@nitida/sdk 0.31.6 → 0.31.7

package/README.md

@@ -1403,6 +1403,43 @@ If you need a dimension that doesn't exist, two options: use the closest
 preset and let the browser scale, or file an issue to add it to the
 server-side pipeline (a platform-wide addition, not a per-tenant one).
 
+### ⭐ What happens when two tenants upload the SAME image
+
+Dedup is **content-addressed and cross-tenant**: the sha is a hash of the bytes,
+so if you and another customer upload the same logo, the same stock photo or the
+same placeholder, you share a candidate row. This is normal, not exotic.
+
+A `/t/…` transform URL names **content**, not a tenant — there is no tenant
+segment in it. Three consequences follow, and all three are measured behaviour:
+
+**1 · A signed transform is resolved by the SIGNATURE, not by tenant id.**
+The signature proves possession of one specific tenant's key, which is exactly
+the identity the URL lacks. Before `2026-08-25` the lowest tenant id won, so a
+correctly signed URL could be verified against someone else's key and answer
+`invalid_signature`. Nothing to do on your side — just know the signature is
+what disambiguates.
+
+**2 · `strict_transforms` fails CLOSED across every tenant that shares the sha.**
+If any tenant holding those bytes requires signed URLs, the unsigned request is
+refused — because an unsigned request cannot say which tenant it belongs to, and
+picking the most permissive one would let a third party defeat your policy.
+
+> ⚠️ The cost, stated plainly: if you do **not** use `strict_transforms` but you
+> share content with someone who does, that sha needs a signed URL from you too.
+> The alternative — failing open — means your own strict setting is silently
+> cancelled by a stranger. A 401 you fix by signing is the cheaper mistake.
+
+**3 · Making an asset private does NOT unpublish another tenant's public copy.**
+`visibility: "private"` retracts **your** row. If another tenant uploaded the
+same bytes and left them public, that copy keeps serving, and a `/t/` request
+resolves to it. No new information leaks — those exact bytes were already public
+— but do not read "private" as "these bytes are now unreachable". It means
+"reachable through me only by signature".
+
+> If that distinction matters for your content, the answer is not a flag: it is
+> not to share the bytes. Anything unique to you (a customer photo, a document,
+> a render) has a unique sha and never collides.
+
 ### CDN URL format
 
 `<cdnBase>/<tenantId base36>/v/<sha16>-<presetCode>.<ext>`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitida/sdk",
-  "version": "0.31.6",
+  "version": "0.31.7",
   "description": "nitida — the media SDK: browser and mobile upload with resume, client-side compression, on-the-fly transforms behind a CDN, video transcode, HLS ladders and AI proxies. Multi-tenant.",
   "private": false,
   "publishConfig": {

package/skills/nitida-sdk/SKILL.md

@@ -501,6 +501,31 @@ The progressive MP4 is capped unconditionally at 1920 wide, so `getAssetUrl(sha,
 never exceeds 1080p whatever you uploaded. A rung that weighs *more* than its own source (measured:
 5090 vs 4866 kbps) is the signature of the fallback path, not of a broken ladder.
 
+### 3c. ⭐ Dedup is CROSS-TENANT, and three things follow from it
+
+The sha hashes the **bytes**, so two customers who upload the same logo, stock
+photo or placeholder share a candidate row. A `/t/…` URL names content and
+carries **no tenant segment**. Measured behaviour as of 2026-08-25:
+
+| | |
+|---|---|
+| **signed** `/t/` | the **signature** picks the tenant — it proves possession of one key, which is the identity the URL lacks. (Before this, the lowest tenant id won and a valid signature could answer `invalid_signature`.) |
+| **`strict_transforms`** | fails **closed** across every tenant sharing that sha. If any of them requires signing, the unsigned request is refused. |
+| **`visibility: "private"`** | retracts **your** row only. Another tenant's public copy of the same bytes keeps serving, and `/t/` resolves to it. |
+
+⚠️ **Do not read `private` as "these bytes are unreachable".** It means
+"reachable through me only by signature". Nothing new leaks — those bytes were
+already public via the other tenant — but the promise is narrower than it looks.
+
+⚠️ And the cost of failing closed, stated plainly: a tenant that does **not**
+use `strict_transforms` but shares content with one that does will need signed
+URLs for that sha. Failing open would let a stranger cancel someone's policy;
+a 401 you fix by signing is the cheaper of the two mistakes.
+
+⭐ **Anything unique to you has a unique sha and never collides** — a customer
+photo, a document, a render. Collisions are for generic assets, which is exactly
+the content where sharing costs you nothing.
+
 ## 4. Resolving a stored reference — `extractAssetSha`
 
 When a stored value is already an `8ok.uk` URL, pull its sha: