@covia/covia-sdk 1.15.0 → 1.17.0

package/dist/index.d.mts

@@ -174,7 +174,9 @@ declare abstract class Asset {
      */
     getContent(): Promise<ReadableStream<Uint8Array> | null>;
     /**
-     * Get the URL for downloading asset content
+     * Get the URL for downloading asset content. Resolves any reference form
+     * this asset was addressed by, via the venue's canonical any-ref content
+     * route (covia#368).
      * @returns {string} The URL for downloading the asset content
      */
     getContentURL(): string;
@@ -523,8 +525,11 @@ declare class AssetManager {
      */
     putContent(assetId: string, content: BodyInit): Promise<ContentHashResult>;
     /**
-     * Get asset content
-     * @param assetId - Asset identifier
+     * Get asset content. Resolves any reference form the metadata endpoint
+     * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+     * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+     * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+     * @param assetId - Asset reference (any form)
      */
     getContent(assetId: string): Promise<ReadableStream<Uint8Array> | null>;
     /**
@@ -1152,7 +1157,31 @@ interface JobMetadata {
     updated?: string;
     input?: unknown;
     output?: unknown;
-    operation?: string;
+    /** The operation reference that was invoked, verbatim: a venue path
+     *  (`v/ops/json/merge`), a caller-namespace path (`o/my-tool`), a DID URL, or
+     *  a bare hash when the caller pinned a definition explicitly. An inline
+     *  definition has no reference, so its own metadata hash stands in. Records
+     *  written by venues before 0.9.9 always carry the resolved hash, so readers
+     *  must accept both forms (covia#499).
+     *
+     *  A path is a mutable binding: re-invoking this reference runs whatever
+     *  definition sits at that path now, which is not necessarily the one that
+     *  ran for this job. Invoke by hash when the record must pin the exact
+     *  definition.
+     *
+     *  Replaces the never-populated `operation` field — the venue has always
+     *  emitted this as `op`. */
+    op?: string;
+    /** Id (hex) of the nearest *recorded* job inside whose execution this job was
+     *  dispatched; absent on top-level jobs (covia#500). Transient wrappers never
+     *  appear in a record, so a recorded grandchild dispatched through a
+     *  transient layer links straight to its recorded ancestor.
+     *
+     *  Only the up-link is stored: there is no `root`, no children list and no
+     *  children query. Reconstruct a tree by tracing `parent` across the jobs you
+     *  hold. Links are venue- and user-local — a job run on another venue through
+     *  the grid adapter carries none. */
+    parent?: string;
     caller?: string;
     error?: string;
     [key: string]: unknown;

package/dist/index.d.ts

@@ -174,7 +174,9 @@ declare abstract class Asset {
      */
     getContent(): Promise<ReadableStream<Uint8Array> | null>;
     /**
-     * Get the URL for downloading asset content
+     * Get the URL for downloading asset content. Resolves any reference form
+     * this asset was addressed by, via the venue's canonical any-ref content
+     * route (covia#368).
      * @returns {string} The URL for downloading the asset content
      */
     getContentURL(): string;
@@ -523,8 +525,11 @@ declare class AssetManager {
      */
     putContent(assetId: string, content: BodyInit): Promise<ContentHashResult>;
     /**
-     * Get asset content
-     * @param assetId - Asset identifier
+     * Get asset content. Resolves any reference form the metadata endpoint
+     * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+     * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+     * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+     * @param assetId - Asset reference (any form)
      */
     getContent(assetId: string): Promise<ReadableStream<Uint8Array> | null>;
     /**
@@ -1152,7 +1157,31 @@ interface JobMetadata {
     updated?: string;
     input?: unknown;
     output?: unknown;
-    operation?: string;
+    /** The operation reference that was invoked, verbatim: a venue path
+     *  (`v/ops/json/merge`), a caller-namespace path (`o/my-tool`), a DID URL, or
+     *  a bare hash when the caller pinned a definition explicitly. An inline
+     *  definition has no reference, so its own metadata hash stands in. Records
+     *  written by venues before 0.9.9 always carry the resolved hash, so readers
+     *  must accept both forms (covia#499).
+     *
+     *  A path is a mutable binding: re-invoking this reference runs whatever
+     *  definition sits at that path now, which is not necessarily the one that
+     *  ran for this job. Invoke by hash when the record must pin the exact
+     *  definition.
+     *
+     *  Replaces the never-populated `operation` field — the venue has always
+     *  emitted this as `op`. */
+    op?: string;
+    /** Id (hex) of the nearest *recorded* job inside whose execution this job was
+     *  dispatched; absent on top-level jobs (covia#500). Transient wrappers never
+     *  appear in a record, so a recorded grandchild dispatched through a
+     *  transient layer links straight to its recorded ancestor.
+     *
+     *  Only the up-link is stored: there is no `root`, no children list and no
+     *  children query. Reconstruct a tree by tracing `parent` across the jobs you
+     *  hold. Links are venue- and user-local — a job run on another venue through
+     *  the grid adapter carries none. */
+    parent?: string;
     caller?: string;
     error?: string;
     [key: string]: unknown;

