@nitida/sdk 0.36.0 → 0.36.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nitida/sdk",
-  "version": "0.36.0",
+  "version": "0.36.2",
   "description": "nitida — the media SDK: browser and mobile upload with resume, client-side compression, on-the-fly transforms behind a CDN, video transcode, HLS ladders and AI proxies. Multi-tenant.",
   "private": false,
   "publishConfig": {
@@ -93,7 +93,7 @@
     "@types/bun": "^1.3.14",
     "react": "^19.2.6",
     "tsup": "^8.5.1",
-    "typescript": "^6.0.3",
+    "typescript": "npm:@typescript/typescript6@6.0.2",
     "@nitida/asset-client": "workspace:*",
     "@nitida/asset-compressor-web": "workspace:*",
     "@nitida/asset-compressor-native": "workspace:*",

package/skills/nitida-sdk/SKILL.md

@@ -190,11 +190,24 @@ everyone, and the ladder buys you nothing.
 
 > Full measurements, with the method: <https://nitida.gofuture.space/guides/transform-benchmark/>
 
-`/t/` short-circuits to the smallest **stored variant** that covers the request
-— and that variant is already a WebP
-that went through one lossy pass. **The short-circuit only fires when the
-request carries an explicit numeric `quality`**, so **passing any explicit numeric `quality` at all** is
-exactly what turns it on.
+`/t/` can short-circuit to the smallest **stored variant** that covers the request
+— and that variant is already a WebP that went through one lossy pass.
+
+🔴 **Until 2026-08-31 that shortcut fired on `typeof quality === "number"`**, so
+the parameter named "quality" was the one that chose WHICH BYTES to decode, and
+pinning it *lowered* quality. **That is fixed at the server.** `quality` now only
+sets the encoder; the cheap source has to be asked for by name, `source=nearest`
+(default `master`), and a bogus value is a 400.
+
+Verified against production the day it shipped, same asset, cold DSLs:
+`quality=61` → `x-transform-source: lg` before · `quality=62` → `original` after ·
+`quality=64,source=nearest` → `lg`, deliberately.
+
+⇒ **You cannot trigger a second lossy pass by accident any more.** The numbers
+below are the honest cost of one, i.e. what `source=nearest` buys today. And
+`source` is deliberately NOT in `TransformOptions`: the only legitimate consumer
+is a bulk pipeline that hand-builds URLs, and keeping it off the typed surface is
+what stops an ordinary caller from landing there.
 
 Measured at `width=800` on five photographs, same photo uploaded twice (full
 ladder vs `["original"]` only):

package/src/index.ts

@@ -309,12 +309,22 @@ export {
 class SlotsApi {
   constructor(private readonly opts: NitidaClientOptions) {}
 
+  /** This client's own auth/endpoint scope, threaded into every resolve so it
+   *  never uses another client's key (audit N15). */
+  private resolverConfig() {
+    return {
+      endpoint: this.opts.endpoint,
+      apiKey: this.opts.apiKey ?? null,
+      tenantCode: this.opts.tenantCode,
+    };
+  }
+
   /** Resolve one slot — returns `{slot, preset, url}` or `{slot: null, url: null}` when unbound. */
   resolve(
     slotKey: string,
     options: ResolveSlotOptions = {},
   ): Promise<SlotResolution> {
-    return resolveSlot(slotKey, options);
+    return resolveSlot(slotKey, { config: this.resolverConfig(), ...options });
   }
 
   /** Bulk-resolve N slots in one HTTP round-trip. */
@@ -322,7 +332,7 @@ class SlotsApi {
     slotKeys: string[],
     options: ResolveSlotOptions = {},
   ): Promise<Record<string, SlotResolution>> {
-    return resolveSlots(slotKeys, options);
+    return resolveSlots(slotKeys, { config: this.resolverConfig(), ...options });
   }
 
   /** List slots for the tenant (admin). Optional prefix filter for tree views. */
@@ -570,7 +580,7 @@ class AssetsApi {
    */
   async byHash(sha256: string): Promise<AssetDTO | null> {
     const r = await fetch(
-      endpointHref(this.opts, `/assets/by-hash/${sha256}`),
+      endpointHref(this.opts, `/assets/by-hash/${encodeURIComponent(sha256)}`),
       { headers: this.headers() },
     );
     if (r.status === 404) return null;
@@ -614,7 +624,7 @@ class AssetsApi {
 
   /** Full DTO for an asset (admin view — includes audit-only fields). */
   async get(assetId: string): Promise<AssetDTO & Record<string, unknown>> {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}`), {
       headers: this.headers(),
     });
     if (!r.ok) throw new Error(`asset get ${r.status}: ${await r.text()}`);
@@ -635,7 +645,7 @@ class AssetsApi {
       updatedBy: string | null;
     }>
   > {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}/slots`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}/slots`), {
       headers: this.headers(),
     });
     if (!r.ok) throw new Error(`asset bindings ${r.status}: ${await r.text()}`);
@@ -713,7 +723,7 @@ class AssetsApi {
     opts: { presets?: RequestablePreset[] } = {},
   ): Promise<RegenerateResult> {
     const r = await fetch(
-      endpointHref(this.opts, `/assets/${assetId}/regenerate`),
+      endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}/regenerate`),
       {
         method: "POST",
         headers: { ...this.headers(), "Content-Type": "application/json" },
@@ -730,7 +740,7 @@ class AssetsApi {
     assetId: string,
     metadata: Record<string, unknown>,
   ): Promise<{ ok: true; metadata: Record<string, unknown> }> {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}`), {
       method: "PATCH",
       headers: { ...this.headers(), "Content-Type": "application/json" },
       body: JSON.stringify({ metadata }),
@@ -1434,11 +1444,12 @@ export class NitidaClient {
     // (`getAssetUrl`, `urlFor`, `srcSetFor`, upload `cdnUrl`) emits the
     // tenant-prefixed path `<cdn>/<tid b36>/v/<sha>-<preset>.<ext>`.
     setTenantId(opts.tenantId);
-    configureSlotResolver({
-      endpoint: opts.endpoint,
-      apiKey: opts.apiKey,
-      tenantCode: opts.tenantCode,
-    });
+    // NOTE: do NOT configure the process-global slot resolver here. A second
+    // client for another tenant would overwrite the first client's apiKey /
+    // tenantCode and make its slots.resolve() read cross-tenant (audit N15).
+    // Slot scope is threaded per-client via SlotsApi.resolve → resolveSlot({config}).
+    // `configureSlotResolver` stays exported for standalone resolveSlot() users
+    // (a browser/edge that boots one resolver).
     this.slots = new SlotsApi(opts);
     this.assets = new AssetsApi(opts);
     this.usage = new UsageApi(opts);

package/src/web/index.ts

@@ -84,6 +84,16 @@ export type WebClientOptions = Omit<
  */
 export class NitidaClient extends BaseNitidaClient {
   constructor(opts: WebClientOptions) {
+    // "Keys can't reach a browser" was a TYPESCRIPT-only property: WebClientOptions
+    // omits apiKey/signingKey, but a JS consumer (or `as any`) could still pass them
+    // and this bundle would use them (audit N14). Refuse at runtime too.
+    for (const k of ["apiKey", "signingKey"] as const) {
+      if (k in (opts as object)) {
+        throw new Error(
+          `@nitida/sdk/web: ${k} must never reach a browser bundle. Import @nitida/sdk/server on the server, and use a BFF route from the browser.`,
+        );
+      }
+    }
     super(opts as NitidaClientOptions);
   }
 }