@nitida/asset-client 0.24.0 → 0.24.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitida/asset-client",
-  "version": "0.24.0",
+  "version": "0.24.1",
   "description": "nitida URL builders — construct image, video and HLS URLs for the nitida CDN. No network, no key, no config beyond a tenant id.",
   "private": false,
   "publishConfig": {
@@ -42,7 +42,7 @@
   },
   "devDependencies": {
     "tsup": "^8.5.1",
-    "typescript": "^6.0.3"
+    "typescript": "npm:@typescript/typescript6@6.0.2"
   },
   "keywords": [
     "media",

package/src/slots.ts

@@ -61,6 +61,31 @@ let endpoint = "https://api.nitida.gofuture.space";
 let apiKey: string | null = null;
 let tenantCode: string | null = null;
 
+/** Per-call resolver scope. When passed, it fully overrides the process globals. */
+export type SlotResolverConfig = {
+  endpoint?: string;
+  apiKey?: string | null;
+  tenantCode?: string | null;
+};
+
+/**
+ * Effective config for one resolve call: explicit per-client config wins, else
+ * the process globals. This is what makes a per-client `slots.resolve()` use ITS
+ * OWN key instead of whatever client was constructed last (audit N15).
+ */
+function effectiveConfig(cfg?: SlotResolverConfig): {
+  endpoint: string;
+  apiKey: string | null;
+  tenantCode: string | null;
+} {
+  if (!cfg) return { endpoint, apiKey, tenantCode };
+  return {
+    endpoint: cfg.endpoint ? cfg.endpoint.replace(/\/+$/, "") : endpoint,
+    apiKey: cfg.apiKey ?? null,
+    tenantCode: cfg.tenantCode ?? null,
+  };
+}
+
 /**
  * Configure the resolver process-wide. Call once at boot from your
  * storefront layout / server entry / worker init.
@@ -93,16 +118,25 @@ export function invalidateSlotCache(slotKey?: string): void {
 // Internal fetch helper
 // ---------------------------------------------------------------------------
 
-const baseHeaders = (): Record<string, string> => {
+type ResolvedConfig = {
+  endpoint: string;
+  apiKey: string | null;
+  tenantCode: string | null;
+};
+
+const baseHeaders = (cfg: ResolvedConfig): Record<string, string> => {
   const h: Record<string, string> = {};
-  if (apiKey) h.Authorization = `Bearer ${apiKey}`;
-  if (tenantCode) h["X-Tenant-Code"] = tenantCode;
+  if (cfg.apiKey) h.Authorization = `Bearer ${cfg.apiKey}`;
+  if (cfg.tenantCode) h["X-Tenant-Code"] = cfg.tenantCode;
   return h;
 };
 
-async function fetchSlot(slotKey: string): Promise<SlotDTO | null> {
-  const r = await fetch(`${endpoint}/slots/${encodeURIComponent(slotKey)}`, {
-    headers: baseHeaders(),
+async function fetchSlot(
+  slotKey: string,
+  cfg: ResolvedConfig,
+): Promise<SlotDTO | null> {
+  const r = await fetch(`${cfg.endpoint}/slots/${encodeURIComponent(slotKey)}`, {
+    headers: baseHeaders(cfg),
   });
   if (r.status === 404) return null;
   if (!r.ok) throw new Error(`slot fetch ${r.status}: ${await r.text()}`);
@@ -111,11 +145,12 @@ async function fetchSlot(slotKey: string): Promise<SlotDTO | null> {
 
