k9o 1.3.0 → 1.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fddde5f475c121ba44d0e069107845e30e0104613b717edb809813d152e2882a
-  data.tar.gz: af7564a794aa6c40150a09bf38800dad60e092afb26dfdf8e918524124b4a68c
+  metadata.gz: eaf2bcfb047371f56983f311783294b81d482812171a893b3e57ea5361d9a5e1
+  data.tar.gz: 1afe1668983a800d3c061f11e5f6117bda5eff6459b1f7aab210b091f7f8eaaa
 SHA512:
-  metadata.gz: c3735d8f97f9a0eacc9fa02dcf897ac0182056c606179b7cdcc104cc32ebba9ddb14b433c7522e30e4a10deadbd8b13022de1db262f4abccb2912b9edb05ac4a
-  data.tar.gz: f4f833edfa3f6fc6ea2d75efccfb85f09c902e0e2fb79cc43c8edad7db02bcd3817832087227005944fb4714f198ac4b0dd6f88134248698c9d2b4e3674aa1a0
+  metadata.gz: d4595a0da65edfee744aac3adac7f8f96b4aa67352bc013dca3c3b8bcb534182992f83387bd554e17c9da50c07275a0172fb8ab4488dab6a23b81570fbcefaf2
+  data.tar.gz: 9686288bd9ea43dbabb7148e6033d78a45124b16f72774856ac26d893638f1794dc64948e4778fb27237d9a310c62c20f17de4786bc4aa528a3c727e807be45a

data/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog — k9o (Ruby)
 
+## 1.4.0 (unreleased)
+
+### Added
+
+- `query(sql, params)`: one read-only SQL statement; an array binds `$1, $2, ...`, a hash binds `:name` placeholders.
+- `search(collection, column:, q:)`: full-text search over one column, plus `text_search` and `vector_search` on `select`.
+- `ai.generate`: text generation from a prompt (verb sugar over `compute.llms.invoke`; `model` defaults to the org's default LLM).
+- `streams` namespace for user data streams: `create`, `list`, `get`, `delete`, `publish`, `replay` and `subscribe`.
+  `subscribe` tails live events over SSE and reconnects from the last sequence when the server closes the connection.
+
+- `approvals` namespace for the pending-change queue: `list`, `get`, `approve`, `reject` and `bulk`.
+- `approval_policies` namespace: `list`, `create` and `delete`.
+- `schema.collections.list`: the project's collections with row counts and last migration, paged by cursor.
+
+### Changed
+
+- The README description now covers streams and realtime, and the platform overview moved to an "About Kilimanjaro" appendix.
+- Function deploy examples use the sandbox tier.
+
 ## 1.3.0 — 2026-10-26
 
 Every method now matches the gateway.
@@ -37,7 +56,7 @@ Every method now matches the gateway.
 
 ## 1.2.0 — 2026-10-25
 
-- The README now introduces the Kilimanjaro products (Keep, Pulse, Gate, Kibo). No change to the public API.
+- The README now introduces the Kilimanjaro building blocks (Keep, Pulse, Gate, Kibo). No change to the public API.
 
 ## 1.1.1 — 2026-10-25
 

data/README.md

@@ -1,14 +1,7 @@
 # k9o
 
-The Kilimanjaro platform SDK for Ruby.
-
-Kilimanjaro is the AI-native foundation for building critical applications.
-Its products are:
-
-- Keep: AI Security and Governance
-- Pulse: Data Intelligence
-- Gate: Customer Identity and Access Management
-- Kibo: Keys and Secrets Management
+Client for Kilimanjaro. Read and write your data, store files, manage policies and migrations,
+deploy and invoke agents or functions, and publish to and subscribe to streams and realtime events.
 
 ## Contents
 
@@ -17,8 +10,15 @@ Its products are:
 - [Quick start](#quick-start)
 - [Authentication and project context](#authentication-and-project-context)
 - [Running queries](#running-queries)
+- [Query with SQL](#query-with-sql)
+- [Search](#search)
+- [Streams](#streams)
+- [Approvals](#approvals)
+- [Approval policies](#approval-policies)
+- [Schema collections](#schema-collections)
 - [Handling errors](#handling-errors)
 - [Appendix](#appendix)
+  - [About Kilimanjaro](#about-kilimanjaro)
 - [License](#license)
 
 ## Links
@@ -31,13 +31,13 @@ Its products are:
 ## Install
 
 ```bash
-gem install k9o
+gem install k9o -v 1.4.0
 ```
 
 Or add it to your `Gemfile`:
 
 ```ruby
-gem "k9o"
+gem "k9o", "1.4.0"
 ```
 
 Requires Ruby 3.2 or newer. See [requirements](#requirements) for details.
@@ -63,11 +63,11 @@ k9o = K9o.create_client(
 ```ruby
 new_task = { "title" => "Write the README", "done" => false }
 created = k9o.from("tasks").insert(new_task)
-puts "created: #{created.data['title']}"
+puts "Output: #{created.data['title']}"
 ```
 
 ```text
-created: Write the README
+Output: Write the README
 ```
 
 ### List tasks
@@ -75,12 +75,12 @@ created: Write the README
 ```ruby
 response = k9o.from("tasks").select.eq("done", false).limit(10).execute
 response.data.each do |task|
-  puts "#{task['title']} #{task['done']}"
+  puts "Output: #{task['title']} #{task['done']}"
 end
 ```
 
 ```text
-Write the README false
+Output: Write the README false
 ```
 
