@nitida/asset-client 0.24.0 → 0.24.1

package/dist/index.d.cts

@@ -689,6 +689,12 @@ type SlotResolution = {
     /** The CDN URL the consumer should use. */
     url: string | null;
 };
+/** Per-call resolver scope. When passed, it fully overrides the process globals. */
+type SlotResolverConfig = {
+    endpoint?: string;
+    apiKey?: string | null;
+    tenantCode?: string | null;
+};
 /**
  * Configure the resolver process-wide. Call once at boot from your
  * storefront layout / server entry / worker init.
@@ -711,6 +717,12 @@ type ResolveSlotOptions = {
     preset?: VariantPreset;
     /** TTL for the in-process cache. Default 60s. Set 0 to bypass. */
     ttlMs?: number;
+    /**
+     * Per-client auth/endpoint scope. Omit to use the process globals
+     * (configureSlotResolver). A NitidaClient passes its own here so its
+     * resolve() never uses another client's key (audit N15).
+     */
+    config?: SlotResolverConfig;
 };
 /**
  * Resolve a single slot to a CDN URL. Returns `{slot: null, url: null}`

package/dist/index.d.ts

@@ -689,6 +689,12 @@ type SlotResolution = {
     /** The CDN URL the consumer should use. */
     url: string | null;
 };
+/** Per-call resolver scope. When passed, it fully overrides the process globals. */
+type SlotResolverConfig = {
+    endpoint?: string;
+    apiKey?: string | null;
+    tenantCode?: string | null;
+};
 /**
  * Configure the resolver process-wide. Call once at boot from your
  * storefront layout / server entry / worker init.
@@ -711,6 +717,12 @@ type ResolveSlotOptions = {
     preset?: VariantPreset;
     /** TTL for the in-process cache. Default 60s. Set 0 to bypass. */
     ttlMs?: number;
+    /**
+     * Per-client auth/endpoint scope. Omit to use the process globals
+     * (configureSlotResolver). A NitidaClient passes its own here so its
+     * resolve() never uses another client's key (audit N15).
+     */
+    config?: SlotResolverConfig;
 };
 /**
  * Resolve a single slot to a CDN URL. Returns `{slot: null, url: null}`

package/dist/index.js

@@ -219,10 +219,16 @@ function extractAssetSha(url) {
 function serializeTransform(opts) {
   const entries = [];
   const keys = Object.keys(opts).sort();
+  const VALUE_RE = /^[a-z0-9._-]+$/;
   for (const k of keys) {
     const v = opts[k];
     if (v == null) continue;
     const serialized = typeof v === "string" ? v.toLowerCase() : String(v);
+    if (!VALUE_RE.test(serialized)) {
+      throw new Error(
+        `invalid transform value for "${k}": ${JSON.stringify(serialized)} (only [a-z0-9._-] allowed)`
+      );
+    }
     entries.push([k, serialized]);
   }
   return entries.map(([k, v]) => `${k}=${v}`).join(",");
@@ -418,6 +424,14 @@ var cache = /* @__PURE__ */ new Map();
 var endpoint = "https://api.nitida.gofuture.space";
 var apiKey = null;
 var tenantCode = null;
+function effectiveConfig(cfg) {
+  if (!cfg) return { endpoint, apiKey, tenantCode };
+  return {
+    endpoint: cfg.endpoint ? cfg.endpoint.replace(/\/+$/, "") : endpoint,
+    apiKey: cfg.apiKey ?? null,
+    tenantCode: cfg.tenantCode ?? null
+  };
+}
 function configureSlotResolver(opts) {
   if (opts.endpoint) endpoint = opts.endpoint.replace(/\/+$/, "");
   if (opts.apiKey !== void 0) apiKey = opts.apiKey;
@@ -429,25 +443,25 @@ function invalidateSlotCache(slotKey) {
     for (const k of cache.keys())
       if (k.endsWith(`:${slotKey}`)) cache.delete(k);
 }
-var baseHeaders = () => {
+var baseHeaders = (cfg) => {
   const h = {};
-  if (apiKey) h.Authorization = `Bearer ${apiKey}`;
-  if (tenantCode) h["X-Tenant-Code"] = tenantCode;
+  if (cfg.apiKey) h.Authorization = `Bearer ${cfg.apiKey}`;
+  if (cfg.tenantCode) h["X-Tenant-Code"] = cfg.tenantCode;
   return h;
 };
-async function fetchSlot(slotKey) {
-  const r = await fetch(`${endpoint}/slots/${encodeURIComponent(slotKey)}`, {
-    headers: baseHeaders()
+async function fetchSlot(slotKey, cfg) {
+  const r = await fetch(`${cfg.endpoint}/slots/${encodeURIComponent(slotKey)}`, {
+    headers: baseHeaders(cfg)
   });
   if (r.status === 404) return null;
   if (!r.ok) throw new Error(`slot fetch ${r.status}: ${await r.text()}`);
   return await r.json();
 }
-async function fetchSlotsBulk(slotKeys) {
+async function fetchSlotsBulk(slotKeys, cfg) {
   if (slotKeys.length === 0) return {};
-  const r = await fetch(`${endpoint}/slots/resolve`, {
+  const r = await fetch(`${cfg.endpoint}/slots/resolve`, {
     method: "POST",
-    headers: { ...baseHeaders(), "Content-Type": "application/json" },
+    headers: { ...baseHeaders(cfg), "Content-Type": "application/json" },
     body: JSON.stringify({ keys: slotKeys })
   });
   if (!r.ok) throw new Error(`slots resolve ${r.status}: ${await r.text()}`);
@@ -456,14 +470,15 @@ async function fetchSlotsBulk(slotKeys) {
 }
 async function resolveSlot(slotKey, opts = {}) {
   const ttl = opts.ttlMs ?? DEFAULT_TTL_MS;
-  const cacheKey = `${tenantCode ?? "_"}:${slotKey}`;
+  const cfg = effectiveConfig(opts.config);
+  const cacheKey = `${cfg.tenantCode ?? "_"}:${slotKey}`;
   const now = Date.now();
   let dto;
   const hit = cache.get(cacheKey);
   if (hit && now - hit.fetchedAt < ttl) {
     dto = hit.value;
   } else {
-    dto = await fetchSlot(slotKey);
+    dto = await fetchSlot(slotKey, cfg);
     cache.set(cacheKey, { fetchedAt: now, value: dto });
   }
   return materializeResolution(dto, opts.preset);
@@ -471,11 +486,12 @@ async function resolveSlot(slotKey, opts = {}) {
 async function resolveSlots(slotKeys, opts = {}) {
   if (slotKeys.length === 0) return {};
   const ttl = opts.ttlMs ?? DEFAULT_TTL_MS;
+  const cfg = effectiveConfig(opts.config);
   const now = Date.now();
   const missing = [];
   const out = {};
   for (const k of slotKeys) {
-    const cacheKey = `${tenantCode ?? "_"}:${k}`;
+    const cacheKey = `${cfg.tenantCode ?? "_"}:${k}`;
     const hit = cache.get(cacheKey);
     if (hit && now - hit.fetchedAt < ttl) {
       out[k] = materializeResolution(hit.value, opts.preset);
@@ -484,10 +500,10 @@ async function resolveSlots(slotKeys, opts = {}) {
     }
   }
   if (missing.length > 0) {
-    const resolved = await fetchSlotsBulk(missing);
+    const resolved = await fetchSlotsBulk(missing, cfg);
     for (const k of missing) {
       const dto = resolved[k] ?? null;
-      cache.set(`${tenantCode ?? "_"}:${k}`, { fetchedAt: now, value: dto });
+      cache.set(`${cfg.tenantCode ?? "_"}:${k}`, { fetchedAt: now, value: dto });
       out[k] = materializeResolution(dto, opts.preset);
     }
   }