@gradial/aci 0.1.52-rc.10 → 0.1.52-rc.13

package/dist/mimic/core.js

@@ -0,0 +1,127 @@
+// View-as-audience mimic session helpers (specs/features/audience-mimic).
+// Mirror of internal/domain/hosting/runtime/mimic.ts for SDK-hosted paths
+// (Next middleware); the token validator is the twin of
+// validateMimicToken in internal/domain/hosting/runtime/edge_router.ts and
+// internal/domain/edge/routing/mimic.go, pinned by the shared vector file
+// (internal/domain/edge/routing/testdata/mimic_token_vectors.json).
+export const MIMIC_PARAM = 'aci_mimic';
+export const MIMIC_COOKIE = 'aci_mimic';
+export const MIMIC_EXIT = 'exit';
+export const MIMIC_MAX_MEMBERSHIPS = 32;
+export const MIMIC_MAX_TOKEN_BYTES = 2048;
+export async function validateMimicToken(token, signKey, siteId) {
+    try {
+        if (!token || token.length > MIMIC_MAX_TOKEN_BYTES || !signKey || !siteId)
+            return null;
+        const parts = token.split('.');
+        if (parts.length !== 3)
+            return null;
+        const signingInput = `${parts[0]}.${parts[1]}`;
+        const signature = base64URLToBytes(parts[2]);
+        const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(signKey), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+        const expected = new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(signingInput)));
+        if (!constantTimeEqual(signature, expected))
+            return null;
+        const claims = JSON.parse(new TextDecoder().decode(base64URLToBytes(parts[1])));
+        if (claims.scope !== 'mimic')
+            return null;
+        if (typeof claims.siteId !== 'string' || claims.siteId !== siteId)
+            return null;
+        const aud = Array.isArray(claims.aud) ? claims.aud : [];
+        const seg = Array.isArray(claims.seg) ? claims.seg : [];
+        if (aud.length + seg.length === 0)
+            return null;
+        if (aud.length > MIMIC_MAX_MEMBERSHIPS || seg.length > MIMIC_MAX_MEMBERSHIPS)
+            return null;
+        const expiresAt = Date.parse(claims.expiresAt);
+        if (Number.isNaN(expiresAt) || expiresAt <= Date.now())
+            return null;
+        return { ...claims, aud, seg };
+    }
+    catch {
+        return null;
+    }
+}
+// The session cookie dies with the token so an expired session self-clears
+// back to the genuine experience (D-12).
+export function createMimicEntryCookie(token, expiresAt, secure = true) {
+    const maxAge = Math.max(1, Math.ceil((Date.parse(expiresAt) - Date.now()) / 1000));
+    return {
+        name: MIMIC_COOKIE,
+        value: token,
+        options: { httpOnly: true, sameSite: 'lax', maxAge, path: '/', secure },
+    };
+}
+export function createMimicClearCookie(secure = true) {
+    return {
+        name: MIMIC_COOKIE,
+        value: '',
+        options: { httpOnly: true, sameSite: 'lax', maxAge: 0, path: '/', secure },
+    };
+}
+// The banner is the truth signal (REQ-4): present on every mimic render,
+// absent otherwise. v1 lists raw IDs — the documented fallback (spec 04).
+export function createMimicBannerHTML(claims, expiresAt) {
+    const names = [...(claims.aud ?? []), ...(claims.seg ?? [])]
+        .map(escapeHTML)
+        .join(', ');
+    const remainingMinutes = Math.max(1, Math.ceil((Date.parse(expiresAt) - Date.now()) / 60000));
+    return `<div role="alert" style="position:fixed;top:0;left:0;right:0;z-index:9999;display:flex;align-items:center;justify-content:center;gap:12px;padding:8px 16px;background-color:#0f2e1d;color:#fff;font-size:13px;font-family:system-ui,-apple-system,sans-serif;box-shadow:0 2px 8px rgba(0,0,0,0.3);">
+  <span aria-hidden="true" style="display:inline-flex;align-items:center;justify-content:center;width:18px;height:18px;border-radius:50%;background-color:#10b981;color:#0f2e1d;font-weight:700;font-size:11px;flex-shrink:0;">M</span>
+  <span style="font-weight:500;">Viewing as audience</span>
+  <span style="font-family:monospace;opacity:0.85;font-size:12px;">${names}</span>
+  <span style="opacity:0.7;font-size:12px;">expires in ${remainingMinutes} min</span>
+  <a href="?${MIMIC_PARAM}=${MIMIC_EXIT}" style="margin-left:auto;padding:4px 12px;border-radius:6px;background-color:#dc2626;color:#fff;text-decoration:none;font-size:12px;font-weight:600;white-space:nowrap;">Exit</a>
+</div>`;
+}
+export function injectMimicBannerIntoHTML(html, banner) {
+    return html.includes('</body>') ? html.replace('</body>', `${banner}</body>`) : html + banner;
+}
+// MIMIC_BANNER_HEADER carries the base64url-encoded banner HTML from the
+// middleware to the framework render (the MimicBanner component in
+// next/page.tsx). It is a reserved header: the middleware strips any inbound
+// copy and sets it only for a validated session.
+export const MIMIC_BANNER_HEADER = 'x-aci-mimic-banner';
+export function encodeMimicBanner(claims) {
+    return bytesToBase64URL(new TextEncoder().encode(createMimicBannerHTML(claims, claims.expiresAt)));
+}
+export function decodeMimicBanner(encoded) {
+    try {
+        return new TextDecoder().decode(base64URLToBytes(encoded));
+    }
+    catch {
+        return '';
+    }
+}
+function bytesToBase64URL(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function base64URLToBytes(value) {
+    const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+    const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+function constantTimeEqual(left, right) {
+    if (left.length !== right.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < left.length; i++) {
+        diff |= left[i] ^ right[i];
+    }
+    return diff === 0;
+}
+function escapeHTML(value) {
+    return value
+        .replace(/&/g, '&amp;')
+        .replace(/</g, '&lt;')
+        .replace(/>/g, '&gt;')
+        .replace(/"/g, '&quot;');
+}

