k9o 1.1.1 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8266cd8220381fff27135c8ef7bdcdc6432bdaf90a98ce31ce710f1eb583882
-  data.tar.gz: b5110855f5acd547d18180eab1b6d22a00ae25d7de1b441411ed4d2ee54cd2e2
+  metadata.gz: fddde5f475c121ba44d0e069107845e30e0104613b717edb809813d152e2882a
+  data.tar.gz: af7564a794aa6c40150a09bf38800dad60e092afb26dfdf8e918524124b4a68c
 SHA512:
-  metadata.gz: d3d7559ed789b15ae5bf26aecf6abe623c52794cd48685d6471605c21acf73f21a73a233d80ec9cf0de6e5d6423a00f51bf1142e5e5a2045a3ba9025df08bcf7
-  data.tar.gz: 3a14bb7e47092c45c34e350c1029598ae0ee056a58c06519c4270487ac88951a491fba6f8731d947233cc08ca166502d3f741f3faa3d0f241cd39979e3560c73
+  metadata.gz: c3735d8f97f9a0eacc9fa02dcf897ac0182056c606179b7cdcc104cc32ebba9ddb14b433c7522e30e4a10deadbd8b13022de1db262f4abccb2912b9edb05ac4a
+  data.tar.gz: f4f833edfa3f6fc6ea2d75efccfb85f09c902e0e2fb79cc43c8edad7db02bcd3817832087227005944fb4714f198ac4b0dd6f88134248698c9d2b4e3674aa1a0

data/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog — k9o (Ruby)
 
+## 1.3.0 — 2026-10-26
+
+Every method now matches the gateway.
+
+### Changed
+
+- `projects.create` takes `display_name:` (and optional `slug:`, `region:`, `custody_mode:`, ...);
+  `projects.get` and `projects.update` use the projects routes.
+- `functions.deploy` takes `name:`, `runtime:`, `tier:` (`gateway` or `sandbox`), `artifact_key:`, `version:` and `description:`.
+  Inline code is gone.
+- `functions.invoke` sends the payload as `{payload}`.
+- `policies.create`, `update` and `validate` take a `policy:` document (plus optional `rules:`, `editor_mode:`);
+  `policies.list` takes only `status:`.
+- `audit.query` filters are `event_type:`, `actor_id:`, `after:`, `before:`, `limit:` and `cursor:`.
+- Org roles, identity providers and default model use the current routes; `smtp.set` uses `password_ref:` and `from_address:`;
+  `smtp.test` takes `to:` and `subject:`.
+- `me.api_tokens.create` takes `label:` and `scope_manifest:` (and `ttl_seconds:`); `me.sessions.revoke` and `revoke_all` use new routes.
+- `compute.llms.invoke` settings are sent flat, and the result has `content` and `usage`.
+- `studio.workflows.trigger` sends the context as `triggerContext`.
+- `gate.sign_out` requires the refresh token.
+- The API host comes from the base URL: any `<org>.api.<apex>` host works and no apex is hardcoded.
+  `https://api.k9o.io` is only the default.
+
+### Removed
+
+- `gate.verify_session`, `gate.hosted`, `realtime.replay` and `realtime.subscribe_poll`.
+- `me.notifications`, `me.audit_log` and `me.data_export`.
+- `org.groups.create`, `org.groups.delete`, `org.members.get` and `org.smtp.get`.
+
+### Added
+
+- `functions.upload_artifact(bytes, kind)` uploads a build and returns the `artifactKey` for `deploy`.
+- `UrlGrammar.parse_api_host` reads the org, region and apex from any gateway host.
+- A contract test checks every method against the gateway's API description.
+
+## 1.2.0 — 2026-10-25
+
+- The README now introduces the Kilimanjaro products (Keep, Pulse, Gate, Kibo). No change to the public API.
+
 ## 1.1.1 — 2026-10-25
 
 - Documentation links corrected: the documentation hub is https://docs.kilimanjaro.dev, with the website, platform API and console listed in a Links section. Package metadata points at the same places.

data/README.md

@@ -2,6 +2,14 @@
 
 The Kilimanjaro platform SDK for Ruby.
 
+Kilimanjaro is the AI-native foundation for building critical applications.
+Its products are:
+
+- Keep: AI Security and Governance
+- Pulse: Data Intelligence
+- Gate: Customer Identity and Access Management
+- Kibo: Keys and Secrets Management
+
 ## Contents
 
 - [Links](#links)
@@ -95,27 +103,28 @@ The client needs a key and, for project calls, an org and project.
 | Option | What it does |
 |---|---|
 | `api_key:` | Bearer token sent with every request. |
-| `org_slug:` | Organization. On the default host the SDK uses `https://<org_slug>.api.k9o.io`. |
+| `org_slug:` | Organization. The SDK builds `https://<org_slug>.<host>` from the platform host. |
 | `project_slug:` | Project. Required by every project-scoped namespace. |
 
 See [client options](#client-options) for every option.
 
 ### Choose a host
 
-Pick one of two forms.
+The API host always comes from the base URL. Pick one of two forms.
 
-- Default platform host: pass the org slug, project slug and key.
-- Custom or self-hosted host: pass `base_url`, project slug and key, and no org slug.
+- Default public host: pass the org slug, project slug and key.
+- Any other platform, internal or air-gapped host: pass its `base_url` as well.
 
 ```ruby
 k9o = K9o.create_client(
-  base_url: "https://k9o.internal.example.com",
+  base_url: "https://api.corp.internal",
+  org_slug: "acme",
   project_slug: "task-app",
   api_key: ENV.fetch("K9O_API_KEY")
 )
 ```
 
-The base URL rules are listed under [regional hosts](#regional-hosts).
+This client talks to `https://acme.api.corp.internal`. See [regional hosts](#regional-hosts) for the rules.
 
 ## Running queries
 
@@ -177,9 +186,9 @@ Collection not found
 | Option | What it does |
 |---|---|
 | `api_key:` | Bearer token sent with every request. |
-| `org_slug:` | Organization. On the default host the SDK uses `https://<org_slug>.api.k9o.io`. |
+| `org_slug:` | Organization. Prefixed to a platform host (`api.<apex>`) to form the org host. |
 | `project_slug:` | Project. Required by every project-scoped namespace. |
-| `base_url:` | Scheme and host only. Defaults to `https://api.k9o.io`. |
+| `base_url:` | Scheme and host only. Defaults to the public host `https://api.k9o.io`. |
 | `default_headers:` | Extra headers added to every request. |
 | `http_client:` | A `Net::HTTP`-compatible object used instead of the default connection. |
 
@@ -234,9 +243,18 @@ Chain filters before `execute`. Values are matched against one column.
 | Method | What it does |
 |---|---|
 | `k9o.projects.list` | List projects you can access. |
-| `k9o.projects.create` | Create a project from `slug` and `name`. |
+| `k9o.projects.create` | Create a project from `display_name:` (optional `slug:`, `region:`, `custody_mode:`, more). |
 | `k9o.projects.get` | Read a project by slug. |
-| `k9o.projects.update` | Change a project's `name`. |
+| `k9o.projects.update` | Change a project by slug: `display_name:`, `slug:` (rename), `description:`, `region:`, more. |
+
+```ruby
+project = k9o.projects.create(display_name: "Task app", slug: "task-app")
+puts project.data["slug"]
+```
+
+```text
+task-app
+```
 
 #### Gate (end-user sign-in)
 
@@ -246,11 +264,9 @@ Chain filters before `execute`. Values are matched against one column.
 |---|---|
 | `k9o.gate.sign_up` | Create an end user from email and password. |
 | `k9o.gate.sign_in` | Sign in with email and password. |
-| `k9o.gate.sign_out` | Revoke the session's refresh token. |
+| `k9o.gate.sign_out` | Revoke a session. Requires `refresh_token:`. |
 | `k9o.gate.whoami` | Return the signed-in identity. |
 | `k9o.gate.refresh_token` | Exchange a refresh token for a new access token. |
-| `k9o.gate.verify_session` | Check that the current session is valid. |
-| `k9o.gate.hosted` | Return the hosted sign-in `signInUrl` and `rpId`. |
 
 ```ruby
 session = k9o.gate.sign_in(email: "ada@example.com", password: "correct-horse")
@@ -301,11 +317,32 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 
 | Method | What it does |
 |---|---|
-| `k9o.functions.deploy` | Deploy a function from `name`, `runtime` and `code`. |
-| `k9o.functions.list` | List functions. |
+| `k9o.functions.upload_artifact` | Upload the build (`bytes`, `kind` of `"wasm"` or `"tar"`). Returns `artifactKey`. |
+| `k9o.functions.deploy` | Deploy from `name:`, `runtime:`, `tier:`, `artifact_key:`, `version:`, optional `description:`. |
+| `k9o.functions.list` | List functions. Options: `status:`, `limit:`, `cursor:`. |
 | `k9o.functions.get` | Read one function by name. |
 | `k9o.functions.delete` | Remove a function. |
-| `k9o.functions.invoke` | Run a function with a payload. |
+| `k9o.functions.invoke` | Run a function. The `payload` argument is sent as `{payload}`. |
+
+`tier:` is `"gateway"` (WebAssembly, `"wasm"`) or `"sandbox"` (OCI image archive, `"tar"`).
+
+```ruby
+artifact = k9o.functions.upload_artifact(File.binread("hello.wasm"), "wasm")
+
+k9o.functions.deploy(
+  name: "hello",
+  runtime: "bun",
+  tier: "gateway",
+  artifact_key: artifact.data["artifactKey"],
+  version: "1.0.0"
+)
+result = k9o.functions.invoke("hello", { "name" => "Ada" })
+puts result.data["greeting"]
+```
+
+```text
+Hello, Ada
+```
 
 #### Migrations
 
@@ -329,11 +366,11 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 | Method | What it does |
 |---|---|
 | `k9o.policies.current` | Read the published bundle. |
-| `k9o.policies.list` | List bundles. |
-| `k9o.policies.create` | Create a bundle from `name` and `rules`. |
-| `k9o.policies.validate` | Check rules without saving. |
+| `k9o.policies.list` | List bundles. Only option: `status:`. |
+| `k9o.policies.create` | Create a bundle from a `policy:` document (optional `rules:`, `editor_mode:`). |
+| `k9o.policies.validate` | Check a `policy:` document (and optional `rules:`) without saving. |
 | `k9o.policies.get` | Read one bundle. |
-| `k9o.policies.update` | Change a bundle. |
+| `k9o.policies.update` | Replace a bundle's `policy:` (optional `rules:`, `editor_mode:`). |
 | `k9o.policies.delete` | Remove a bundle. |
 | `k9o.policies.publish` | Make a bundle current. |
 
@@ -343,7 +380,9 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 
 | Method | What it does |
 |---|---|
-| `k9o.audit.query` | Search events by time range, type and more. |
+| `k9o.audit.query` | Filter by `event_type:`, `actor_id:`, `after:`, `before:`, `limit:`, `cursor:`. |
+
+`after:` and `before:` are ISO 8601 timestamps.
 
 #### AI embeddings
 
@@ -362,7 +401,18 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 | `k9o.compute.llms.list` | List available models. |
 | `k9o.compute.llms.read` | Read one model. |
 | `k9o.compute.llms.invoke` | Send a prompt and get the reply. |
-| `k9o.compute.llms.invoke_stream` | Stream the reply token by token (returns an `Enumerator`). |
+| `k9o.compute.llms.invoke_stream` | Stream the reply chunk by chunk (returns an `Enumerator`). |
+
+Pass settings in `params:` (`max_tokens`, `temperature`, `usage_type`). The result `data` has `content` and `usage`.
+
+```ruby
+reply = k9o.compute.llms.invoke("llama-3-8b", prompt: "Say hi", params: { max_tokens: 20 })
