k9o 1.3.0 → 1.5.0

data/sig/k9o/moat.rbs

@@ -0,0 +1,29 @@
+# RBS signatures for Moat, the local guard around a model call.
+
+module K9o
+  module Moat
+    REASONS: Array[Symbol]
+
+    # Raised when Moat refuses input or output. `reason` is :role_marker, :input_schema, :output_schema or :pii.
+    class Refusal < StandardError
+      attr_reader reason: Symbol
+      attr_reader detail: String
+      def initialize: (Symbol reason, String detail) -> void
+    end
+
+    class ConfigError < ArgumentError
+    end
+
+    class SchemaError < ConfigError
+    end
+
+    def self.new: (prompt: String, ?input_schema: Hash[String | Symbol, untyped]?, ?output_schema: Hash[String | Symbol, untyped]?, ?filters: Hash[Symbol | String, ^(String) -> untyped]?) -> Guard
+
+    class Guard
+      def initialize: (prompt: String, ?input_schema: Hash[String | Symbol, untyped]?, ?output_schema: Hash[String | Symbol, untyped]?, ?filters: Hash[Symbol | String, ^(String) -> untyped]?) -> void
+      def messages: (untyped untrusted_input) -> Array[{ role: String, content: String }]
+      def check_output: (untyped model_output) -> untyped
+      def prompt_sha256: () -> String
+    end
+  end
+end

data/sig/k9o/query.rbs

@@ -0,0 +1,26 @@
+# RBS signatures for `client.query`, `client.search` and the select builder's search methods.
+
+module K9o
+  module Query
+    type value = String | Integer | Float | bool | nil
+
+    # Rewrites :name placeholders to $n; returns [sql, positional values].
+    def self.translate_named_params: (String sql, Hash[(String | Symbol), untyped] named) -> [String, Array[value]]
+  end
+
+  module QueryMethods
+    # An Array binds positionally to $1, $2, ...; a Hash binds :name placeholders. `data` is the array of rows.
+    def query: (String sql, ?(Array[untyped] | Hash[(String | Symbol), untyped])? params) -> Envelope
+
+    def search: (String collection, column: String, q: String, ?language: String?, ?type: String?, ?limit: Integer?, ?cursor: String?) -> Envelope
+  end
+
+  class K9oClient
+    include QueryMethods
+  end
+
+  class SelectBuilder
+    def text_search: (String column, String query, ?language: String, ?type: (String | Symbol)) -> self
+    def vector_search: (String column, Array[Numeric] embedding, ?metric: (String | Symbol), ?limit: Integer?) -> self
+  end
+end

data/sig/k9o/rampart.rbs

@@ -0,0 +1,59 @@
+# RBS signatures for Rampart classification and receipt verification.
+
+module K9o
+  module Jcs
+    class Error < ArgumentError
+      attr_reader kind: Symbol
+      def initialize: (String message, ?Symbol kind) -> void
+    end
+
+    def self.canonicalize: (untyped value) -> String
+    def self.canonical_bytes: (untyped value) -> String
+  end
+
+  module Ed25519
+    def self.verify: (String public_key, String message, String signature) -> bool
+    def self.native?: () -> bool
+  end
+
+  class Rampart
+    RECEIPT_TYP: String
+    CLASSIFICATIONS: Array[String]
+    DEFAULT_CLOCK_SKEW: Integer
+    REASONS: Array[Symbol]
+
+    # Raised by verify_receipt. `reason` is one of REASONS: :malformed, :key_unknown, :alg, :typ, :signature,
+    # :issuer, :project_unknown, :project, :expired, :not_yet_valid, :input_hash.
+    class ReceiptRefusal < KError
+      attr_reader reason: Symbol
+      def initialize: (Symbol reason, String detail) -> void
+    end
+
+    class Verdict < Struct[untyped]
+      attr_accessor classification: String
+      attr_accessor risk_bp: Integer
+      attr_accessor confidence_bp: Integer
+      attr_accessor categories: Array[String]
+      attr_accessor project_id: String
+      attr_accessor calibration_version: String
+      attr_accessor input_sha256: String
+      attr_accessor issued_at: Time
+      attr_accessor expires_at: Time
+      attr_accessor kid: String
+      attr_accessor windows: Integer?
+    end
+
+    def initialize: (untyped config) -> void
+    # data: { "classification", "riskScore", "confidence", "categories", "calibrationVersion", "classificationReceipt", "projectId" }.
+    def classify: (Hash[String | Symbol, untyped] input, ?label: String?) -> Envelope
+    # data: { "keys" => [ { "kid", "kty", "crv", "x", ... } ], "issuer" => "<issuer>/rampart" }. Public: no credential is sent.
+    def jwks: () -> Envelope
+    # `receipt` is the Envelope classify returned (it carries the receipt and its projectId) or the bare receipt String.
+    def verify_receipt: ((Envelope | String) receipt, Hash[String | Symbol, untyped] input, ?key_set: (Hash[untyped, untyped] | Array[Hash[untyped, untyped]])?, ?issuer: String?, ?project_id: String?, ?clock_skew: Numeric, ?clock: (Time | Numeric | ^() -> (Time | Numeric))?) -> Verdict
+    def input_digest: (Hash[String | Symbol, untyped] input) -> String
+  end
+
+  class K9oClient
+    attr_reader rampart: Rampart
+  end
+end

