k9o 1.2.0-aarch64-linux → 1.5.0-aarch64-linux

data/sig/k9o/datasets.rbs

@@ -0,0 +1,125 @@
+# RBS signatures for `client.analytics` (datasets), `client.rollups` and `client.keys`.
+
+module K9o
+  class Download
+    attr_reader body: String
+    attr_reader content_type: String?
+    def initialize: (body: String, ?content_type: String?) -> void
+  end
+
+  class AnalyticsRollups
+    def initialize: (untyped config) -> void
+    def create: (String dataset_slug, slug: String, source: String, measures: Array[Hash[Symbol | String, untyped]], window_seconds: Integer,
+                 ?dimensions: Array[String]?, ?subject_field: String?, ?non_personal: bool?, ?reattest_interval_days: Integer?) -> Envelope
+    def list: (String dataset_slug) -> Envelope
+    def delete: (String dataset_slug, String rollup_id) -> Envelope
+    # People only: a service, workload or extension token gets 403 K9O_RBAC_DENY (reason human_only).
+    def reattest: (String dataset_slug, String rollup_id, ?reattest_interval_days: Integer?) -> Envelope
+  end
+
+  class AnalyticsSchedules
+    def initialize: (untyped config) -> void
+    def create: (String dataset_slug, from_collection: String, interval_seconds: Integer, ?reattest_interval_days: Integer?) -> Envelope
+    def list: (String dataset_slug) -> Envelope
+    def delete: (String dataset_slug, String schedule_id) -> Envelope
+    def reattest: (String dataset_slug, String schedule_id, ?reattest_interval_days: Integer?) -> Envelope
+  end
+
+  class Analytics
+    attr_reader rollups: AnalyticsRollups
+    attr_reader schedules: AnalyticsSchedules
+    def initialize: (untyped config) -> void
+    def list: () -> Envelope
+    def query: (String sql, Array[String] datasets) -> Envelope
+    def create: (String slug, display_name: String, columns: Array[Hash[Symbol | String, untyped]], residency_class: (String | Symbol),
+                 ?partition_by: Array[String]?, ?storage_target: Hash[Symbol | String, untyped]?) -> Envelope
+    def get: (String slug) -> Envelope
+    def delete: (String slug) -> Envelope
+    def materialize: (String slug, ?from_collection: String?, ?from_query: String?) -> Envelope
+    def read: (String slug, ?partition_filter: Hash[Symbol | String, untyped]?, ?cursor: String?, ?limit: Integer?) -> Envelope
+    def write: (String slug, (Array[Hash[Symbol | String, untyped]] | String) rows, ?on_error: (String | Symbol)?) -> Envelope
+    def upload: (String slug, (String | IO) data, format: (String | Symbol), ?filename: String, ?manifest: Hash[Symbol | String, untyped]?,
+                 ?dry_run: bool?, ?on_error: (String | Symbol)?, ?delimiter: String?, ?encoding: String?, ?has_header: bool?) -> Envelope
+    def download_original: (String slug) -> Download
+  end
+
+  class Rollups
+    def initialize: (untyped config) -> void
+    def list: () -> Envelope
+    def read: (String rollup_slug, ?from: (String | Time)?, ?to: (String | Time)?, ?dims: (Array[String] | String)?) -> Envelope
+    def subscribe: (String rollup_slug, ?from_sequence: Integer?, ?on_resync: (^(Hash[String, untyped]) -> untyped)?) -> Enumerator[Hash[String, untyped], untyped]
+  end
+
+  class Keys
+    STATUSES: Array[String]
+    def initialize: (untyped config) -> void
