@nitida/asset-compressor-native 0.2.1 → 0.2.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Espacio Futuro LTD
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,7 +2,7 @@
 
 Fast, native (iOS + Android) image compression for React Native apps that
 upload to the [aquienpz](https://aquienpz.com) asset platform. Pairs with
-`@aquienpz/asset-uploader-expo` and mirrors the API of
+`@nitida/asset-uploader-expo` and mirrors the API of
 `@nitida/asset-compressor-web` so call sites are identical across
 platforms.
 

package/SECURITY.md

@@ -0,0 +1,56 @@
+# Security
+
+## Reporting a vulnerability
+
+Email **security@espaciofuturo.io**. Please do not open a public issue — a
+public report is a disclosure, and it reaches attackers at the same moment it
+reaches us.
+
+Include what you have: the affected package and version, what you did, and what
+happened. A URL that reproduces it is worth more than a paragraph describing
+one. We will confirm receipt and tell you what we found.
+
+## What is in scope
+
+The published client packages and the service they talk to:
+
+- `@nitida/sdk`, `@nitida/asset-client`
+- `@nitida/asset-compressor-web`, `@nitida/asset-compressor-native`
+- `@nitida/asset-uploader-web`, `@nitida/asset-uploader-expo`
+- the delivery edge (`8ok.uk`) and the API (`api.nitida.gofuture.space`)
+
+## Two behaviours that look like bugs and are not
+
+Reported often enough to state up front, so a real report is not lost among
+them:
+
+**A 404 on a private asset is the feature.** An asset with
+`visibility: "private"` answers 404 on every public URL — the raw path, every
+stored variant, every `/t/` transform and every HLS segment. It is not a
+missing file. Signed access lives at `/a/{tenant}/…?exp&sig`, minted on your
+backend. See the SDK's `getPrivateAssetUrl`.
+
+**A presigned upload URL is a bearer credential, on purpose.** The browser
+uploader persists presigned R2 PUT URLs in IndexedDB, because that is what
+resuming after a reload means. They are write-only, scoped to the parts of one
+upload the holder started, expire in 60 minutes, and are deleted on complete
+and on abort.
+
+## Credentials, and the one mistake that matters
+
+An API key (`amk_rt_*`, `amk_ad_*`, `amk_ci_*`) is a **server-side** credential.
+It must never reach a browser bundle, an `NEXT_PUBLIC_*` variable, or a mobile
+app binary.
+
+The same goes for a tenant's **URL signing key**: it mints signed URLs for
+every private asset that tenant owns. Sign on your backend, or pre-sign at
+build time.
+
+The client packages are built so this is hard to get wrong — the web entrypoint
+`@nitida/sdk/web` does not accept `apiKey` or `signingKey` at all; the types
+reject them. If you find a path that leaks either one, that is exactly the
+report we want.
+
+If you believe a key has been exposed, email the address above and we will
+rotate it. Rotating a signing key invalidates every URL already signed with it,
+so tell us whether you have signed URLs in circulation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitida/asset-compressor-native",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "nitida image compression for React Native and Expo. Same JS API as @nitida/asset-compressor-web, so call sites are identical across web and native.",
   "private": false,
   "publishConfig": {
@@ -13,7 +13,8 @@
     "directory": "packages/asset-compressor-native"
   },
   "homepage": "https://nitida.gofuture.space",
-  "license": "UNLICENSED",
+  "license": "MIT",
+  "author": "Espacio Futuro LTD (https://espaciofuturo.io)",
   "type": "module",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -27,6 +28,7 @@
     }
   },
   "files": [
+    "SECURITY.md",
     "dist/**",
     "src/**"
   ],

package/src/index.ts

@@ -1,6 +1,6 @@
 /**
  * @nitida/asset-compressor-native — React Native image compression for
- * the @aquienpz upload pipeline. Pairs with @aquienpz/asset-uploader-expo.
+ * the @aquienpz upload pipeline. Pairs with @nitida/asset-uploader-expo.
  *
  * Public API mirrors @nitida/asset-compressor-web so consumers can
  * write platform-agnostic code: