@nitida/sdk 0.29.0 → 0.30.1

package/dist/web.js

@@ -772,7 +772,15 @@ var NitidaClient = class {
         assetId: existing.id,
         sha256: sha,
         sha: sha.slice(0, 16),
-        cdnUrl: this.urlFor(existing, this.bestPresetForAsset(existing, mime))
+        mime: existing.mime ?? mime,
+        oext: existing.oext ?? null,
+        // Same shape as the presign branch below, for the same reason. This
+        // DTO does carry `sha` today — but relying on that is how the other
+        // branch broke, and the value we hashed ourselves is authoritative.
+        cdnUrl: this.urlFor(
+          { ...existing, sha: sha.slice(0, 16) },
+          this.bestPresetForAsset(existing, mime)
+        )
       };
     }
     const presign = await this.assets.presignUploadUrl({
@@ -785,11 +793,38 @@ var NitidaClient = class {
       ...opts.video != null && { video: opts.video }
     });
     if (presign.deduped) {
+      const short = sha.slice(0, 16);
       return {
         assetId: presign.asset.id,
         sha256: sha,
-        sha: sha.slice(0, 16),
-        cdnUrl: this.urlFor(presign.asset, this.defaultPresetForMime(mime))
+        sha: short,
+        mime: presign.asset.mime ?? mime,
+        oext: presign.asset.oext ?? null,
+        // ⭐ `{ ...asset, sha: short }`, never `asset` alone.
+        //
+        // The presign route answers a dedup hit with `sha256` and NO `sha` —
+        // literally the shape `assertSha`'s message names. Handing it straight
+        // to a URL builder threw:
+        //
+        //   getAssetUrl: no usable `sha` … has `sha256` but not `sha` —
+        //   that is the shape `upload()` returns.
+        //
+        // …with `upload()` as BOTH the accuser and the caller. Found
+        // 2026-08-24 by neo's hourly canary, ~16 alerts deep. Before
+        // asset-client 0.18.1 the same line produced a `cdnUrl` with the word
+        // `undefined` inside it, silently; the guard did its job and made a
+        // latent defect loud.
+        //
+        // This branch is only reached when the asset EXISTS but is not
+        // `ready` — the `byHash` branch above returns first otherwise — so
+        // ordinary uploads never touched it and no test did either.
+        //
+        // The sha is not the DTO's to supply: we hashed the bytes ourselves at
+        // the top of this method. Build from what we KNOW.
+        cdnUrl: this.urlFor(
+          { ...presign.asset, sha: short },
+          this.defaultPresetForMime(mime)
+        )
       };
     }
     const putR = await fetch(presign.upload.url, {
@@ -832,6 +867,8 @@ var NitidaClient = class {
       assetId,
       sha256: sha,
       sha: sha.slice(0, 16),
+      mime: final.mime ?? mime,
+      oext: final.oext ?? null,
       cdnUrl: this.urlFor(final, this.bestPresetForAsset(final, mime))
     };
   }