@gr4vy/sdk 1.10.17 → 2.0.0

package/jsr.json

@@ -2,7 +2,7 @@
 
 {
   "name": "@gr4vy/sdk",
-  "version": "1.10.17",
+  "version": "2.0.0",
   "exports": {
     ".": "./src/index.ts",    
     "./models/errors": "./src/models/errors/index.ts",    

package/lib/config.d.ts

@@ -44,8 +44,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "1.0.0";
-    readonly sdkVersion: "1.10.17";
-    readonly genVersion: "2.856.1";
-    readonly userAgent: "speakeasy-sdk/typescript 1.10.17 2.856.1 1.0.0 @gr4vy/sdk";
+    readonly sdkVersion: "2.0.0";
+    readonly genVersion: "2.858.2";
+    readonly userAgent: "speakeasy-sdk/typescript 2.0.0 2.858.2 1.0.0 @gr4vy/sdk";
 };
 //# sourceMappingURL=config.d.ts.map

package/lib/config.js

@@ -37,8 +37,8 @@ function serverURLFromOptions(options) {
 exports.SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1.0.0",
-    sdkVersion: "1.10.17",
-    genVersion: "2.856.1",
-    userAgent: "speakeasy-sdk/typescript 1.10.17 2.856.1 1.0.0 @gr4vy/sdk",
+    sdkVersion: "2.0.0",
+    genVersion: "2.858.2",
+    userAgent: "speakeasy-sdk/typescript 2.0.0 2.858.2 1.0.0 @gr4vy/sdk",
 };
 //# sourceMappingURL=config.js.map

package/lib/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/lib/config.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAkDH,oDAsBC;AAnED,qCAA8C;AAEjC,QAAA,aAAa,GAAG,SAAS,CAAC;AAC1B,QAAA,gBAAgB,GAAG,YAAY,CAAC;AAC7C;;GAEG;AACU,QAAA,UAAU,GAAG;IACxB,CAAC,qBAAa,CAAC,EAAE,oCAAoC;IACrD,CAAC,wBAAgB,CAAC,EAAE,4BAA4B;CACxC,CAAC;AAmCX,SAAgB,oBAAoB,CAAC,OAAmB;IACtD,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAElC,MAAM,YAAY,GAA2B;QAC3C,SAAS,EAAE;YACT,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;SAC9B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,GAAW,EAAE,CAAC;IAExB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,qBAAa,CAAC;QAC/C,SAAS,GAAG,kBAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,GAAG,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAEY,QAAA,YAAY,GAAG;IAC1B,QAAQ,EAAE,YAAY;IACtB,iBAAiB,EAAE,OAAO;IAC1B,UAAU,EAAE,SAAS;IACrB,UAAU,EAAE,SAAS;IACrB,SAAS,EAAE,2DAA2D;CAC9D,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/lib/config.ts"],"names":[],"mappings":";AAAA;;GAEG;;;AAkDH,oDAsBC;AAnED,qCAA8C;AAEjC,QAAA,aAAa,GAAG,SAAS,CAAC;AAC1B,QAAA,gBAAgB,GAAG,YAAY,CAAC;AAC7C;;GAEG;AACU,QAAA,UAAU,GAAG;IACxB,CAAC,qBAAa,CAAC,EAAE,oCAAoC;IACrD,CAAC,wBAAgB,CAAC,EAAE,4BAA4B;CACxC,CAAC;AAmCX,SAAgB,oBAAoB,CAAC,OAAmB;IACtD,IAAI,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IAElC,MAAM,YAAY,GAA2B;QAC3C,SAAS,EAAE;YACT,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;SAC9B;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,OAAO,CAAC,EAAE,IAAI,SAAS;SAC9B;KACF,CAAC;IAEF,IAAI,MAAM,GAAW,EAAE,CAAC;IAExB,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,qBAAa,CAAC;QAC/C,SAAS,GAAG,kBAAU,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,CAAC,GAAG,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC;IACxC,OAAO,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAEY,QAAA,YAAY,GAAG;IAC1B,QAAQ,EAAE,YAAY;IACtB,iBAAiB,EAAE,OAAO;IAC1B,UAAU,EAAE,OAAO;IACnB,UAAU,EAAE,SAAS;IACrB,SAAS,EAAE,yDAAyD;CAC5D,CAAC"}

