@covia/covia-sdk 1.15.0 → 1.16.0

package/dist/index.d.mts

@@ -174,7 +174,9 @@ declare abstract class Asset {
      */
     getContent(): Promise<ReadableStream<Uint8Array> | null>;
     /**
-     * Get the URL for downloading asset content
+     * Get the URL for downloading asset content. Resolves any reference form
+     * this asset was addressed by, via the venue's canonical any-ref content
+     * route (covia#368).
      * @returns {string} The URL for downloading the asset content
      */
     getContentURL(): string;
@@ -523,8 +525,11 @@ declare class AssetManager {
      */
     putContent(assetId: string, content: BodyInit): Promise<ContentHashResult>;
     /**
-     * Get asset content
-     * @param assetId - Asset identifier
+     * Get asset content. Resolves any reference form the metadata endpoint
+     * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+     * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+     * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+     * @param assetId - Asset reference (any form)
      */
     getContent(assetId: string): Promise<ReadableStream<Uint8Array> | null>;
     /**

package/dist/index.d.ts

@@ -174,7 +174,9 @@ declare abstract class Asset {
      */
     getContent(): Promise<ReadableStream<Uint8Array> | null>;
     /**
-     * Get the URL for downloading asset content
+     * Get the URL for downloading asset content. Resolves any reference form
+     * this asset was addressed by, via the venue's canonical any-ref content
+     * route (covia#368).
      * @returns {string} The URL for downloading the asset content
      */
     getContentURL(): string;
@@ -523,8 +525,11 @@ declare class AssetManager {
      */
     putContent(assetId: string, content: BodyInit): Promise<ContentHashResult>;
     /**
-     * Get asset content
-     * @param assetId - Asset identifier
+     * Get asset content. Resolves any reference form the metadata endpoint
+     * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+     * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+     * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+     * @param assetId - Asset reference (any form)
      */
     getContent(assetId: string): Promise<ReadableStream<Uint8Array> | null>;
     /**

package/dist/index.js

@@ -1157,7 +1157,10 @@ function createEdDSAJWT(privateKey, lifetimeSeconds = 300, audience) {
     sub: did,
     iss: did,
     iat: nowSecs,
-    exp: nowSecs + lifetimeSeconds
+    // Floored defensively — lifetimeSeconds has no integer enforcement at
+    // the type level, and a float exp claim can fail JWT validation on
+    // servers that require a bare integer Unix timestamp (covia-sdk#46).
+    exp: Math.floor(nowSecs + lifetimeSeconds)
   };
   if (audience) claims.aud = audience;
   const payload = JSON.stringify(claims);
@@ -2262,11 +2265,13 @@ var Asset = class {
     return this._assets.getContent(this.id);
   }
   /**
-   * Get the URL for downloading asset content
+   * Get the URL for downloading asset content. Resolves any reference form
+   * this asset was addressed by, via the venue's canonical any-ref content
+   * route (covia#368).
    * @returns {string} The URL for downloading the asset content
    */
   getContentURL() {
-    return `${this.venue.baseUrl}/api/v1/assets/${this.id}/content`;
+    return `${this.venue.baseUrl}/api/v1/content/${this.id}`;
   }
   /**
    * Execute the operation and await its result.
@@ -2443,14 +2448,17 @@ var AssetManager = class {
     }
   }
   /**
-   * Get asset content
-   * @param assetId - Asset identifier
+   * Get asset content. Resolves any reference form the metadata endpoint
+   * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+   * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+   * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+   * @param assetId - Asset reference (any form)
    */
   async getContent(assetId) {
     try {
       const response = await venueStream(
         this.venue,
-        `/api/v1/assets/${assetId}/content`,
+        `/api/v1/content/${assetId}`,
         { contentType: null }
       );
       return response.body;
@@ -3516,7 +3524,12 @@ function createUCANJWT(privateKey, audienceDID, att, lifetimeSeconds, proofs = [
     ucv: UCV_VERSION,
     att,
     prf: proofs,
-    exp: lifetimeSeconds === null ? null : nowSecs + lifetimeSeconds
+    // Floored even though nowSecs already is: lifetimeSeconds is a public
+    // number param with no integer enforcement, and Convex's JSON reader
+    // only decodes a bare integer as CVMLong — a float exp (e.g. a caller
+    // passing Date.now()/1000 + n instead of an integer offset) becomes a
+    // CVMDouble the venue's UcanJwtValidator rejects outright (covia-sdk#46).
+    exp: lifetimeSeconds === null ? null : Math.floor(nowSecs + lifetimeSeconds)
   };
   const signingInput = `${base64UrlEncode(encoder2.encode(header))}.${base64UrlEncode(encoder2.encode(JSON.stringify(claims)))}`;
   const signature = sign(encoder2.encode(signingInput), privateKey);