package/dist/next/collect-route.d.ts

@@ -12,6 +12,12 @@ export interface PersonalizationCollectRouteConfig {
      * suppression disabled (fails safe).
      */
     claimsKeys?: Record<string, string>;
+    /**
+     * Mimic sign key (audience-mimic design/05): a validly signed, unexpired
+     * aci_mimic cookie gets the uniform 202 with nothing stored and no claims
+     * rotation. An invalid cookie is ignored. Absent = no suppression.
+     */
+    mimicSignKey?: string;
     retentionSeconds?: number;
     secureCookies?: boolean;
     now?: () => Date;

package/dist/next/collect-route.js

@@ -1,5 +1,6 @@
 import { MAX_BATCH_EVENTS } from '../collect/batcher.js';
 import { computeEnvelopeDigest } from './envelope-digest.js';
+import { validateMimicToken } from '../mimic/core.js';
 import { consentSignals, IdentityErasureFencedError, identityHashHex, parseCookieHeader, verifyClaims, verifyIdentityCookie, } from './personalization-host.js';
 const MAX_COLLECT_BODY_BYTES = 64 * 1024;
 const DEFAULT_RETENTION_SECONDS = 13 * 30 * 24 * 60 * 60;
@@ -78,6 +79,20 @@ export function createPersonalizationCollectRoute(config) {
             return validationResponse(error);
         }
         const cookies = parseCookieHeader(request.headers.get('cookie'));
+        // Mimic suppression (audience-mimic REQ-5): a validly signed, unexpired
+        // aci_mimic cookie marks a marketer's view-as session — accept uniformly,
+        // store nothing, and never rotate the visitor's real aci_claims. Placed
+        // after schema validation so the 400/202 split stays independent of
+        // session type; an invalid cookie is ignored (events process normally).
+        if (config.mimicSignKey) {
+            const mimicCookie = cookies.get('aci_mimic') || '';
+            if (mimicCookie) {
+                const mimic = await validateMimicToken(mimicCookie, config.mimicSignKey, config.siteId);
+                if (mimic) {
+                    return accepted(new Headers({ 'cache-control': 'no-store', 'content-type': 'application/json' }));
+                }
+            }
+        }
         const signals = consentSignals(request, cookies);
         const rawIdentity = await verifyIdentityCookie(cookies.get('aci_id') || '', config.identityKeys);
         const now = (config.now ?? (() => new Date()))();