package/lib/helpers.d.ts

@@ -1,12 +1,29 @@
 /**
- * Attempts to detect the JS runtime and its version based on available globals.
+ * Best-effort runtime identification used for SDK metadata/user-agent strings.
+ *
+ * The function prefers browser-style detection via `navigator.userAgent` and
+ * falls back to Node.js `process.version` when available.
+ *
+ * @returns A runtime identifier string, or `"<unknown-runtime>"` when not detectable.
  */
 export declare function getRuntime(): string;
 /**
- * Calculate the Key ID
+ * Derives JWT `kid` from a private key using an RFC 7638 JWK thumbprint.
+ *
+ * Expected key format:
+ * - PKCS#8 PEM-encoded private key
+ * - EC P-521 curve (matches ES512 signing)
+ *
+ * Steps:
+ * 1. Decode PEM to PKCS#8 DER bytes.
+ * 2. Import key through Web Crypto.
+ * 3. Export as JWK and validate required fields.
+ * 4. Hash the canonical RFC 7638 thumbprint input with SHA-256.
+ * 5. Return base64url encoded digest.
+ *
+ * @param privateKey PEM-encoded PKCS#8 EC private key.
+ * @returns The base64url-encoded JWK thumbprint used as JWT `kid`.
+ * @throws If key parsing/import/export/validation/digest fails.
  */
 export declare function getKeyId(privateKey: string): Promise<string>;
-export declare function stripUndefined<T extends {}>(obj: T): {
-    [K in keyof T]?: Exclude<T[K], undefined>;
-};
 //# sourceMappingURL=helpers.d.ts.map

package/lib/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../src/lib/helpers.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,wBAAgB,UAAU,WAsBzB;AAED;;GAEG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAalE;AAED,wBAAgB,cAAc,CAAC,CAAC,SAAS,EAAE,EACzC,GAAG,EAAE,CAAC,GACL;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC;CAAE,CAa/C"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../src/lib/helpers.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,wBAAgB,UAAU,WAsBzB;AAyDD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAkElE"}

