@unkey/api 2.3.1 → 2.3.3

package/src/funcs/permissionsDeleteRole.ts

@@ -37,6 +37,8 @@ import { Result } from "../types/fp.js";
  *
  * Your root key must have the following permission:
  * - `rbac.*.delete_role`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function permissionsDeleteRole(
   client: UnkeyCore,
@@ -113,7 +115,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/permissionsGetPermission.ts

@@ -35,6 +35,8 @@ import { Result } from "../types/fp.js";
  *
  * Your root key must have the following permission:
  * - `rbac.*.read_permission`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function permissionsGetPermission(
   client: UnkeyCore,
@@ -115,7 +117,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/permissionsGetRole.ts

@@ -35,6 +35,8 @@ import { Result } from "../types/fp.js";
  *
  * Your root key must have the following permission:
  * - `rbac.*.read_role`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function permissionsGetRole(
   client: UnkeyCore,
@@ -113,7 +115,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/permissionsListPermissions.ts

@@ -36,6 +36,8 @@ import { Result } from "../types/fp.js";
  *
  * Your root key must have the following permission:
  * - `rbac.*.read_permission`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function permissionsListPermissions(
   client: UnkeyCore,
@@ -114,7 +116,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/permissionsListRoles.ts

@@ -36,6 +36,8 @@ import { Result } from "../types/fp.js";
  *
  * Your root key must have the following permission:
  * - `rbac.*.read_role`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function permissionsListRoles(
   client: UnkeyCore,
@@ -114,7 +116,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/ratelimitDeleteOverride.ts

@@ -36,6 +36,8 @@ import { Result } from "../types/fp.js";
  * **Important:** Deletion is immediate and permanent. The override cannot be recovered and must be recreated if needed again.
  *
  * **Permissions:** Requires `ratelimit.*.delete_override` or `ratelimit.<namespace_id>.delete_override`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function ratelimitDeleteOverride(
   client: UnkeyCore,
@@ -116,7 +118,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/ratelimitGetOverride.ts

@@ -36,6 +36,8 @@ import { Result } from "../types/fp.js";
  * **Important:** The identifier must match exactly as specified when creating the override, including wildcard patterns.
  *
  * **Permissions:** Requires `ratelimit.*.read_override` or `ratelimit.<namespace_id>.read_override`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function ratelimitGetOverride(
   client: UnkeyCore,
@@ -114,7 +116,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/ratelimitLimit.ts

@@ -40,6 +40,8 @@ import { Result } from "../types/fp.js";
  * Your root key must have one of the following permissions:
  * - `ratelimit.*.limit` (to check limits in any namespace)
  * - `ratelimit.<namespace_id>.limit` (to check limits in a specific namespace)
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function ratelimitLimit(
   client: UnkeyCore,
@@ -120,7 +122,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/ratelimitListOverrides.ts

@@ -36,6 +36,8 @@ import { Result } from "../types/fp.js";
  * **Important:** Results are paginated. Use the cursor parameter to retrieve additional pages when more results are available.
  *
  * **Permissions:** Requires `ratelimit.*.read_override` or `ratelimit.<namespace_id>.read_override`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function ratelimitListOverrides(
   client: UnkeyCore,
@@ -116,7 +118,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/ratelimitMultiLimit.ts

@@ -41,6 +41,8 @@ import { Result } from "../types/fp.js";
  * Your root key must have one of the following permissions:
  * - `ratelimit.*.limit` (to check limits in any namespace)
  * - `ratelimit.<namespace_id>.limit` (to check limits in all specific namespaces being checked)
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function ratelimitMultiLimit(
   client: UnkeyCore,
@@ -123,7 +125,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/funcs/ratelimitSetOverride.ts