package/dist/next/hosted-page-target.d.ts

@@ -0,0 +1,7 @@
+export type HostedPageTarget = Readonly<{
+    kind: 'base' | 'variant';
+    route: string;
+    pageRef: string;
+    variantKey?: string;
+}>;
+export declare function parseHostedPageTarget(rawSegments: readonly string[]): HostedPageTarget | null;

package/dist/next/hosted-page-target.js

@@ -0,0 +1,39 @@
+const VARIANT_NAMESPACE = '__variant';
+export function parseHostedPageTarget(rawSegments) {
+    const segments = decodeSegments(rawSegments);
+    if (!segments)
+        return null;
+    const variantAt = segments.indexOf(VARIANT_NAMESPACE);
+    if (variantAt < 0)
+        return target('base', segments, segments);
+    if (variantAt !== segments.lastIndexOf(VARIANT_NAMESPACE) || variantAt !== segments.length - 2) {
+        return null;
+    }
+    return {
+        ...target('variant', segments.slice(0, variantAt), segments),
+        variantKey: segments[variantAt + 1],
+    };
+}
+function target(kind, routeSegments, targetSegments) {
+    return {
+        kind,
+        route: routeSegments.length === 0 ? '/' : `/${routeSegments.join('/')}/`,
+        pageRef: ['routes', ...targetSegments, 'index.json'].join('/'),
+    };
+}
+function decodeSegments(rawSegments) {
+    const segments = [];
+    for (const raw of rawSegments) {
+        let segment;
+        try {
+            segment = decodeURIComponent(raw);
+        }
+        catch {
+            return null;
+        }
+        if (!segment || segment === '.' || segment === '..' || segment.includes('/'))
+            return null;
+        segments.push(segment);
+    }
+    return segments;
+}

package/dist/next/index.d.ts

@@ -5,7 +5,6 @@ export { createPage, type CreatePageOptions, type SlotPropsFn } from './page.js'
 export { getSiteConfig, getFragment, getLayout, getPage, getRenderInput, routeFromNextParams } from './server.js';
 export { PageNotFoundError, FragmentNotFoundError, LayoutNotFoundError } from './server.js';
 export { CollectScript, type CollectScriptProps } from './collect-script.js';
-export { aciMiddlewareMatcher } from './middleware.js';
 export { AssignmentsScript, type AssignmentsScriptProps } from './assignments-script.js';
 export { createNotFound, renderPageForRoute, resolveErrorPage, type NextResolvedErrorPage, } from './error-pages.js';
 export { ErrorPageInstrumentation } from './error-page-instrumentation.js';

package/dist/next/index.js

@@ -5,7 +5,6 @@ export { createPage } from './page.js';
 export { getSiteConfig, getFragment, getLayout, getPage, getRenderInput, routeFromNextParams } from './server.js';
 export { PageNotFoundError, FragmentNotFoundError, LayoutNotFoundError } from './server.js';
 export { CollectScript } from './collect-script.js';
-export { aciMiddlewareMatcher } from './middleware.js';
 export { AssignmentsScript } from './assignments-script.js';
 export { createNotFound, renderPageForRoute, resolveErrorPage, } from './error-pages.js';
 export { ErrorPageInstrumentation } from './error-page-instrumentation.js';