package/lib/helpers.js

@@ -1,15 +1,15 @@
 "use strict";
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getRuntime = getRuntime;
 exports.getKeyId = getKeyId;
-exports.stripUndefined = stripUndefined;
-const keyto_1 = __importDefault(require("@trust/keyto"));
-const jwk_thumbprint_1 = require("jwk-thumbprint");
+const base64_1 = require("./base64");
 /**
- * Attempts to detect the JS runtime and its version based on available globals.
+ * Best-effort runtime identification used for SDK metadata/user-agent strings.
+ *
+ * The function prefers browser-style detection via `navigator.userAgent` and
+ * falls back to Node.js `process.version` when available.
+ *
+ * @returns A runtime identifier string, or `"<unknown-runtime>"` when not detectable.
  */
 function getRuntime() {
     if (typeof navigator !== "undefined" &&
@@ -28,26 +28,115 @@ function getRuntime() {
     }
     return "<unknown-runtime>";
 }
+let cachedWebCrypto;
 /**
- * Calculate the Key ID
+ * Resolves a Web Crypto implementation across supported runtimes.
+ *
+ * Resolution order:
+ * 1. `globalThis.crypto` when already exposed by the runtime.
+ * 2. Node.js fallback via `node:crypto`.webcrypto (important for some Node 18 setups).
+ *
+ * @returns A Web Crypto compatible `Crypto` object with `subtle` APIs.
+ * @throws If no Web Crypto implementation is available.
  */
-async function getKeyId(privateKey) {
-    const jwk = keyto_1.default.from(privateKey, "pem").toJwk("private");
-    const keyid = (0, jwk_thumbprint_1.jwkThumbprintByEncoding)(stripUndefined(jwk), "SHA-256", "base64url");
-    if (keyid == null) {
-        throw new Error("Failed to generate jwk thumbprint");
+async function resolveWebCrypto() {
+    // Browsers, Bun, Deno, and many Node setups expose crypto globally.
+    if (globalThis.crypto?.subtle != null) {
+        return globalThis.crypto;
+    }
+    // Reuse the resolved Node fallback to avoid repeated dynamic imports.
+    if (cachedWebCrypto != null) {
+        return cachedWebCrypto;
     }
-    return keyid;
+    const gt = globalThis;
+    const isNodeRuntime = typeof gt === "object" &&
+        gt != null &&
+        "process" in gt &&
+        typeof gt.process === "object" &&
+        gt.process != null &&
+        "versions" in gt.process &&
+        typeof gt.process.versions === "object" &&
+        gt.process.versions != null &&
+        "node" in gt.process.versions;
+    // Avoid attempting to resolve `node:crypto` in non-Node runtimes.
+    if (isNodeRuntime) {
+        try {
+            // Keep the specifier non-literal to avoid eager bundler resolution.
+            const nodeCryptoSpecifier = `node${":"}crypto`;
+            const nodeCrypto = await import(nodeCryptoSpecifier);
+            if (nodeCrypto.webcrypto?.subtle != null) {
+                cachedWebCrypto = nodeCrypto.webcrypto;
+                return cachedWebCrypto;
+            }
+        }
+        catch {
+            // Intentionally ignored. We'll throw a descriptive error below.
+        }
+    }
+    throw new Error("Web Crypto API is unavailable. Expected globalThis.crypto.subtle or Node's crypto.webcrypto.");
 }
-function stripUndefined(obj) {
-    const newObj = {};
-    const target = newObj;
-    for (const entry of Object.entries(obj)) {
-        const [key, value] = entry;
-        if (typeof value !== "undefined") {
-            target[key] = value;
+/**
+ * Derives JWT `kid` from a private key using an RFC 7638 JWK thumbprint.
+ *
+ * Expected key format:
+ * - PKCS#8 PEM-encoded private key
+ * - EC P-521 curve (matches ES512 signing)
+ *
+ * Steps:
+ * 1. Decode PEM to PKCS#8 DER bytes.
+ * 2. Import key through Web Crypto.
+ * 3. Export as JWK and validate required fields.
+ * 4. Hash the canonical RFC 7638 thumbprint input with SHA-256.
+ * 5. Return base64url encoded digest.
+ *
+ * @param privateKey PEM-encoded PKCS#8 EC private key.
+ * @returns The base64url-encoded JWK thumbprint used as JWT `kid`.
+ * @throws If key parsing/import/export/validation/digest fails.
+ */
+async function getKeyId(privateKey) {
+    try {
+        const runtimeCrypto = await resolveWebCrypto();
+        // Parse PEM to DER binary
+        const pemBody = privateKey
+            .replace(/-----BEGIN PRIVATE KEY-----/, "")
+            .replace(/-----END PRIVATE KEY-----/, "")
+            .replace(/\s/g, "");
+        const der = (0, base64_1.bytesFromBase64)(pemBody);
+        // Import as extractable CryptoKey (ES512 = P-521)
+        const key = await runtimeCrypto.subtle.importKey("pkcs8", der, { name: "ECDSA", namedCurve: "P-521" }, true, ["sign"]);
+        // Export as JWK and validate fields required to build an RFC 7638 thumbprint.
+        const jwk = await runtimeCrypto.subtle.exportKey("jwk", key);
+        const requiredFields = ["kty", "crv", "x", "y"];
+        const invalidFields = requiredFields.filter((field) => {
+            const value = jwk[field];
+            return typeof value !== "string" || value.length === 0;
+        });
+        if (invalidFields.length > 0) {
+            throw new Error(`Exported JWK is missing required string field(s): ${invalidFields.join(", ")}`);
+        }
+        if (jwk.kty !== "EC" || jwk.crv !== "P-521") {
+            throw new Error("Imported key is not an EC P-521 private key");
         }
+        // RFC 7638 canonical member set for EC keys: crv, kty, x, y.
+        const input = JSON.stringify({
+            crv: jwk.crv,
+            kty: jwk.kty,
+            x: jwk.x,
+            y: jwk.y,
+        });
+        const hash = await runtimeCrypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+        // Base64url encode
+        return btoa(String.fromCharCode(...new Uint8Array(hash)))
+            .replace(/\+/g, "-")
+            .replace(/\//g, "_")
+            .replace(/=+$/, "");
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.message
+            ? ` Reason: ${error.message}`
+            : "";
+        throw new Error("Failed to derive JWT key ID from private key. Expected a PKCS#8 PEM-encoded EC private key on curve P-521 (ES512)." +
+            reason);
     }
-    return newObj;
 }
 //# sourceMappingURL=helpers.js.map

