@nitida/sdk 0.36.1 → 0.36.2

package/dist/web.js

@@ -1,6 +1,5 @@
 // src/index.ts
 import {
-  configureSlotResolver,
   getAssetSrcSet,
   getAssetUrl,
   getHlsStreamingUrl,
@@ -119,13 +118,22 @@ var SlotsApi = class {
     this.opts = opts;
   }
   opts;
+  /** This client's own auth/endpoint scope, threaded into every resolve so it
+   *  never uses another client's key (audit N15). */
+  resolverConfig() {
+    return {
+      endpoint: this.opts.endpoint,
+      apiKey: this.opts.apiKey ?? null,
+      tenantCode: this.opts.tenantCode
+    };
+  }
   /** Resolve one slot — returns `{slot, preset, url}` or `{slot: null, url: null}` when unbound. */
   resolve(slotKey, options = {}) {
-    return resolveSlot(slotKey, options);
+    return resolveSlot(slotKey, { config: this.resolverConfig(), ...options });
   }
   /** Bulk-resolve N slots in one HTTP round-trip. */
   resolveMany(slotKeys, options = {}) {
-    return resolveSlots(slotKeys, options);
+    return resolveSlots(slotKeys, { config: this.resolverConfig(), ...options });
   }
   /** List slots for the tenant (admin). Optional prefix filter for tree views. */
   async list(opts = {}) {
@@ -217,7 +225,7 @@ var AssetsApi = class {
    */
   async byHash(sha256) {
     const r = await fetch(
-      endpointHref(this.opts, `/assets/by-hash/${sha256}`),
+      endpointHref(this.opts, `/assets/by-hash/${encodeURIComponent(sha256)}`),
       { headers: this.headers() }
     );
     if (r.status === 404) return null;
@@ -248,7 +256,7 @@ var AssetsApi = class {
   }
   /** Full DTO for an asset (admin view — includes audit-only fields). */
   async get(assetId) {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}`), {
       headers: this.headers()
     });
     if (!r.ok) throw new Error(`asset get ${r.status}: ${await r.text()}`);
@@ -260,7 +268,7 @@ var AssetsApi = class {
    * resolve to nothing.
    */
   async bindings(assetId) {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}/slots`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}/slots`), {
       headers: this.headers()
     });
     if (!r.ok) throw new Error(`asset bindings ${r.status}: ${await r.text()}`);
@@ -323,7 +331,7 @@ var AssetsApi = class {
    */
   async regenerate(assetId, opts = {}) {
     const r = await fetch(
-      endpointHref(this.opts, `/assets/${assetId}/regenerate`),
+      endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}/regenerate`),
       {
         method: "POST",
         headers: { ...this.headers(), "Content-Type": "application/json" },
@@ -336,7 +344,7 @@ var AssetsApi = class {
   }
   /** Merge metadata into an asset (role / slot / description / tags). */
   async patchMetadata(assetId, metadata) {
-    const r = await fetch(endpointHref(this.opts, `/assets/${assetId}`), {
+    const r = await fetch(endpointHref(this.opts, `/assets/${encodeURIComponent(assetId)}`), {
       method: "PATCH",
       headers: { ...this.headers(), "Content-Type": "application/json" },
       body: JSON.stringify({ metadata })
@@ -577,11 +585,6 @@ var NitidaClient = class {
     const cdn = opts.cdnBase ?? "https://8ok.uk";
     setCdnBase(cdn);
     setTenantId(opts.tenantId);
-    configureSlotResolver({
-      endpoint: opts.endpoint,
-      apiKey: opts.apiKey,
-      tenantCode: opts.tenantCode
-    });
     this.slots = new SlotsApi(opts);
     this.assets = new AssetsApi(opts);
     this.usage = new UsageApi(opts);
@@ -972,6 +975,13 @@ var NitidaClient = class {
 // src/web/index.ts
 var NitidaClient2 = class extends NitidaClient {
   constructor(opts) {
+    for (const k of ["apiKey", "signingKey"]) {
+      if (k in opts) {
+        throw new Error(
+          `@nitida/sdk/web: ${k} must never reach a browser bundle. Import @nitida/sdk/server on the server, and use a BFF route from the browser.`
+        );
+      }
+    }
     super(opts);
   }
 };