package/dist/next/page.d.ts

@@ -31,12 +31,10 @@ export interface CreatePageOptions {
  * the collect script tag exactly once per page (design/04 contract tag).
  *
  * Release-scoped routes (production): the middleware rewrites a public URL
- * to `/__r/{releaseId}/routes/{path}`. The optional catch-all `[[...slug]]`
- * receives `['__r', releaseId, 'routes', ...pathSegments]`. createPage
- * extracts the releaseId and passes it to the content loader, giving
- * each release a unique CDN cache key without a separate route folder.
- * The `routes` namespace segment leaves room for future siblings under
- * the release prefix (e.g. `/__r/{releaseId}/assets/*`).
+ * to `/__r/{releaseId}/{targetRef}`. The target ref selects the exact immutable
+ * base or variant page while its prefix identifies the logical public route.
+ * createPage passes both identities to the content loader, giving each target
+ * a distinct CDN cache key without sending selection headers into Next.
  *
  * Dev pass-through (ACI_CONTENT_PROVIDER=file): the middleware passes
  * requests through unrewritten, so `/` arrives with an empty/undefined
@@ -54,4 +52,29 @@ export declare function createPage(registry: Registry, options?: CreatePageOptio
     generateMetadata: ({ params }: NextPageProps) => Promise<Metadata>;
     default: ({ params }: NextPageProps) => Promise<import("react").JSX.Element>;
 };
+/**
+ * Resolves the logical route and releaseId from Next.js catch-all params.
+ *
+ * Two shapes are supported:
+ *
+ * 1. **Rewritten (production):** middleware rewrites a public URL to the exact
+ *    selected target under `/__r/{releaseId}`. A root variant therefore has
+ *    `['__r', releaseId, '__variant', variantKey]`. The full suffix selects the
+ *    immutable page object; the segments before the reserved `__variant`
+ *    namespace form the logical public route.
+ *
+ * 2. **Dev pass-through (ACI_CONTENT_PROVIDER=file):** middleware passes
+ *    requests through unrewritten, so the slug is the raw public path
+ *    segments (possibly empty/undefined for `/`). No releaseId is present;
+ *    the file provider serves content from disk.
+ */
+export declare function resolveRouteAndRelease(params: Promise<{
+    slug?: string[];
+}> | {
+    slug?: string[];
+}): Promise<{
+    route: string;
+    releaseId?: string;
+    pageRef?: string;
+}>;
 export {};

package/dist/next/page.js

@@ -1,12 +1,15 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { notFound } from 'next/navigation.js';
+import { headers } from 'next/headers.js';
 import { Fragment } from 'react';
 import { PageNotFoundError, getRenderInput, getLayout, getFragment, } from './server.js';
+import { MIMIC_BANNER_HEADER, decodeMimicBanner } from '../mimic/core.js';
 import { routeMetadataForContent, resolveSlots, } from '../content/index.js';
 import { renderBlocks } from './render.js';
 import { AssignmentsScript } from './assignments-script.js';
 import { CollectScript } from './collect-script.js';
 import { renderProofContentFor } from '../internal/render-proof.js';
+import { parseHostedPageTarget } from './hosted-page-target.js';
 /**
  * Creates the catch-all route handler for a Next.js ACI site.
  *
@@ -28,12 +31,10 @@ import { renderProofContentFor } from '../internal/render-proof.js';
  * the collect script tag exactly once per page (design/04 contract tag).
  *
  * Release-scoped routes (production): the middleware rewrites a public URL
- * to `/__r/{releaseId}/routes/{path}`. The optional catch-all `[[...slug]]`
- * receives `['__r', releaseId, 'routes', ...pathSegments]`. createPage
- * extracts the releaseId and passes it to the content loader, giving
- * each release a unique CDN cache key without a separate route folder.
- * The `routes` namespace segment leaves room for future siblings under
- * the release prefix (e.g. `/__r/{releaseId}/assets/*`).
+ * to `/__r/{releaseId}/{targetRef}`. The target ref selects the exact immutable
+ * base or variant page while its prefix identifies the logical public route.
+ * createPage passes both identities to the content loader, giving each target
+ * a distinct CDN cache key without sending selection headers into Next.
  *
  * Dev pass-through (ACI_CONTENT_PROVIDER=file): the middleware passes
  * requests through unrewritten, so `/` arrives with an empty/undefined
@@ -49,8 +50,9 @@ import { renderProofContentFor } from '../internal/render-proof.js';
 export function createPage(registry, options) {
     const dynamic = 'force-dynamic';
     async function generateMetadata({ params }) {
-        const { route, releaseId } = await resolveRouteAndRelease(params);
-        const input = await getRenderInput(route, { releaseId });
+        const { route, releaseId, pageRef } = await resolveRouteAndRelease(params);
+        const fetchConfig = { releaseId, pageRef };
+        const input = await getRenderInput(route, fetchConfig);
         const meta = routeMetadataForContent(input.siteConfig, input.page);
         return {
             title: meta.title,
@@ -64,8 +66,8 @@ export function createPage(registry, options) {
         };
     }
     async function CatchAllPage({ params }) {
-        const { route, releaseId } = await resolveRouteAndRelease(params);
-        const fetchConfig = { releaseId };
+        const { route, releaseId, pageRef } = await resolveRouteAndRelease(params);
+        const fetchConfig = { releaseId, pageRef };
         try {
             const input = await getRenderInput(route, fetchConfig);
             if (!input.page)
@@ -84,7 +86,7 @@ export function createPage(registry, options) {
                 }
                 return (_jsx(Fragment, { children: renderedBlocks }, slot.name));
             }));
-            return (_jsxs(_Fragment, { children: [renderedSlots.filter(Boolean), _jsx(AssignmentsScript, { page: input.page }), _jsx(CollectScript, { siteConfig: input.siteConfig }), renderProofContent
+            return (_jsxs(_Fragment, { children: [renderedSlots.filter(Boolean), _jsx(AssignmentsScript, { page: input.page }), _jsx(CollectScript, { siteConfig: input.siteConfig }), _jsx(MimicBanner, { html: await readMimicBannerHTML() }), renderProofContent
                         ? _jsx("meta", { name: "aci-render-proof", content: renderProofContent })
                         : null] }));
         }
@@ -105,19 +107,18 @@ export function createPage(registry, options) {
  *
  * Two shapes are supported:
  *
- * 1. **Rewritten (production):** middleware rewrites a public URL to
- *    `/__r/{releaseId}/routes/{path}`, so slug is
- *    `['__r', releaseId, 'routes', ...pathSegments]`. The releaseId is
- *    extracted; the remaining segments form the content route. The `routes`
- *    segment is the namespace for page routes (siblings like `assets/` live
- *    under the same release prefix).
+ * 1. **Rewritten (production):** middleware rewrites a public URL to the exact
+ *    selected target under `/__r/{releaseId}`. A root variant therefore has
+ *    `['__r', releaseId, '__variant', variantKey]`. The full suffix selects the
+ *    immutable page object; the segments before the reserved `__variant`
+ *    namespace form the logical public route.
  *
  * 2. **Dev pass-through (ACI_CONTENT_PROVIDER=file):** middleware passes
  *    requests through unrewritten, so the slug is the raw public path
  *    segments (possibly empty/undefined for `/`). No releaseId is present;
  *    the file provider serves content from disk.
  */
-async function resolveRouteAndRelease(params) {
+export async function resolveRouteAndRelease(params) {
     const resolved = await params;
     const slug = resolved.slug ?? [];
     if (slug.length >= 2 && slug[0] === '__r') {
@@ -125,13 +126,14 @@ async function resolveRouteAndRelease(params) {
         if (!releaseId || releaseId.includes('/') || releaseId === '.' || releaseId === '..') {
             return { route: '/' };
         }
-        // Skip the 'routes' namespace segment when present.
-        const rest = slug.length >= 3 && slug[2] === 'routes' ? slug.slice(3) : slug.slice(2);
-        if (rest.length === 0)
-            return { route: '/', releaseId };
-        if (rest.some((s) => s === '' || s === '.' || s === '..'))
+        const target = parseHostedPageTarget(slug.slice(2));
+        if (!target)
             return { route: '/' };
-        return { route: `/${rest.join('/')}/`, releaseId };
+        return {
+            route: target.route,
+            releaseId,
+            pageRef: target.pageRef,
+        };
     }
     const route = routeFromSlug(slug);
     return { route };
@@ -141,3 +143,23 @@ function routeFromSlug(slug) {
         return '/';
     return `/${slug.join('/')}/`;
 }
+// The middleware emits the banner HTML in a reserved request header only
+// after validating a signed mimic token; viewer-forged copies are stripped at
+// the dispatch gate (specs/features/audience-mimic REQ-4). The header read
+// happens here (the page already awaits request-scoped data) so the banner
+// itself stays a synchronous leaf.
+async function readMimicBannerHTML() {
+    try {
+        const current = await headers();
+        return decodeMimicBanner(current.get(MIMIC_BANNER_HEADER) || '');
+    }
+    catch {
+        // headers() has no request context in static generation and unit tests.
+        return '';
+    }
+}
+function MimicBanner({ html }) {
+    if (!html)
+        return null;
+    return _jsx("div", { dangerouslySetInnerHTML: { __html: html } });
+}

package/dist/next/personalization-host.d.ts

@@ -88,6 +88,10 @@ export interface PersonalizationHostConfig {
     secureCookies?: boolean;
     now?: () => Date;
     randomBytes?: (length: number) => Uint8Array;
+    mimicClaims?: {
+        aud?: string[];
+        seg?: string[];
+    };
 }
 export interface CookieMutation {
     name: string;

package/dist/next/personalization-host.js

@@ -23,6 +23,9 @@ export class IdentityErasureFencedError extends Error {
 }
 export async function resolvePersonalizationRequest(request, releaseId, config) {
     const requestHeaders = new Headers(request.headers);
+    // The mimic banner header is middleware-emitted only; a viewer-presented
+    // copy never reaches the render.
+    requestHeaders.delete('x-aci-mimic-banner');
     const cookies = parseCookieHeader(request.headers.get('cookie'));
     const consent = consentSignals(request, cookies);
     const mutations = [];
@@ -35,10 +38,14 @@ export async function resolvePersonalizationRequest(request, releaseId, config)
     // re-minting (REQ-4). aci_m is issue-only (D-11): a resolve-path refresh
     // would put a Set-Cookie on every returning visitor's response, defeating
     // the any-Set-Cookie => private, no-store cache rule.
-    let rawIdentity = consent.privacyDenied
+    //
+    // Mimic (audience-mimic): a validated mimicClaims input skips identity
+    // entirely — no read, no mint, no claims-cookie touch (REQ-5).
+    const mimic = config.mimicClaims;
+    let rawIdentity = mimic || consent.privacyDenied
         ? null
         : await verifyIdentityCookie(cookies.get('aci_id') || '', config.identityKeys);
-    if (!consent.privacyDenied && !rawIdentity) {
+    if (!mimic && !consent.privacyDenied && !rawIdentity) {
         rawIdentity = randomIdentity(config.randomBytes);
         const signed = await signIdentity(rawIdentity, config.identityKeys.current);
         const maxAge = config.identityCookieTTLSeconds ?? DEFAULT_IDENTITY_TTL_SECONDS;
@@ -48,7 +55,7 @@ export async function resolvePersonalizationRequest(request, releaseId, config)
     // The identity hash feeds experiment bucketing for EVERY identified
     // visitor. Claims are a signed cookie written by /collect; the EdgeRouter
     // never reads the customer object store to refresh or revoke them.
-    let signedClaims = cookies.get('aci_claims') || '';
+    let signedClaims = mimic ? '' : cookies.get('aci_claims') || '';
     let identityHash = '';
     if (rawIdentity) {
         identityHash = await identityHashHex('aci_id', rawIdentity);
@@ -58,7 +65,9 @@ export async function resolvePersonalizationRequest(request, releaseId, config)
             signedClaims = '';
         }
     }
-    if ((!consent.allowsIdentityTier || !rawIdentity || !signedClaims) && cookies.has('aci_claims')) {
+    // Under mimic the visitor's real aci_claims is never touched (REQ-5) — the
+    // exit path returns them to exactly their pre-mimic state.
+    if (!mimic && (!consent.allowsIdentityTier || !rawIdentity || !signedClaims) && cookies.has('aci_claims')) {
         mutations.push(expireCookie('aci_claims', secure));
     }
     const manifest = await config.store.readEdgeManifest(releaseId);
@@ -66,9 +75,11 @@ export async function resolvePersonalizationRequest(request, releaseId, config)
     let contentPath = route?.dispatch.contentPath || '';
     let variantKey = '';
     if (route) {
-        const claims = consent.allowsIdentityTier
-            ? await verifyClaims(signedClaims, config.claimsKeys || {}, now)
-            : null;
+        const claims = mimic
+            ? { aud: mimic.aud, seg: mimic.seg, iat: 0, exp: 0 }
+            : consent.allowsIdentityTier
+                ? await verifyClaims(signedClaims, config.claimsKeys || {}, now)
+                : null;
         const decision = resolvePersonalizationDecision(toPersonalizationRequestContext(request), route, claims, manifest?.experiments, identityHash
             ? { usable: true, siteId: config.siteId, namespace: 'aci_id', identityHash }
             : undefined);

