@k9o/core 1.0.0 → 1.1.0

package/dist/kerror.d.ts

@@ -17,7 +17,7 @@
  *                  gateway didn't return one).
  *   - `status`   — HTTP status the gateway returned (or null for
  *                  SDK-side construct-time errors like
- *                  `K9O_INVALID_BASE_URL` per ch13 §7.2).
+ *                  `K9O_INVALID_BASE_URL`).
  *   - `requestId` — gateway-emitted trace ID for downstream correlation.
  *
  * Standalone `@k9o/gate` ships its own `GateError` for the Auth0-parity
@@ -63,7 +63,7 @@ declare class KError extends Error {
  * Rehydrate a wire `KError` payload into a typed `KError` instance.
  * Unlike `@k9o/gate.gateErrorFromWire`, `@k9o/core` does not maintain
  * a hand-curated allow-list of known codes — the gateway's KError
- * code-space is open-ended and curated centrally per ch11; the SDK
+ * code-space is open-ended and curated centrally; the SDK
  * preserves whatever code the gateway sends. Code-narrowing in caller
  * code uses string-literal comparison against the well-known codes
  * (e.g. `if (e.code === 'K9O_TIER_CAP_HIT')`).

package/dist/kerror.js

@@ -1,7 +1,7 @@
 import {
   KError,
   kerrorFromWire
-} from "./chunk-2VSTF5UU.js";
+} from "./chunk-LJZ45UA2.js";
 export {
   KError,
   kerrorFromWire

package/dist/types.d.ts

@@ -24,11 +24,10 @@
  *   - `baseUrl` — gateway host root (scheme + host; no path). **Optional**;
  *     defaults to the platform apex `https://api.k9o.io`.
  *     When it is the bare apex and `orgSlug` is set, the SDK composes the
- *     canonical org subdomain `https://<orgSlug>.api.k9o.io` (ch01 §5.4 / ch13
- *     §7.1). Pass an explicit host to override — an explicit `<orgSlug>` subdomain,
+ *     canonical org subdomain `https://<orgSlug>.api.k9o.io`. Pass an explicit host to override — an explicit `<orgSlug>` subdomain,
  *     or a self-hosted / Sovereign-Control host, or a dev host — used as-is.
  *   - `fetch` — custom fetch implementation (defaults to global)
- *   - `retryConfig` — retry/backoff config (reserved; v0.1.0 ships single-attempt)
+ *   - `retryConfig` — retry/backoff config (reserved; currently ships single-attempt)
  *   - `defaultHeaders` — headers merged into every request
  */
 type CreateClientOptions = {
@@ -41,9 +40,8 @@ type CreateClientOptions = {
     defaultHeaders?: Record<string, string> | undefined;
 };
 /**
- * Retry config per ch13 §7.1. v0.1.0 reserves the type; the HTTP client
- * ships single-attempt and will honour this config in a subsequent
- * sub-cycle.
+ * Retry config. The type is reserved; the HTTP client currently makes a
+ * single attempt per request and does not yet honour this config.
  */
 type RetryConfig = {
     maxRetries: number;

package/dist/url-grammar.d.ts

@@ -1,5 +1,5 @@
 /**
- * URL grammar v2.5.68.
+ * URL grammar.
  *
  * Canonical URL shapes:
  *   - Member-plane (project-scoped): `<orgSlug>.api.k9o.io/@<projectSlug>/<sub-resource>/...`
@@ -7,15 +7,15 @@
  *   - Platform-plane (cross-org):    `api.k9o.io/discovery/...` + `api.k9o.io/auth/...` etc.
  *
  * The `baseUrl` passed to `createClient` is the gateway host root —
- * scheme + host (+ optional port) per ch13 §7. Path-bearing baseUrls
- * are rejected with `K9O_INVALID_BASE_URL` per ch13 §7.2.
+ * scheme + host (+ optional port). Path-bearing baseUrls
+ * are rejected with `K9O_INVALID_BASE_URL`.
  *
  * The SDK constructs URLs by composing `baseUrl + path-from-builder`.
  * Per-resource SDK methods use the builders below to assemble their
  * `path` argument before handing to the HTTP client.
  */
 /**
- * Validate a `baseUrl` per ch13 §7.2. Returns the normalised form
+ * Validate a `baseUrl`. Returns the normalised form
  * (trailing-slash stripped) on success; throws `K9O_INVALID_BASE_URL`
  * on any violation.
  *
@@ -37,7 +37,7 @@ declare function validateBaseUrl(baseUrl: string): string;
  * OPTIONAL — it defaults to the platform apex `https://api.k9o.io`. When the
  * (validated) host is a bare apex in `K9O_ORG_DERIVABLE_APEXES` and `orgSlug`
  * is supplied, the SDK composes the canonical org-subdomain wire root
- * `https://<orgSlug>.<apex>` (ch01 §5.4). An explicit `<orgSlug>` subdomain, a
+ * `https://<orgSlug>.<apex>`. An explicit `<orgSlug>` subdomain, a
  * self-hosted / Sovereign host, or a dev host (anything not in that set)
  * passes through unchanged — `orgSlug` is intentionally NOT validated or
  * composed onto a non-apex host (fixed 2026-08-30: this used to silently
@@ -48,7 +48,7 @@ declare function validateBaseUrl(baseUrl: string): string;
 declare function resolveBaseUrl(baseUrl: string | undefined, orgSlug?: string): string;
 declare function validateSlug(slug: string, kind: "org" | "project"): void;
 /**
- * Build a project-scoped (member-plane) URL path per v2.5.68 §5.4.
+ * Build a project-scoped (member-plane) URL path per the URL grammar
  * E.g. `projectPath('member-portal', 'collections/posts/documents')`
  *      → `/@member-portal/collections/posts/documents`.
  *

package/dist/url-grammar.js

@@ -5,8 +5,8 @@ import {
   resolveBaseUrl,
   validateBaseUrl,
   validateSlug
-} from "./chunk-OE2MMUIG.js";
-import "./chunk-2VSTF5UU.js";
+} from "./chunk-2NDFTHUB.js";
+import "./chunk-LJZ45UA2.js";
 export {
   orgPath,
   platformPath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@k9o/core",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Kilimanjaro platform SDK — createClient + data-plane + projects + migrations + functions + studio (workflows/dashboards) + compute.llms + realtime subscriptions + KError + meta accessor sugar. Composes with @k9o/gate (auth) and @k9o/extensions (extension consumption).",
   "type": "module",
   "main": "./dist/index.js",
@@ -59,9 +59,9 @@
     "url": "https://github.com/k9o-dev/sdk-typescript"
   },
   "dependencies": {
-    "@k9o/gate": "1.0.0",
-    "@k9o/extensions": "1.0.0",
-    "@k9o/kibo": "1.0.0"
+    "@k9o/gate": "1.1.0",
+    "@k9o/extensions": "1.1.0",
+    "@k9o/kibo": "1.1.0"
   },
   "devDependencies": {
     "bun-types": "^1.1.0",

package/src/audit.ts

@@ -9,11 +9,11 @@
  *
  * The endpoint accepts cursor-paginated reverse-chronological queries.
  * `type` is the audit-event namespace (e.g. `data.write.access.insert`,
- * `gate.signin.success`) per the ch05 §4 event-name taxonomy +
+ * `gate.signin.success`) per the event-name taxonomy +
  * `feedback_error_code_namespace_boundary_and_prefix.md` cement.
  *
  * Returns audit events with full context payload — actorId / targetKind /
- * targetId / payload / occurredAt / requestId / traceId per ch05 §4.2.
+ * targetId / payload / occurredAt / requestId / traceId.
  */
 
 import { request, type HttpClientConfig } from "./http.ts";
@@ -21,11 +21,11 @@ import { projectPath } from "./url-grammar.ts";
 import type { Envelope } from "./envelope.ts";
 
 /**
- * Audit event record per ch05 §4.2 `_sys.audit_log` shape.
+ * Audit event record `_sys.audit_log` shape.
  */
 export type AuditEvent = {
   id: string;
-  /** Dotted namespace per ch05 §4 (e.g. `data.write.access.insert`). */
+  /** Dotted namespace (e.g. `data.write.access.insert`). */
   type: string;
   actorId: string | null;
   targetKind: string | null;
@@ -68,7 +68,7 @@ export function makeAuditNamespace(config: HttpClientConfig) {
      * Query the audit log. Returns reverse-chronological events matching
      * all supplied filters (AND composition).
      *
-     * Per ch05 §4 RBAC: requires `AUDIT_READER` role minimum; Custodian-
+     * Per RBAC: requires `AUDIT_READER` role minimum; Custodian-
      * class roles inherit. Project-level audit is project-scoped (this
      * endpoint); platform-level audit is admin-only (separate surface).
      */
@@ -84,7 +84,7 @@ export function makeAuditNamespace(config: HttpClientConfig) {
     /**
      * Convenience: live-tail recent events. Currently single-shot read
      * with `since` defaulted to "1 minute ago"; subscription-mode tail
-     * (SSE) lands when the streaming layer ships per ch04 §8 pattern.
+     * (SSE) lands when the streaming layer ships pattern.
      */
     async tail(opts?: { sinceMinutes?: number; limit?: number }): Promise<Envelope<ReadonlyArray<AuditEvent>>> {
       const slug = requireProjectSlug(config);

package/src/compute/llms.ts

@@ -2,17 +2,17 @@
  * Compute LLMs SDK — `client.compute.llms.*`.
  *
  * Compute LLMs registry. Curated 9-model library
- * (§10.1) + 4-endpoint family (§10.2) + per-model tier-gating.
+ * + 4-endpoint family + per-model tier-gating.
  *
- * Wire mapping (project-plane; ch07 §10.2):
+ * Wire mapping (project-plane;):
  *   - list()                    → GET  /@<slug>/compute/llms
  *   - read(modelId)             → GET  /@<slug>/compute/llms/<model-id>
  *   - invoke(modelId, ...)      → POST /@<slug>/compute/llms/<model-id>/invoke
  *   - invokeStream(modelId,...) → POST /@<slug>/compute/llms/<model-id>/invoke-stream (SSE)
  *
- * Per ch07 §10.5 RBAC: list/read against all cohort roles; invoke +
+ * Per RBAC: list/read against all cohort roles; invoke +
  * invokeStream require PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate).
- * Per ch07 §10.6, surfaces K9O_LLM_PROVIDER_UNAVAILABLE (503) +
+ * Per, surfaces K9O_LLM_PROVIDER_UNAVAILABLE (503) +
  * reuses K9O_MODEL_NOT_DECLARED / K9O_TIER_FEATURE_GATED /
  * K9O_AGENT_INFERENCE_TIMEOUT.
  */
@@ -22,7 +22,7 @@ import { projectPath } from "../url-grammar.ts";
 import type { Envelope } from "../envelope.ts";
 import { parseSseStream } from "../internal/sse.ts";
 
-/** Curated 9-model closed enum at v2 launch per ch07 §10.1 (extensible v2.x). */
+/** Curated 9-model closed enum at v2 launch (extensible v2.x). */
 export type LLMModelId =
   | "mistral-7b"
   | "mistral-8x7b"
@@ -37,21 +37,21 @@ export type LLMModelId =
 export type LLMProviderClass = "self-hosted" | "external";
 export type LLMModality = "text-completion" | "text-completion+tool-use" | "embeddings";
 
-/** Model metadata per ch07 §10.1 + §10.4 (cost transparency). */
+/** Model metadata + (cost transparency). */
 export type LLMModel = {
   id: LLMModelId;
   providerClass: LLMProviderClass;
   modality: LLMModality;
-  /** Minimum tier gate per ch10 (e.g. "base-camp", "ascent", "ridge"). */
+  /** Minimum tier gate (e.g. "base-camp", "ascent", "ridge"). */
   tierGate: string;
   contextWindow: number;
   capabilities: ReadonlyArray<string>;
-  /** Per-model token cost for cost-transparency per §10.4. */
+  /** Per-model token cost for cost-transparency. */
   costPerMillionInputTokens: number;
   costPerMillionOutputTokens: number;
 };
 
-/** Inference parameters per ch07 §10.2 (passed through to provider). */
+/** Inference parameters (passed through to provider). */
 export type LLMInvokeParams = {
   maxTokens?: number;
   temperature?: number;
@@ -60,14 +60,14 @@ export type LLMInvokeParams = {
   [key: string]: unknown;
 };
 
-/** Synchronous inference response per ch07 §10.2 `/invoke`. */
+/** Synchronous inference response `/invoke`. */
 export type LLMResponse = {
   completion: string;
   tokensUsed: number;
   latencyMs: number;
 };
 
-/** Streaming chunk per ch07 §10.2 `/invoke-stream` (SSE per-token). */
+/** Streaming chunk `/invoke-stream` (SSE per-token). */
 export type LLMStreamChunk = {
   /** Incremental completion delta. */
   delta: string;
@@ -82,7 +82,7 @@ export type LLMInvokeInput = {
   params?: LLMInvokeParams;
 };
 
-/** Error code coined in ch07 §10.6 (others reused per §10.6). */
+/** Error code coined in (others reused). */
 export const LLM_ERROR_CODES = {
   PROVIDER_UNAVAILABLE: "K9O_LLM_PROVIDER_UNAVAILABLE",
 } as const;
@@ -96,7 +96,7 @@ function requireProjectSlug(config: HttpClientConfig): string {
 
 export function makeLlmsNamespace(config: HttpClientConfig) {
   return {
-    /** GET /@<slug>/compute/llms — list models available to the project tier per ch10. */
+    /** GET /@<slug>/compute/llms — list models available to the project tier. */
     async list(opts?: { modality?: LLMModality; providerClass?: LLMProviderClass }): Promise<Envelope<ReadonlyArray<LLMModel>>> {
       const slug = requireProjectSlug(config);
       return request(config, { method: "GET", path: projectPath(slug, "compute/llms"), query: opts });
@@ -113,7 +113,7 @@ export function makeLlmsNamespace(config: HttpClientConfig) {
 
     /**
      * POST /@<slug>/compute/llms/<model-id>/invoke — synchronous inference.
-     * Requires PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate per §10.5).
+     * Requires PROJECT_AUTHOR or PROJECT_ADMIN (LLM cost gate).
      */
     async invoke(modelId: LLMModelId | string, input: LLMInvokeInput): Promise<Envelope<LLMResponse>> {
       const slug = requireProjectSlug(config);
@@ -126,7 +126,7 @@ export function makeLlmsNamespace(config: HttpClientConfig) {
 
     /**
      * POST /@<slug>/compute/llms/<model-id>/invoke-stream — streaming
-     * inference (SSE; per-token delta for low-latency UX per §10.2).
+     * inference (SSE; per-token delta for low-latency UX).
      * Returns an async iterable of `LLMStreamChunk` — caller writes
      * `for await (const chunk of client.compute.llms.invokeStream(...))`.
      * The SDK handles SSE framing internally per
@@ -148,7 +148,7 @@ export function makeLlmsNamespace(config: HttpClientConfig) {
 
 export function makeComputeNamespace(config: HttpClientConfig) {
   return {
-    /** LLM registry + inference — `client.compute.llms.*` (ch07 §10). */
+    /** LLM registry + inference — `client.compute.llms.*`. */
     llms: makeLlmsNamespace(config),
   };
 }

package/src/data/from.ts

@@ -14,14 +14,14 @@
  *   - `from('posts').update({ title: '...' }).eq(...)`  → PATCH  /@<projectSlug>/data/posts/:id
  *   - `from('posts').delete().eq('id','rec_X')`         → DELETE /@<projectSlug>/data/posts/:id
  *
- * Filters compose as AND per ch04 §3.2; multiple chained `.eq()` /
+ * Filters compose as AND; multiple chained `.eq()` /
  * `.gt()` / etc. calls all attach to the query string.
  *
- * Pagination + counting per ch01 §6.4: `.limit(n)`, `.cursor(opaque)`,
+ * Pagination + counting: `.limit(n)`, `.cursor(opaque)`,
  * `.count('none' | 'exact' | 'estimated')`. The returned envelope's
  * `meta.cursor.next` is the cursor for the next page.
  *
- * Per ch13 §4.1 KError delivery: every terminal verb throws KError on
+ * Per KError delivery: every terminal verb throws KError on
  * non-2xx. Caller catches via `instanceof KError` + narrows on `.code`.
  */
 
@@ -136,7 +136,7 @@ class QueryBuilder {
   }
 
   /**
-   * Total-count behaviour per ch01 §6.4. `none` (default) skips the
+   * Total-count behaviour. `none` (default) skips the
    * count query (cheapest); `exact` runs `SELECT COUNT(*)` (most
    * expensive at scale); `estimated` reads from pg_stats (fast +
    * approximate).
@@ -158,7 +158,7 @@ class QueryBuilder {
         ? `(${(f.value as ReadonlyArray<string | number>).join(",")})`
         : String(f.value);
       // Multiple filters on the same column are not currently supported via
-      // the simple key=value query map. ch04 §3.2 future cycles cover
+      // the simple key=value query map. future cycles cover
       // `.or()` / multi-filter — when those land the builder will switch
       // to a serialisation that supports collisions.
       q[f.column] = `${f.op}.${val}`;
@@ -190,7 +190,7 @@ class FromBuilder {
 