+puts "#{reply.data['content']} #{reply.data['usage']['totalTokens']}"
+```
+
+```text
+Hi there! 14
+```
 
 #### Realtime
 
@@ -370,9 +420,7 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 
 | Method | What it does |
 |---|---|
-| `k9o.realtime.subscribe` | Stream live events (returns an `Enumerator`). |
-| `k9o.realtime.replay` | Read past events from a sequence number. |
-| `k9o.realtime.subscribe_poll` | Poll for events from a sequence number. |
+| `k9o.realtime.subscribe` | Stream live events over SSE (returns an `Enumerator`). |
 
 `K9o::Realtime::Topic` builds topic names, for example `Topic.collection("tasks")`.
 
@@ -389,7 +437,7 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 | `k9o.studio.workflows.read` | Read one workflow. |
 | `k9o.studio.workflows.update` | Change a workflow. |
 | `k9o.studio.workflows.delete` | Delete a workflow. |
-| `k9o.studio.workflows.trigger` | Start a run. |
+| `k9o.studio.workflows.trigger` | Start a run, with an optional context hash. |
 | `k9o.studio.workflows.runs.list` | List a workflow's runs. |
 | `k9o.studio.workflows.runs.read` | Read one run. |
 | `k9o.studio.workflows.runs.cancel` | Cancel a run. |
@@ -413,19 +461,13 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 | Method | What it does |
 |---|---|
 | `k9o.me.profile.get` | Read the profile. |
-| `k9o.me.profile.update` | Change the display name. |
+| `k9o.me.profile.update` | Change `display_name:`, `locale:` or `timezone:` (only those given). |
 | `k9o.me.sessions.list` | List active sessions. |
 | `k9o.me.sessions.revoke` | End one session. |
 | `k9o.me.sessions.revoke_all` | End all sessions. |
 | `k9o.me.api_tokens.list` | List API tokens. |
-| `k9o.me.api_tokens.create` | Create an API token. |
+| `k9o.me.api_tokens.create` | Create a token from `label:` and `scope_manifest:` (optional `ttl_seconds:`). |
 | `k9o.me.api_tokens.delete` | Delete an API token. |
-| `k9o.me.notifications.list` | List notifications. |
-| `k9o.me.notifications.mark_read` | Mark one as read. |
-| `k9o.me.notifications.mark_all_read` | Mark all as read. |
-| `k9o.me.audit_log.query` | Search your own audit events. |
-| `k9o.me.data_export.request` | Request a data export. |
-| `k9o.me.data_export.status` | Check an export job. |
 
 #### Organization
 
@@ -445,30 +487,26 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 | Method | What it does |
 |---|---|
 | `k9o.org.get` | Read the active organization. |
-| `k9o.org.members.list` | List members. |
+| `k9o.org.members.list` | List members. Options: `user_id:`, `role:`, `acceptance_status:`, `status:`, `state:`. |
 | `k9o.org.members.invite` | Invite a member by email and role. |
-| `k9o.org.members.get` | Read one member. |
 | `k9o.org.members.remove` | Remove a member. |
-| `k9o.org.groups.list` | List groups. |
-| `k9o.org.groups.create` | Create a group. |
+| `k9o.org.groups.list` | List groups, optionally for one `user_id:`. |
 | `k9o.org.groups.get` | Read one group. |
-| `k9o.org.groups.delete` | Delete a group. |
-| `k9o.org.audit_log.query` | Search organization audit events. |
+| `k9o.org.audit_log.query` | Search organization audit events by `type:` and `limit:`. |
 | `k9o.org.gate.roles.list` | List role grants. |
-| `k9o.org.gate.roles.grant` | Grant a role to a user. |
+| `k9o.org.gate.roles.grant` | Grant a role to a user (`user_id:`, `role:`, optional `decision_reason:`). |
 | `k9o.org.gate.roles.get` | Read one grant. |
 | `k9o.org.gate.roles.revoke` | Revoke a grant. |
 | `k9o.org.gate.idp_providers.list` | List identity providers. |
-| `k9o.org.gate.idp_providers.create` | Add an identity provider. |
+| `k9o.org.gate.idp_providers.create` | Add a provider: `idp_provider:`, `display_name:`, `client_id:`, `client_secret_ref:`, `tier_gating:`. |
 | `k9o.org.gate.idp_providers.get` | Read one provider. |
 | `k9o.org.gate.idp_providers.configure` | Change a provider. |
 | `k9o.org.gate.idp_providers.delete` | Remove a provider. |
-| `k9o.org.smtp.get` | Read the mail server settings. |