+    # data: { "items" => [key] } (not paged)
+    def list: (?status: (String | Symbol)?) -> Envelope
+    def get: (String key_id) -> Envelope
+    # data: { "keyId", "previousVersion", "newVersion", "status" => "rotated" }
+    # step_up: ^(StepUpChallenge, String, String) -> { method: String, proof: String }
+    def rotate: (String key_id, ?step_up: untyped, ?headers: Hash[String, String]?) -> Envelope
+
+    class StepUpChallenge < Struct[untyped]
+      attr_reader scope_set_root: String
+      attr_reader nonce: String
+      attr_reader min_tier: String?
+      attr_reader methods: Array[String]
+      attr_reader max_age_sec: Integer?
+      attr_reader single_use: bool?
+      attr_reader rp_id: String?
+    end
+  end
+
+  class Crypto
+    def initialize: (untyped config) -> void
+    def encrypt: (String crypt, Array[Hash[Symbol | String, untyped] | String] items) -> Envelope
+    def decrypt: (String crypt, Array[Hash[Symbol | String, untyped] | String] items) -> Envelope
+    def rewrap: (String crypt, Array[Hash[Symbol | String, untyped] | String] items) -> Envelope
+    def self.text: (Hash[String, untyped] item) -> String?
+    # Reads the project's custody mode; every encrypt does this first, with no cache.
+    def mode: () -> Mode
+    # Registers the Kibo client core (an object with encrypt, decrypt and rewrap); nil removes it.
+    def use_client_core: (untyped core) -> untyped
+    def self.check_expected_key_refs: (Array[String]? refs) -> Array[String]?
+    def self.key_ref_matches?: (String key_ref, Array[String] expected, provider: (:aws | :gcp | :azure | :vault)) -> bool
+
+    # Ask for a short-lived federated token for +op+ ("encrypt", "decrypt" or "rewrap") on +crypt+.
+    def federated_token: (String crypt, String op) -> FederatedToken
+
+    # Crypts: data is { "crypts" => [...] } (list) or one { "name", "status", "createdAt", "retiredAt" } Hash.
+    def crypts_list: () -> Envelope
+    def crypts_create: (String name) -> Envelope
+    def crypts_retire: (String name) -> Envelope
+
+    class Mode < Struct[untyped]
+      def custody_mode: () -> String?
+      def epoch: () -> String?
+    end
+
+    # +provider+ and +project_id+ are nil unless the gateway names them; they are only checked against configuration.
+    class FederatedToken < Struct[untyped]
+      attr_reader token: String
+      attr_reader expires_at: String
+      attr_reader issuer: String
+      attr_reader subject: String
+      attr_reader audience: String
+      attr_reader kid: String
+      attr_reader provider: String?
+      attr_reader project_id: String?
+    end
+  end
+
+  class Audit
+    # Yields { "auditEventId", "type", "actorType", "occurredAt", "outcome", "eventId" }.
+    def tail: (?types: (Array[String | Symbol] | String | Symbol)?, ?on_resync: (^(Hash[String, untyped]) -> untyped)?) -> Enumerator[Hash[String, untyped], untyped]
+    def replay: (?topic: String, ?after_audit_event_id: String?, ?from_sequence: Integer?, ?until_sequence: Integer?, ?limit: Integer?) -> Envelope
+  end
+
+  class K9oClient
+    attr_reader analytics: Analytics
+    attr_reader rollups: Rollups
+    attr_reader keys: Keys
+    attr_reader crypto: Crypto
+  end
+end

data/sig/k9o/gate.rbs

@@ -1,11 +1,14 @@
-# RBS signatures for the `client.gate` namespace (additions).
+# RBS signatures for the `client.gate` namespace.
 
 module K9o
   class Gate
-    # GET /@<slug>/gate/hosted. Unauthenticated (no credential sent).
-    # Returns an Envelope whose `data` is { "signInUrl" => String, "rpId" => String }.
-    # Raises KError (K9O_MISSING_PROJECT_CONTEXT) without a project slug; the
-    # uniform 404 K9O_PROJECT_NOT_FOUND for unknown org / deleted / non-Gate project.
-    def hosted: () -> Envelope
+    def sign_up: (email: String, password: String, ?display_name: String?) -> Envelope
+    def sign_in: (email: String, password: String) -> Envelope
+    # The refresh token is required: the gateway answers 400 without it.
+    def sign_out: (refresh_token: String) -> Envelope
+    def whoami: () -> Envelope
+    def revoke_all_sessions: () -> Envelope
+    # `data` is `{ accessToken, refreshToken, expiresAt }`; the refresh token sent stops working, so store the new one.
+    def refresh_token: (refresh_token: String) -> Envelope
   end
 end

data/sig/k9o/kerror.rbs

@@ -0,0 +1,24 @@
+# RBS signatures for the error type raised by every call.
+
+module K9o
+  class KError < StandardError
+    attr_reader code: String
+    attr_reader context: Hash[untyped, untyped]
+    # Suggested next step as text, or nil.
+    attr_reader recommendation: String?
+    attr_reader status: Integer?
+    attr_reader request_id: String?
+    # Seconds the gateway asks the caller to wait before retrying, or nil.
+    attr_reader retry_after_sec: Numeric?
+    # The step-up challenge of a 401 K9O_STEP_UP_REQUIRED, or nil.
+    def step_up: () -> Keys::StepUpChallenge?
+
+    def initialize: (code: String, message: String, ?context: Hash[untyped, untyped], ?recommendation: String?, ?status: Integer?, ?request_id: String?, ?retry_after_sec: Numeric?) -> void
+    def with_recommendation: (String? rec) -> KError
+    def message: () -> String
+    def to_s: () -> String
+    def self.from_wire: (Hash[String, untyped] wire, Integer? status) -> KError
+    def self.recommendation_text: (untyped raw) -> String?
+    def self.retry_after: (untyped raw) -> Numeric?
+  end
+end

data/sig/k9o/kibo_client_core.rbs

@@ -0,0 +1,25 @@
+# RBS signatures for the Kibo client core of client.crypto (BYOK and HYOK projects).
+
+module K9o
+  class KiboClientCore
+    EXCHANGE_TIMEOUT: String
+    CORE_FUNCTIONS: Array[Symbol]
+    PROVIDER_WIRE: Hash[Symbol, String]
+    SKEW_SECS: Integer
+    DEFAULT_DEADLINE_SECS: Integer
+
+    # +core+ responds to app_crypto_seal_blocking, app_crypto_open_blocking, acquire_kms_credential_blocking and
+    # core_capabilities (the generated KiboKmsRestFfi module does). +federated_token+ answers call(crypt, op) with a
+    # Crypto::FederatedToken.
+    def initialize: (provider: (:aws | :gcp | :azure | :vault), posture: (:byok | :hyok), key_ref: Hash[Symbol, untyped],
+                     federation: Hash[Symbol | String, untyped], expected_key_refs: Array[String], federated_token: untyped, core: untyped,
+                     ?project_id: String?, ?provider_config: Hash[Symbol | String, String?], ?exchange_deadline: Numeric,
+                     ?now: ^() -> Integer) -> void
+    def enforces_expected_key_refs?: () -> true
+    def encrypt: (String crypt, Array[Hash[Symbol, untyped]] items, **untyped options) -> Hash[String, Array[Hash[String, untyped]]]
+    def decrypt: (String crypt, Array[Hash[Symbol, untyped]] items, **untyped options) -> Hash[String, Array[Hash[String, untyped]]]
+    def rewrap: (String crypt, Array[Hash[Symbol, untyped]] items, **untyped options) -> Hash[String, Array[Hash[String, untyped]]]
+    def inspect: () -> String
+    def to_s: () -> String
+  end
+end

data/sig/k9o/metadata.rbs

@@ -0,0 +1,54 @@
+# RBS signatures for `client.metadata`.
+
+module K9o
+  class Metadata
+    # An Envelope whose data is the Array of rows; `cursor` is the next page's cursor, or nil on the last page.
+    # A row is { "surface", "scope", "recordId" (collection) or "eventId" (telemetry), "metadata" => { column => value } }.
+    class Page < Envelope
+      def cursor: () -> String?
+    end
+
+    OPS: Array[String]
+    METRICS: Array[String]
+    SLICES: Array[String]
+    PREFIX: String
+    MAX_COLUMNS: Integer
+    MAX_LIMIT: Integer
+    TELEMETRY_FIELDS: Array[String]
+
+    attr_reader vectors: MetadataVectors
+    attr_reader index: MetadataIndex
+
+    def initialize: (untyped config) -> void
+    # surfaces: ["collection:posts"]; where: [{ field:, op:, value: }]; limit 1..1000; cursor only with one surface.
+    # Options may be keyword arguments or one Hash.
+    def filter: (?Hash[String | Symbol, untyped]? input, ?surfaces: Array[String], ?where: Array[Hash[String | Symbol, untyped]]?, ?limit: Integer?, ?cursor: String?) -> Page
+    # data is the whole updated record. Columns may be keyword arguments or one Hash.
+    def set: (String | Symbol collection, String id, ?Hash[String | Symbol, untyped]? columns, **untyped extra) -> Envelope
+    def search: (?Hash[String | Symbol, untyped]? input, ?surface: String, ?field: String | Symbol, ?q: String, ?limit: Integer?) -> Page
+    # Yields { "topic", "eventType", "payload" => { "collection", "id" }, "occurredAt", "eventId"? }.
+    def subscribe: (String surface, ?Hash[String | Symbol, untyped]? input, ?from_sequence: Integer?, ?fromSequence: Integer?, ?on_resync: (^(Hash[String, untyped]) -> untyped)?) -> Enumerator[Hash[String, untyped], untyped]
+  end
+
+  class MetadataVectors
+    def initialize: (untyped config) -> void
+    # Rows carry no score; at most 50 rows come back whatever k is.
+    def nearest: (?Hash[String | Symbol, untyped]? input, ?surface: String, ?column: String | Symbol, ?embedding: Array[Numeric], ?k: Integer?, ?metric: (String | Symbol)?, ?where: Array[Hash[String | Symbol, untyped]]?) -> Metadata::Page
+  end
+
+  class MetadataIndex
+    def initialize: (untyped config) -> void
+    # data is { "collection" => String, "columns" => [{ "column" => String, "indexed" => bool }] }.
+    def get: (String | Symbol collection) -> Envelope
+    def declare: (String | Symbol collection, Array[Hash[String | Symbol, untyped]] columns) -> Envelope
+  end
+
+  class Realtime
+    # The reconnecting reader behind subscribe; initial_query applies to the first connection only.
+    def feed: (String route, Hash[String, untyped] q, Hash[String, untyped]? initial_query, (^(Hash[String, untyped]) -> untyped)? on_resync) -> Enumerator[Hash[String, untyped], untyped]
+  end
+
+  class K9oClient
+    attr_reader metadata: Metadata
+  end
+end

data/sig/k9o/moat.rbs

@@ -0,0 +1,29 @@
+# RBS signatures for Moat, the local guard around a model call.
+
+module K9o
+  module Moat
+    REASONS: Array[Symbol]
+
+    # Raised when Moat refuses input or output. `reason` is :role_marker, :input_schema, :output_schema or :pii.
+    class Refusal < StandardError
+      attr_reader reason: Symbol
+      attr_reader detail: String
+      def initialize: (Symbol reason, String detail) -> void
+    end
+
+    class ConfigError < ArgumentError
+    end
+
+    class SchemaError < ConfigError
+    end
+
+    def self.new: (prompt: String, ?input_schema: Hash[String | Symbol, untyped]?, ?output_schema: Hash[String | Symbol, untyped]?, ?filters: Hash[Symbol | String, ^(String) -> untyped]?) -> Guard
+
+    class Guard
+      def initialize: (prompt: String, ?input_schema: Hash[String | Symbol, untyped]?, ?output_schema: Hash[String | Symbol, untyped]?, ?filters: Hash[Symbol | String, ^(String) -> untyped]?) -> void
+      def messages: (untyped untrusted_input) -> Array[{ role: String, content: String }]
+      def check_output: (untyped model_output) -> untyped
+      def prompt_sha256: () -> String
+    end
+  end
+end

data/sig/k9o/query.rbs

@@ -0,0 +1,26 @@
+# RBS signatures for `client.query`, `client.search` and the select builder's search methods.
+
+module K9o
+  module Query
+    type value = String | Integer | Float | bool | nil
+
+    # Rewrites :name placeholders to $n; returns [sql, positional values].
+    def self.translate_named_params: (String sql, Hash[(String | Symbol), untyped] named) -> [String, Array[value]]
+  end
+
+  module QueryMethods
+    # An Array binds positionally to $1, $2, ...; a Hash binds :name placeholders. `data` is the array of rows.
+    def query: (String sql, ?(Array[untyped] | Hash[(String | Symbol), untyped])? params) -> Envelope
+
+    def search: (String collection, column: String, q: String, ?language: String?, ?type: String?, ?limit: Integer?, ?cursor: String?) -> Envelope
+  end
+
+  class K9oClient
+    include QueryMethods
+  end
+
+  class SelectBuilder
+    def text_search: (String column, String query, ?language: String, ?type: (String | Symbol)) -> self
+    def vector_search: (String column, Array[Numeric] embedding, ?metric: (String | Symbol), ?limit: Integer?) -> self
+  end
+end