package/lib/helpers.js.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/lib/helpers.ts"],"names":[],"mappings":";;;;;AAMA,gCAsBC;AAKD,4BAaC;AAED,wCAeC;AA/DD,yDAAiC;AACjC,mDAAyD;AAEzD;;GAEG;AACH,SAAgB,UAAU;IACxB,IACE,OAAO,SAAS,KAAK,WAAW;QAChC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,EACvC,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,GAAY,UAAU,CAAC;IAC/B,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,IAAI,IAAI;QACV,SAAS,IAAI,EAAE;QACf,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ;QAC9B,EAAE,CAAC,OAAO,IAAI,IAAI;QAClB,SAAS,IAAI,EAAE,CAAC,OAAO;QACvB,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,EACtC,CAAC;QACD,OAAO,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED;;GAEG;AACI,KAAK,UAAU,QAAQ,CAAC,UAAkB;IAC/C,MAAM,GAAG,GAAG,eAAK,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,IAAA,wCAAuB,EACnC,cAAc,CAAC,GAAG,CAAC,EACnB,SAAS,EACT,WAAW,CACZ,CAAC;IACF,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,cAAc,CAC5B,GAAM;IAEN,MAAM,MAAM,GAAkD,EAAE,CAAC;IACjE,MAAM,MAAM,GAA4B,MAAM,CAAC;IAE/C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC;QAE3B,IAAI,OAAO,KAAK,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../src/lib/helpers.ts"],"names":[],"mappings":";;AAUA,gCAsBC;AA2ED,4BAkEC;AA7KD,qCAA2C;AAE3C;;;;;;;GAOG;AACH,SAAgB,UAAU;IACxB,IACE,OAAO,SAAS,KAAK,WAAW;QAChC,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,EACvC,CAAC;QACD,OAAO,SAAS,CAAC,SAAS,CAAC;IAC7B,CAAC;IAED,MAAM,EAAE,GAAY,UAAU,CAAC;IAC/B,IACE,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,IAAI,IAAI;QACV,SAAS,IAAI,EAAE;QACf,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ;QAC9B,EAAE,CAAC,OAAO,IAAI,IAAI;QAClB,SAAS,IAAI,EAAE,CAAC,OAAO;QACvB,OAAO,EAAE,CAAC,OAAO,CAAC,OAAO,KAAK,QAAQ,EACtC,CAAC;QACD,OAAO,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IACzC,CAAC;IAED,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,IAAI,eAAmC,CAAC;AAExC;;;;;;;;;GASG;AACH,KAAK,UAAU,gBAAgB;IAC7B,oEAAoE;IACpE,IAAI,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,MAAM,CAAC;IAC3B,CAAC;IAED,sEAAsE;IACtE,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,EAAE,GAAY,UAAU,CAAC;IAC/B,MAAM,aAAa,GACjB,OAAO,EAAE,KAAK,QAAQ;QACtB,EAAE,IAAI,IAAI;QACV,SAAS,IAAI,EAAE;QACf,OAAO,EAAE,CAAC,OAAO,KAAK,QAAQ;QAC9B,EAAE,CAAC,OAAO,IAAI,IAAI;QAClB,UAAU,IAAI,EAAE,CAAC,OAAO;QACxB,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;QACvC,EAAE,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI;QAC3B,MAAM,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAEhC,kEAAkE;IAClE,IAAI,aAAa,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,oEAAoE;YACpE,MAAM,mBAAmB,GAAG,OAAO,GAAG,QAAQ,CAAC;YAC/C,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACrD,IAAI,UAAU,CAAC,SAAS,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;gBACzC,eAAe,GAAG,UAAU,CAAC,SAA8B,CAAC;gBAC5D,OAAO,eAAe,CAAC;YACzB,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACI,KAAK,UAAU,QAAQ,CAAC,UAAkB;IAC/C,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,gBAAgB,EAAE,CAAC;QAE/C,0BAA0B;QAC1B,MAAM,OAAO,GAAG,UAAU;aACvB,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC;aAC1C,OAAO,CAAC,2BAA2B,EAAE,EAAE,CAAC;aACxC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtB,MAAM,GAAG,GAAG,IAAA,wBAAe,EAAC,OAAO,CAAC,CAAC;QAErC,kDAAkD;QAClD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,SAAS,CAC9C,OAAO,EACP,GAAG,EACH,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,EACtC,IAAI,EACJ,CAAC,MAAM,CAAC,CACT,CAAC;QAEF,8EAA8E;QAC9E,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC7D,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAU,CAAC;QACzD,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;YACpD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;YACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CACb,qDAAqD,aAAa,CAAC,IAAI,CACrE,IAAI,CACL,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,GAAG,CAAC,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,6DAA6D;QAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,CAAC,EAAE,GAAG,CAAC,CAAC;YACR,CAAC,EAAE,GAAG,CAAC,CAAC;SACT,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,MAAM,CAC5C,SAAS,EACT,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAC;QAEF,mBAAmB;QACnB,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;aACtD,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;aACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GACV,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO;YACrC,CAAC,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE;YAC7B,CAAC,CAAC,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,oHAAoH;YAClH,MAAM,CACT,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gr4vy/sdk",
-  "version": "1.10.17",
+  "version": "2.0.0",
   "author": "Gr4vy",
   "main": "./index.js",
   "sideEffects": false,
@@ -19,7 +19,6 @@
   "devDependencies": {
     "@eslint/js": "^9.26.0",
     "@types/jsonwebtoken": "^9.0.10",
-    "@types/trust__keyto": "^1.0.4",
     "@types/uuid": "^11.0.0",
     "eslint": "^9.26.0",
     "globals": "^15.14.0",
@@ -29,9 +28,7 @@
     "vitest": "^4.0.3"
   },
   "dependencies": {
-    "@trust/keyto": "^1.0.1",
     "jsonwebtoken": "^9.0.3",
-    "jwk-thumbprint": "^0.1.4",
     "snakecase-keys": "^6.0.0",
     "uuid": "^11.1.0",
     "zod": "^3.25.0 || ^4.0.0"

package/src/lib/config.ts

@@ -77,7 +77,7 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "1.0.0",
-  sdkVersion: "1.10.17",
-  genVersion: "2.856.1",
-  userAgent: "speakeasy-sdk/typescript 1.10.17 2.856.1 1.0.0 @gr4vy/sdk",
+  sdkVersion: "2.0.0",
+  genVersion: "2.858.2",
+  userAgent: "speakeasy-sdk/typescript 2.0.0 2.858.2 1.0.0 @gr4vy/sdk",
 } as const;

package/src/lib/helpers.ts

@@ -1,8 +1,12 @@
-import keyto from "@trust/keyto";
-import { jwkThumbprintByEncoding } from "jwk-thumbprint";
+import { bytesFromBase64 } from "./base64";
 
 /**
- * Attempts to detect the JS runtime and its version based on available globals.
+ * Best-effort runtime identification used for SDK metadata/user-agent strings.
+ *
+ * The function prefers browser-style detection via `navigator.userAgent` and
+ * falls back to Node.js `process.version` when available.
+ *
+ * @returns A runtime identifier string, or `"<unknown-runtime>"` when not detectable.
  */
 export function getRuntime() {
   if (
@@ -28,37 +32,143 @@ export function getRuntime() {
   return "<unknown-runtime>";
 }
 
+let cachedWebCrypto: Crypto | undefined;
+
 /**
- * Calculate the Key ID
+ * Resolves a Web Crypto implementation across supported runtimes.
+ *
+ * Resolution order:
+ * 1. `globalThis.crypto` when already exposed by the runtime.
+ * 2. Node.js fallback via `node:crypto`.webcrypto (important for some Node 18 setups).
+ *
+ * @returns A Web Crypto compatible `Crypto` object with `subtle` APIs.
+ * @throws If no Web Crypto implementation is available.
  */
-export async function getKeyId(privateKey: string): Promise<string> {
-  const jwk = keyto.from(privateKey, "pem").toJwk("private");
+async function resolveWebCrypto(): Promise<Crypto> {
+  // Browsers, Bun, Deno, and many Node setups expose crypto globally.
+  if (globalThis.crypto?.subtle != null) {
+    return globalThis.crypto;
+  }
 
-  const keyid = jwkThumbprintByEncoding(
-    stripUndefined(jwk),
-    "SHA-256",
-    "base64url"
-  );
-  if (keyid == null) {
-    throw new Error("Failed to generate jwk thumbprint");
+  // Reuse the resolved Node fallback to avoid repeated dynamic imports.
+  if (cachedWebCrypto != null) {
+    return cachedWebCrypto;
+  }
+
+  const gt: unknown = globalThis;
+  const isNodeRuntime =
+    typeof gt === "object" &&
+    gt != null &&
+    "process" in gt &&
+    typeof gt.process === "object" &&
+    gt.process != null &&
+    "versions" in gt.process &&
+    typeof gt.process.versions === "object" &&
+    gt.process.versions != null &&
+    "node" in gt.process.versions;
+
+  // Avoid attempting to resolve `node:crypto` in non-Node runtimes.
+  if (isNodeRuntime) {
+    try {
+      // Keep the specifier non-literal to avoid eager bundler resolution.
+      const nodeCryptoSpecifier = `node${":"}crypto`;
+      const nodeCrypto = await import(nodeCryptoSpecifier);
+      if (nodeCrypto.webcrypto?.subtle != null) {
+        cachedWebCrypto = nodeCrypto.webcrypto as unknown as Crypto;
+        return cachedWebCrypto;
+      }
+    } catch {
+      // Intentionally ignored. We'll throw a descriptive error below.
+    }
   }
 
-  return keyid;
+  throw new Error(
+    "Web Crypto API is unavailable. Expected globalThis.crypto.subtle or Node's crypto.webcrypto."
+  );
 }
 
-export function stripUndefined<T extends {}>(
-  obj: T
-): { [K in keyof T]?: Exclude<T[K], undefined> } {
-  const newObj: { [K in keyof T]?: Exclude<T[K], undefined> } = {};
-  const target: Record<string, unknown> = newObj;
+/**
+ * Derives JWT `kid` from a private key using an RFC 7638 JWK thumbprint.
+ *
+ * Expected key format:
+ * - PKCS#8 PEM-encoded private key
+ * - EC P-521 curve (matches ES512 signing)
+ *
+ * Steps:
+ * 1. Decode PEM to PKCS#8 DER bytes.
+ * 2. Import key through Web Crypto.
+ * 3. Export as JWK and validate required fields.
+ * 4. Hash the canonical RFC 7638 thumbprint input with SHA-256.
+ * 5. Return base64url encoded digest.
+ *
+ * @param privateKey PEM-encoded PKCS#8 EC private key.
+ * @returns The base64url-encoded JWK thumbprint used as JWT `kid`.
+ * @throws If key parsing/import/export/validation/digest fails.
+ */
+export async function getKeyId(privateKey: string): Promise<string> {
+  try {
+    const runtimeCrypto = await resolveWebCrypto();
+
+    // Parse PEM to DER binary
+    const pemBody = privateKey
+      .replace(/-----BEGIN PRIVATE KEY-----/, "")
+      .replace(/-----END PRIVATE KEY-----/, "")
+      .replace(/\s/g, "");
+    const der = bytesFromBase64(pemBody);
 
-  for (const entry of Object.entries(obj)) {
-    const [key, value] = entry;
+    // Import as extractable CryptoKey (ES512 = P-521)
+    const key = await runtimeCrypto.subtle.importKey(
+      "pkcs8",
+      der,
+      { name: "ECDSA", namedCurve: "P-521" },
+      true,
+      ["sign"]
+    );
 
-    if (typeof value !== "undefined") {
-      target[key] = value;
+    // Export as JWK and validate fields required to build an RFC 7638 thumbprint.
+    const jwk = await runtimeCrypto.subtle.exportKey("jwk", key);
+    const requiredFields = ["kty", "crv", "x", "y"] as const;
+    const invalidFields = requiredFields.filter((field) => {
+      const value = jwk[field];
+      return typeof value !== "string" || value.length === 0;
+    });
+    if (invalidFields.length > 0) {
+      throw new Error(
+        `Exported JWK is missing required string field(s): ${invalidFields.join(
+          ", "
+        )}`
+      );
     }
-  }
 
-  return newObj;
+    if (jwk.kty !== "EC" || jwk.crv !== "P-521") {
+      throw new Error("Imported key is not an EC P-521 private key");
+    }
+
+    // RFC 7638 canonical member set for EC keys: crv, kty, x, y.
+    const input = JSON.stringify({
+      crv: jwk.crv,
+      kty: jwk.kty,
+      x: jwk.x,
+      y: jwk.y,
+    });
+    const hash = await runtimeCrypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(input)
+    );
+
+    // Base64url encode
+    return btoa(String.fromCharCode(...new Uint8Array(hash)))
+      .replace(/\+/g, "-")
+      .replace(/\//g, "_")
+      .replace(/=+$/, "");
+  } catch (error) {
+    const reason =
+      error instanceof Error && error.message
+        ? ` Reason: ${error.message}`
+        : "";
+    throw new Error(
+      "Failed to derive JWT key ID from private key. Expected a PKCS#8 PEM-encoded EC private key on curve P-521 (ES512)." +
+        reason
+    );
+  }
 }