@nitida/sdk 0.36.0 → 0.36.2

package/README.md

@@ -69,7 +69,7 @@ slots and reads assets — your bundle stays a few KB.
 
 **Never ship the API key to the browser.** Whichever subpath you import,
 the long-lived `amk_rt_*` key lives on the server. Browser flows hit a BFF
-route that proxies to aquienpz with the real key.
+route that proxies to the nitida API with the real key.
 
 ## Which subpath do I import from?
 
@@ -128,11 +128,11 @@ loud — same pattern as `@vercel/blob/client`, `better-auth/client`, AI SDK's
 is `Omit<NitidaClientOptions, "apiKey" | "signingKey">`. Passing `apiKey`
 won't compile, period.
 
-## BFF-proxy mode (browser → your route → aquienpz)
+## BFF-proxy mode (browser → your route → nitida)
 
 Browser code constructs the client against a **relative endpoint** that
 points at your own route handler. The handler attaches the real bearer
-token and forwards to aquienpz. Same pattern Vercel Blob uses for
+token and forwards to the nitida API. Same pattern Vercel Blob uses for
 `@vercel/blob/client.upload`.
 
 ### Next.js — client component
@@ -206,7 +206,7 @@ import { NitidaClient } from "@nitida/sdk/web"; // same browser-safe type
 
 ### SSG storefront (build-time)
 
-Use `/server` at build time (Node/Bun) with the absolute aquienpz URL —
+Use `/server` at build time (Node/Bun) with the absolute nitida API URL —
 no proxy needed because keys never reach the browser bundle. Static
 HTML output references the CDN directly.
 
@@ -400,9 +400,16 @@ import {
   listResumableSessions,
 } from "@nitida/sdk/expo";
 
+// Background upload survival means a token DOES reach the native session — but
+// it must be a short-lived, per-user token your backend mints, NEVER a shared
+// platform amk_rt_* baked into the binary via EXPO_PUBLIC_* (that ships one write
+// key to the whole platform, readable by anyone who unzips the IPA/APK). Fetch it
+// at runtime from your own /session route and hand it to the client.
+const { uploadToken } = await fetch(`${API}/session/upload-token`).then((r) => r.json());
+
 const aq = new NitidaClient({
   endpoint:   process.env.EXPO_PUBLIC_AQUIENPZ_URL!,
-  apiKey:     process.env.EXPO_PUBLIC_AQUIENPZ_API_KEY!, // amk_rt_*
+  apiKey:     uploadToken, // short-lived, scoped, from YOUR backend — not EXPO_PUBLIC_*
   tenantCode: "your-tenant",
   tenantId:   42,
 });
@@ -503,10 +510,13 @@ each hook subscribes to the in-process cache.
 import { NitidaClient } from "@nitida/sdk";
 import { NitidaProvider } from "@nitida/sdk/react";
 
-// In production, get apiKey from a /session route instead of bundling it.
+// NO apiKey in the browser. Reads and URL building (useSlot, urlFor, srcSetFor)
+// need no credential; writes go through a BFF route that calls aq.upload()
+// server-side with the real amk_rt_* key (see the warning above). Shipping
+// NEXT_PUBLIC_AQUIENPZ_API_KEY inlines a shared platform write key into every
+// bundle — readable by any visitor.
 const client = new NitidaClient({
   endpoint:   process.env.NEXT_PUBLIC_AQUIENPZ_URL!,
-  apiKey:     process.env.NEXT_PUBLIC_AQUIENPZ_API_KEY!,
   tenantCode: "your-tenant",
   tenantId:   42,
 });
@@ -1059,8 +1069,8 @@ the same signature.
 `kid` names the key so a rotation does not kill URLs already in flight: the
 outgoing key keeps verifying for 14 days
 (`POST /admin/projects/:code/rotate-signing-key` returns the new key, its `kid`,
-and when the previous one retires). See
-[the rotation runbook](https://github.com/espaciofuturoio/aquienpz/blob/main/docs/RUNBOOKS/signing-key-rotation.md).
+and when the previous one retires). The rotation runbook lives in the private
+source repository — ask the platform owner if you need it.
 
