k9o 1.2.0-aarch64-linux → 1.5.2-aarch64-linux

data/lib/k9o/vault.rb

@@ -1,48 +1,35 @@
 # frozen_string_literal: true
 
-require 'base64'
 require 'uri'
 
 module K9o
-  # `k9o.kibo.vault.secrets.*` — the typed secrets surface
+  # `k9o.kibo.vault.secrets.*` - the typed secrets surface
   # (`services/gateway/src/routes/vault-secrets.ts`). Full family: list / get /
   # create / reveal_challenge / reveal / update / rotate / move / delete.
   #
-  # Contract live-verified against the real staging gateway (not just the
-  # route's OpenAPI schema, which is wrong/incomplete in several places noted
-  # below) by the `@k9o/kibo` TS reference build — this wrapper mirrors that
-  # verified behavior exactly:
-  #
-  #   - Every operation on a NAMED secret (everything except `list`) REQUIRES
-  #     `region` on the query string. Omitting it fails with
-  #     K9O_INVALID_FIELD_VALUE ("this request requires an authoritative
-  #     region"). NOT documented in the route's OpenAPI schema. `list` is the
-  #     one exception (verified it does NOT need `region`).
-  #   - The wire `value` field is base64 in BOTH directions, contradicting the
-  #     OpenAPI's plain-language "the plaintext to seal" description (reads
-  #     like it should be raw). A raw non-base64 `value` on create/update is
-  #     rejected as unparseable. `create`/`update` take plaintext as a normal
-  #     Ruby String and base64-encode it here; `reveal` base64-decodes the
-  #     wire `value` back to plaintext before returning it — callers never
-  #     see base64 on either side.
-  #   - `update`/`rotate`/`move` responses are LIVE-VERIFIED NARROWER than (or
-  #     entirely undocumented vs.) the OpenAPI's claimed `SecretSummary` — see
-  #     the comment on each method below.
+  #   - `region` is OPTIONAL on every named-secret operation: the gateway
+  #     ignores any caller-supplied region and uses its own. It is sent on the
+  #     query string only when the caller passes one (never by `get`, which
+  #     reads the list route).
+  #   - The wire `value` field is base64 in BOTH directions. `create`/`update`
+  #     take plaintext as a normal Ruby String and base64-encode it here;
+  #     `reveal` base64-decodes the wire `value` back to plaintext before
+  #     returning it - callers never see base64 on either side.
+  #   - `update`/`rotate`/`move` responses are narrower than a full summary -
+  #     see the comment on each method below.
   #
   # `data` is returned as the raw wire Hash (camelCase string keys), matching
-  # this package's existing convention (Projects/Policies/Studio/etc. all
-  # return `envelope.data` untransformed — there is no generic
-  # camelCase<->snake_case response transform anywhere in this gem); `reveal`
-  # is the one exception, where the `value` key is base64-decoded in place
-  # (mirroring the TS reference's own `value`-only transform).
+  # this package's existing convention; `reveal` is the one exception, where
+  # the `value` key is base64-decoded in place.
   class VaultSecrets
+    MAX_GET_PAGES = 20
+
     def initialize(config)
       @config = config
     end
 
     # List secrets (metadata only — never lists ciphertext).
     # `GET /@<project_slug>/vault/secrets`.
-    # The one secrets operation that does NOT need `region` (live-verified).
     def list(prefix: nil, cursor: nil, limit: nil)
       slug = require_project_slug
       q = {}
@@ -56,146 +43,154 @@ module K9o
       )
     end
 
-    # Read a secret's metadata (never its value — use `reveal_challenge` +
+    # Read a secret's metadata (never its value - use `reveal_challenge` +
     # `reveal` for that).
-    # `GET /@<project_slug>/vault/secrets/<name>?region=<region>`.
     #
-    # KNOWN LIVE BUG (staging, 2026-09-05): this call currently fails with
-    # K9O_REVEAL_CHALLENGE_REQUIRED on every attempt — the gateway does not
-    # honor its own documented "no X-K9O-Reveal-Challenge header => return
-    # metadata" behavior; it demands a challenge unconditionally. Implemented
-    # per the documented contract anyway (this is a backend defect to flag,
-    # not something to design around) — `list(prefix: exact_name)` is the
-    # current working alternative for a single secret's metadata until the
-    # gateway side is fixed.
-    def get(name, region:)
-      slug = require_project_slug
-      HttpTransport.request(
-        config: @config, method: 'GET',
-        path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'region' => region }
+    # `GET /@<project>/vault/secrets/<name>` is a reveal and always demands an
+    # `X-K9O-Reveal-Challenge` header, so metadata is read from the list route:
+    # list with the exact name as `prefix` (limit 100, following `nextCursor`
+    # for up to MAX_GET_PAGES pages) and return the secret whose `name` equals
+    # the argument. Raises `KError` `K9O_NOT_FOUND` (status 404) when none
+    # matches. `region` is accepted for symmetry and not sent.
+    def get(name, region: nil) # rubocop:disable Lint/UnusedMethodArgument
+      cursor = nil
+      MAX_GET_PAGES.times do
+        env = list(prefix: name, cursor: cursor, limit: 100)
+        data = env.data || {}
+        secret = (data['secrets'] || []).find { |s| s['name'] == name }
+        return Envelope.new(data: secret, meta: env.meta) if secret
+
+        cursor = data['nextCursor']
+        break if cursor.nil? || cursor.to_s.empty?
+      end
+      raise KError.new(
+        code: 'K9O_NOT_FOUND',
+        message: "No secret named '#{name}' in this project.",
+        context: { 'name' => name },
+        status: 404
       )
     end
 
     # Create a secret under the caller's own auth.
-    # `POST /@<project_slug>/vault/secrets/<name>?region=<region>` → the full
-    # `sec_<base62>` summary.
-    #
-    # `region` scopes the vault WRITE itself (residency guard) and is
-    # REQUIRED — live-verified against staging, not documented in the route's
-    # OpenAPI schema.
+    # `POST /@<project_slug>/vault/secrets/<name>` (+ `region` when given) -> the
+    # full `sec_<base62>` summary.
     #
     # `visibility` (`{'kind' => 'private'}` or
     # `{'kind' => 'shared', 'principals' => [...], 'roles' => [...]}`) and
-    # `metadata` (`Hash[String, String]`) are passed through verbatim — their
-    # own field names are already single words, so no wire-casing applies.
-    def create(name:, value:, region:, visibility: nil, metadata: nil)
+    # `metadata` (`Hash[String, String]`) are passed through verbatim.
+    def create(name:, value:, region: nil, visibility: nil, metadata: nil)
       slug = require_project_slug
-      body = { 'value' => Base64.strict_encode64(value) }
+      body = { 'value' => [value].pack('m0') }
       body['visibility'] = visibility if visibility
       body['metadata'] = metadata if metadata
       HttpTransport.request(
         config: @config, method: 'POST',
         path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'region' => region },
+        query: region_query(region),
         body: body
       )
     end
 
     # Mint a single-use reveal challenge — present it as
     # `X-K9O-Reveal-Challenge` on the immediately-following `reveal` call.
-    # `POST .../<name>?op=reveal-challenge&region=<region>`.
-    def reveal_challenge(name, region:)
+    # `POST .../<name>?op=reveal-challenge`.
+    def reveal_challenge(name, region: nil)
       slug = require_project_slug
       HttpTransport.request(
         config: @config, method: 'POST',
         path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'op' => 'reveal-challenge', 'region' => region }
+        query: region_query(region, 'op' => 'reveal-challenge')
       )
     end
 
     # Reveal a secret's plaintext value using a single-use challenge from
-    # `reveal_challenge`. `GET .../<name>?region=<region>` with
+    # `reveal_challenge`. `GET .../<name>` with
     # `X-K9O-Reveal-Challenge`. Base64-decodes the wire's `value` back to
-    # plaintext (live-verified: the reveal response's `value` is base64,
-    # symmetric with `create`'s encode) before returning it to the caller.
-    def reveal(name, region:, challenge:)
+    # plaintext (the reveal response's `value` is base64, symmetric with
+    # `create`'s encode) before returning it to the caller.
+    def reveal(name, challenge:, region: nil)
       slug = require_project_slug
       envelope = HttpTransport.request(
         config: @config, method: 'GET',
         path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'region' => region },
+        query: region_query(region),
         headers: { 'X-K9O-Reveal-Challenge' => challenge }
       )
       data = envelope.data
       if data.is_a?(Hash) && data.key?('value')
-        data = data.merge('value' => Base64.decode64(data['value']))
+        data = data.merge('value' => data['value'].unpack1('m'))
       end
       Envelope.new(data: data, meta: envelope.meta)
     end
 