   /**
    * Insert one record. Returns the inserted record (with platform-
-   * generated `id` + `metadata`) per ch04 §6.4.
+   * generated `id` + `metadata`).
    */
   async insert<T = unknown>(record: Partial<T>): Promise<Envelope<T>> {
     return request<T>(this.config, {
@@ -256,9 +256,9 @@ class UpdateBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<T>>
     if (idFilter === undefined) {
       throw new KError({
         code: "K9O_INVALID_FIELD_VALUE",
-        message: "update() requires an `.eq('id', '...')` filter; row-mass update is not supported at v0.1.0",
+        message: "update() requires an `.eq('id', '...')` filter; changing many rows in one call is not supported",
         context: { collection: this.collection },
-        recommendation: "Chain `.eq('id', 'rec_…')` before awaiting the update; row-mass update lands in a v0.x sub-cycle.",
+        recommendation: "Chain `.eq('id', 'rec_…')` before awaiting the update; to change several rows, call update once per id.",
       });
     }
     return request<T>(this.config, {
@@ -289,9 +289,9 @@ class DeleteBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<T>>
     if (idFilter === undefined) {
       throw new KError({
         code: "K9O_INVALID_FIELD_VALUE",
-        message: "delete() requires an `.eq('id', '...')` filter; row-mass delete is not supported at v0.1.0",
+        message: "delete() requires an `.eq('id', '...')` filter; deleting many rows in one call is not supported",
         context: { collection: this.collection },
-        recommendation: "Chain `.eq('id', 'rec_…')` before awaiting the delete; row-mass delete lands in a v0.x sub-cycle.",
+        recommendation: "Chain `.eq('id', 'rec_…')` before awaiting the delete; to delete several rows, call delete once per id.",
       });
     }
     return request<T>(this.config, {
@@ -311,7 +311,7 @@ class DeleteBuilder<T> extends QueryBuilder implements PromiseLike<Envelope<T>>
 /**
  * Build the collection-records URL path. Requires `config.projectSlug`
  * to be bound; member-plane resources route via the `/@<projectSlug>/...`
- * prefix per v2.5.68 URL grammar.
+ * prefix per the URL grammar.
  */
 function collectionPath(config: HttpClientConfig, collection: string): string {
   if (typeof config.projectSlug !== "string" || config.projectSlug.length === 0) {
@@ -323,7 +323,7 @@ function collectionPath(config: HttpClientConfig, collection: string): string {
     });
   }
   validateSlug(config.projectSlug, "project");
-  // Validate collection name shape — same slug grammar per ch04 §1.2.
+  // Validate collection name shape — same slug grammar.
   if (!/^[a-z][a-z0-9_-]{0,62}$/.test(collection)) {
     throw new KError({
       code: "K9O_INVALID_FIELD_VALUE",

package/src/envelope.ts

@@ -1,5 +1,5 @@
 /**
- * Standard ch01 §1 envelope + meta namespace types.
+ * Standard envelope + meta namespace types.
  *
  * The `meta` namespace surfaces structured per-namespace
  * accessors (cursor / subscription / idempotency / warnings / cost /
@@ -24,7 +24,7 @@ export type Envelope<T> = {
 };
 
 /**
- * Cursor pagination accessor per ch01 §6.4. `next` is the opaque cursor
+ * Cursor pagination accessor. `next` is the opaque cursor
  * for the next page (null when no more); `totalCount` populated only
  * when the caller passes `?count=exact` (otherwise undefined).
  */
@@ -34,7 +34,7 @@ export type MetaCursor = {
 };
 
 /**
- * Subscription delivery metadata per ch04 §8. `isInitial` is true on
+ * Subscription delivery metadata. `isInitial` is true on
  * the first batch of an initial-load subscription; false on subsequent
  * live deltas.
  */
@@ -43,7 +43,7 @@ export type MetaSubscription = {
 };
 
 /**
- * Idempotency replay metadata per ch01 §10.2. `replayed` is true when
+ * Idempotency replay metadata. `replayed` is true when
  * the gateway recognised a previously-seen idempotency key and returned
  * the original response.
  */
@@ -52,7 +52,7 @@ export type MetaIdempotency = {
 };
 