package/dist/index.js

@@ -1157,7 +1157,10 @@ function createEdDSAJWT(privateKey, lifetimeSeconds = 300, audience) {
     sub: did,
     iss: did,
     iat: nowSecs,
-    exp: nowSecs + lifetimeSeconds
+    // Floored defensively — lifetimeSeconds has no integer enforcement at
+    // the type level, and a float exp claim can fail JWT validation on
+    // servers that require a bare integer Unix timestamp (covia-sdk#46).
+    exp: Math.floor(nowSecs + lifetimeSeconds)
   };
   if (audience) claims.aud = audience;
   const payload = JSON.stringify(claims);
@@ -2262,11 +2265,13 @@ var Asset = class {
     return this._assets.getContent(this.id);
   }
   /**
-   * Get the URL for downloading asset content
+   * Get the URL for downloading asset content. Resolves any reference form
+   * this asset was addressed by, via the venue's canonical any-ref content
+   * route (covia#368).
    * @returns {string} The URL for downloading the asset content
    */
   getContentURL() {
-    return `${this.venue.baseUrl}/api/v1/assets/${this.id}/content`;
+    return `${this.venue.baseUrl}/api/v1/content/${this.id}`;
   }
   /**
    * Execute the operation and await its result.
@@ -2443,14 +2448,17 @@ var AssetManager = class {
     }
   }
   /**
-   * Get asset content
-   * @param assetId - Asset identifier
+   * Get asset content. Resolves any reference form the metadata endpoint
+   * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+   * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+   * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+   * @param assetId - Asset reference (any form)
    */
   async getContent(assetId) {
     try {
       const response = await venueStream(
         this.venue,
-        `/api/v1/assets/${assetId}/content`,
+        `/api/v1/content/${assetId}`,
         { contentType: null }
       );
       return response.body;
@@ -3516,7 +3524,12 @@ function createUCANJWT(privateKey, audienceDID, att, lifetimeSeconds, proofs = [
     ucv: UCV_VERSION,
     att,
     prf: proofs,
-    exp: lifetimeSeconds === null ? null : nowSecs + lifetimeSeconds
+    // Floored even though nowSecs already is: lifetimeSeconds is a public
+    // number param with no integer enforcement, and Convex's JSON reader
+    // only decodes a bare integer as CVMLong — a float exp (e.g. a caller
+    // passing Date.now()/1000 + n instead of an integer offset) becomes a
+    // CVMDouble the venue's UcanJwtValidator rejects outright (covia-sdk#46).
+    exp: lifetimeSeconds === null ? null : Math.floor(nowSecs + lifetimeSeconds)
   };
   const signingInput = `${base64UrlEncode(encoder2.encode(header))}.${base64UrlEncode(encoder2.encode(JSON.stringify(claims)))}`;
   const signature = sign(encoder2.encode(signingInput), privateKey);

package/dist/index.mjs

@@ -1155,7 +1155,10 @@ function createEdDSAJWT(privateKey, lifetimeSeconds = 300, audience) {
     sub: did,
     iss: did,
     iat: nowSecs,
-    exp: nowSecs + lifetimeSeconds
+    // Floored defensively — lifetimeSeconds has no integer enforcement at
+    // the type level, and a float exp claim can fail JWT validation on
+    // servers that require a bare integer Unix timestamp (covia-sdk#46).
+    exp: Math.floor(nowSecs + lifetimeSeconds)
   };
   if (audience) claims.aud = audience;
   const payload = JSON.stringify(claims);
@@ -2260,11 +2263,13 @@ var Asset = class {
     return this._assets.getContent(this.id);
   }
   /**
-   * Get the URL for downloading asset content
+   * Get the URL for downloading asset content. Resolves any reference form
+   * this asset was addressed by, via the venue's canonical any-ref content
+   * route (covia#368).
    * @returns {string} The URL for downloading the asset content
    */
   getContentURL() {
-    return `${this.venue.baseUrl}/api/v1/assets/${this.id}/content`;
+    return `${this.venue.baseUrl}/api/v1/content/${this.id}`;
   }
   /**
    * Execute the operation and await its result.
@@ -2441,14 +2446,17 @@ var AssetManager = class {
     }
   }
   /**
-   * Get asset content
-   * @param assetId - Asset identifier
+   * Get asset content. Resolves any reference form the metadata endpoint
+   * does — a bare hash, `a/<hash>`, a workspace/operation path, or a
+   * DID-qualified URL — via the venue's canonical `GET /api/v1/content/{ref}`
+   * (covia#368), not the hash-only legacy `assets/{id}/content` route.
+   * @param assetId - Asset reference (any form)
    */
   async getContent(assetId) {
     try {
       const response = await venueStream(
         this.venue,
-        `/api/v1/assets/${assetId}/content`,
+        `/api/v1/content/${assetId}`,
         { contentType: null }
       );
       return response.body;
@@ -3514,7 +3522,12 @@ function createUCANJWT(privateKey, audienceDID, att, lifetimeSeconds, proofs = [
     ucv: UCV_VERSION,
     att,
     prf: proofs,
-    exp: lifetimeSeconds === null ? null : nowSecs + lifetimeSeconds
+    // Floored even though nowSecs already is: lifetimeSeconds is a public
+    // number param with no integer enforcement, and Convex's JSON reader
+    // only decodes a bare integer as CVMLong — a float exp (e.g. a caller
+    // passing Date.now()/1000 + n instead of an integer offset) becomes a
+    // CVMDouble the venue's UcanJwtValidator rejects outright (covia-sdk#46).
+    exp: lifetimeSeconds === null ? null : Math.floor(nowSecs + lifetimeSeconds)
   };
   const signingInput = `${base64UrlEncode(encoder2.encode(header))}.${base64UrlEncode(encoder2.encode(JSON.stringify(claims)))}`;
   const signature = sign(encoder2.encode(signingInput), privateKey);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@covia/covia-sdk",
-  "version": "1.15.0",
+  "version": "1.17.0",
   "description": "Typescript library for covia-ai",
   "packageManager": "pnpm@11.9.0",
   "main": "./dist/index.js",