 ### Update and delete a task
@@ -143,13 +143,193 @@ A sub-object the server did not send is `nil`, so use `&.` when it may be absent
 ```ruby
 request_id = response.meta.context.request_id
 total = response.meta.cursor.total_count
-puts "#{request_id} #{total}"
+puts "Output: #{request_id} #{total}"
+```
+
+```text
+Output: req_01H... 1
+```
+
+## Query with SQL
+
+`k9o.query(sql, params)` runs one read-only SQL statement and returns the rows in `data`.
+It is read-only (a write is refused with `K9O_RAW_SQL_READ_ONLY`; change data through `from`), takes one statement per call,
+applies row-level security, accepts at most 100000 characters of SQL and 1000 parameters, and needs the project editor role.
+A reference to `dataset.<name>` reads an analytics dataset.
+
+Pass an array to bind `$1`, `$2`, and so on, or a hash to bind `:name` placeholders. Values are bound by the database and can be a string, number, boolean or `nil`; serialise anything else (for example as JSON text) first.
+
+```ruby
+rows = k9o.query("SELECT data->>'title' AS title FROM posts WHERE data->>'status' = :status", status: "published")
+puts "Output: #{rows.data.first['title']}"
+
+same = k9o.query("SELECT count(*) AS n FROM posts WHERE data->>'status' = $1", ["published"])
+puts "Output: #{same.data.first['n']}"
+```
+
+```text
+Output: Hello
+Output: 12
+```
+
+A `:name` with no key in the hash raises `K9o::KError` with code `K9O_INVALID_FIELD_VALUE` before any request is sent.
+
+## Search
+
+`k9o.search(collection, column:, q:)` runs a full-text search over one text column, best matches first.
+`language:` defaults to `english`; `type:` is `plain` (default), `phrase` or `websearch`. `limit:` and `cursor:` page the result.
+
+```ruby
+found = k9o.search("articles", column: "body", q: "climate resilience", limit: 5)
+puts "Output: #{found.data.length} #{found.data.first['title']}"
+```
+
+```text
+Output: 5 Adapting to heat
+```
+
+The same search is available on a query as `text_search(column, query, language: "english", type: "plain")`.
+`vector_search(column, embedding, metric: "cosine", limit: nil)` finds the closest rows to an embedding, closest first;
+`metric:` is `cosine`, `euclidean` or `dot`, and `limit:` is 1 to 1000.
+
+```ruby
+vector = k9o.ai.embed(input: "heat waves").data["embeddings"].first
+near = k9o.from("articles").select.vector_search("embedding", vector, limit: 3).execute
+puts "Output: #{near.data.length}"
+```
+
+```text
+Output: 3
+```
+
+## Streams
+
+Publish events to a stream and tail them live. Publishing needs the project admin role; subscribing and replaying need admin or auditor.
+`subscribe` reconnects from the last sequence when the server closes the connection, so no event is repeated or skipped.
+
+```ruby
+stream = k9o.streams.create("Orders feed", 1_073_741_824)
+slug = stream.data["slug"]
+puts "Output: #{slug}"
+k9o.streams.publish(slug, { "order" => 1001 }, subject: "eu.new")
+
+k9o.streams.subscribe(slug).each do |event|
+  puts "Output: #{event["sequence"]} #{event["data"]["order"]}"
+  break
+end
 ```
 
 ```text
-req_01H... 1
+Output: orders-feed
+Output: 1 1001
 ```
 
+`replay` reads a bounded range of past events.
+Failures raise `K9o::KError`: `K9O_STREAM_UNAVAILABLE` while streams are not available, and `K9O_STREAM_INVALID` for a bad subject.
+
+## Approvals
+
+Writes that need approval wait in a queue for a second person. `k9o.approvals` reads that queue and decides its changes.
+Project admins and auditors see every change; other members see only the ones they proposed.
+
+```ruby
+queue = k9o.approvals.list(status: "pending_approval", limit: 20)
+change = queue.data.first
+
+puts "Output: #{change["id"]} #{change["operation"]} #{change["collection"]}"
+
+decided = k9o.approvals.approve(change["id"], reason: "checked the amount")
+
+puts "Output: #{decided.data["status"]}"
+```
+
+```text
+Output: apr_01j9x3 update orders
+Output: redeemed
+```
+
+- A change is `pending_approval`, `approved`, `rejected`, `expired` or `redeemed` (applied). An `expired` change can still read `pending_approval` until someone decides it.
+- `approve` can answer 200 with `status` still `pending_approval`. That means your approval is recorded and more approvers are needed; the change is not applied yet.
+- `reject(id, reason:)` needs a non-empty `reason`; the SDK checks it before sending.
+- `list` is not paginated: it returns the newest `limit` changes (1 to 200, default 50). `get(id)` reads one.
+- Deciding needs the queue-admin role (project admin or auditor).
+
+Decide many at once with `bulk`. `criteria` is a predicate over each pending change (see [Approval policies](#approval-policies)):
+
+```ruby
+run = k9o.approvals.bulk(
+  action: "reject",
+  criteria: { "eq" => ["change.table", "orders"] },
+  reason: "stale"
+)
+
+puts "Output: #{run.data["affectedCount"]} #{run.data["affectedIds"].join(",")}"
+```
+
+```text
+Output: 2 apr_01j9x3,apr_01j9x4
+```
+
+- A row that fails (a conflict, an apply error) is skipped silently and left out of `affectedIds`. Compare `affectedIds` with the set you intended.
+- `reject` needs a `reason`; `criteria` must be a predicate hash. `attestationId` identifies the batch, even when nothing matched.
+- It considers the newest 10000 pending changes. Bulk approve is not guaranteed to apply every matched row.
+
+## Approval policies
+
+A policy decides what happens to writes on one collection that match a predicate: `queue` them for approval, or `auto_approve` them.
+For a write the first matching policy, oldest first, decides. Policies are evaluated for writes sent with the `requireApproval=true` query parameter.
+
+```ruby
+policy = k9o.approval_policies.create(
+  collection: "orders",
+  operation: "update",
+  action: "queue",
+  predicate: { "gt" => ["change.row.amount", 1000] }
+)
+
+puts "Output: #{policy.data["id"]} #{policy.data["action"]}"
+
+removed = k9o.approval_policies.delete(policy.data["id"])
+
+puts "Output: #{removed.data["id"]}"
+```
+
+```text
+Output: apo_01j9x5 queue
+Output: apo_01j9x5
+```
+
+- `operation` is `insert`, `update` or `delete`; `action` is `auto_approve` or `queue`.
+- `collection` matches `^[a-zA-Z_][a-zA-Z0-9_]{0,62}$` and `predicate` is a non-null hash. The SDK checks both before sending.
+- A predicate has one operator key: `and`, `or`, `not`, `eq`, `neq`, `gt`, `gte`, `lt`, `lte`, `in`, `not_in`, `in_cidr`, `not_in_cidr` or `contains`.
+  `and` and `or` take an array of predicates, `not` takes one, and a comparison takes `[left, right]`.
+- Operands start with `maker.` or `change.` (for example `change.row.amount`, `change.table`, `change.operation`, `maker.id`).
+- `list` returns all policies. Identical policies are not de-duplicated. Creating and deleting need project admin or author.
+
+## Schema collections
+
+`k9o.schema.collections.list` lists the project's collections by name, with their size and last migration.
+
+```ruby
+page = k9o.schema.collections.list(limit: 2)
+
+page.data.each do |collection|
+  puts "Output: #{collection["name"]} #{collection["rowCount"]} rows, #{collection["columnCount"]} columns"
+end
+puts "Output: next #{page.meta.cursor.next}"
+```
+
+```text
+Output: orders 120 rows, 8 columns
+Output: tasks 14 rows, 4 columns
+Output: next dGFza3M
+```
+
+- Pass `meta.cursor.next` as `cursor` for the next page; it is `nil` on the last page. `limit` is 1 to 200 (default 50).
+- A row is `name`, `rowCount`, `rowCountIsExact`, `columnCount`, `indexCount`, `lastMigrationSlug` and `lastMigrationAppliedAt`.
+- `rowCount` is a live count that skips soft-deleted rows and ignores row-level security. Without an `org_id` claim on the token, `meta.warnings` says so.
+- Project admins, auditors, editors, members and viewers can read it.
+
 ## Handling errors
 