-| `k9o.org.smtp.set` | Save the mail server settings. |
-| `k9o.org.smtp.test` | Send a test email. |
+| `k9o.org.smtp.set` | Save the mail server: `host:`, `port:`, `username:`, `password_ref:`, `from_address:`. |
+| `k9o.org.smtp.test` | Send a test email to `to:`, with an optional `subject:`. |
 | `k9o.org.smtp.unset` | Remove the mail server settings. |
 | `k9o.org.default_llm.get` | Read the default model. |
-| `k9o.org.default_llm.set` | Set the default model. |
+| `k9o.org.default_llm.set` | Set the default model from a model id. |
 
 #### Vault secrets
 
@@ -477,7 +515,7 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 | Method | What it does |
 |---|---|
 | `k9o.kibo.vault.secrets.list` | List secrets by prefix. |
-| `k9o.kibo.vault.secrets.get` | Read a secret's details. |
+| `k9o.kibo.vault.secrets.get` | Read a secret by name (`region:` is required). |
 | `k9o.kibo.vault.secrets.create` | Store a new secret. |
 | `k9o.kibo.vault.secrets.reveal_challenge` | Get a one-time challenge for revealing. |
 | `k9o.kibo.vault.secrets.reveal` | Reveal the value using the challenge. |
@@ -532,10 +570,12 @@ The server may send codes not listed here, so keep a fallback branch.
 
 ### Regional hosts
 
-- Organization hosts such as `https://acme.api.k9o.io` are region-free.
-- The SDK sends one credential-free `HEAD` request to learn the region.
-- Later requests go to the regional host.
-- Any other base URL is used exactly as given.
+- A platform host is `api.<apex>` or `api-staging.<apex>`, on any apex.
+- With `org_slug`, the SDK builds the org host `<org_slug>.<host>`.
+- A region-free org host gets one credential-free `HEAD` request to learn its region.
+- Later requests go to the regional host, which must share the org, family and apex.
+- Any other base URL (internal, air-gapped, localhost) is used exactly as given.
+- `https://api.k9o.io` is only the default when `base_url:` is omitted.
 
 ### Related packages
 

data/lib/k9o/audit.rb

@@ -2,27 +2,25 @@
 
 module K9o
   # Project-plane audit log namespace — k9o.audit.*.
-  # Distinct from k9o.org.audit_log + k9o.me.audit_log.
+  # Distinct from k9o.org.audit_log.
   class Audit
     def initialize(config)
       @config = config
     end
 
-    # Query the audit log (reverse-chronological; filters AND-compose).
-    # Accepts keyword filters: since/until/type/actor_id/target_kind/
-    # target_id/limit/cursor (wire camelCase mapping applied here).
-    def query(since: nil, until_: nil, type: nil, actor_id: nil,
-              target_kind: nil, target_id: nil, limit: nil, cursor: nil)
+    # GET /@<slug>/audit-log — reverse-chronological; filters AND-compose. Requires the AUDIT_READER role.
+    #   event_type: audit-event name prefix (e.g. 'data.write.access')    actor_id: filter by actor
+    #   after / before: ISO 8601 bounds (events after / before this instant)
+    #   limit: page size (bounded server-side)    cursor: from the prior response's meta.cursor.next
+    def query(event_type: nil, actor_id: nil, after: nil, before: nil, limit: nil, cursor: nil)
       slug = Studio.require_project_slug(@config, 'audit')
       q = {}
-      q['since'] = since if since
-      q['until'] = until_ if until_
-      q['type'] = type if type
-      q['actorId'] = actor_id if actor_id
-      q['targetKind'] = target_kind if target_kind
-      q['targetId'] = target_id if target_id
-      q['limit'] = limit if limit
-      q['cursor'] = cursor if cursor
+      q['eventType'] = event_type unless event_type.nil?
+      q['actorId'] = actor_id unless actor_id.nil?
+      q['after'] = after unless after.nil?
+      q['before'] = before unless before.nil?
+      q['limit'] = limit unless limit.nil?
+      q['cursor'] = cursor unless cursor.nil?
       HttpTransport.request(config: @config, method: 'GET', path: UrlGrammar.project_path(slug, 'audit-log'), query: q)
     end
   end

data/lib/k9o/client.rb

@@ -36,17 +36,15 @@ module K9o
 
   # Factory — construct a K9oClient bound to the supplied options.
   #
-  # Per spec sample:
   #   k9o = K9o.create_client(
   #     api_key: ENV["K9O_API_KEY"],
   #     org_slug: "acme",
   #     project_slug: "member-portal",
   #   )
   #
-  # base_url is OPTIONAL. When omitted it
-  # defaults to the platform apex https://api.k9o.io; when the host is the
-  # bare apex and org_slug is set, the canonical org-subdomain wire root
-  # https://<org_slug>.api.k9o.io is composed. Any other host passes through.
+  # base_url is OPTIONAL. When omitted it defaults to the public-cloud platform host (a convenience only, never used
+  # to parse a host). When the host is a platform host (+api.<apex>+ or +api-staging.<apex>+, any apex) and org_slug
+  # is set, the org host +<org_slug>.<host>+ is composed. Any other host passes through unchanged.
   def self.create_client(base_url: nil, api_key: nil, org_slug: nil, project_slug: nil, default_headers: {}, http_client: nil)
     normalised = UrlGrammar.resolve_base_url(base_url, org_slug)
     config = HttpClientConfig.new(

data/lib/k9o/compute.rb

@@ -4,30 +4,37 @@ module K9o
   # Compute namespace (Compute LLMs registry).
   # k9o.compute.llms.*
   class Compute
-    # Curated 9-model closed enum (extensible v2.x).
+    # The curated model ids (closed enum).
     LLM_MODEL_IDS = %w[
       mistral-7b mistral-8x7b llama-3-8b llama-3-70b
       claude-3-5-sonnet gpt-4o gpt-4o-mini
       text-embedding-3-small text-embedding-3-large
     ].freeze
 
+    # Inference parameters the gateway reads (top-level body fields next to +prompt+). Snake_case spellings map to
+    # the gateway's.
+    PARAM_FIELDS = {
+      'max_tokens' => 'maxTokens', 'maxTokens' => 'maxTokens',
+      'temperature' => 'temperature',
+      'usage_type' => 'usageType', 'usageType' => 'usageType'
+    }.freeze
+
     attr_reader :llms
 
     def initialize(config)
       @llms = Llms.new(config)
     end
 
-    # k9o.compute.llms.*.
+    # k9o.compute.llms.*
     class Llms
       def initialize(config)
         @config = config
       end
 
-      def list(modality: nil)
+      # GET /@<slug>/compute/llms
+      def list
         slug = Studio.require_project_slug(@config, 'compute.llms')
-        q = modality ? { 'modality' => modality } : nil
-        HttpTransport.request(config: @config, method: 'GET',
-                              path: UrlGrammar.project_path(slug, 'compute/llms'), query: q)
+        HttpTransport.request(config: @config, method: 'GET', path: UrlGrammar.project_path(slug, 'compute/llms'))
       end
 
       def read(model_id)
@@ -36,29 +43,39 @@ module K9o
                               path: UrlGrammar.project_path(slug, "compute/llms/#{enc(model_id)}"))
       end
 
-      # Synchronous inference (PROJECT_AUTHOR/ADMIN).
+      # Synchronous inference: POST /@<slug>/compute/llms/<id>/invoke { prompt, maxTokens?, temperature?,
+      # usageType? }. +params+ takes max_tokens / temperature / usage_type (the gateway's spellings also work).
+      # The envelope's data is { 'modelId', 'content', 'finishReason', 'usage' => { 'promptTokens',
+      # 'completionTokens', 'totalTokens' }, 'usageType' }.
       def invoke(model_id, prompt:, params: nil)
         slug = Studio.require_project_slug(@config, 'compute.llms')
-        body = { 'prompt' => prompt }
-        body['params'] = params if params
         HttpTransport.request(config: @config, method: 'POST',
-                              path: UrlGrammar.project_path(slug, "compute/llms/#{enc(model_id)}/invoke"), body: body)
+                              path: UrlGrammar.project_path(slug, "compute/llms/#{enc(model_id)}/invoke"),
+                              body: invoke_body(prompt, params))
       end
 
-      # Streaming inference (SSE per-token). Returns an
-      # Enumerator of chunk hashes (Ruby idiom). Consume with
+      # Streaming inference (SSE per-token). Returns an Enumerator of chunk hashes. Consume with
       # `.each { |chunk| ... }`.
       def invoke_stream(model_id, prompt:, params: nil)
         slug = Studio.require_project_slug(@config, 'compute.llms')
-        body = { 'prompt' => prompt }
-        body['params'] = params if params
         HttpTransport.stream_sse(config: @config, method: 'POST',
                                  path: UrlGrammar.project_path(slug, "compute/llms/#{enc(model_id)}/invoke-stream"),
-                                 body: body)
+                                 body: invoke_body(prompt, params))
       end
 
       private
 
+      def invoke_body(prompt, params)
+        body = { 'prompt' => prompt }
+        (params || {}).each do |key, value|
+          wire = PARAM_FIELDS[key.to_s]
+          raise ArgumentError, "unknown inference parameter: #{key}" if wire.nil?
+
+          body[wire] = value unless value.nil?
+        end
+        body
+      end
+
       def enc(s)
         ::URI.encode_www_form_component(s)
       end

data/lib/k9o/functions.rb

@@ -2,22 +2,52 @@
 
 module K9o
   # Function lifecycle namespace — k9o.functions.*.
+  #
+  # Upload the function's bytes first (+upload_artifact+ returns the +artifactKey+), then +deploy+ references that
+  # artifact. Deploy requires PROJECT_ADMIN and returns with status +deploying+; the function is ready when status
+  # flips to +active+.
   class Functions
+    ARTIFACT_CONTENT_TYPES = { 'wasm' => 'application/wasm', 'tar' => 'application/x-tar' }.freeze
+
     def initialize(config)
       @config = config
     end
 
-    def deploy(name:, runtime:, code:, tier: nil, config: nil)
+    # POST /@<slug>/functions/artifacts with the raw bytes: a WebAssembly module for the gateway tier (up to 16 MiB,
+    # +kind+ 'wasm') or an OCI image archive for the sandbox tier (up to 256 MiB, +kind+ 'tar'). Uploading the same
+    # bytes again returns the same key. The envelope's data is { 'artifactKey' => String }.
+    def upload_artifact(bytes, kind)
+      content_type = ARTIFACT_CONTENT_TYPES[kind.to_s]
+      raise ArgumentError, "kind must be 'wasm' or 'tar'" if content_type.nil?
+
+      bytes = bytes.read if bytes.respond_to?(:read)
+      raise ArgumentError, 'bytes must be a String or an IO' unless bytes.is_a?(String)
+
+      slug = require_project_slug
+      HttpTransport.request(config: @config, method: 'POST',
+                            path: UrlGrammar.project_path(slug, 'functions/artifacts'),
+                            raw_body: bytes, headers: { 'content-type' => content_type })
+    end
+
+    # POST /@<slug>/functions — deploy or redeploy from an uploaded artifact.
+    #   runtime: bun python go java kotlin dotnet swift php ruby rust tinygo zig assemblyscript
+    #   tier:    'gateway' (WebAssembly) or 'sandbox' (OCI image archive)
+    #   artifact_key: the key +upload_artifact+ returned; version: label for this deploy (1 to 64 characters)
+    def deploy(name:, runtime:, tier:, artifact_key:, version:, description: nil)
       slug = require_project_slug
-      body = { 'name' => name, 'runtime' => runtime, 'code' => code }
-      body['tier'] = tier if tier
-      body['config'] = config if config
+      body = { 'name' => name, 'runtime' => runtime, 'tier' => tier, 'artifactKey' => artifact_key,
+               'version' => version }
+      body['description'] = description unless description.nil?
       HttpTransport.request(config: @config, method: 'POST', path: UrlGrammar.project_path(slug, 'functions'), body: body)
     end
 
-    def list(status: nil)
+    # GET /@<slug>/functions (cursor pagination).
+    def list(status: nil, limit: nil, cursor: nil)
       slug = require_project_slug
-      q = status ? { 'status' => status } : nil
+      q = {}
+      q['status'] = status unless status.nil?
+      q['limit'] = limit unless limit.nil?
+      q['cursor'] = cursor unless cursor.nil?
       HttpTransport.request(config: @config, method: 'GET', path: UrlGrammar.project_path(slug, 'functions'), query: q)
     end
 
@@ -26,16 +56,25 @@ module K9o
       HttpTransport.request(config: @config, method: 'GET', path: UrlGrammar.project_path(slug, "functions/#{enc(name)}"))
     end
 
+    # Retire a function; its name enters a 24h cooldown.
     def delete(name)
       slug = require_project_slug
       HttpTransport.request(config: @config, method: 'DELETE', path: UrlGrammar.project_path(slug, "functions/#{enc(name)}"))
     end
 
-    # Invoke a function; payload passed to the runtime verbatim.
-    def invoke(name, payload)
+    # POST /@<slug>/functions/<name>/invoke. +payload+ is sent as the +payload+ field of the request body and passed
+    # to the function runtime verbatim. Optional controls: +background+ (run asynchronously), +delegation+
+    # ({ 'token' => ..., 'invokeSessionId' => ... }), +on_behalf_of+, +confined_to+.
+    def invoke(name, payload = nil, background: nil, delegation: nil, on_behalf_of: nil, confined_to: nil)
       slug = require_project_slug
+      body = {}
+      body['payload'] = payload unless payload.nil?
+      body['background'] = background unless background.nil?
+      body['delegation'] = delegation unless delegation.nil?
+      body['onBehalfOf'] = on_behalf_of unless on_behalf_of.nil?
+      body['confinedTo'] = confined_to unless confined_to.nil?
       HttpTransport.request(config: @config, method: 'POST',
-                            path: UrlGrammar.project_path(slug, "functions/#{enc(name)}/invoke"), body: payload)
+                            path: UrlGrammar.project_path(slug, "functions/#{enc(name)}/invoke"), body: body)
     end
 
     private

data/lib/k9o/gate.rb

@@ -1,18 +1,20 @@
 # frozen_string_literal: true
 
 module K9o
-  # Gate (Identity-Aware Kernel) namespace. Project-scoped.
+  # Gate (Identity-Aware Kernel) namespace. Project-scoped; the gateway closes each body to the fields shown.
   class Gate
     def initialize(config)
       @config = config
     end
 
+    # POST /@<slug>/gate/signup { email, password, displayName? }
     def sign_up(email:, password:, display_name: nil)
       body = { 'email' => email, 'password' => password }
       body['displayName'] = display_name if display_name
       HttpTransport.request(config: @config, method: 'POST', path: gate_path('signup'), body: body)
     end
 
+    # POST /@<slug>/gate/signin { email, password }
     def sign_in(email:, password:)
       HttpTransport.request(
         config: @config, method: 'POST', path: gate_path('signin'),
@@ -20,15 +22,18 @@ module K9o
       )
     end
 
-    def sign_out(refresh_token: nil)
-      body = refresh_token ? { 'refreshToken' => refresh_token } : {}
-      HttpTransport.request(config: @config, method: 'POST', path: gate_path('signout'), body: body)
+    # POST /@<slug>/gate/signout { refreshToken } — the refresh token is required (the gateway answers 400 without it).
+    def sign_out(refresh_token:)
+      HttpTransport.request(config: @config, method: 'POST', path: gate_path('signout'),
+                            body: { 'refreshToken' => refresh_token })
     end
 
+    # GET /@<slug>/gate/whoami
     def whoami
       HttpTransport.request(config: @config, method: 'GET', path: gate_path('whoami'))
     end
 
+    # POST /@<slug>/gate/refresh { refreshToken }
     def refresh_token(refresh_token:)
       HttpTransport.request(
         config: @config, method: 'POST', path: gate_path('refresh'),
@@ -36,20 +41,6 @@ module K9o
       )
     end
 
-    def verify_session
-      HttpTransport.request(config: @config, method: 'GET', path: gate_path('verify'))
-    end
-
-    # The project's hosted sign-in URL and WebAuthn rpId:
-    # GET /@<slug>/gate/hosted. Unauthenticated and cacheable; no credential is
-    # sent even when an api_key is configured. Returns an Envelope whose `data`
-    # is { 'signInUrl' => String, 'rpId' => String }. Take both values as given:
-    # an unknown org, a deleted project and a non-Gate project all answer the
-    # same 404 K9O_PROJECT_NOT_FOUND.
-    def hosted
-      HttpTransport.request(config: @config, method: 'GET', path: gate_path('hosted'), authenticated: false)
-    end
-
     private
 
     def gate_path(action)