 /**
- * Non-fatal warning shape per ch01 §1.3. Surfaced on responses where
+ * Non-fatal warning shape. Surfaced on responses where
  * the operation succeeded but the caller should know about caveats
  * (e.g. tier-approaching-cap; deprecated field used).
  */
@@ -62,8 +62,8 @@ export type MetaWarning = {
 };
 
 /**
- * Cost metadata per ch10 — per-dimension consumption attribution.
- * Field names per ch10 cost dimensions (waypoints, storageGbHours, egress,
+ * Cost metadata — per-dimension consumption attribution.
+ * Field names (waypoints, storageGbHours, egress,
  * apiCalls, vaultOps, etc.). Dimensions are sparsely populated and values
  * may be scalars (e.g. `waypoints: 3`) or structured objects (e.g.
  * `egress: { gb, zone }`, `vaultOps: { encrypt, decrypt, ... }`), so the
@@ -73,7 +73,7 @@ export type MetaWarning = {
 export type MetaCost = Record<string, unknown>;
 
 /**
- * Timing metadata per ch01 §1.3. `totalMs` is the gateway-side wall-clock
+ * Timing metadata. `totalMs` is the gateway-side wall-clock
  * for the request.
  */
 export type MetaTiming = {
@@ -81,7 +81,7 @@ export type MetaTiming = {
 };
 
 /**
- * Request-correlation metadata per ch01 §1.3. `requestId` is the
+ * Request-correlation metadata. `requestId` is the
  * gateway-emitted trace ID; surface in error reports for support.
  */
 export type MetaContext = {

package/src/extensions-bridge.ts

@@ -7,14 +7,12 @@
  * factory returning typed bindings for Trailblazer/Anchor/Keystone
  * class extensions (baked in at SDK publish time). Circuit-class
  * (Long Tail) extensions use the install-time `k9o codegen` tool
- * (v2.x) per ch13 §8.1.4 path (a) OR raw HTTP / vendor-SDK fallback
- * per path (b).
+ * path (a) OR raw HTTP / vendor-SDK fallback per path (b).
  *
- * The bridge re-exports the factory directly — it is config-free at
- * v0.3.0 (extension stubs do not require HTTP routing yet; v2.5.68p-
- * stack-sdk-pass2 wires per-method HTTP dispatch). When pass2 lands,
- * the bridge will need to thread baseUrl + auth into the extension
- * runtime; until then the re-export is a thin pass-through.
+ * The bridge re-exports the factory directly — it is config-free
+ * (extension stubs do not require HTTP routing yet). Once per-method dispatch
+ * ships, the bridge will thread baseUrl + auth into the extension runtime;
+ * until then the re-export is a thin pass-through.
  */
 
 import { k9o as extensionsNamespace, type ExtensionSlug, type Extension } from "@k9o/extensions";
@@ -24,8 +22,8 @@ export { extensionsNamespace, type ExtensionSlug, type Extension };
 /**
  * Build the composed `client.extensions` namespace. Currently a thin
  * re-export of the `@k9o/extensions` `k9o.extension(slug)` factory.
- * Config-free at v0.3.0 — wires to client HTTP config when pass2 lands
- * runtime dispatch.
+ * Config-free for now; it will use the client HTTP config once runtime
+ * dispatch ships.
  */
 export function makeExtensionsBridge() {
   return {

package/src/functions.ts

@@ -10,8 +10,8 @@
  *   - `delete(name)`                          → DELETE /@<slug>/functions/<name>
  *   - `invoke(name, payload)`                 → POST   /@<slug>/functions/<name>/invoke
  *
- * Per ch07 §3.3: deploy requires PROJECT_ADMIN; invoke authority is per
- * function manifest. Per ch07 §3.1: deploy returns 202 with status
+ * Per: deploy requires PROJECT_ADMIN; invoke authority is per
+ * function manifest. Per: deploy returns 202 with status
  * `deploying`; the function is ready when status flips to `active`.
  */
 
@@ -23,7 +23,7 @@ import type { Envelope } from "./envelope.ts";
  * Function record returned by gateway endpoints.
  */
 export type FunctionRecord = {
-  /** `fn_<base62>` per ch01 §3.2. */
+  /** `fn_<base62>`. */
   id: string;
   name: string;
   runtime: "wasm" | "bun" | "node";
@@ -35,7 +35,7 @@ export type FunctionRecord = {
 
 /**
  * Deploy input. The `code` field is the runtime bundle (base64-encoded
- * WASM or JS source) per ch07 §3.4.
+ * WASM or JS source).
  */
 export type DeployFunctionInput = {
   name: string;
@@ -64,7 +64,7 @@ export function makeFunctionsNamespace(config: HttpClientConfig) {
       });
     },
 
-    /** List deployed functions (cursor pagination per ch01 §6.4). */
+    /** List deployed functions (cursor pagination). */
     async list(opts?: { limit?: number; cursor?: string; status?: FunctionRecord["status"] }): Promise<Envelope<ReadonlyArray<FunctionRecord>>> {
       const slug = requireProjectSlug(config);
       return request(config, {
@@ -83,7 +83,7 @@ export function makeFunctionsNamespace(config: HttpClientConfig) {
       });
     },
 
-    /** Retire a function. Returns confirmation; the function name enters a 24h cooldown per ch07 §3.1. */
+    /** Retire a function. Returns confirmation; the function name enters a 24h cooldown. */
     async delete(name: string): Promise<Envelope<{ retired: boolean; cooldownUntil: string }>> {
       const slug = requireProjectSlug(config);
       return request(config, {
@@ -97,8 +97,8 @@ export function makeFunctionsNamespace(config: HttpClientConfig) {
      * verbatim; the gateway returns whatever the function returns wrapped
      * in the standard envelope.
      *
-     * Per ch07 §3.3: invoke authority is per-function (declared in the
-     * function manifest). Per ch07 §5: streaming responses use the
+     * Per: invoke authority is per-function (declared in the
+     * function manifest). Per: streaming responses use the
      * subscription/async-iterator pattern; this method covers the
      * request-response variant only.
      */

package/src/gate-bridge.ts

@@ -11,7 +11,7 @@
  *
  * Mode defaults to `native` for the composition path — Native is the
  * mode that pairs with the broader Kilimanjaro billing model per
- * `@k9o/gate/mode.ts` ch01 §12.4. Standalone customers should import
+ * `@k9o/gate/mode.ts`. Standalone customers should import
  * `@k9o/gate` directly and call `createGateClient({ mode: 'standalone', ... })`.
  *
  * KError vs GateError alignment is still open.
@@ -28,7 +28,7 @@ import { KError } from "./kerror.ts";
  * Build the composed `client.gate` namespace bound to the K9oClient's
  * baseUrl + projectSlug. Requires `projectSlug` to be set on the
  * client config — gate operations are inherently project-scoped per
- * v2.5.68 URL grammar.
+ * URL grammar.
  *
  * Returns `null` when projectSlug is not bound — the K9oClient may be
  * constructed for org-plane operations only (e.g. `client.orgs.list()`

package/src/http.ts

@@ -11,8 +11,8 @@
  *   - KError rehydration on non-2xx
  *   - Bearer token injection (from per-call override OR bound default)
  *   - Project context header (`x-k9o-project-slug`) injection when bound
- *   - Retry with exponential backoff per RetryConfig (see retry.ts) — TBD
- *     in next sub-cycle; v0.1.0 ships single-attempt
+ *   - Retry with exponential backoff per RetryConfig (see retry.ts) — not available
+ *     yet; requests are currently a single attempt
  *
  * The client is intentionally minimal — per-resource SDK methods compose
  * the path + body + bearer themselves and hand to `request()`. This keeps
@@ -42,7 +42,7 @@ export type HttpClientConfig = {
   fetch?: typeof globalThis.fetch | undefined;
   /** Default headers merged into every request. */
   defaultHeaders?: Record<string, string> | undefined;
-  /** Retry config per ch13 §7.1; idempotent methods only (GET/HEAD/OPTIONS/DELETE) — applied when transport fails or upstream returns 502/503/504/429. */
+  /** Retry config; idempotent methods only (GET/HEAD/OPTIONS/DELETE) — applied when transport fails or upstream returns 502/503/504/429. */
   retryConfig?: RetryConfig | undefined;
 };
 
@@ -176,7 +176,7 @@ export async function requestOnce<T>(
  * `Response` on 2xx (caller consumes `response.body` as an SSE / chunked
  * stream); throws `KError` on non-2xx, transport failures, or a missing
  * body. Used by streaming surfaces — `client.compute.llms.invokeStream`
- * (ch07 §10.2) + `client.realtime.subscribe` SSE transport (ch07 §11.3).
+ * + `client.realtime.subscribe` SSE transport.
  *
  * Unlike `request()`, this does NOT unwrap the JSON envelope or apply
  * retry — streaming responses are consumed incrementally and retry on a