package/dist/next/server.js

@@ -1,14 +1,18 @@
 import { headers } from 'next/headers.js';
 import { FragmentNotFoundError, LayoutNotFoundError, PageNotFoundError, } from '../content/provider.js';
+import { ObjectContentProvider } from '../providers/object.js';
 import { normalizeRoute } from '../content/routes.js';
 import { getCachedManifest, getCachedSiteConfig } from '../content/cache.js';
 import { S3ContentProvider } from '../providers/s3.js';
+import { VercelReleaseObjectReader } from '../providers/vercel-object-reader.js';
 import { GRADIAL_RENDER_INPUT_HEADER, getPendingRenderInput } from '../runtime/page.js';
 import { attachRenderProofReceipt, selectVerifiedPage, } from '../internal/render-proof.js';
 import { getUncachedEdgeConfigValue } from './edge-config.js';
 import { activeReleaseV1Key, clampDeploymentCompatibleReleaseV1, decodeActiveReleaseV1, decodeDeploymentCompatibilityV1, deploymentCompatibilityKey, } from './vercel-edge-projection-v1.js';
 export { FragmentNotFoundError, PageNotFoundError, LayoutNotFoundError };
-const releaseObjectReaderSymbol = Symbol.for('aci.releaseObjectReader');
+const releaseObjectReaderSymbol = Symbol.for('@gradial/aci.release-object-reader');
+const objectProviders = new WeakMap();
+let vercelReleaseObjectReader;
 export function setReleaseObjectReader(reader) {
     const scope = globalThis;
     if (reader)
@@ -339,6 +343,29 @@ async function resolveS3Provider(config) {
 }
 async function resolveProviderWithFallback(config) {
     const injected = getInjectedReader();
+    const pageRef = config.pageRef;
+    const hostedReaderConfigured = injected || config.roleArn || process.env.AWS_ROLE_ARN;
+    if (pageRef && hostedReaderConfigured) {
+        const releaseId = config.releaseId || process.env.ACI_RELEASE_ID || 'test';
+        let provider = objectProviders.get(config);
+        if (!provider) {
+            if (!injected && !vercelReleaseObjectReader) {
+                vercelReleaseObjectReader = new VercelReleaseObjectReader({
+                    bucket: config.bucket,
+                    keyPrefix: config.keyPrefix,
+                    region: config.region,
+                    roleArn: config.roleArn,
+                    endpoint: config.endpoint,
+                });
+            }
+            const reader = injected || vercelReleaseObjectReader;
+            if (!reader)
+                throw new Error('ACI hosted page reader is unavailable');
+            provider = new ObjectContentProvider({ releaseId, pageRef, reader });
+            objectProviders.set(config, provider);
+        }
+        return provider;
+    }
     if (injected) {
         const releaseId = config.releaseId || process.env.ACI_RELEASE_ID || 'test';
         return new InjectedReaderProvider(releaseId, injected);

package/dist/next/vercel-s3-personalization.d.ts

@@ -76,4 +76,5 @@ export declare function createVercelCollectionFromEnv(env?: Record<string, strin
     identityKeys: PersonalizationHostConfig['identityKeys'];
     claimsKeys: Record<string, string>;
     secureCookies: boolean;
+    mimicSignKey?: string;
 } | undefined;

package/dist/next/vercel-s3-personalization.js

@@ -493,6 +493,7 @@ export function createVercelCollectionFromEnv(env = process.env) {
             ...(previousKID ? { [previousKID]: previousSecret } : {}),
         },
         secureCookies: env.AUDIENCE_IDENTITY_COOKIE_SECURE !== 'false',
+        mimicSignKey: env.GRADIAL_PREVIEW_SIGN_KEY || env.ACI_PREVIEW_SIGN_KEY || undefined,
     };
 }
 function requiredSegment(value, label) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gradial/aci",
-  "version": "0.1.52-rc.10",
+  "version": "0.1.52-rc.13",
   "repository": {
     "type": "git",
     "url": "https://github.com/gradial/bare-metal-go.git",
@@ -146,11 +146,11 @@
     "zod": "^4.0.0"
   },
   "optionalDependencies": {
-    "@gradial/aci-cli-darwin-arm64": "0.1.52-rc.10",
-    "@gradial/aci-cli-darwin-x64": "0.1.52-rc.10",
-    "@gradial/aci-cli-linux-arm64": "0.1.52-rc.10",
-    "@gradial/aci-cli-linux-x64": "0.1.52-rc.10",
-    "@gradial/aci-cli-win32-arm64": "0.1.52-rc.10",
-    "@gradial/aci-cli-win32-x64": "0.1.52-rc.10"
+    "@gradial/aci-cli-darwin-arm64": "0.1.52-rc.13",
+    "@gradial/aci-cli-darwin-x64": "0.1.52-rc.13",
+    "@gradial/aci-cli-linux-arm64": "0.1.52-rc.13",
+    "@gradial/aci-cli-linux-x64": "0.1.52-rc.13",
+    "@gradial/aci-cli-win32-arm64": "0.1.52-rc.13",
+    "@gradial/aci-cli-win32-x64": "0.1.52-rc.13"
   }
 }

package/templates/astro/template/package.json.tmpl

@@ -14,7 +14,7 @@
     "build:storybook": "storybook build"
   },
   "engines": {
-    "node": ">=22",
+    "node": ">=24",
     "npm": ">=10"
   },
   "dependencies": {

package/templates/astro/template/src/layouts/SiteLayout.astro

@@ -48,8 +48,8 @@ const { title, description, canonical, siteName = 'Gradial', collectTag, assignm
       // island (@astrojs/react + @c15t/react) or any setup built on
       // c15t's createConsentManagerStore; this bridge picks it up either
       // way. Without a c15t setup the poll gives up silently and only the
-      // JS consent API (aci('consent', …) under the manual preset) writes
-      // envelopes.
+      // JS consent API (aci('consent', …)) writes envelopes — it is live
+      // under every preset, including c15t.
       //
       // Consents are mirrored only after a real visitor decision
       // (consentInfo set), never for pre-decision defaults, so the SDK

package/templates/common/.content/schemas/site.schema.json

@@ -27,7 +27,7 @@
     },
     "overlayResolution": {
       "type": "array",
-      "items": { "enum": ["locale", "audience"] }
+      "items": { "enum": ["locale", "audience", "segment", "experiment", "experimentArm"] }
     },
     "brandHref": { "type": "string" },
     "brandLogo": {

package/templates/common/.nvmrc

@@ -1 +1 @@
-22
+24

package/templates/common/starter-content/.content/config/site.json

@@ -10,7 +10,7 @@
     "notFound": "/404/",
     "catchAll": "/error/"
   },
-  "overlayResolution": ["locale", "audience"],
+  "overlayResolution": ["locale", "audience", "segment"],
   "brandHref": "/",
   "brandLogo": {
     "src": "/assets/meridian-logo.svg",

package/templates/common/starter-content/.content/schemas/site.schema.json

@@ -27,7 +27,7 @@
     },
     "overlayResolution": {
       "type": "array",
-      "items": { "enum": ["locale", "audience"] }
+      "items": { "enum": ["locale", "audience", "segment", "experiment", "experimentArm"] }
     },
     "brandHref": { "type": "string" },
     "brandLogo": {