package/dist/index.mjs

@@ -1155,7 +1155,10 @@ function createEdDSAJWT(privateKey, lifetimeSeconds = 300, audience) {
     sub: did,
     iss: did,
     iat: nowSecs,
-    exp: nowSecs + lifetimeSeconds
+    // Floored defensively — lifetimeSeconds has no integer enforcement at
+    // the type level, and a float exp claim can fail JWT validation on
+    // servers that require a bare integer Unix timestamp (covia-sdk#46).
+    exp: Math.floor(nowSecs + lifetimeSeconds)
   };
   if (audience) claims.aud = audience;
   const payload = JSON.stringify(claims);
@@ -2260,11 +2263,13 @@ var Asset = class {
     return this._assets.getContent(this.id);
   }
   /**
-   * Get the URL for downloading asset content
+   * Get the URL for downloading asset content. Resolves any reference form
+   * this asset was addressed by, via the venue's canonical any-ref content
+   * route (covia#368).
    * @returns {string} The URL for downloading the asset content
    */
   getContentURL() {
-    return `${this.venue.baseUrl}/api/v1/assets/${this.id}/content`;
+    return `${this.venue.baseUrl}/api/v1/content/${this.id}`;
   }
   /**
    * Execute the operation and await its result.
@@ -2441,14 +2446,17 @@ var AssetManager = class {
     }
   }
   /**
-   * Get asset content
-   * @param assetId - Asset identifier
+   * Get asset content. Resolves any reference form the metadata endpoint
+   * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+   * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+   * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+   * @param assetId - Asset reference (any form)
    */
   async getContent(assetId) {
     try {
       const response = await venueStream(
         this.venue,
-        `/api/v1/assets/${assetId}/content`,
+        `/api/v1/content/${assetId}`,
         { contentType: null }
       );
       return response.body;
@@ -3514,7 +3522,12 @@ function createUCANJWT(privateKey, audienceDID, att, lifetimeSeconds, proofs = [
     ucv: UCV_VERSION,
     att,
     prf: proofs,
-    exp: lifetimeSeconds === null ? null : nowSecs + lifetimeSeconds
+    // Floored even though nowSecs already is: lifetimeSeconds is a public
+    // number param with no integer enforcement, and Convex's JSON reader
+    // only decodes a bare integer as CVMLong — a float exp (e.g. a caller
+    // passing Date.now()/1000 + n instead of an integer offset) becomes a
+    // CVMDouble the venue's UcanJwtValidator rejects outright (covia-sdk#46).
+    exp: lifetimeSeconds === null ? null : Math.floor(nowSecs + lifetimeSeconds)
   };
   const signingInput = `${base64UrlEncode(encoder2.encode(header))}.${base64UrlEncode(encoder2.encode(JSON.stringify(claims)))}`;
   const signature = sign(encoder2.encode(signingInput), privateKey);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@covia/covia-sdk",
-  "version": "1.15.0",
+  "version": "1.16.0",
   "description": "Typescript library for covia-ai",
   "packageManager": "pnpm@11.9.0",
   "main": "./dist/index.js",