 async function fetchSlotsBulk(
   slotKeys: string[],
+  cfg: ResolvedConfig,
 ): Promise<Record<string, SlotDTO | null>> {
   if (slotKeys.length === 0) return {};
-  const r = await fetch(`${endpoint}/slots/resolve`, {
+  const r = await fetch(`${cfg.endpoint}/slots/resolve`, {
     method: "POST",
-    headers: { ...baseHeaders(), "Content-Type": "application/json" },
+    headers: { ...baseHeaders(cfg), "Content-Type": "application/json" },
     body: JSON.stringify({ keys: slotKeys }),
   });
   if (!r.ok) throw new Error(`slots resolve ${r.status}: ${await r.text()}`);
@@ -132,6 +167,12 @@ export type ResolveSlotOptions = {
   preset?: VariantPreset;
   /** TTL for the in-process cache. Default 60s. Set 0 to bypass. */
   ttlMs?: number;
+  /**
+   * Per-client auth/endpoint scope. Omit to use the process globals
+   * (configureSlotResolver). A NitidaClient passes its own here so its
+   * resolve() never uses another client's key (audit N15).
+   */
+  config?: SlotResolverConfig;
 };
 
 /**
@@ -146,14 +187,15 @@ export async function resolveSlot(
   opts: ResolveSlotOptions = {},
 ): Promise<SlotResolution> {
   const ttl = opts.ttlMs ?? DEFAULT_TTL_MS;
-  const cacheKey = `${tenantCode ?? "_"}:${slotKey}`;
+  const cfg = effectiveConfig(opts.config);
+  const cacheKey = `${cfg.tenantCode ?? "_"}:${slotKey}`;
   const now = Date.now();
   let dto: SlotDTO | null;
   const hit = cache.get(cacheKey);
   if (hit && now - hit.fetchedAt < ttl) {
     dto = hit.value;
   } else {
-    dto = await fetchSlot(slotKey);
+    dto = await fetchSlot(slotKey, cfg);
     cache.set(cacheKey, { fetchedAt: now, value: dto });
   }
   return materializeResolution(dto, opts.preset);
@@ -170,11 +212,12 @@ export async function resolveSlots(
 ): Promise<Record<string, SlotResolution>> {
   if (slotKeys.length === 0) return {};
   const ttl = opts.ttlMs ?? DEFAULT_TTL_MS;
+  const cfg = effectiveConfig(opts.config);
   const now = Date.now();
   const missing: string[] = [];
   const out: Record<string, SlotResolution> = {};
   for (const k of slotKeys) {
-    const cacheKey = `${tenantCode ?? "_"}:${k}`;
+    const cacheKey = `${cfg.tenantCode ?? "_"}:${k}`;
     const hit = cache.get(cacheKey);
     if (hit && now - hit.fetchedAt < ttl) {
       out[k] = materializeResolution(hit.value, opts.preset);
@@ -183,10 +226,10 @@ export async function resolveSlots(
     }
   }
   if (missing.length > 0) {
-    const resolved = await fetchSlotsBulk(missing);
+    const resolved = await fetchSlotsBulk(missing, cfg);
     for (const k of missing) {
       const dto = resolved[k] ?? null;
-      cache.set(`${tenantCode ?? "_"}:${k}`, { fetchedAt: now, value: dto });
+      cache.set(`${cfg.tenantCode ?? "_"}:${k}`, { fetchedAt: now, value: dto });
       out[k] = materializeResolution(dto, opts.preset);
     }
   }

package/src/transform.ts

@@ -238,10 +238,21 @@ export function serializeTransform(
 ): string {
   const entries: Array<[string, string]> = [];
   const keys = Object.keys(opts).sort();
+  // DSL segments are joined with `,` and `/`; a value carrying either (or `=`,
+  // `%`, a space) breaks out of its segment and smuggles extra transform ops
+  // into the path (audit N17). Every legitimate DSL value is [a-z0-9._-] — reject
+  // anything else rather than emit it, keeping the canonical form byte-identical
+  // to what the server parses.
+  const VALUE_RE = /^[a-z0-9._-]+$/;
   for (const k of keys) {
     const v = (opts as Record<string, unknown>)[k];
     if (v == null) continue;
     const serialized = typeof v === "string" ? v.toLowerCase() : String(v);
+    if (!VALUE_RE.test(serialized)) {
+      throw new Error(
+        `invalid transform value for "${k}": ${JSON.stringify(serialized)} (only [a-z0-9._-] allowed)`,
+      );
+    }
     entries.push([k, serialized]);
   }
   return entries.map(([k, v]) => `${k}=${v}`).join(",");