     # Update a secret's value (bumps version) — owner-only.
-    # `PUT .../<name>?region=<region>`.
+    # `PUT .../<name>`.
     #
-    # LIVE-VERIFIED NARROWER than documented: the gateway returns only
+    # Narrower than a full summary: the gateway returns only
     # `{id, name, version}` on a real PUT, not the full summary the OpenAPI
     # schema claims — call `get` afterward if the full summary is needed.
-    def update(name, region:, value:, metadata: nil)
+    def update(name, value:, region: nil, metadata: nil)
       slug = require_project_slug
-      body = { 'value' => Base64.strict_encode64(value) }
+      body = { 'value' => [value].pack('m0') }
       body['metadata'] = metadata if metadata
       HttpTransport.request(
         config: @config, method: 'PUT',
         path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'region' => region },
+        query: region_query(region),
         body: body
       )
     end
 
     # Rotate a secret's wrapping key (re-wraps under a fresh `kid`; content
-    # unchanged) — owner-only. `POST .../<name>?op=rotate&region=<region>`.
+    # unchanged) — owner-only. `POST .../<name>?op=rotate`.
     #
-    # LIVE-VERIFIED undocumented shape: `{id, name, version, rotatedAt,
+    # Response shape: `{id, name, version, rotatedAt,
     # ledgerSequenceNumber}` — the route's OpenAPI schema doesn't document
     # this response at all.
-    def rotate(name, region:)
+    def rotate(name, region: nil)
       slug = require_project_slug
       HttpTransport.request(
         config: @config, method: 'POST',
         path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'op' => 'rotate', 'region' => region }
+        query: region_query(region, 'op' => 'rotate')
       )
     end
 
     # Move (rename) a secret's hierarchical path — owner-only.
-    # `POST .../<name>?op=move&region=<region>` with `{newPath}`.
+    # `POST .../<name>?op=move` with `{newPath}`.
     #
-    # LIVE-VERIFIED undocumented shape: `{id, name, event}` (observed
+    # Response shape: `{id, name, event}` (observed
     # `event: "SECRET_PATH_CHANGED"`; treat as a plain String, not a closed
     # enum — only one sample was observed).
-    def move(name, region:, new_path:)
+    def move(name, new_path:, region: nil)
       slug = require_project_slug
       HttpTransport.request(
         config: @config, method: 'POST',
         path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'op' => 'move', 'region' => region },
+        query: region_query(region, 'op' => 'move'),
         body: { 'newPath' => new_path }
       )
     end
 
-    # Retire a secret — owner-only. `DELETE .../<name>?region=<region>` →
-    # `204 No Content` (HttpTransport already maps that to `data: nil`).
-    def delete(name, region:)
+    # Retire a secret - owner-only. `DELETE .../<name>`; any 2xx is success
+    # (204 No Content maps to `data: nil`).
+    def delete(name, region: nil)
       slug = require_project_slug
       HttpTransport.request(
         config: @config, method: 'DELETE',
         path: UrlGrammar.project_path(slug, "vault/secrets/#{enc(name)}"),
-        query: { 'region' => region }
+        query: region_query(region)
       )
     end
 
     private
 
+    def region_query(region, extra = {})
+      q = extra.dup
+      q['region'] = region if region
+      q
+    end
+
     def require_project_slug
       Studio.require_project_slug(@config, 'kibo.vault.secrets')
     end
@@ -206,8 +201,8 @@ module K9o
   end
 
   # `k9o.kibo.vault.*` — the Kibo vault surface (member-plane, project-scoped).
-  # Currently just `secrets`; a `zk_deks` accessor
-  # (F.5, `POST vault/zk-deks` / `GET vault/zk-deks/<id>`) would
+  # Currently just `secrets` ; a `zk_deks` accessor
+  # (`POST vault/zk-deks` / `GET vault/zk-deks/<id>`) would
   # nest here alongside it if/when that surface is built for Ruby — out of
   # scope for this wrapper, which only covers the vault-secrets audit gap.
   class KiboVault
@@ -220,7 +215,7 @@ module K9o
 
