@gradial/aci 0.1.52-rc.16 → 0.1.52-rc.21

package/dist/mimic/core.js

@@ -1,90 +1,16 @@
-// View-as-audience mimic session helpers (specs/features/audience-mimic).
-// Mirror of internal/domain/hosting/runtime/mimic.ts for SDK-hosted paths
-// (Next middleware); the token validator is the twin of
-// validateMimicToken in internal/domain/hosting/runtime/edge_router.ts and
-// internal/domain/edge/routing/mimic.go, pinned by the shared vector file
-// (internal/domain/edge/routing/testdata/mimic_token_vectors.json).
-export const MIMIC_PARAM = 'aci_mimic';
-export const MIMIC_COOKIE = 'aci_mimic';
-export const MIMIC_EXIT = 'exit';
-export const MIMIC_MAX_MEMBERSHIPS = 32;
-export const MIMIC_MAX_TOKEN_BYTES = 2048;
-export async function validateMimicToken(token, signKey, siteId) {
-    try {
-        if (!token || token.length > MIMIC_MAX_TOKEN_BYTES || !signKey || !siteId)
-            return null;
-        const parts = token.split('.');
-        if (parts.length !== 3)
-            return null;
-        const signingInput = `${parts[0]}.${parts[1]}`;
-        const signature = base64URLToBytes(parts[2]);
-        const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(signKey), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
-        const expected = new Uint8Array(await crypto.subtle.sign('HMAC', key, new TextEncoder().encode(signingInput)));
-        if (!constantTimeEqual(signature, expected))
-            return null;
-        const claims = JSON.parse(new TextDecoder().decode(base64URLToBytes(parts[1])));
-        if (claims.scope !== 'mimic')
-            return null;
-        if (typeof claims.siteId !== 'string' || claims.siteId !== siteId)
-            return null;
-        const aud = Array.isArray(claims.aud) ? claims.aud : [];
-        const seg = Array.isArray(claims.seg) ? claims.seg : [];
-        if (aud.length + seg.length === 0)
-            return null;
-        if (aud.length > MIMIC_MAX_MEMBERSHIPS || seg.length > MIMIC_MAX_MEMBERSHIPS)
-            return null;
-        const expiresAt = Date.parse(claims.expiresAt);
-        if (Number.isNaN(expiresAt) || expiresAt <= Date.now())
-            return null;
-        return { ...claims, aud, seg };
-    }
-    catch {
-        return null;
-    }
-}
-// The session cookie dies with the token so an expired session self-clears
-// back to the genuine experience (D-12).
-export function createMimicEntryCookie(token, expiresAt, secure = true) {
-    const maxAge = Math.max(1, Math.ceil((Date.parse(expiresAt) - Date.now()) / 1000));
-    return {
-        name: MIMIC_COOKIE,
-        value: token,
-        options: { httpOnly: true, sameSite: 'lax', maxAge, path: '/', secure },
-    };
-}
-export function createMimicClearCookie(secure = true) {
-    return {
-        name: MIMIC_COOKIE,
-        value: '',
-        options: { httpOnly: true, sameSite: 'lax', maxAge: 0, path: '/', secure },
-    };
-}
-// The banner is the truth signal (REQ-4): present on every mimic render,
-// absent otherwise. v1 lists raw IDs — the documented fallback (spec 04).
-export function createMimicBannerHTML(claims, expiresAt) {
-    const names = [...(claims.aud ?? []), ...(claims.seg ?? [])]
-        .map(escapeHTML)
-        .join(', ');
-    const remainingMinutes = Math.max(1, Math.ceil((Date.parse(expiresAt) - Date.now()) / 60000));
-    return `<div role="alert" style="position:fixed;top:0;left:0;right:0;z-index:9999;display:flex;align-items:center;justify-content:center;gap:12px;padding:8px 16px;background-color:#0f2e1d;color:#fff;font-size:13px;font-family:system-ui,-apple-system,sans-serif;box-shadow:0 2px 8px rgba(0,0,0,0.3);">
-  <span aria-hidden="true" style="display:inline-flex;align-items:center;justify-content:center;width:18px;height:18px;border-radius:50%;background-color:#10b981;color:#0f2e1d;font-weight:700;font-size:11px;flex-shrink:0;">M</span>
-  <span style="font-weight:500;">Viewing as audience</span>
-  <span style="font-family:monospace;opacity:0.85;font-size:12px;">${names}</span>
-  <span style="opacity:0.7;font-size:12px;">expires in ${remainingMinutes} min</span>
-  <a href="?${MIMIC_PARAM}=${MIMIC_EXIT}" style="margin-left:auto;padding:4px 12px;border-radius:6px;background-color:#dc2626;color:#fff;text-decoration:none;font-size:12px;font-weight:600;white-space:nowrap;">Exit</a>
-</div>`;
-}
-export function injectMimicBannerIntoHTML(html, banner) {
-    return html.includes('</body>') ? html.replace('</body>', `${banner}</body>`) : html + banner;
-}
-// MIMIC_BANNER_HEADER carries the base64url-encoded banner HTML from the
-// middleware to the framework render (the MimicBanner component in
-// next/page.tsx). It is a reserved header: the middleware strips any inbound
-// copy and sets it only for a validated session.
+// View-as-audience mimic banner contract (specs/features/audience-mimic).
+// The platform edge router (internal/domain/hosting/runtime/mimic.ts) owns
+// the mimic session — token validation, cookies, redirects, and banner
+// creation. On body-less SSR rewrites it forwards the rendered banner to the
+// framework host via MIMIC_BANNER_HEADER; this module is the framework-side
+// leg that decodes it (the MimicBanner component in next/page.tsx). The
+// middleware strips any inbound copy of the header and sets it only for a
+// validated session, so the decoded HTML is trusted as authored.
+//
+// The SDK-side token validator that used to live here served the retired
+// Next personalization-host lane (ADR 0041); the Go/TS validators in
+// internal/domain/edge remain pinned by the shared vector file.
 export const MIMIC_BANNER_HEADER = 'x-aci-mimic-banner';
-export function encodeMimicBanner(claims) {
-    return bytesToBase64URL(new TextEncoder().encode(createMimicBannerHTML(claims, claims.expiresAt)));
-}
 export function decodeMimicBanner(encoded) {
     try {
         return new TextDecoder().decode(base64URLToBytes(encoded));
@@ -93,12 +19,6 @@ export function decodeMimicBanner(encoded) {
         return '';
     }
 }
-function bytesToBase64URL(bytes) {
-    let binary = '';
-    for (const byte of bytes)
-        binary += String.fromCharCode(byte);
-    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
 function base64URLToBytes(value) {
     const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
     const padded = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
@@ -109,19 +29,3 @@ function base64URLToBytes(value) {
     }
     return bytes;
 }
-function constantTimeEqual(left, right) {
-    if (left.length !== right.length)
-        return false;
-    let diff = 0;
-    for (let i = 0; i < left.length; i++) {
-        diff |= left[i] ^ right[i];
-    }
-    return diff === 0;
-}
-function escapeHTML(value) {
-    return value
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;');
-}

package/dist/next/vercel-edge-projection-v1.d.ts

@@ -1,7 +1,3 @@
-import type { EdgeRouteManifest } from './personalization-host.js';
-export declare const VERCEL_EDGE_PROJECTION_SCHEMA_V1 = "gradial.vercel.edgeRoutes.v1";
-export declare const VERCEL_EDGE_PROJECTION_ENCODING_V1 = "gzip+base64";
-export declare const MAX_VERCEL_EDGE_MANIFEST_BYTES_V1: number;
 export interface ActiveReleasePointerV1 {
     releaseId: string;
     sequence: bigint;
@@ -13,12 +9,7 @@ export interface DeploymentCompatibilityV1 {
     maxSequence?: bigint;
 }
 export declare function activeReleaseV1Key(siteId: string): string;
-export declare function edgeRoutesV1Key(siteId: string, releaseId: string): string;
 export declare function deploymentCompatibilityKey(siteId: string, deploymentId: string): string;
 export declare function decodeActiveReleaseV1(value: unknown): ActiveReleasePointerV1;
 export declare function decodeDeploymentCompatibilityV1(value: unknown): DeploymentCompatibilityV1;
 export declare function clampDeploymentCompatibleReleaseV1(active: ActiveReleasePointerV1, compatibility: DeploymentCompatibilityV1): string;
-export declare function decodeEdgeRouteProjectionV1(value: unknown, expected: {
-    siteId: string;
-    releaseId: string;
-}): EdgeRouteManifest;