 > ⚠️ **A signature does NOT widen the ladder.** Off-ladder widths are 400 at
 > the edge whether or not the URL is signed. Until `@nitida/asset-client`

package/dist/index.d.ts

@@ -145,6 +145,9 @@ type NitidaClientOptions = {
 declare class SlotsApi {
     private readonly opts;
     constructor(opts: NitidaClientOptions);
+    /** This client's own auth/endpoint scope, threaded into every resolve so it
+     *  never uses another client's key (audit N15). */
+    private resolverConfig;
     /** Resolve one slot — returns `{slot, preset, url}` or `{slot: null, url: null}` when unbound. */
     resolve(slotKey: string, options?: ResolveSlotOptions): Promise<SlotResolution>;
     /** Bulk-resolve N slots in one HTTP round-trip. */

package/dist/index.js

@@ -1,6 +1,5 @@
 // src/index.ts
 import {
-  configureSlotResolver,
   getAssetSrcSet,
   getAssetUrl,
   getHlsStreamingUrl,
@@ -119,13 +118,22 @@ var SlotsApi = class {
     this.opts = opts;
   }
   opts;
+  /** This client's own auth/endpoint scope, threaded into every resolve so it
+   *  never uses another client's key (audit N15). */
+  resolverConfig() {
+    return {
+      endpoint: this.opts.endpoint,
+      apiKey: this.opts.apiKey ?? null,
+      tenantCode: this.opts.tenantCode
+    };
+  }
   /** Resolve one slot — returns `{slot, preset, url}` or `{slot: null, url: null}` when unbound. */
   resolve(slotKey, options = {}) {
-    return resolveSlot(slotKey, options);
+    return resolveSlot(slotKey, { config: this.resolverConfig(), ...options });
   }
   /** Bulk-resolve N slots in one HTTP round-trip. */
   resolveMany(slotKeys, options = {}) {
-    return resolveSlots(slotKeys, options);
+    return resolveSlots(slotKeys, { config: this.resolverConfig(), ...options });
   }
   /** List slots for the tenant (admin). Optional prefix filter for tree views. */
   async list(opts = {}) {
@@ -217,7 +225,7 @@ var AssetsApi = class {
    */
   async byHash(sha256) {
     const r = await fetch(
-      endpointHref(this.opts, `/assets/by-hash/${sha256}`),
+      endpointHref(this.opts, `/assets/by-hash/${encodeURIComponent(sha256)}`),
       { headers: this.headers() }
     );
     if (r.status === 404) return null;
@@ -248,7 +256,7 @@ var AssetsApi = class {
   }
   /** Full DTO for an asset (admin view — includes audit-only fields). */
   async get(assetId) {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}`), {
       headers: this.headers()
     });
     if (!r.ok) throw new Error(`asset get ${r.status}: ${await r.text()}`);
@@ -260,7 +268,7 @@ var AssetsApi = class {
    * resolve to nothing.
    */
   async bindings(assetId) {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}/slots`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}/slots`), {
       headers: this.headers()
     });
     if (!r.ok) throw new Error(`asset bindings ${r.status}: ${await r.text()}`);
@@ -323,7 +331,7 @@ var AssetsApi = class {
    */
   async regenerate(assetId, opts = {}) {
     const r = await fetch(
-      endpointHref(this.opts, `/assets/${assetId}/regenerate`),
+      endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}/regenerate`),
       {
         method: "POST",
         headers: { ...this.headers(), "Content-Type": "application/json" },
@@ -336,7 +344,7 @@ var AssetsApi = class {
   }
   /** Merge metadata into an asset (role / slot / description / tags). */
   async patchMetadata(assetId, metadata) {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}`), {
       method: "PATCH",
       headers: { ...this.headers(), "Content-Type": "application/json" },
       body: JSON.stringify({ metadata })
@@ -577,11 +585,6 @@ var NitidaClient = class {
     const cdn = opts.cdnBase ?? "https://8ok.uk";
     setCdnBase(cdn);
     setTenantId(opts.tenantId);
-    configureSlotResolver({
-      endpoint: opts.endpoint,
-      apiKey: opts.apiKey,
-      tenantCode: opts.tenantCode
-    });
     this.slots = new SlotsApi(opts);
     this.assets = new AssetsApi(opts);
     this.usage = new UsageApi(opts);