   # `k9o.kibo.*` — per-client namespace root for the Kibo vault REST surface.
   # Distinct from the module-level `K9o::Kibo` (native ZK `encrypt`/`decrypt`
-  # FFI bindings, /, called directly as
+  # FFI bindings, called directly as
   # `K9o::Kibo.encrypt`/`.decrypt` since that surface needs no per-client HTTP
   # config): this class exists so `client.kibo.vault.secrets.*` is reachable
   # per client instance, mirroring the TS reference's

data/lib/k9o/vectors.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+module K9o
+  # Vector collections: k9o.vectors.* store embeddings you computed yourself, next to the text and metadata they came
+  # from, and find the nearest ones.
+  #
+  #   nearest(collection, query_vector, top_k:, min_score:, metric:, filters:)  POST /@<slug>/vectors/<collection>/search
+  #   upsert(collection, rows)                                                  POST /@<slug>/vectors/<collection>/upsert
+  #
+  # Both send the vector in the request body, so they take real embeddings of any common size (up to 16000 numbers).
+  # The collection name must start with +_+. The first upsert creates the collection and fixes its dimension; every
+  # later vector must have the same length. Searching a collection that was never upserted answers 404
+  # K9O_COLLECTION_NOT_FOUND.
+  class Vectors
+    METRICS = %w[cosine euclidean dot].freeze
+    MAX_VECTOR = 16_000
+    MAX_ROWS = 1000
+    # Snake_case spellings accepted for the camelCase wire keys of a row and of its +_source+.
+    ROW_ALIASES = { 'content_hash' => 'contentHash', 'subject_ids' => 'subjectIds' }.freeze
+    SOURCE_ALIASES = { 'chunk_index' => 'chunkIndex' }.freeze
+
+    def initialize(config)
+      @config = config
+    end
+
+    # The rows nearest to +query_vector+ (1 to 16000 numbers), closest first. +top_k+ is 1 to 1000 (the gateway
+    # defaults to 10); +min_score+ drops results scoring below it; +metric+ is cosine (default), euclidean or dot;
+    # +filters+ is a Hash of equality checks on +id+, +contentHash+, +source.<key>+ and +metadata.<key>+.
+    # +data+ is { 'results' => [...], 'collection' => name }.
+    def nearest(collection, query_vector, top_k: nil, min_score: nil, metric: nil, filters: nil)
+      route = path(collection, 'search')
+      check_vector(query_vector, 'query_vector')
+      body = { 'queryVector' => query_vector.to_a }
+      unless top_k.nil?
+        unless top_k.is_a?(Integer) && top_k >= 1 && top_k <= 1000
+          raise invalid('top_k must be a whole number from 1 to 1000', top_k: top_k)
+        end
+
+        body['topK'] = top_k
+      end
+      unless min_score.nil?
+        raise invalid('min_score must be a number', min_score: min_score) unless finite?(min_score)
+
+        body['minScore'] = min_score
+      end
+      body['metric'] = ApprovalChecks.enum!(metric, METRICS, 'metric') unless metric.nil?
+      unless filters.nil?
+        raise invalid('filters must be a Hash of path to value') unless filters.is_a?(Hash)
+
+        body['filters'] = filters.transform_keys(&:to_s)
+      end
+      call(route, body)
+    end
+
+    # Insert or overwrite 1 to 1000 rows in one request; the first upsert creates the collection. A row is a Hash
+    # with +vector+ and +_source+ ({ handle:, chunkIndex: }), and optionally +id+, +contentHash+, +text+, +metadata+
+    # and +subjectIds+ (one end-user id, ["eu_..."]; required unless the collection was declared shared). Keys may
+    # be strings or symbols, and +content_hash+, +subject_ids+ and +chunk_index+ are accepted for the camelCase
+    # names. A single row may be passed on its own, with or without braces. +data+ is { 'upserted' => n,
+    # 'collection' => name }.
+    def upsert(collection, rows = nil, **row)
+      route = path(collection, 'upsert')
+      rows = [row] if rows.nil? && !row.empty?
+      rows = [rows] if rows.is_a?(Hash)
+      unless rows.is_a?(Array) && rows.size >= 1 && rows.size <= MAX_ROWS
+        raise invalid("rows must be an array of 1 to #{MAX_ROWS} rows")
+      end
+
+      wire = rows.each_with_index.map do |entry, index|
+        raise invalid("rows[#{index}] must be a Hash") unless entry.is_a?(Hash)
+
+        normalize_row(entry, index)
+      end
+      call(route, 'rows' => wire)
+    end
+
+    private
+
+    def normalize_row(entry, index)
+      row = entry.each_with_object({}) do |(key, value), out|
+        name = key.to_s
+        out[ROW_ALIASES.fetch(name, name)] = value
+      end
+      check_vector(row['vector'], "rows[#{index}].vector")
+      source = row['_source']
+      if source.is_a?(Hash)
+        row['_source'] = source.each_with_object({}) do |(key, value), out|
+          name = key.to_s
+          out[SOURCE_ALIASES.fetch(name, name)] = value
+        end
+      end
+      row['vector'] = row['vector'].to_a
+      row
+    end
+
+    def check_vector(vector, name)
+      unless vector.is_a?(Array) && vector.size >= 1 && vector.size <= MAX_VECTOR
+        raise invalid("#{name} must be an array of 1 to #{MAX_VECTOR} numbers")
+      end
+      return if vector.all? { |n| finite?(n) }
+
+      raise invalid("#{name} must contain only finite numbers")
+    end
+
+    def finite?(value)
+      value.is_a?(Numeric) && !value.is_a?(Complex) && (!value.respond_to?(:finite?) || value.finite?)
+    end
+
+    def invalid(message, context = {})
+      ApprovalChecks.invalid(message, context)
+    end
+
+    def call(route, body)
+      HttpTransport.request(config: @config, method: 'POST', path: route, body: body)
+    end
+
+    def path(collection, tail)
+      raise invalid('a vector collection name must start with _', collection: collection) unless collection.is_a?(String) && collection.start_with?('_')
+
+      slug = Studio.require_project_slug(@config, 'vectors')
+      UrlGrammar.project_path(slug, "vectors/#{::URI.encode_www_form_component(collection).gsub('+', '%20')}/#{tail}")
+    end
+  end
+end

data/lib/k9o/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module K9o
-  VERSION = '1.2.0'
+  VERSION = '1.5.2'
 end

data/lib/k9o.rb

@@ -29,15 +29,30 @@ require_relative 'k9o/url_grammar'
 require_relative 'k9o/region'
 require_relative 'k9o/http_transport'
 require_relative 'k9o/data'
+require_relative 'k9o/query'
 require_relative 'k9o/projects'
+require_relative 'k9o/locate'
 require_relative 'k9o/gate'
 require_relative 'k9o/studio'
 require_relative 'k9o/compute'
 require_relative 'k9o/ai'
 require_relative 'k9o/storage'
 require_relative 'k9o/realtime'
+require_relative 'k9o/streams'
+require_relative 'k9o/approvals'
+require_relative 'k9o/schema'
 require_relative 'k9o/migrations'
 require_relative 'k9o/functions'
+require_relative 'k9o/schedules'
+require_relative 'k9o/vectors'
+require_relative 'k9o/metadata'
+require_relative 'k9o/rampart'
+require_relative 'k9o/moat'
+require_relative 'k9o/custody'
+require_relative 'k9o/analytics'
+require_relative 'k9o/keys'
+require_relative 'k9o/crypto'
+require_relative 'k9o/end_users'
 require_relative 'k9o/policies'
 require_relative 'k9o/audit'
 require_relative 'k9o/orgs'
@@ -46,6 +61,8 @@ require_relative 'k9o/org'
 # kibo ZK BYOK/HYOK crypto — self-guards its native binding (LoadError-safe), so
 # requiring k9o never breaks on a platform without the kibo native lib.
 require_relative 'k9o/kibo'
+require_relative 'k9o/kibo_client_core'
+require_relative 'k9o/kibo_ffi_core'
 # kibo vault REST surface (client.kibo.vault.secrets) —.
 require_relative 'k9o/vault'
 # Barbican guardrail SDK — self-guards its native binding (LoadError-safe), so

data/sig/k9o/ai.rbs

@@ -8,6 +8,10 @@ module K9o
     # { "embeddings" => Array[Array[Float]], "model" => String, "dimensions" => Integer }.
     def initialize: (untyped config) -> void
     def embed: (input: (String | Array[String]), ?model: String?) -> Envelope
+
+    # Only the fields given are sent. Returns an Envelope whose `data` is
+    # { "modelId" => String, "content" => String, "finishReason" => String, "usage" => Hash, "usageType" => String }.
+    def generate: (String prompt, ?model: String?, ?max_tokens: Integer?, ?temperature: Numeric?, ?usage_type: String?) -> Envelope
   end
 
   class K9oClient

data/sig/k9o/approvals.rbs

@@ -0,0 +1,71 @@
+# RBS signatures for `client.approvals`, `client.approval_policies` and `client.schema`.
+
+module K9o
+  module ApprovalChecks
+    def self.invalid: (String message, ?Hash[Symbol, untyped] context) -> KError
+    def self.check_limit: (untyped limit) -> void
+    def self.id_segment: (untyped value, String what) -> String
+    def self.reason!: (untyped reason) -> String
+    def self.predicate!: (untyped value, String field) -> Hash[untyped, untyped]
+    def self.enum!: (untyped value, Array[String] allowed, String field) -> String
+  end
+
+  class Approvals
+    attr_reader comments: ApprovalComments
+    def initialize: (untyped config) -> void
+    # One page, newest first. `limit` is 1 to 200 (default 50); pass `meta.cursor.next` back as `cursor`
+    # (nil on the last page).
+    def list: (?status: (String | Symbol)?, ?limit: Integer?, ?cursor: String?) -> Envelope
+    def get: (String id) -> Envelope
+    # `status` on the answer stays "pending_approval" while more approvers are needed.
+    def approve: (String id, ?reason: String?) -> Envelope
+    def reject: (String id, reason: String) -> Envelope
+    # HTTP 200 even when rows fail: `data["failed"]` is an Array of { "id", "code", "reason" } (empty when none).
+    # Compare `affectedIds` with what you intended.
+    def bulk: (action: (String | Symbol), criteria: Hash[(String | Symbol), untyped], ?reason: String?) -> Envelope
+  end
+
+  # `approvals.comments`. Posting needs a session (a personal access token alone is refused, K9O_RBAC_DENY).
+  class ApprovalComments
+    VISIBILITIES: Array[String]
+    BODY_MAX: Integer
+
+    # An Envelope whose data is the Array of comments, oldest first; `next_cursor` is nil on the last page.
+    # A comment is { "id", "caseId", "authorId", "visibility", "body", "createdAt" }.
+    class Page < Envelope
+      attr_reader next_cursor: String?
+      def initialize: (data: untyped, meta: Meta, ?next_cursor: String?) -> void
+    end
+
+    def initialize: (untyped config) -> void
+    # `body` is 1 to 4000 characters; `visibility` is "everyone" or "approvers_only", fixed once posted. HTTP 201.
+    def add: (String pending_id, body: String, visibility: (String | Symbol)) -> Envelope
+    # `limit` is 1 to 200 (default 50); pass `next_cursor` back as `cursor`.
+    def list: (String pending_id, ?limit: Integer?, ?cursor: String?) -> Page
+  end
+
+  class ApprovalPolicies
+    COLLECTION_RE: Regexp
+
+    def initialize: (untyped config) -> void
+    def list: () -> Envelope
+    def create: (collection: String, operation: (String | Symbol), action: (String | Symbol), predicate: Hash[(String | Symbol), untyped]) -> Envelope
+    def delete: (String id) -> Envelope
+  end
+
+  class SchemaCollections
+    def initialize: (untyped config) -> void
+    def list: (?limit: Integer?, ?cursor: String?) -> Envelope
+  end
+
+  class Schema
+    attr_reader collections: SchemaCollections
+    def initialize: (untyped config) -> void
+  end
+
+  class K9oClient
+    attr_reader approvals: Approvals
+    attr_reader approval_policies: ApprovalPolicies
+    attr_reader schema: Schema
+  end
+end