data/sig/k9o/realtime.rbs

@@ -0,0 +1,34 @@
+# RBS signatures for `client.realtime`.
+
+module K9o
+  class Realtime
+    DEFAULT_RETRY_MS: Integer
+    SEEN_LIMIT: Integer
+
+    # Seconds without any bytes after which a connection is abandoned (default 45).
+    def self.idle_timeout: () -> Numeric
+    def self.idle_timeout=: (Numeric) -> Numeric
+    # Longest reconnect delay in seconds (default 30).
+    def self.max_backoff: () -> Numeric
+    def self.max_backoff=: (Numeric) -> Numeric
+    def self.sleeper: () -> ^(Numeric) -> void
+    def self.sleeper=: (^(Numeric) -> void) -> ^(Numeric) -> void
+
+    def initialize: (untyped config) -> void
+    # Yields { "topic", "eventType", "payload", "occurredAt", "eventId" }. Reconnects with `Last-Event-ID`, drops
+    # events already delivered, and calls `on_resync` with { "reason", "action" } when the position is lost.
+    def subscribe: (String topic, ?filter: Hash[untyped, untyped]?, ?on_resync: (^(Hash[String, untyped]) -> untyped)?) -> Enumerator[Hash[String, untyped], untyped]
+
+    # POST /@<slug>/realtime/replay: data is { "events", "nextCursor", "hasMore" } plus "resync" when the topic has no stored history.
+    def replay: (String topic, ?from_sequence: Integer?, ?until_sequence: Integer?, ?limit: Integer?) -> Envelope
+
+    module Topic
+      def self.collection: (String collection) -> String
+      def self.workflow_runs: () -> String
+      def self.query_executed: (String query_id) -> String
+      def self.dashboard_refresh: (String dashboard_id) -> String
+      def self.function_invocations: (String function_id) -> String
+      def self.audit_org: (String event_family) -> String
+    end
+  end
+end

data/sig/k9o/workload.rbs

@@ -0,0 +1,64 @@
+# RBS signatures for write approval, event triggers, schedules, vectors and end users.
+
+module K9o
+  # True when a single-record write sent with `require_approval` was queued (HTTP 202) instead of applied.
+  def self.queued_write?: (untyped result) -> bool
+
+  class FunctionTriggers
+    def initialize: (untyped config) -> void
+    def list: (String name) -> Envelope
+    def create: (String name, collection: String, events: Array[String | Symbol], ?filter: Hash[untyped, untyped]?, ?enabled: bool?, ?log_ok_invocations: bool?) -> Envelope
+    # Fields: events, filter (nil clears it), enabled, log_ok_invocations. At least one.
+    def update: (String name, String trigger_id, **untyped fields) -> Envelope
+    # data is nil (HTTP 204).
+    def delete: (String name, String trigger_id) -> Envelope
+  end
+
+  # Key custody (read-only). `data` holds mode, attached, provider, lastJob and hsm (nil when absent).
+  class Custody
+    def initialize: (untyped config) -> void
+    def status: () -> Envelope
+  end
+
+  class Schedules
+    def initialize: (untyped config) -> void
+    def list: (?status: (String | Symbol)?, ?function_name: String?, ?limit: Integer?, ?cursor: String?) -> Envelope
+    def get: (String id) -> Envelope
+    def create: (function_name: String, schedule_expression: String, ?schedule_timezone: String?, ?catchup_policy: (String | Symbol)?, ?collection: String?, ?enabled: bool?, ?log_ok_invocations: bool?) -> Envelope
+    # Fields: schedule_expression, schedule_timezone, catchup_policy, status, enabled, log_ok_invocations. At least one.
+    def update: (String id, **untyped fields) -> Envelope
+    # data is nil (HTTP 204).
+    def delete: (String id) -> Envelope
+    def runs: (String id, ?limit: Integer?, ?cursor: String?) -> Envelope
+    def run_now: (String id) -> Envelope
+  end
+
+  class Vectors
+    def initialize: (untyped config) -> void
+    # data is { "results" => [...], "collection" => String }; each result has id, score, _source, contentHash, text (nil when absent), metadata, model (nil) and chunk (nil).
+    def nearest: (String collection, Array[Numeric] query_vector, ?top_k: Integer?, ?min_score: Numeric?, ?metric: (String | Symbol)?, ?filters: Hash[String | Symbol, String | Numeric | bool]?) -> Envelope
+    # rows: Hashes with vector and _source; optional id, contentHash, text, metadata, subjectIds. A single row Hash is accepted. data is { "upserted" => Integer, "collection" => String }.
+    def upsert: (String collection, ?(Array[Hash[String | Symbol, untyped]] | Hash[String | Symbol, untyped])? rows, **untyped row) -> Envelope
+  end
+
+  class EndUsers
+    def initialize: (untyped config) -> void
+    attr_reader role_grants: EndUserRoleGrants
+    def list: (?status: (String | Symbol)?, ?q: String?, ?limit: Integer?, ?cursor: String?) -> Envelope
+    def get: (String id) -> Envelope
+  end
+
+  class EndUserRoleGrants
+    def initialize: (untyped config) -> void
+    # data is the Array of grants.
+    def list: (?end_user_id: String?) -> Envelope
+    # data is the grant.
+    def grant: (end_user_id: String, role: String) -> Envelope
+    # data is { "revoked" => bool, "revokedAt" => String? }.
+    def revoke: (String grant_id) -> Envelope
+  end
+
+  class K9oClient
+    attr_reader vectors: Vectors
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: k9o
 version: !ruby/object:Gem::Version
-  version: 1.3.0
+  version: 1.5.0
 platform: ruby
 authors:
 - Kilimanjaro
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-10-26 00:00:00.000000000 Z
+date: 2026-11-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: minitest
@@ -39,44 +39,73 @@ files:
 - k9o.gemspec
 - lib/k9o.rb
 - lib/k9o/ai.rb
+- lib/k9o/analytics.rb
+- lib/k9o/approvals.rb
 - lib/k9o/audit.rb
 - lib/k9o/barbican.rb
 - lib/k9o/client.rb
 - lib/k9o/compute.rb
+- lib/k9o/crypto.rb
+- lib/k9o/custody.rb
 - lib/k9o/data.rb
+- lib/k9o/ed25519.rb
+- lib/k9o/end_users.rb
 - lib/k9o/envelope.rb
 - lib/k9o/functions.rb
 - lib/k9o/gate.rb
 - lib/k9o/http_transport.rb
+- lib/k9o/jcs.rb
 - lib/k9o/kerror.rb
+- lib/k9o/keys.rb
 - lib/k9o/kibo.rb
+- lib/k9o/kibo_client_core.rb
+- lib/k9o/kibo_ffi_core.rb
+- lib/k9o/locate.rb
 - lib/k9o/me.rb
+- lib/k9o/metadata.rb
 - lib/k9o/migrations.rb
+- lib/k9o/moat.rb
 - lib/k9o/multipart.rb
 - lib/k9o/org.rb
 - lib/k9o/orgs.rb
 - lib/k9o/policies.rb
 - lib/k9o/projects.rb
+- lib/k9o/query.rb
+- lib/k9o/rampart.rb
 - lib/k9o/realtime.rb
 - lib/k9o/region.rb
+- lib/k9o/schedules.rb
+- lib/k9o/schema.rb
 - lib/k9o/storage.rb
+- lib/k9o/streams.rb
 - lib/k9o/studio.rb
 - lib/k9o/url_grammar.rb
 - lib/k9o/vault.rb
+- lib/k9o/vectors.rb
 - lib/k9o/version.rb
 - sig/k9o/ai.rbs
+- sig/k9o/approvals.rbs
+- sig/k9o/datasets.rbs
 - sig/k9o/gate.rbs
+- sig/k9o/kerror.rbs
+- sig/k9o/kibo_client_core.rbs
+- sig/k9o/metadata.rbs
 - sig/k9o/migrations.rbs
+- sig/k9o/moat.rbs
+- sig/k9o/query.rbs
+- sig/k9o/rampart.rbs
+- sig/k9o/realtime.rbs
 - sig/k9o/region.rbs
 - sig/k9o/storage.rbs
+- sig/k9o/workload.rbs
 homepage: https://kilimanjaro.dev
 licenses:
 - Apache-2.0
 metadata:
   homepage_uri: https://kilimanjaro.dev
   documentation_uri: https://docs.kilimanjaro.dev
-  source_code_uri: https://github.com/k9o-dev/sdk-ruby
-  changelog_uri: https://github.com/k9o-dev/sdk-ruby/blob/main/CHANGELOG.md
+  source_code_uri: https://github.com/k9o-platform/sdk-ruby
+  changelog_uri: https://github.com/k9o-platform/sdk-ruby/blob/main/CHANGELOG.md
 post_install_message:
 rdoc_options: []
 require_paths: