@gradial/aci 0.1.52-rc.3 → 0.1.52-rc.34-e2e.1

package/dist/next/page.js

@@ -1,12 +1,15 @@
 import { jsx as _jsx, Fragment as _Fragment, jsxs as _jsxs } from "react/jsx-runtime";
 import { notFound } from 'next/navigation.js';
+import { headers } from 'next/headers.js';
 import { Fragment } from 'react';
 import { PageNotFoundError, getRenderInput, getLayout, getFragment, } from './server.js';
+import { MIMIC_BANNER_HEADER, decodeMimicBanner } from '../mimic/core.js';
 import { routeMetadataForContent, resolveSlots, } from '../content/index.js';
 import { renderBlocks } from './render.js';
 import { AssignmentsScript } from './assignments-script.js';
 import { CollectScript } from './collect-script.js';
 import { renderProofContentFor } from '../internal/render-proof.js';
+import { parseHostedPageTarget } from './hosted-page-target.js';
 /**
  * Creates the catch-all route handler for a Next.js ACI site.
  *
@@ -28,12 +31,10 @@ import { renderProofContentFor } from '../internal/render-proof.js';
  * the collect script tag exactly once per page (design/04 contract tag).
  *
  * Release-scoped routes (production): the middleware rewrites a public URL
- * to `/__r/{releaseId}/routes/{path}`. The optional catch-all `[[...slug]]`
- * receives `['__r', releaseId, 'routes', ...pathSegments]`. createPage
- * extracts the releaseId and passes it to the content loader, giving
- * each release a unique CDN cache key without a separate route folder.
- * The `routes` namespace segment leaves room for future siblings under
- * the release prefix (e.g. `/__r/{releaseId}/assets/*`).
+ * to `/__r/{releaseId}/{targetRef}`. The target ref selects the exact immutable
+ * base or variant page while its prefix identifies the logical public route.
+ * createPage passes both identities to the content loader, giving each target
+ * a distinct CDN cache key without sending selection headers into Next.
  *
  * Dev pass-through (ACI_CONTENT_PROVIDER=file): the middleware passes
  * requests through unrewritten, so `/` arrives with an empty/undefined
@@ -49,8 +50,9 @@ import { renderProofContentFor } from '../internal/render-proof.js';
 export function createPage(registry, options) {
     const dynamic = 'force-dynamic';
     async function generateMetadata({ params }) {
-        const { route, releaseId } = await resolveRouteAndRelease(params);
-        const input = await getRenderInput(route, { releaseId });
+        const { route, releaseId, pageRef } = await resolveRouteAndRelease(params);
+        const fetchConfig = { releaseId, pageRef };
+        const input = await getRenderInput(route, fetchConfig);
         const meta = routeMetadataForContent(input.siteConfig, input.page);
         return {
             title: meta.title,
@@ -64,8 +66,8 @@ export function createPage(registry, options) {
         };
     }
     async function CatchAllPage({ params }) {
-        const { route, releaseId } = await resolveRouteAndRelease(params);
-        const fetchConfig = { releaseId };
+        const { route, releaseId, pageRef } = await resolveRouteAndRelease(params);
+        const fetchConfig = { releaseId, pageRef };
         try {
             const input = await getRenderInput(route, fetchConfig);
             if (!input.page)
@@ -84,9 +86,9 @@ export function createPage(registry, options) {
                 }
                 return (_jsx(Fragment, { children: renderedBlocks }, slot.name));
             }));
-            return (_jsxs(_Fragment, { children: [renderProofContent
+            return (_jsxs(_Fragment, { children: [renderedSlots.filter(Boolean), _jsx(AssignmentsScript, { page: input.page }), _jsx(CollectScript, { siteConfig: input.siteConfig }), _jsx(MimicBanner, { html: await readMimicBannerHTML() }), renderProofContent
                         ? _jsx("meta", { name: "aci-render-proof", content: renderProofContent })
-                        : null, renderedSlots.filter(Boolean), _jsx(AssignmentsScript, { page: input.page }), _jsx(CollectScript, { siteConfig: input.siteConfig })] }));
+                        : null] }));
         }
         catch (error) {
             if (error instanceof PageNotFoundError)
@@ -105,19 +107,18 @@ export function createPage(registry, options) {
  *
  * Two shapes are supported:
  *
- * 1. **Rewritten (production):** middleware rewrites a public URL to
- *    `/__r/{releaseId}/routes/{path}`, so slug is
- *    `['__r', releaseId, 'routes', ...pathSegments]`. The releaseId is
- *    extracted; the remaining segments form the content route. The `routes`
- *    segment is the namespace for page routes (siblings like `assets/` live
- *    under the same release prefix).
+ * 1. **Rewritten (production):** middleware rewrites a public URL to the exact
+ *    selected target under `/__r/{releaseId}`. A root variant therefore has
+ *    `['__r', releaseId, '__variant', variantKey]`. The full suffix selects the
+ *    immutable page object; the segments before the reserved `__variant`
+ *    namespace form the logical public route.
  *
  * 2. **Dev pass-through (ACI_CONTENT_PROVIDER=file):** middleware passes
  *    requests through unrewritten, so the slug is the raw public path
  *    segments (possibly empty/undefined for `/`). No releaseId is present;
  *    the file provider serves content from disk.
  */
-async function resolveRouteAndRelease(params) {
+export async function resolveRouteAndRelease(params) {
     const resolved = await params;
     const slug = resolved.slug ?? [];
     if (slug.length >= 2 && slug[0] === '__r') {
@@ -125,13 +126,14 @@ async function resolveRouteAndRelease(params) {
         if (!releaseId || releaseId.includes('/') || releaseId === '.' || releaseId === '..') {
             return { route: '/' };
         }
-        // Skip the 'routes' namespace segment when present.
-        const rest = slug.length >= 3 && slug[2] === 'routes' ? slug.slice(3) : slug.slice(2);
-        if (rest.length === 0)
-            return { route: '/', releaseId };
-        if (rest.some((s) => s === '' || s === '.' || s === '..'))
+        const target = parseHostedPageTarget(slug.slice(2));
+        if (!target)
             return { route: '/' };
-        return { route: `/${rest.join('/')}/`, releaseId };
+        return {
+            route: target.route,
+            releaseId,
+            pageRef: target.pageRef,
+        };
     }
     const route = routeFromSlug(slug);
     return { route };
@@ -141,3 +143,23 @@ function routeFromSlug(slug) {
         return '/';
     return `/${slug.join('/')}/`;
 }
+// The middleware emits the banner HTML in a reserved request header only
+// after validating a signed mimic token; viewer-forged copies are stripped at
+// the dispatch gate (specs/features/audience-mimic REQ-4). The header read
+// happens here (the page already awaits request-scoped data) so the banner
+// itself stays a synchronous leaf.
+async function readMimicBannerHTML() {
+    try {
+        const current = await headers();
+        return decodeMimicBanner(current.get(MIMIC_BANNER_HEADER) || '');
+    }
+    catch {
+        // headers() has no request context in static generation and unit tests.
+        return '';
+    }
+}
+function MimicBanner({ html }) {
+    if (!html)
+        return null;
+    return _jsx("div", { dangerouslySetInnerHTML: { __html: html } });
+}

package/dist/next/release-context.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The release identity of a request the hosting router rewrote to
+ * `/__r/{releaseId}/…`. The catch-all reads the release from that path; Next
+ * code that receives no route params (the not-found seat, release-less SDK
+ * reads such as a secondary `getPage('/blog')`) reads it from this header.
+ *
+ * Mirrors the router's signer byte for byte
+ * (internal/domain/hosting/runtime/edgeoutput/vercel_middleware.ts):
+ * `v1.<base64url HMAC-SHA256>.<releaseId>`, keyed by the deployment's
+ * ACI_INTERNAL_ARTIFACT_SECRET over "gradial.release-context.v1\n" +
+ * releaseId. The router strips any inbound copy, but requests under /api,
+ * /assets, /_astro, /_next and /favicon.ico bypass the router and reach Next
+ * with the visitor's own headers — so presence alone proves nothing and an
+ * unverifiable value selects no release.
+ */
+export declare const RELEASE_CONTEXT_HEADER = "x-aci-release-context";
+/** Returns the release a context value names when its signature verifies. */
+export declare function verifyReleaseContext(value: string, secret: string): string | null;
+export interface RoutedRelease {
+    /** The verified release the router dispatched this request to. */
+    releaseId?: string;
+    /** Why a present context was not used; it never selects a release. */
+    rejected?: string;
+}
+/**
+ * Reads the routed release of the current request. Outside a request scope
+ * (build, static generation, tooling) or without the header there is none.
+ */
+export declare function routedRelease(): Promise<RoutedRelease>;

package/dist/next/release-context.js

@@ -0,0 +1,55 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+import { headers } from 'next/headers.js';
+/**
+ * The release identity of a request the hosting router rewrote to
+ * `/__r/{releaseId}/…`. The catch-all reads the release from that path; Next
+ * code that receives no route params (the not-found seat, release-less SDK
+ * reads such as a secondary `getPage('/blog')`) reads it from this header.
+ *
+ * Mirrors the router's signer byte for byte
+ * (internal/domain/hosting/runtime/edgeoutput/vercel_middleware.ts):
+ * `v1.<base64url HMAC-SHA256>.<releaseId>`, keyed by the deployment's
+ * ACI_INTERNAL_ARTIFACT_SECRET over "gradial.release-context.v1\n" +
+ * releaseId. The router strips any inbound copy, but requests under /api,
+ * /assets, /_astro, /_next and /favicon.ico bypass the router and reach Next
+ * with the visitor's own headers — so presence alone proves nothing and an
+ * unverifiable value selects no release.
+ */
+export const RELEASE_CONTEXT_HEADER = 'x-aci-release-context';
+const SECRET_ENV = 'ACI_INTERNAL_ARTIFACT_SECRET';
+const MESSAGE_PREFIX = 'gradial.release-context.v1\n';
+const RELEASE_CONTEXT_PATTERN = /^v1\.([A-Za-z0-9_-]{43})\.([A-Za-z0-9][A-Za-z0-9._-]{0,127})$/;
+/** Returns the release a context value names when its signature verifies. */
+export function verifyReleaseContext(value, secret) {
+    const match = RELEASE_CONTEXT_PATTERN.exec(value);
+    if (!match || !secret)
+        return null;
+    const [, signature, releaseId] = match;
+    const expected = createHmac('sha256', secret).update(MESSAGE_PREFIX + releaseId).digest();
+    const actual = Buffer.from(signature, 'base64url');
+    if (actual.length !== expected.length || !timingSafeEqual(actual, expected))
+        return null;
+    return releaseId;
+}
+/**
+ * Reads the routed release of the current request. Outside a request scope
+ * (build, static generation, tooling) or without the header there is none.
+ */
+export async function routedRelease() {
+    let value;
+    try {
+        value = (await headers()).get(RELEASE_CONTEXT_HEADER);
+    }
+    catch {
+        // headers() has no request context in static generation and unit tests.
+        return {};
+    }
+    if (!value)
+        return {};
+    const secret = process.env[SECRET_ENV]?.trim() || '';
+    if (!secret) {
+        return { rejected: `${SECRET_ENV} is not configured, so the routed release context cannot be verified` };
+    }
+    const releaseId = verifyReleaseContext(value, secret);
+    return releaseId ? { releaseId } : { rejected: 'the routed release context failed verification' };
+}

package/dist/next/render.d.ts

@@ -1,5 +1,5 @@
 import type { ReactElement } from 'react';
 import type { KernelPageBlock } from '../content/types.js';
 import type { Registry } from '../registry.js';
-export declare function renderBlock(block: KernelPageBlock, registry: Registry, extraProps?: Record<string, unknown>): Promise<ReactElement>;
+export declare function renderBlock(block: KernelPageBlock, registry: Registry, key: string, extraProps?: Record<string, unknown>): Promise<ReactElement>;
 export declare function renderBlocks(blocks: readonly KernelPageBlock[], registry: Registry, extraProps?: Record<string, unknown>): Promise<ReactElement[]>;

package/dist/next/render.js

@@ -1,17 +1,27 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-export async function renderBlock(block, registry, extraProps) {
+export async function renderBlock(block, registry, key, extraProps) {
     const entry = registry.find((r) => r.id === block.component);
     if (!entry) {
-        return (_jsxs("div", { className: "mx-auto my-4 max-w-[var(--max-width-container)] rounded-card border-2 border-red-600 bg-red-50 px-5 py-4 font-mono text-sm leading-relaxed text-red-900", children: [_jsx("strong", { children: "Unknown block:" }), " ", _jsx("code", { children: block.component }), _jsx("br", {}), _jsxs("span", { className: "text-red-800 opacity-70", children: ["id: ", block.id] })] }, block.id));
+        return (_jsxs("div", { className: "mx-auto my-4 max-w-[var(--max-width-container)] rounded-card border-2 border-red-600 bg-red-50 px-5 py-4 font-mono text-sm leading-relaxed text-red-900", children: [_jsx("strong", { children: "Unknown block:" }), " ", _jsx("code", { children: block.component }), _jsx("br", {}), _jsxs("span", { className: "text-red-800 opacity-70", children: ["id: ", block.id] })] }, key));
     }
     const Component = entry.component;
     const hasBlockSlots = !!entry.contract.blockSlots;
-    const componentProps = { ...block.props, ...extraProps };
+    // sdk I-19 (ADR 0051): root identity props are applied last so neither
+    // content props nor tenant slotProps can overwrite them.
+    const componentProps = {
+        ...block.props,
+        ...extraProps,
+        'data-aci-block': block.id,
+        'data-aci-component': block.component,
+    };
     if (hasBlockSlots) {
         componentProps.renderChildren = (blocks) => renderBlocks(blocks, registry, extraProps);
     }
-    return _jsx(Component, { ...componentProps }, block.id);
+    return _jsx(Component, { ...componentProps }, key);
 }
 export async function renderBlocks(blocks, registry, extraProps) {
-    return Promise.all(blocks.map((block) => renderBlock(block, registry, extraProps)));
+    // Sibling keys are index+id composites: one fragment placed twice repeats
+    // its authored block id, and React reconciliation keys must be unique per
+    // sibling (ADR 0051 covers analytics identity, not reconciliation).
+    return Promise.all(blocks.map((block, index) => renderBlock(block, registry, `${index}:${block.id}`, extraProps)));
 }

package/dist/next/server.d.ts

@@ -54,4 +54,12 @@ export declare class DamAssetNotFoundError extends Error {
     constructor(assetPath: string, cause?: unknown);
 }
 export declare function getDamAssetResponse(assetPath: string, config?: FetchConfig): Promise<Response>;
+/**
+ * The release a read uses: the caller's explicit release (the catch-all passes
+ * the one its `/__r/{releaseId}` path names), else the release the hosting
+ * router dispatched this request to (release-context.ts — the same release,
+ * for code such as the not-found seat that receives no route params), else a
+ * process pin. A routed release outranks the pin because the catch-all of the
+ * same request renders the routed release regardless of the pin.
+ */
 export declare function resolveReleaseId(config?: FetchConfig): Promise<string>;

package/dist/next/server.js

@@ -1,14 +1,19 @@
 import { headers } from 'next/headers.js';
 import { FragmentNotFoundError, LayoutNotFoundError, PageNotFoundError, } from '../content/provider.js';
+import { ObjectContentProvider } from '../providers/object.js';
 import { normalizeRoute } from '../content/routes.js';
 import { getCachedManifest, getCachedSiteConfig } from '../content/cache.js';
 import { S3ContentProvider } from '../providers/s3.js';
+import { VercelReleaseObjectReader } from '../providers/vercel-object-reader.js';
 import { GRADIAL_RENDER_INPUT_HEADER, getPendingRenderInput } from '../runtime/page.js';
 import { attachRenderProofReceipt, selectVerifiedPage, } from '../internal/render-proof.js';
 import { getUncachedEdgeConfigValue } from './edge-config.js';
+import { routedRelease } from './release-context.js';
 import { activeReleaseV1Key, clampDeploymentCompatibleReleaseV1, decodeActiveReleaseV1, decodeDeploymentCompatibilityV1, deploymentCompatibilityKey, } from './vercel-edge-projection-v1.js';
 export { FragmentNotFoundError, PageNotFoundError, LayoutNotFoundError };
-const releaseObjectReaderSymbol = Symbol.for('aci.releaseObjectReader');
+const releaseObjectReaderSymbol = Symbol.for('@gradial/aci.release-object-reader');
+const objectProviders = new WeakMap();
+let vercelReleaseObjectReader;
 export function setReleaseObjectReader(reader) {
     const scope = globalThis;
     if (reader)
@@ -40,8 +45,9 @@ export async function getFragment(name, config = {}) {
     const runtimeInput = await getPageRuntimeRenderInput();
     if (runtimeInput) {
         const fragments = runtimeInput.fragments || {};
-        if (name in fragments)
+        if (Object.hasOwn(fragments, name))
             return fragments[name];
+        throw new FragmentNotFoundError(name, new Error('fragment is not bound by the selected page'));
     }
     const provider = await resolveProviderWithFallback(config);
     return await provider.getFragment(name);
@@ -287,15 +293,27 @@ async function safeResponseText(res) {
         return '';
     }
 }
+/**
+ * The release a read uses: the caller's explicit release (the catch-all passes
+ * the one its `/__r/{releaseId}` path names), else the release the hosting
+ * router dispatched this request to (release-context.ts — the same release,
+ * for code such as the not-found seat that receives no route params), else a
+ * process pin. A routed release outranks the pin because the catch-all of the
+ * same request renders the routed release regardless of the pin.
+ */
 export async function resolveReleaseId(config = {}) {
     if (config.releaseId)
         return config.releaseId;
+    const routed = await routedRelease();
+    if (routed.releaseId)
+        return routed.releaseId;
     if (process.env.ACI_RELEASE_ID)
         return process.env.ACI_RELEASE_ID;
     const activeReleaseId = await activeReleaseFromEdgeConfig(config);
     if (activeReleaseId)
         return activeReleaseId;
-    throw new Error('ACI release ID is required. Pass releaseId from the release-scoped route or set ACI_RELEASE_ID.');
+    throw new Error('ACI release ID is required. Pass releaseId from the release-scoped route or set ACI_RELEASE_ID.'
+        + (routed.rejected ? ` The request carried a release context that was not used: ${routed.rejected}.` : ''));
 }
 async function resolveS3Provider(config) {
     const releaseId = await resolveReleaseId(config);
@@ -339,6 +357,29 @@ async function resolveS3Provider(config) {
 }
 async function resolveProviderWithFallback(config) {
     const injected = getInjectedReader();
+    const pageRef = config.pageRef;
+    const hostedReaderConfigured = injected || config.roleArn || process.env.AWS_ROLE_ARN;
+    if (pageRef && hostedReaderConfigured) {
+        const releaseId = config.releaseId || process.env.ACI_RELEASE_ID || 'test';
+        let provider = objectProviders.get(config);
+        if (!provider) {
+            if (!injected && !vercelReleaseObjectReader) {
+                vercelReleaseObjectReader = new VercelReleaseObjectReader({
+                    bucket: config.bucket,
+                    keyPrefix: config.keyPrefix,
+                    region: config.region,
+                    roleArn: config.roleArn,
+                    endpoint: config.endpoint,
+                });
+            }
+            const reader = injected || vercelReleaseObjectReader;
+            if (!reader)
+                throw new Error('ACI hosted page reader is unavailable');
+            provider = new ObjectContentProvider({ releaseId, pageRef, reader });
+            objectProviders.set(config, provider);
+        }
+        return provider;
+    }
     if (injected) {
         const releaseId = config.releaseId || process.env.ACI_RELEASE_ID || 'test';
         return new InjectedReaderProvider(releaseId, injected);

package/dist/next/vercel-edge-projection-v1.d.ts

@@ -1,7 +1,3 @@
-import type { EdgeRouteManifest } from './personalization-host.js';
-export declare const VERCEL_EDGE_PROJECTION_SCHEMA_V1 = "gradial.vercel.edgeRoutes.v1";
-export declare const VERCEL_EDGE_PROJECTION_ENCODING_V1 = "gzip+base64";
-export declare const MAX_VERCEL_EDGE_MANIFEST_BYTES_V1: number;
 export interface ActiveReleasePointerV1 {
     releaseId: string;
     sequence: bigint;
@@ -13,12 +9,7 @@ export interface DeploymentCompatibilityV1 {
     maxSequence?: bigint;
 }
 export declare function activeReleaseV1Key(siteId: string): string;
-export declare function edgeRoutesV1Key(siteId: string, releaseId: string): string;
 export declare function deploymentCompatibilityKey(siteId: string, deploymentId: string): string;
 export declare function decodeActiveReleaseV1(value: unknown): ActiveReleasePointerV1;
 export declare function decodeDeploymentCompatibilityV1(value: unknown): DeploymentCompatibilityV1;
 export declare function clampDeploymentCompatibleReleaseV1(active: ActiveReleasePointerV1, compatibility: DeploymentCompatibilityV1): string;
-export declare function decodeEdgeRouteProjectionV1(value: unknown, expected: {
-    siteId: string;
-    releaseId: string;
-}): EdgeRouteManifest;