data/sig/k9o/rampart.rbs

@@ -0,0 +1,59 @@
+# RBS signatures for Rampart classification and receipt verification.
+
+module K9o
+  module Jcs
+    class Error < ArgumentError
+      attr_reader kind: Symbol
+      def initialize: (String message, ?Symbol kind) -> void
+    end
+
+    def self.canonicalize: (untyped value) -> String
+    def self.canonical_bytes: (untyped value) -> String
+  end
+
+  module Ed25519
+    def self.verify: (String public_key, String message, String signature) -> bool
+    def self.native?: () -> bool
+  end
+
+  class Rampart
+    RECEIPT_TYP: String
+    CLASSIFICATIONS: Array[String]
+    DEFAULT_CLOCK_SKEW: Integer
+    REASONS: Array[Symbol]
+
+    # Raised by verify_receipt. `reason` is one of REASONS: :malformed, :key_unknown, :alg, :typ, :signature,
+    # :issuer, :project_unknown, :project, :expired, :not_yet_valid, :input_hash.
+    class ReceiptRefusal < KError
+      attr_reader reason: Symbol
+      def initialize: (Symbol reason, String detail) -> void
+    end
+
+    class Verdict < Struct[untyped]
+      attr_accessor classification: String
+      attr_accessor risk_bp: Integer
+      attr_accessor confidence_bp: Integer
+      attr_accessor categories: Array[String]
+      attr_accessor project_id: String
+      attr_accessor calibration_version: String
+      attr_accessor input_sha256: String
+      attr_accessor issued_at: Time
+      attr_accessor expires_at: Time
+      attr_accessor kid: String
+      attr_accessor windows: Integer?
+    end
+
+    def initialize: (untyped config) -> void
+    # data: { "classification", "riskScore", "confidence", "categories", "calibrationVersion", "classificationReceipt", "projectId" }.
+    def classify: (Hash[String | Symbol, untyped] input, ?label: String?) -> Envelope
+    # data: { "keys" => [ { "kid", "kty", "crv", "x", ... } ], "issuer" => "<issuer>/rampart" }. Public: no credential is sent.
+    def jwks: () -> Envelope
+    # `receipt` is the Envelope classify returned (it carries the receipt and its projectId) or the bare receipt String.
+    def verify_receipt: ((Envelope | String) receipt, Hash[String | Symbol, untyped] input, ?key_set: (Hash[untyped, untyped] | Array[Hash[untyped, untyped]])?, ?issuer: String?, ?project_id: String?, ?clock_skew: Numeric, ?clock: (Time | Numeric | ^() -> (Time | Numeric))?) -> Verdict
+    def input_digest: (Hash[String | Symbol, untyped] input) -> String
+  end
+
+  class K9oClient
+    attr_reader rampart: Rampart
+  end
+end

data/sig/k9o/realtime.rbs

@@ -0,0 +1,34 @@
+# RBS signatures for `client.realtime`.
+
+module K9o
+  class Realtime
+    DEFAULT_RETRY_MS: Integer
+    SEEN_LIMIT: Integer
+
+    # Seconds without any bytes after which a connection is abandoned (default 45).
+    def self.idle_timeout: () -> Numeric
+    def self.idle_timeout=: (Numeric) -> Numeric
+    # Longest reconnect delay in seconds (default 30).
+    def self.max_backoff: () -> Numeric
+    def self.max_backoff=: (Numeric) -> Numeric
+    def self.sleeper: () -> ^(Numeric) -> void
+    def self.sleeper=: (^(Numeric) -> void) -> ^(Numeric) -> void
+
+    def initialize: (untyped config) -> void
+    # Yields { "topic", "eventType", "payload", "occurredAt", "eventId" }. Reconnects with `Last-Event-ID`, drops
+    # events already delivered, and calls `on_resync` with { "reason", "action" } when the position is lost.
+    def subscribe: (String topic, ?filter: Hash[untyped, untyped]?, ?on_resync: (^(Hash[String, untyped]) -> untyped)?) -> Enumerator[Hash[String, untyped], untyped]
+
+    # POST /@<slug>/realtime/replay: data is { "events", "nextCursor", "hasMore" } plus "resync" when the topic has no stored history.
+    def replay: (String topic, ?from_sequence: Integer?, ?until_sequence: Integer?, ?limit: Integer?) -> Envelope
+
+    module Topic
+      def self.collection: (String collection) -> String
+      def self.workflow_runs: () -> String
+      def self.query_executed: (String query_id) -> String
+      def self.dashboard_refresh: (String dashboard_id) -> String
+      def self.function_invocations: (String function_id) -> String
+      def self.audit_org: (String event_family) -> String
+    end
+  end
+end

