsx src/cli/compile-registry.mjs"
+    "@gradial/aci-cli-darwin-arm64": "0.1.44",
+    "@gradial/aci-cli-darwin-x64": "0.1.44",
+    "@gradial/aci-cli-linux-arm64": "0.1.44",
+    "@gradial/aci-cli-linux-x64": "0.1.44",
+    "@gradial/aci-cli-win32-arm64": "0.1.44",
+    "@gradial/aci-cli-win32-x64": "0.1.44"
   }
-}
+}

package/templates/nextjs/starter-content/src/middleware.ts

@@ -7,5 +7,35 @@ export default createGradialMiddleware({
 
 export const config = {
   runtime: 'nodejs',
-  matcher: ['/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)'],
+  matcher: [
+    '/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)',
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-gradial-framework-origin-auth' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-site-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-release-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-ref' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-content-base-url' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-path' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'query', key: '__aci_content_path' }],
+    },
+  ],
 };

package/templates/nextjs/template/src/app/collect/route.ts

@@ -1,11 +1,11 @@
 import {
   createPersonalizationCollectRoute,
-  createVercelPersonalizationFromEnv,
+  createVercelCollectionFromEnv,
 } from '@gradial/aci/next/vercel-personalization';
 
 export const runtime = 'nodejs';
 
-const personalization = createVercelPersonalizationFromEnv();
+const personalization = createVercelCollectionFromEnv();
 const unavailable = async () => new Response('personalization host is not configured', {
   status: 503,
   headers: { 'Cache-Control': 'private, no-store' },

package/templates/nextjs/template/src/middleware.ts

@@ -7,5 +7,35 @@ export default createGradialMiddleware({
 
 export const config = {
   runtime: 'nodejs',
-  matcher: ['/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)'],
+  matcher: [
+    '/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)',
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-gradial-framework-origin-auth' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-site-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-release-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-ref' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-content-base-url' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-path' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'query', key: '__aci_content_path' }],
+    },
+  ],
 };

package/templates/nextjs/template/src/middleware.ts.tmpl

@@ -6,5 +6,35 @@ export default createGradialMiddleware();
 // Source of truth: aciMiddlewareMatcher from '@gradial/aci/next/middleware'.
 // The conformance check verifies this stays in sync with the SDK export.
 export const config = {
-  matcher: ['/((?!_next(?:/|$)|api(?:/|$)|favicon\\.ico$|\\.gradial-dam(?:/|$)).*)'],
+  matcher: [
+    '/((?!_next(?:/|$)|api(?:/|$)|collect(?:/|$)|gradial/assets(?:/|$)|favicon\\.ico$).*)',
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-gradial-framework-origin-auth' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-site-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-release-id' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-ref' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-baremetal-content-base-url' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'header', key: 'x-aci-content-path' }],
+    },
+    {
+      source: '/:path*',
+      has: [{ type: 'query', key: '__aci_content_path' }],
+    },
+  ],
 };