@@ -36,6 +36,8 @@ import { Result } from "../types/fp.js";
  * **Important:** Overrides take effect immediately and completely replace the default limit for matching identifiers. Use wildcard patterns (e.g., `premium_*`) to match multiple identifiers.
  *
  * **Permissions:** Requires `ratelimit.*.set_override` or `ratelimit.<namespace_id>.set_override`
+ *
+ * If set, this operation will use {@link Security.rootKey} from the global security.
  */
 export function ratelimitSetOverride(
   client: UnkeyCore,
@@ -114,7 +116,7 @@ async function $do(
 
   const secConfig = await extractSecurity(client._options.rootKey);
   const securityInput = secConfig == null ? {} : { rootKey: secConfig };
-  const requestSecurity = resolveGlobalSecurity(securityInput);
+  const requestSecurity = resolveGlobalSecurity(securityInput, [0]);
 
   const context = {
     options: client._options,

package/src/lib/config.ts

@@ -58,7 +58,7 @@ export function serverURLFromOptions(options: SDKOptions): URL | null {
 export const SDK_METADATA = {
   language: "typescript",
   openapiDocVersion: "2.0.0",
-  sdkVersion: "2.3.1",
-  genVersion: "2.856.1",
-  userAgent: "speakeasy-sdk/typescript 2.3.1 2.856.1 2.0.0 @unkey/api",
+  sdkVersion: "2.3.3",
+  genVersion: "2.879.1",
+  userAgent: "speakeasy-sdk/typescript 2.3.3 2.879.1 2.0.0 @unkey/api",
 } as const;

package/src/lib/encodings.ts

@@ -479,6 +479,23 @@ export const encodeSpaceDelimitedQuery = queryEncoder(encodeSpaceDelimited);
 export const encodePipeDelimitedQuery = queryEncoder(encodePipeDelimited);
 export const encodeDeepObjectQuery = queryEncoder(encodeDeepObject);
 
+function isBlobLike(val: unknown): val is Blob {
+  if (val instanceof Blob) {
+    return true;
+  }
+
+  if (typeof val !== "object" || val == null || !(Symbol.toStringTag in val)) {
+    return false;
+  }
+
+  const tag = val[Symbol.toStringTag];
+  if (tag !== "Blob" && tag !== "File") {
+    return false;
+  }
+
+  return "stream" in val && typeof val.stream === "function";
+}
+
 export function appendForm(
   fd: FormData,
   key: string,
@@ -487,10 +504,12 @@ export function appendForm(
 ): void {
   if (value == null) {
     return;
-  } else if (value instanceof Blob && fileName) {
-    fd.append(key, value, fileName);
-  } else if (value instanceof Blob) {
-    fd.append(key, value);
+  } else if (isBlobLike(value)) {
+    if (fileName) {
+      fd.append(key, value as Blob, fileName);
+    } else {
+      fd.append(key, value as Blob);
+    }
   } else {
     fd.append(key, String(value));
   }

package/src/lib/files.ts

@@ -80,3 +80,25 @@ export function getContentTypeFromFileName(fileName: string): string | null {
 
   return mimeTypes[ext] || null;
 }
+
+/**
+ * Creates a Blob from file content with the given MIME type.
+ *
+ * Node.js Buffers are Uint8Array subclasses that may share a pooled
+ * ArrayBuffer (byteOffset > 0, byteLength < buffer.byteLength). Passing
+ * such a Buffer directly to `new Blob([buf])` can include the entire
+ * underlying pool on some runtimes, producing a Blob with extra bytes
+ * that corrupts multipart uploads.
+ *
+ * Copying into a standalone Uint8Array ensures the Blob receives only the
+ * intended bytes regardless of runtime behaviour.
+ */
+export function bytesToBlob(
+  content: Uint8Array<ArrayBufferLike> | ArrayBuffer | Blob | string,
+  contentType: string,
+): Blob {
+  if (content instanceof Uint8Array) {
+    return new Blob([new Uint8Array(content)], { type: contentType });
+  }
+  return new Blob([content as BlobPart], { type: contentType });
+}

package/src/lib/sdks.ts

@@ -128,13 +128,15 @@ export class ClientSDK {
     if (!base) {
       return ERR(new InvalidRequestError("No base URL provided for operation"));
     }
-    const reqURL = new URL(base);
-    const inputURL = new URL(path, reqURL);
-
+    const baseURL = new URL(base);
+    let reqURL: URL;
     if (path) {
-      reqURL.pathname += reqURL.pathname.endsWith("/") ? "" : "/";
-      reqURL.pathname += inputURL.pathname.replace(/^\/+/, "");
+      baseURL.pathname = baseURL.pathname.replace(/\/+$/, "") + "/";
+      reqURL = new URL(path, baseURL);
+    } else {
+      reqURL = baseURL;
     }
+    reqURL.hash = "";
 
     let finalQuery = query || "";
 

package/src/lib/security.ts

@@ -240,8 +240,9 @@ function applyBearer(
 
 export function resolveGlobalSecurity(
   security: Partial<components.Security> | null | undefined,
+  allowedFields?: number[],
 ): SecurityState | null {
-  return resolveSecurity(
+  let inputs: SecurityInput[][] = [
     [
       {
         fieldName: "Authorization",
@@ -249,7 +250,18 @@ export function resolveGlobalSecurity(
         value: security?.rootKey ?? env().UNKEY_ROOT_KEY,
       },
     ],
-  );
+  ];
+
+  if (allowedFields) {
+    inputs = allowedFields.map((i) => {
+      if (i < 0 || i >= inputs.length) {
+        throw new RangeError(`invalid allowedFields index ${i}`);
+      }
+      return inputs[i]!;
+    });
+  }
+
+  return resolveSecurity(...inputs);
 }
 
 export async function extractSecurity<

package/src/lib/url.ts

@@ -13,21 +13,23 @@ export function pathToFunc(
   const paramRE = /\{([a-zA-Z0-9_][a-zA-Z0-9_-]*?)\}/g;
 
   return function buildURLPath(params: Record<string, unknown> = {}): string {
-    return pathPattern.replace(paramRE, function (_, placeholder) {
-      if (!hasOwn.call(params, placeholder)) {
-        throw new Error(`Parameter '${placeholder}' is required`);
-      }
+    return pathPattern
+      .replace(paramRE, function (_, placeholder) {
+        if (!hasOwn.call(params, placeholder)) {
+          throw new Error(`Parameter '${placeholder}' is required`);
+        }
 
-      const value = params[placeholder];
-      if (typeof value !== "string" && typeof value !== "number") {
-        throw new Error(
-          `Parameter '${placeholder}' must be a string or number`,
-        );
-      }
+        const value = params[placeholder];
+        if (typeof value !== "string" && typeof value !== "number") {
+          throw new Error(
+            `Parameter '${placeholder}' must be a string or number`,
+          );
+        }
 
-      return options?.charEncoding === "percent"
-        ? encodeURIComponent(`${value}`)
-        : `${value}`;
-    });
+        return options?.charEncoding === "percent"
+          ? encodeURIComponent(`${value}`)
+          : `${value}`;
+      })
+      .replace(/^\/+/, "");
   };
 }

package/src/models/components/keyresponsedata.ts

@@ -45,6 +45,10 @@ export type KeyResponseData = {
    * Unix timestamp in milliseconds when key was last updated.
    */
   updatedAt?: number | undefined;
+  /**
+   * Unix timestamp in milliseconds when key was last used for verification. This is an approximated value, accurate to within 5 minutes.
+   */
+  lastUsedAt?: number | undefined;
   /**
    * Unix timestamp in milliseconds when key expires (if set).
    */
@@ -76,6 +80,7 @@ export const KeyResponseData$inboundSchema: z.ZodType<
   meta: z.record(z.any()).optional(),
   createdAt: z.number().int(),
   updatedAt: z.number().int().optional(),
+  lastUsedAt: z.number().int().optional(),
   expires: z.number().int().optional(),
   permissions: z.array(z.string()).optional(),
   roles: z.array(z.string()).optional(),

package/src/models/components/v2deploygetdeploymentresponsedata.ts

@@ -26,6 +26,9 @@ export const Status = {
   Finalizing: "FINALIZING",
   Ready: "READY",
   Failed: "FAILED",
+  Skipped: "SKIPPED",
+  AwaitingApproval: "AWAITING_APPROVAL",
+  Stopped: "STOPPED",
 } as const;
 /**
  * Current deployment status