data/sig/k9o/region.rbs

@@ -2,9 +2,6 @@
 
 module K9o
   module Region
-    REGION_FREE_ORG_HOST: Regexp
-    REGION_CODE: Regexp
-
     # The regional origin `location` may name for `host`, or nil.
     def self.origin_from_location: (String host, String location, String base) -> String?
     # The origin requests go to: cached regional origin, else the configured base URL. Never raises.
@@ -17,3 +14,17 @@ module K9o
     attr_accessor regional_origin: String?
   end
 end
+
+module K9o
+  module UrlGrammar
+    # The org, family, region and apex of a gateway host (`acme.api-de01.corp.internal`), or nil for any other shape.
+    class ApiHost < Struct[untyped]
+      attr_reader org_slug: String?
+      attr_reader family: String
+      attr_reader region: String?
+      attr_reader apex: String
+    end
+
+    def self.parse_api_host: (String host) -> ApiHost?
+  end
+end

data/sig/k9o/workload.rbs

@@ -0,0 +1,64 @@
+# RBS signatures for write approval, event triggers, schedules, vectors and end users.
+
+module K9o
+  # True when a single-record write sent with `require_approval` was queued (HTTP 202) instead of applied.
+  def self.queued_write?: (untyped result) -> bool
+
+  class FunctionTriggers
+    def initialize: (untyped config) -> void
+    def list: (String name) -> Envelope
+    def create: (String name, collection: String, events: Array[String | Symbol], ?filter: Hash[untyped, untyped]?, ?enabled: bool?, ?log_ok_invocations: bool?) -> Envelope
+    # Fields: events, filter (nil clears it), enabled, log_ok_invocations. At least one.
+    def update: (String name, String trigger_id, **untyped fields) -> Envelope
+    # data is nil (HTTP 204).
+    def delete: (String name, String trigger_id) -> Envelope
+  end
+
+  # Key custody (read-only). `data` holds mode, attached, provider, lastJob and hsm (nil when absent).
+  class Custody
+    def initialize: (untyped config) -> void
+    def status: () -> Envelope
+  end
+
+  class Schedules
+    def initialize: (untyped config) -> void
+    def list: (?status: (String | Symbol)?, ?function_name: String?, ?limit: Integer?, ?cursor: String?) -> Envelope
+    def get: (String id) -> Envelope
+    def create: (function_name: String, schedule_expression: String, ?schedule_timezone: String?, ?catchup_policy: (String | Symbol)?, ?collection: String?, ?enabled: bool?, ?log_ok_invocations: bool?) -> Envelope
+    # Fields: schedule_expression, schedule_timezone, catchup_policy, status, enabled, log_ok_invocations. At least one.
+    def update: (String id, **untyped fields) -> Envelope
+    # data is nil (HTTP 204).
+    def delete: (String id) -> Envelope
+    def runs: (String id, ?limit: Integer?, ?cursor: String?) -> Envelope
+    def run_now: (String id) -> Envelope
+  end
+
+  class Vectors
+    def initialize: (untyped config) -> void
+    # data is { "results" => [...], "collection" => String }; each result has id, score, _source, contentHash, text (nil when absent), metadata, model (nil) and chunk (nil).
+    def nearest: (String collection, Array[Numeric] query_vector, ?top_k: Integer?, ?min_score: Numeric?, ?metric: (String | Symbol)?, ?filters: Hash[String | Symbol, String | Numeric | bool]?) -> Envelope