 Failures raise `K9o::KError`, a subclass of `StandardError`. Branch on `code`.
@@ -158,14 +338,14 @@ Failures raise `K9o::KError`, a subclass of `StandardError`. Branch on `code`.
 begin
   k9o.from("missing").select.execute
 rescue K9o::KError => error
-  puts "#{error.code} #{error.status} #{error.request_id}"
-  puts error.message
+  puts "Output: #{error.code} #{error.status} #{error.request_id}"
+  puts "Output: #{error.message}"
 end
 ```
 
 ```text
-K9O_NOT_FOUND 404 req_01H...
-Collection not found
+Output: K9O_NOT_FOUND 404 req_01H...
+Output: Collection not found
 ```
 
 - See [error attributes](#error-attributes) for every field.
@@ -235,6 +415,8 @@ Chain filters before `execute`. Values are matched against one column.
 | `limit(n)` | Maximum rows to return. |
 | `cursor(token)` | Continue from `meta.cursor.next`. |
 | `count(mode)` | Row count mode: `none`, `exact` or `estimated`. |
+| `text_search(column, query, language: "english", type: "plain")` | Full-text search over one column. |
+| `vector_search(column, embedding, metric: "cosine", limit: nil)` | Nearest rows to an embedding, closest first. |
 
 #### Projects
 
@@ -249,11 +431,11 @@ Chain filters before `execute`. Values are matched against one column.
 
 ```ruby
 project = k9o.projects.create(display_name: "Task app", slug: "task-app")
-puts project.data["slug"]
+puts "Output: #{project.data["slug"]}"
 ```
 
 ```text
-task-app
+Output: task-app
 ```
 
 #### Gate (end-user sign-in)
@@ -271,11 +453,11 @@ task-app
 ```ruby
 session = k9o.gate.sign_in(email: "ada@example.com", password: "correct-horse")
 user = session.data["user"]
-puts user["email"]
+puts "Output: #{user["email"]}"
 ```
 
 ```text
-ada@example.com
+Output: ada@example.com
 ```
 
 #### Storage
@@ -324,24 +506,24 @@ signed = avatars.create_signed_url("ada.png", expires_in: 300)
 | `k9o.functions.delete` | Remove a function. |
 | `k9o.functions.invoke` | Run a function. The `payload` argument is sent as `{payload}`. |
 
-`tier:` is `"gateway"` (WebAssembly, `"wasm"`) or `"sandbox"` (OCI image archive, `"tar"`).
+`tier:` is `"sandbox"` (an OCI image archive, `"tar"`, up to 256 MiB). The `gateway` tier is for functions owned by platform operators and is not available to most projects. Sandbox functions run in a [Firelock](https://github.com/firelock-sandbox/firelock) microVM sandbox.
 
 ```ruby
-artifact = k9o.functions.upload_artifact(File.binread("hello.wasm"), "wasm")
+artifact = k9o.functions.upload_artifact(File.binread("hello.tar"), "tar")
 
 k9o.functions.deploy(
   name: "hello",
   runtime: "bun",
-  tier: "gateway",
+  tier: "sandbox",
   artifact_key: artifact.data["artifactKey"],
   version: "1.0.0"
 )
 result = k9o.functions.invoke("hello", { "name" => "Ada" })
-puts result.data["greeting"]
+puts "Output: #{result.data["greeting"]}"
 ```
 
 ```text
-Hello, Ada
+Output: Hello, Ada
 ```
 
 #### Migrations
@@ -391,6 +573,21 @@ Hello, Ada
 | Method | What it does |
 |---|---|
 | `k9o.ai.embed(input:, model: nil)` | Embed one string or a list of strings. |
+| `k9o.ai.generate(prompt, model: nil, max_tokens: nil, temperature: nil, usage_type: nil)` | Generate text from a prompt. |
+
+##### Generate text
+
+`model` is optional: without it the org's default model is used. Models from outside providers answer 501 until built.
+The result `data` is the same as `compute.llms.invoke`.
+
+```ruby
+result = k9o.ai.generate("Say hi in three words", max_tokens: 20)
+puts "Output: #{result.data['content']}"
+```
+
+```text
+Output: Hi there, friend!
+```
 
 #### Language models
 
@@ -407,11 +604,11 @@ Pass settings in `params:` (`max_tokens`, `temperature`, `usage_type`). The resu
 
 ```ruby
 reply = k9o.compute.llms.invoke("llama-3-8b", prompt: "Say hi", params: { max_tokens: 20 })
-puts "#{reply.data['content']} #{reply.data['usage']['totalTokens']}"
+puts "Output: #{reply.data['content']} #{reply.data['usage']['totalTokens']}"
 ```
 
 ```text
-Hi there! 14
+Output: Hi there! 14
 ```
 
 #### Realtime
@@ -424,6 +621,48 @@ Hi there! 14
 
 `K9o::Realtime::Topic` builds topic names, for example `Topic.collection("tasks")`.
 
+#### Streams
+
+`k9o.streams` publishes to and subscribes to the project's user streams. It needs `project_slug`.
+
+| Method | What it does |
+|---|---|
+| `k9o.streams.create(display_name, max_bytes, retention_seconds: nil)` | Create a stream. The slug comes from the name. |
+| `k9o.streams.list` | List the project's streams. |
+| `k9o.streams.get(slug)` | Read one stream. |
+| `k9o.streams.delete(slug)` | Retire a stream. |
+| `k9o.streams.publish(slug, data, subject: nil)` | Append an event. `subject` is a dot-separated routing suffix. |
+| `k9o.streams.replay(slug, from_sequence: nil, until_sequence: nil, limit: nil)` | Read past events: `events`, `nextCursor`, `hasMore`. |
+| `k9o.streams.subscribe(slug, from_sequence: nil)` | Tail live events over SSE (an `Enumerator`). Reconnects from the last sequence. |
+
+#### Approvals
+
+`k9o.approvals` reads and decides the queue of changes waiting for approval. It needs `project_slug`.
+
+| Method | What it does |
+|---|---|
+| `k9o.approvals.list(status: nil, limit: nil)` | Newest pending changes first. Not paginated; `limit` is 1 to 200. |
+| `k9o.approvals.get(id)` | Read one change. |
+| `k9o.approvals.approve(id, reason: nil)` | Approve. `status` can stay `pending_approval` while more approvers are needed. |
+| `k9o.approvals.reject(id, reason:)` | Reject. `reason` is required. |
+| `k9o.approvals.bulk(action:, criteria:, reason: nil)` | Approve or reject every change matching a predicate. `reason` is required to reject. Failed rows are skipped. |
+
+#### Approval policies
+
+`k9o.approval_policies` holds the rules that decide which writes are queued. It needs `project_slug`.
+
+| Method | What it does |
+|---|---|
+| `k9o.approval_policies.list` | All policies, oldest first. |
+| `k9o.approval_policies.create(collection:, operation:, action:, predicate:)` | Create a policy. `action` is `auto_approve` or `queue`. |
+| `k9o.approval_policies.delete(id)` | Delete a policy. |
+
+#### Schema
+
+| Method | What it does |
+|---|---|
+| `k9o.schema.collections.list(limit: nil, cursor: nil)` | List the project's collections by name, with `meta.cursor.next` paging. |
+
 #### Studio
 
 `k9o.studio` manages workflows and dashboards.
@@ -584,6 +823,20 @@ The server may send codes not listed here, so keep a fallback branch.
 | `@k9o/core` | TypeScript SDK |
 | `@k9o/cli` | Command-line tool |
 
+### About Kilimanjaro
+
+Kilimanjaro is a modular developer platform for building secure enterprise applications.
+You define AI agents, functions and data pipelines on the platform.
+The SDKs let you deploy and invoke them, read and write your data, publish to and subscribe to streams,
+sign users in, and encrypt with keys you hold.
+
+It provides four building blocks:
+
+- **Keep**: AI security and governance. Guardrails and policy for the agents you run.
+- **Pulse**: data intelligence and real-time stream processing. Streams, analytics and live feeds.
+- **Gate**: customer identity and access management. Sign-in and sessions, and automatic data scoping so a signed-in user reaches only their own data.
+- **Kibo**: cryptographic keys and secrets management. Client-side encryption with keys you hold, and a secrets vault.
+
 ## License
 
 Apache-2.0 © Formelo Inc. See `LICENSE` and `NOTICE`.

data/lib/k9o/ai.rb

@@ -7,6 +7,8 @@ module K9o
   # Wire (project-plane):
   #   POST /@<slug>/ai/embeddings  body { model?, input: String | [String] }
   #   -> { data: { embeddings: [[Float]], model:, dimensions: }, meta }
+  #   POST /@<slug>/ai/generate    body { prompt:, model?, maxTokens?, temperature?, usageType? }
+  #   -> { data: { modelId:, content:, finishReason:, usage:, usageType: }, meta }
   #
   # Bounds are enforced by the gateway, not here. The SDK sends `input`
   # exactly as given and never puts it in an error.
@@ -24,5 +26,18 @@ module K9o
       HttpTransport.request(config: @config, method: 'POST',
                             path: UrlGrammar.project_path(slug, 'ai/embeddings'), body: body)
     end
+
+    # POST /@<slug>/ai/generate — one synchronous text generation (verb sugar over compute.llms.invoke).
+    # Only the fields given are sent; without `model` the gateway uses the org's default LLM.
+    def generate(prompt, model: nil, max_tokens: nil, temperature: nil, usage_type: nil)
+      slug = Studio.require_project_slug(@config, 'ai')
+      body = { 'prompt' => prompt }
+      body['model'] = model unless model.nil?
+      body['maxTokens'] = max_tokens unless max_tokens.nil?
+      body['temperature'] = temperature unless temperature.nil?
+      body['usageType'] = usage_type unless usage_type.nil?
+      HttpTransport.request(config: @config, method: 'POST',
+                            path: UrlGrammar.project_path(slug, 'ai/generate'), body: body)
+    end
   end
 end

data/lib/k9o/approvals.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+module K9o
+  # Shared argument checks for the approvals, approval policy and schema namespaces. A bad value raises
+  # K9o::KError K9O_INVALID_FIELD_VALUE before any request is sent.
+  module ApprovalChecks
+    module_function
+
+    def invalid(message, context = {})
+      KError.new(code: 'K9O_INVALID_FIELD_VALUE', message: message, context: context)
+    end
+
+    def check_limit(limit)
+      return if limit.nil?
+      return if limit.is_a?(Integer) && limit >= 1 && limit <= 200
+
+      raise invalid('limit must be a whole number from 1 to 200', limit: limit)
+    end
+
+    def id_segment(value, what)
+      raise invalid("#{what} id must be a non-empty string") unless value.is_a?(String) && !value.empty?
+
+      ::URI.encode_www_form_component(value).gsub('+', '%20')
+    end
+
+    def reason!(reason)
+      raise invalid('reason is required and must be a non-empty string') unless reason.is_a?(String) && !reason.strip.empty?
+
+      reason
+    end
+
+    def predicate!(value, field)
+      raise invalid("#{field} must be a predicate object") unless value.is_a?(Hash)
+
+      value
+    end
+
+    def enum!(value, allowed, field)
+      text = value.is_a?(Symbol) ? value.to_s : value
+      return text if allowed.include?(text)
+
+      raise invalid("#{field} must be #{allowed.map { |a| "\"#{a}\"" }.join(', ')}", field.to_sym => value)
+    end
+  end
+
+  # Pending-change queue: k9o.approvals.*
+  #
+  #   list(status:, limit:)                GET  /@<slug>/pending-approvals
+  #   get(id)                              GET  /@<slug>/pending-approvals/<id>
+  #   approve(id, reason:)                 POST /@<slug>/pending-approvals/<id>/approve
+  #   reject(id, reason:)                  POST /@<slug>/pending-approvals/<id>/reject
+  #   bulk(action:, criteria:, reason:)    POST /@<slug>/pending-approvals/bulk
+  #
+  # +list+ is not paginated: it returns the newest +limit+ changes (1 to 200, default 50). +approve+ can answer 200
+  # with +status+ still +pending_approval+: the approval is recorded and more approvers are needed. +bulk+ skips rows
+  # that fail without a report, so compare +affectedIds+ with what you intended.
+  class Approvals
+    def initialize(config)
+      @config = config
+    end
+
+    # Pending changes, newest first. Only +limit+ caps the result.
+    def list(status: nil, limit: nil)
+      ApprovalChecks.check_limit(limit)
+      query = {}
+      query['status'] = status.to_s unless status.nil?
+      query['limit'] = limit unless limit.nil?
+      call('GET', path, query: query)
+    end
+
+    # One pending change. Members who are not queue admins can read only their own.
+    def get(id)
+      call('GET', path("/#{ApprovalChecks.id_segment(id, 'approval')}"))
+    end
+
+    # Approve a pending change. Read +status+ on the answer: +pending_approval+ means more approvers are needed.
+    def approve(id, reason: nil)
+      seg = ApprovalChecks.id_segment(id, 'approval')
+      call('POST', path("/#{seg}/approve"), body: reason.nil? ? {} : { 'reason' => reason })
+    end
+
+    # Reject a pending change. +reason+ is required and must not be empty.
+    def reject(id, reason:)
+      seg = ApprovalChecks.id_segment(id, 'approval')
+      call('POST', path("/#{seg}/reject"), body: { 'reason' => ApprovalChecks.reason!(reason) })
+    end
+
+    # Approve or reject every pending change matching +criteria+ (a predicate Hash). +reason+ is required to reject.
+    # Rows that fail are skipped without a report: compare +affectedIds+ with what you intended.
+    def bulk(action:, criteria:, reason: nil)
+      act = ApprovalChecks.enum!(action, %w[approve reject], 'action')
+      body = { 'action' => act, 'criteria' => ApprovalChecks.predicate!(criteria, 'criteria') }
+      if act == 'reject'
+        body['reason'] = ApprovalChecks.reason!(reason)
+      elsif !reason.nil?
+        body['reason'] = reason
+      end
+      call('POST', path('/bulk'), body: body)
+    end
+
+    private
+
+    def call(method, route, body: nil, query: nil)
+      HttpTransport.request(config: @config, method: method, path: route, body: body, query: query)
+    end
+
+    def path(tail = '')
+      UrlGrammar.project_path(Studio.require_project_slug(@config, 'approvals'), "pending-approvals#{tail}")
+    end
+  end
+
+  # Approval policies: k9o.approval_policies.*
+  #
+  #   list                                              GET    /@<slug>/approval-policies
+  #   create(collection:, operation:, action:, predicate:)  POST   /@<slug>/approval-policies
+  #   delete(id)                                        DELETE /@<slug>/approval-policies/<id>
+  class ApprovalPolicies
+    COLLECTION_RE = /\A[a-zA-Z_][a-zA-Z0-9_]{0,62}\z/.freeze
+
+    def initialize(config)
+      @config = config
+    end
+
+    # All policies, oldest first. The first matching policy for a write decides.
+    def list
+      call('GET', path)
+    end
+
+    # Create a policy. Identical policies are not de-duplicated.
+    def create(collection:, operation:, action:, predicate:)
+      unless collection.is_a?(String) && COLLECTION_RE.match?(collection)
+        raise ApprovalChecks.invalid('collection must match ^[a-zA-Z_][a-zA-Z0-9_]{0,62}$', collection: collection)
+      end
+
+      body = {
+        'collection' => collection,
+        'operation' => ApprovalChecks.enum!(operation, %w[insert update delete], 'operation'),
+        'action' => ApprovalChecks.enum!(action, %w[auto_approve queue], 'action'),
+        'predicate' => ApprovalChecks.predicate!(predicate, 'predicate')
+      }
+      call('POST', path, body: body)
+    end
+
+    # Delete a policy; the answer is { 'id' => ... }.
+    def delete(id)
+      call('DELETE', path("/#{ApprovalChecks.id_segment(id, 'policy')}"))
+    end
+
+    private
+
+    def call(method, route, body: nil)
+      HttpTransport.request(config: @config, method: method, path: route, body: body)
+    end
+
+    def path(tail = '')
+      UrlGrammar.project_path(Studio.require_project_slug(@config, 'approval_policies'), "approval-policies#{tail}")
+    end
+  end
+end

data/lib/k9o/client.rb

@@ -3,8 +3,10 @@
 module K9o
   # The customer-facing client returned by K9o.create_client.
   class K9oClient
-    attr_reader :config, :projects, :gate, :studio, :compute, :realtime, :org,
-                :orgs, :migrations, :functions, :policies, :audit, :me, :kibo, :ai, :storage
+    include QueryMethods
+
+    attr_reader :config, :projects, :gate, :studio, :compute, :realtime, :streams, :org,
+                :approvals, :approval_policies, :schema, :orgs, :migrations, :functions, :policies, :audit, :me, :kibo, :ai, :storage
 
     def initialize(config)
       @config = config
@@ -13,6 +15,10 @@ module K9o
       @studio = Studio.new(config)
       @compute = Compute.new(config)
       @realtime = Realtime.new(config)
+      @streams = Streams.new(config)
+      @approvals = Approvals.new(config)
+      @approval_policies = ApprovalPolicies.new(config)
+      @schema = Schema.new(config)
       @org = Org.new(config)
       @orgs = Orgs.new(config)
       @migrations = Migrations.new(config)

data/lib/k9o/data.rb

@@ -1,5 +1,7 @@
 # frozen_string_literal: true
 
+require 'json'
+
 module K9o
   # Data-plane DSL.
   #
@@ -113,13 +115,77 @@ module K9o
   end
 
   class SelectBuilder < BaseBuilder
+    SEARCH_COLUMN = /\A[a-zA-Z_][a-zA-Z0-9_]{0,62}\z/.freeze
+    SEARCH_LANGUAGE = /\A[a-zA-Z_]+\z/.freeze
+    TEXT_TYPES = %w[plain phrase websearch].freeze
+    VECTOR_METRICS = %w[cosine euclidean dot].freeze
+
+    def initialize(config, collection)
+      super
+      @search = {}
+    end
+
+    # Full-text search over one text column. +type+ is "plain", "phrase" or "websearch".
+    def text_search(column, query, language: 'english', type: 'plain')
+      check_search_column(column)
+      raise search_error('text search query must be a non-empty string') unless query.is_a?(String) && !query.empty?
+      unless language.is_a?(String) && language.match?(SEARCH_LANGUAGE)
+        raise search_error('text search language must be letters and underscores only')
+      end
+
+      type = type.to_s
+      raise search_error("text search type must be one of #{TEXT_TYPES.join(', ')}") unless TEXT_TYPES.include?(type)
+
+      @search.delete('textSearchLanguage')
+      @search.delete('textSearchType')
+      @search['textSearch'] = "#{column}:#{query}"
+      @search['textSearchLanguage'] = language unless language == 'english'
+      @search['textSearchType'] = type unless type == 'plain'
+      self
+    end
+
+    # Nearest-neighbour search over one vector column; results come back closest first.
+    # +metric+ is "cosine", "euclidean" or "dot"; +limit+ is 1 to 1000 (server default 10).
+    def vector_search(column, embedding, metric: 'cosine', limit: nil)
+      check_search_column(column)
+      unless embedding.is_a?(Array) && !embedding.empty? &&
+             embedding.all? { |v| v.is_a?(Integer) || (v.is_a?(Float) && v.finite?) }
+        raise search_error('embedding must be a non-empty array of finite numbers')
+      end
+
+      metric = metric.to_s
+      raise search_error("vector metric must be one of #{VECTOR_METRICS.join(', ')}") unless VECTOR_METRICS.include?(metric)
+      unless limit.nil? || (limit.is_a?(Integer) && limit >= 1 && limit <= 1000)
+        raise search_error('vector limit must be an integer from 1 to 1000')
+      end
+
+      @search.delete('vectorMetric')
+      @search.delete('vectorLimit')
+      @search['vectorSearch'] = "#{column}:#{JSON.generate(embedding)}"
+      @search['vectorMetric'] = metric unless metric == 'cosine'
+      @search['vectorLimit'] = limit.to_s unless limit.nil?
+      self
+    end
+
     def execute
       HttpTransport.request(
         config: @config, method: 'GET',
         path: FromBuilder.collection_path(@config, @collection),
-        query: to_query
+        query: to_query.merge(@search)
       )
     end
+
+    private
+
+    def search_error(message)
+      KError.new(code: 'K9O_INVALID_FIELD_VALUE', message: message, context: { collection: @collection })
+    end
+
+    def check_search_column(column)
+      return if column.is_a?(String) && column.match?(SEARCH_COLUMN)
+
+      raise search_error('search column must be a column name: letters, digits and underscores, starting with a letter or underscore')
+    end
   end
 
   class UpdateBuilder < BaseBuilder

data/lib/k9o/query.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+module K9o
+  # `client.query(sql, params)` and `client.search(collection, column:, q:)`.
+  #
+  # Wire (project-plane):
+  #   POST /@<slug>/query   body { sql:, params? }   -> { data: [row, ...], meta }
+  #   GET  /@<slug>/data/<collection>?textSearch=<column>:<q>...   (the select builder's +text_search+)
+  #
+  # +params+ is an Array (positional, bound to $1, $2, ...; the SQL is sent as written) or a Hash of named values
+  # (+:name+ placeholders are rewritten to $n here and the values become the positional list). Values are bound by
+  # the database, never interpolated into the SQL text.
+  module Query
+    IDENT_START = /[A-Za-z_]/.freeze
+    IDENT_CHAR = /[A-Za-z0-9_]/.freeze
+    DOLLAR_TAG = /\A\$([A-Za-z_][A-Za-z0-9_]*)?\$/.freeze
+
+    module_function
+
+    def invalid(message, context = {})
+      KError.new(code: 'K9O_INVALID_FIELD_VALUE', message: message, context: context)
+    end
+
+    def check_value(value, where)
+      return value if value.nil? || value == true || value == false || value.is_a?(String)
+      return value if value.is_a?(Integer)
+      return value if value.is_a?(Float) && value.finite?
+
+      raise invalid("#{where} must be a string, number, boolean or nil; serialise anything else (for example as JSON text) first")
+    end
+
+    def lookup(named, name)
+      return [true, named[name]] if named.key?(name)
+      return [true, named[name.to_sym]] if named.key?(name.to_sym)
+
+      [false, nil]
+    end
+
+    # Rewrite +:name+ placeholders to $n. Skips quoted text, comments, dollar-quoted strings and +::+ casts.
+    # Returns [sql, params].
+    def translate_named_params(sql, named)
+      order = []
+      out = +''
+      i = 0
+      n = sql.length
+      while i < n
+        c = sql[i]
+        nxt = i + 1 < n ? sql[i + 1] : ''
+        if c == "'" || ((c == 'E' || c == 'e') && nxt == "'" && !(i > 0 && sql[i - 1] =~ IDENT_CHAR))
+          escapes = c != "'"
+          j = escapes ? i + 2 : i + 1
+          while j < n
+            if escapes && sql[j] == '\\'
+              j += 2
+              next
+            end
+            if sql[j] == "'"
+              if sql[j + 1] == "'"
+                j += 2
+                next
+              end
+              break
+            end
+            j += 1
+          end
+          out << sql[i...[j + 1, n].min]
+          i = j + 1
+        elsif c == '"'
+          j = i + 1
+          while j < n
+            if sql[j] == '"'
+              if sql[j + 1] == '"'
+                j += 2
+                next
+              end
+              break
+            end
+            j += 1
+          end
+          out << sql[i...[j + 1, n].min]
+          i = j + 1
+        elsif c == '-' && nxt == '-'
+          j = sql.index("\n", i) || n
+          out << sql[i...j]
+          i = j
+        elsif c == '/' && nxt == '*'
+          depth = 1
+          j = i + 2
+          while j < n && depth > 0
+            if sql[j, 2] == '/*'
+              depth += 1
+              j += 2
+            elsif sql[j, 2] == '*/'
+              depth -= 1
+              j += 2
+            else
+              j += 1
+            end
+          end
+          out << sql[i...j]
+          i = j
+        elsif c == '$'
+          m = DOLLAR_TAG.match(sql[i..-1])
+          if m
+            close = sql.index(m[0], i + m[0].length)
+            stop = close.nil? ? n : close + m[0].length
+            out << sql[i...stop]
+            i = stop
+          else
+            out << c
+            i += 1
+          end
+        elsif c == ':' && nxt == ':'
+          out << '::'
+          i += 2
+        elsif c == ':' && nxt != '' && nxt =~ IDENT_START && !(i > 0 && sql[i - 1] =~ IDENT_CHAR)
+          j = i + 2
+          j += 1 while j < n && sql[j] =~ IDENT_CHAR
+          name = sql[(i + 1)...j]
+          unless order.include?(name)
+            found, = lookup(named, name)
+            raise invalid("no value for :#{name}", name: name) unless found
+
+            order << name
+          end
+          out << "$#{order.index(name) + 1}"
+          i = j
+        else
+          out << c
+          i += 1
+        end
+      end
+      values = order.map { |name| check_value(lookup(named, name)[1], "the value for :#{name}") }
+      [out, values]
+    end
+
+    # Builds [path, body] for POST /@<slug>/query.
+    def prepare(config, sql, params)
+      slug = Studio.require_project_slug(config, 'query')
+      text = sql
+      values = []
+      if params.is_a?(Hash)
+        text, values = translate_named_params(sql, params)
+      elsif !params.nil?
+        values = params.each_with_index.map { |v, i| check_value(v, "params[#{i}]") }
+      end
+      body = { 'sql' => text }
+      body['params'] = values unless values.empty?
+      [UrlGrammar.project_path(slug, 'query'), body]
+    end
+  end
+
+  # Client-root methods mixed into K9oClient.
+  module QueryMethods
+    # POST /@<slug>/query — run one read-only SQL statement; +data+ is the array of rows.
+    # An Array binds positionally to $1, $2, ...; a Hash binds +:name+ placeholders.
+    def query(sql, params = nil)
+      path, body = Query.prepare(@config, sql, params)
+      HttpTransport.request(config: @config, method: 'POST', path: path, body: body)
+    end
+
+    # Full-text search over one text column of a collection, best matches first. Sugar over
+    # +from(collection).select.text_search(column, q, ...)+; +limit+ and +cursor+ page the result.
+    def search(collection, column:, q:, language: nil, type: nil, limit: nil, cursor: nil)
+      opts = {}
+      opts[:language] = language unless language.nil?
+      opts[:type] = type unless type.nil?
+      builder = from(collection).select.text_search(column, q, **opts)
+      builder.limit(limit) unless limit.nil?
+      builder.cursor(cursor) unless cursor.nil?
+      builder.execute
+    end
+  end
+end

data/lib/k9o/schema.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module K9o
+  # Schema: k9o.schema.*
+  #
+  #   collections.list(limit:, cursor:)    GET /@<slug>/schema/collections
+  #
+  # The list is cursor-paginated and ordered by collection name: pass +meta.cursor.next+ of one page as +cursor+ of
+  # the next, until it is nil.
+  class Schema
+    attr_reader :collections
+
+    def initialize(config)
+      @collections = SchemaCollections.new(config)
+    end
+  end
+
+  class SchemaCollections
+    def initialize(config)
+      @config = config
+    end
+
+    # The project's collections by name, one page at a time. +limit+ is 1 to 200 (default 50).
+    def list(limit: nil, cursor: nil)
+      route = UrlGrammar.project_path(Studio.require_project_slug(@config, 'schema'), 'schema/collections')
+      ApprovalChecks.check_limit(limit)
+      raise ApprovalChecks.invalid('cursor must be a string', cursor: cursor) unless cursor.nil? || cursor.is_a?(String)
+
+      query = {}
+      query['limit'] = limit unless limit.nil?
+      query['cursor'] = cursor unless cursor.nil?
+      HttpTransport.request(config: @config, method: 'GET', path: route, query: query)
+    end
+  end
+end

data/lib/k9o/streams.rb

@@ -0,0 +1,94 @@
+# frozen_string_literal: true
+
+module K9o
+  # User data streams namespace: k9o.streams.*.
+  #
+  # Routes under /@<slug>/data-streams/user. Publish needs project admin; subscribe and replay need admin or
+  # auditor. While the stream data plane is unavailable the gateway answers K9O_STREAM_UNAVAILABLE (503); a bad
+  # subject answers K9O_STREAM_INVALID. Both raise K9o::KError.
+  class Streams
+    @reconnect_delay = 0.25
+
+    class << self
+      # Seconds to wait before reconnecting after the server closes a subscribe connection.
+      attr_accessor :reconnect_delay
+    end
+
+    def initialize(config)
+      @config = config
+    end
+
+    # POST /@<slug>/data-streams/user — +max_bytes+ is the storage ceiling; the slug is derived from +display_name+.
+    def create(display_name, max_bytes, retention_seconds: nil)
+      body = { 'displayName' => display_name, 'maxBytes' => max_bytes }
+      body['retentionSeconds'] = retention_seconds unless retention_seconds.nil?
+      call('POST', path, body)
+    end
+
+    # GET /@<slug>/data-streams/user — the project's active user streams.
+    def list
+      call('GET', path)
+    end
+
+    # GET /@<slug>/data-streams/user/<slug>
+    def get(slug)
+      call('GET', path(slug))
+    end
+
+    # DELETE /@<slug>/data-streams/user/<slug> — retire the stream.
+    def delete(slug)
+      call('DELETE', path(slug))
+    end
+
+    # POST .../<slug>/publish — +data+ is any JSON value; +subject+ is an optional dot-separated routing suffix.
+    def publish(slug, data, subject: nil)
+      body = { 'data' => data }
+      body['subject'] = subject unless subject.nil?
+      call('POST', path(slug, 'publish'), body)
+    end
+
+    # POST .../<slug>/replay — a bounded range of past events: data['events'], data['nextCursor'], data['hasMore'].
+    def replay(slug, from_sequence: nil, until_sequence: nil, limit: nil)
+      body = {}
+      body['fromSequence'] = from_sequence unless from_sequence.nil?
+      body['untilSequence'] = until_sequence unless until_sequence.nil?
+      body['limit'] = limit unless limit.nil?
+      call('POST', path(slug, 'replay'), body)
+    end
+
+    # GET .../<slug>/subscribe — an Enumerator tailing live events { 'sequence', 'subject', 'data', 'publishedAt' }.
+    # The gateway bounds each connection and closes it; the enumerator reconnects from the last sequence it yielded.
+    # Stop by leaving the +each+ block (break) or by taking a finite number (+first(n)+).
+    def subscribe(slug, from_sequence: nil)
+      route = path(slug, 'subscribe')
+      Enumerator.new do |yielder|
+        cursor = from_sequence
+        loop do
+          query = cursor.nil? ? nil : { 'fromSequence' => cursor.to_s }
+          HttpTransport.stream_sse(config: @config, method: 'GET', path: route, query: query).each do |event|
+            next unless event.is_a?(Hash) && event.key?('sequence')
+
+            cursor = event['sequence']
+            yielder << event
+          end
+          delay = self.class.reconnect_delay
+          sleep(delay) if delay.positive?
+        end
+      end
+    end
+
+    private
+
+    def call(method, route, body = nil)
+      HttpTransport.request(config: @config, method: method, path: route, body: body)
+    end
+
+    def path(stream_slug = nil, suffix = nil)
+      project = Studio.require_project_slug(@config, 'streams')
+      sub = +'data-streams/user'
+      sub << "/#{::URI.encode_www_form_component(stream_slug)}" if stream_slug
+      sub << "/#{suffix}" if suffix
+      UrlGrammar.project_path(project, sub)
+    end
+  end
+end

data/lib/k9o/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module K9o
-  VERSION = '1.3.0'
+  VERSION = '1.4.0'
 end

data/lib/k9o.rb

@@ -29,6 +29,7 @@ require_relative 'k9o/url_grammar'
 require_relative 'k9o/region'
 require_relative 'k9o/http_transport'
 require_relative 'k9o/data'
+require_relative 'k9o/query'
 require_relative 'k9o/projects'
 require_relative 'k9o/gate'
 require_relative 'k9o/studio'
@@ -36,6 +37,9 @@ require_relative 'k9o/compute'
 require_relative 'k9o/ai'
 require_relative 'k9o/storage'
 require_relative 'k9o/realtime'
+require_relative 'k9o/streams'
+require_relative 'k9o/approvals'
+require_relative 'k9o/schema'
 require_relative 'k9o/migrations'
 require_relative 'k9o/functions'
 require_relative 'k9o/policies'

data/sig/k9o/ai.rbs

@@ -8,6 +8,10 @@ module K9o
     # { "embeddings" => Array[Array[Float]], "model" => String, "dimensions" => Integer }.
     def initialize: (untyped config) -> void
     def embed: (input: (String | Array[String]), ?model: String?) -> Envelope
+
+    # Only the fields given are sent. Returns an Envelope whose `data` is
+    # { "modelId" => String, "content" => String, "finishReason" => String, "usage" => Hash, "usageType" => String }.
+    def generate: (String prompt, ?model: String?, ?max_tokens: Integer?, ?temperature: Numeric?, ?usage_type: String?) -> Envelope
   end
 
   class K9oClient

data/sig/k9o/approvals.rbs

@@ -0,0 +1,49 @@
+# RBS signatures for `client.approvals`, `client.approval_policies` and `client.schema`.
+
+module K9o
+  module ApprovalChecks
+    def self.invalid: (String message, ?Hash[Symbol, untyped] context) -> KError
+    def self.check_limit: (untyped limit) -> void
+    def self.id_segment: (untyped value, String what) -> String
+    def self.reason!: (untyped reason) -> String
+    def self.predicate!: (untyped value, String field) -> Hash[untyped, untyped]
+    def self.enum!: (untyped value, Array[String] allowed, String field) -> String
+  end
+
+  class Approvals
+    def initialize: (untyped config) -> void
+    # Not paginated: only `limit` (1 to 200, default 50) caps the result.
+    def list: (?status: (String | Symbol)?, ?limit: Integer?) -> Envelope
+    def get: (String id) -> Envelope
+    # `status` on the answer stays "pending_approval" while more approvers are needed.
+    def approve: (String id, ?reason: String?) -> Envelope
+    def reject: (String id, reason: String) -> Envelope
+    # Failed rows are skipped without a report: compare `affectedIds` with what you intended.
+    def bulk: (action: (String | Symbol), criteria: Hash[(String | Symbol), untyped], ?reason: String?) -> Envelope
+  end
+
+  class ApprovalPolicies
+    COLLECTION_RE: Regexp
+
+    def initialize: (untyped config) -> void
+    def list: () -> Envelope
+    def create: (collection: String, operation: (String | Symbol), action: (String | Symbol), predicate: Hash[(String | Symbol), untyped]) -> Envelope
+    def delete: (String id) -> Envelope
+  end
+
+  class SchemaCollections
+    def initialize: (untyped config) -> void
+    def list: (?limit: Integer?, ?cursor: String?) -> Envelope
+  end
+
+  class Schema
+    attr_reader collections: SchemaCollections
+    def initialize: (untyped config) -> void
+  end
+
+  class K9oClient
+    attr_reader approvals: Approvals
+    attr_reader approval_policies: ApprovalPolicies
+    attr_reader schema: Schema
+  end
+end

data/sig/k9o/query.rbs

@@ -0,0 +1,26 @@
+# RBS signatures for `client.query`, `client.search` and the select builder's search methods.
+
+module K9o
+  module Query
+    type value = String | Integer | Float | bool | nil
+
+    # Rewrites :name placeholders to $n; returns [sql, positional values].
+    def self.translate_named_params: (String sql, Hash[(String | Symbol), untyped] named) -> [String, Array[value]]
+  end
+
+  module QueryMethods
+    # An Array binds positionally to $1, $2, ...; a Hash binds :name placeholders. `data` is the array of rows.
+    def query: (String sql, ?(Array[untyped] | Hash[(String | Symbol), untyped])? params) -> Envelope
+
+    def search: (String collection, column: String, q: String, ?language: String?, ?type: String?, ?limit: Integer?, ?cursor: String?) -> Envelope
+  end
+
+  class K9oClient
+    include QueryMethods
+  end
+
+  class SelectBuilder
+    def text_search: (String column, String query, ?language: String, ?type: (String | Symbol)) -> self
+    def vector_search: (String column, Array[Numeric] embedding, ?metric: (String | Symbol), ?limit: Integer?) -> self
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: k9o
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.4.0
 platform: ruby
 authors:
 - Kilimanjaro
@@ -39,6 +39,7 @@ files:
 - k9o.gemspec
 - lib/k9o.rb
 - lib/k9o/ai.rb
+- lib/k9o/approvals.rb
 - lib/k9o/audit.rb
 - lib/k9o/barbican.rb
 - lib/k9o/client.rb
@@ -57,16 +58,21 @@ files:
 - lib/k9o/orgs.rb
 - lib/k9o/policies.rb
 - lib/k9o/projects.rb
+- lib/k9o/query.rb
 - lib/k9o/realtime.rb
 - lib/k9o/region.rb
+- lib/k9o/schema.rb
 - lib/k9o/storage.rb
+- lib/k9o/streams.rb
 - lib/k9o/studio.rb
 - lib/k9o/url_grammar.rb
 - lib/k9o/vault.rb
 - lib/k9o/version.rb
 - sig/k9o/ai.rbs
+- sig/k9o/approvals.rbs
 - sig/k9o/gate.rbs
 - sig/k9o/migrations.rbs
+- sig/k9o/query.rbs
 - sig/k9o/region.rbs
 - sig/k9o/storage.rbs
 homepage: https://kilimanjaro.dev