+    # rows: Hashes with vector and _source; optional id, contentHash, text, metadata, subjectIds. A single row Hash is accepted. data is { "upserted" => Integer, "collection" => String }.
+    def upsert: (String collection, ?(Array[Hash[String | Symbol, untyped]] | Hash[String | Symbol, untyped])? rows, **untyped row) -> Envelope
+  end
+
+  class EndUsers
+    def initialize: (untyped config) -> void
+    attr_reader role_grants: EndUserRoleGrants
+    def list: (?status: (String | Symbol)?, ?q: String?, ?limit: Integer?, ?cursor: String?) -> Envelope
+    def get: (String id) -> Envelope
+  end
+
+  class EndUserRoleGrants
+    def initialize: (untyped config) -> void
+    # data is the Array of grants.
+    def list: (?end_user_id: String?) -> Envelope
+    # data is the grant.
+    def grant: (end_user_id: String, role: String) -> Envelope
+    # data is { "revoked" => bool, "revokedAt" => String? }.
+    def revoke: (String grant_id) -> Envelope
+  end
+
+  class K9oClient
+    attr_reader vectors: Vectors
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: k9o
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.5.0
 platform: aarch64-linux
 authors:
 - Kilimanjaro
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-25 00:00:00.000000000 Z
+date: 2026-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -41,44 +41,73 @@ files:
 - lib/k9o/_ffi/kibo_kms_rest_ffi.rb
 - lib/k9o/_ffi/libkibo_kms_rest_ffi.so
 - lib/k9o/ai.rb
+- lib/k9o/analytics.rb
+- lib/k9o/approvals.rb
 - lib/k9o/audit.rb
 - lib/k9o/barbican.rb
 - lib/k9o/client.rb
 - lib/k9o/compute.rb
+- lib/k9o/crypto.rb
+- lib/k9o/custody.rb
 - lib/k9o/data.rb
+- lib/k9o/ed25519.rb
+- lib/k9o/end_users.rb
 - lib/k9o/envelope.rb
 - lib/k9o/functions.rb
 - lib/k9o/gate.rb
 - lib/k9o/http_transport.rb
+- lib/k9o/jcs.rb
 - lib/k9o/kerror.rb
+- lib/k9o/keys.rb
 - lib/k9o/kibo.rb
+- lib/k9o/kibo_client_core.rb
+- lib/k9o/kibo_ffi_core.rb
+- lib/k9o/locate.rb
 - lib/k9o/me.rb
+- lib/k9o/metadata.rb
 - lib/k9o/migrations.rb
+- lib/k9o/moat.rb
 - lib/k9o/multipart.rb
 - lib/k9o/org.rb
 - lib/k9o/orgs.rb
 - lib/k9o/policies.rb
 - lib/k9o/projects.rb
+- lib/k9o/query.rb
+- lib/k9o/rampart.rb
 - lib/k9o/realtime.rb
 - lib/k9o/region.rb
+- lib/k9o/schedules.rb
+- lib/k9o/schema.rb
 - lib/k9o/storage.rb
+- lib/k9o/streams.rb
 - lib/k9o/studio.rb
 - lib/k9o/url_grammar.rb
 - lib/k9o/vault.rb
+- lib/k9o/vectors.rb
 - lib/k9o/version.rb
 - sig/k9o/ai.rbs
+- sig/k9o/approvals.rbs
+- sig/k9o/datasets.rbs
 - sig/k9o/gate.rbs
+- sig/k9o/kerror.rbs
+- sig/k9o/kibo_client_core.rbs
+- sig/k9o/metadata.rbs
 - sig/k9o/migrations.rbs
+- sig/k9o/moat.rbs
+- sig/k9o/query.rbs
+- sig/k9o/rampart.rbs
+- sig/k9o/realtime.rbs
 - sig/k9o/region.rbs
 - sig/k9o/storage.rbs
+- sig/k9o/workload.rbs
 homepage: https://kilimanjaro.dev
 licenses:
 - Apache-2.0
 metadata:
   homepage_uri: https://kilimanjaro.dev
   documentation_uri: https://docs.kilimanjaro.dev
-  source_code_uri: https://github.com/k9o-dev/sdk-ruby
-  changelog_uri: https://github.com/k9o-dev/sdk-ruby/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/k9o-platform/sdk-ruby
+  changelog_uri: https://github.com/k9o-platform/sdk-ruby/blob/main/CHANGELOG.md
 post_install_message:
 rdoc_options: []
 require_paths: