@k9o/core 1.0.0 → 1.1.1

package/CHANGELOG.md

@@ -1,76 +1,14 @@
 # Changelog — @k9o/core
 
-## Unreleased
+## 1.1.1 — 2026-10-25
 
-- NEW `client.storage.locations.{list, create, get, update, retire, test}` — storage locations over `/@<projectSlug>/storage/locations`: register your own object store once per project from a pre-created `credentialRef`, then link it to buckets and Datasets. Provider-specific ids (`accountId` and `parentAccessKeyId` for r2, `bucketId` for b2) go in `providerParams`. New types: `StorageLocation`, `CreateStorageLocationInput`, `UpdateStorageLocationInput`, `StorageLocationProviderParams` and friends.
-- REMOVED (breaking) `client.byos.{list, create, get}` and the types `ByosBinding`, `CreateByosBindingInput`, `ByosProvider`, `ByosCustodyMode`, `ByosPurpose`. The purpose-based `/@<projectSlug>/byos` routes are withdrawn and answer 404; a location has no purpose. The credential helpers in `@k9o/core/byos` are unchanged.
-- REMOVED `client.policies.deactivate()` — the emergency-deactivate verb is retired per ch06 §9.4.4; use the publish-lockdown pattern instead.
+- Documentation links corrected: the documentation hub is https://docs.kilimanjaro.dev, with the website, platform API and console listed in a Links section. Package metadata points at the same places.
 
-## v0.5.0 — 2026-05-25 (org-plane + operator-self namespaces)
+## 1.1.0 — 2026-10-25
 
-NEW `client.org.*` org-plane namespace + NEW `client.me.*` operator-self namespace.
+- Documentation rewritten with runnable examples and expected output; internal cross-references removed from the published sources. No change to the public API.
+- Error text for `update()` / `delete()` without an `id` filter no longer mentions a version or a roadmap.
 
-- `client.org.members.{list, invite, get, remove}` per ch02 §6 + ask 1
-- `client.org.groups.{list, create, get, delete}` per ch02 §6 + ask 2
-- `client.org.auditLog.{query, tail}` per ch05 §4.4 + 6-event org family per ch05 §4.2 + ask 3 (distinct from project-plane `client.audit`)
-- `client.org.gate.roles.{list, grant, get, revoke}` per ch02 §6.5 `_sys.org_role_grants` substrate + ask 4 (ORG_ADMIN / ORG_BILLING_ADMIN grants with soft-delete revocation)
-- `client.org.gate.idpProviders.{list, create, get, configure, delete}` per ch02 §6.5 + ask 7
-- `client.org.smtp.{get, set, test, unset}` per ch02 §6.6 + ask 5 (3-tier cascade platform→org→project; Kibo-enclave password sequestration; 5/hour test-email rate limit)
-- `client.org.get()` — read bound org (mirrors `client.orgs.current()` for namespace symmetry)
-- `client.me.profile.{get, update}` — operator profile per ch01 §5.4 `/me/*` cross-org canonical
-- `client.me.sessions.{list, revoke, revokeAll}` — operator session management
-- `client.me.apiTokens.{list, create, delete}` — personal scripting tokens (forward substrate)
-- `client.me.notifications.{list, markRead, markAllRead}` — operator-targeted notifications (forward substrate)
-- `client.me.auditLog.query()` — operator-self audit (actions performed BY this operator across orgs; distinct from project-plane + org-plane audit)
-- `client.me.dataExport.{request, status}` — personal data export per GDPR-style flows (forward substrate)
+## 1.0.0 — 2026-10-23
 
-27 new tests pass / 0 fail covering URL composition across all org-plane + me-plane methods. Total @k9o/core suite: 124 / 0 across 8 test files.
-
-## v0.4.0 — 2026-05-25 (checkpoint D — retry + backoff)
-
-- HTTP client now retries transient failures per `retryConfig: { maxRetries, backoff: "exponential" | "linear" | "none", initialDelayMs, maxDelayMs }`
-- `createClient({ retryConfig: ... })` threads the config into the bound HTTP layer
-- Retryable: transport failures (`K9O_UPSTREAM_UNAVAILABLE`); HTTP 502/503/504; HTTP 429 (rate-limit)
-- Non-retryable: other 4xx (caller error); other 5xx (gateway-side bug; surface immediately); non-KError thrown values
-- Idempotency gate: only GET / HEAD / OPTIONS / DELETE are retried. POST / PATCH / PUT are never retried automatically — callers can opt in via `idempotencyKey` header per ch01 §10.2 when they assert idempotency (future sub-cycle integrates the header-driven path)
-- Backoff: exponential default (initialDelayMs * 2^attempt, capped, ±25% jitter); linear available; none for tight loops; defaults 100ms initial / 5000ms cap / 3 retries
-- 19 new tests covering isRetryable predicate + computeDelay backoff variants + withRetry orchestration + end-to-end HTTP retry integration. Total @k9o/core suite: 97 pass / 0 fail.
-
-## v0.3.0 — 2026-05-25 (checkpoint C — pillar composition: `client.gate` + `client.extensions`)
-
-- `client.gate` composed from `@k9o/gate` via gate-bridge — shares baseUrl + projectSlug; mode defaults to `native`; partnerToken inherits from apiKey. Throws `K9O_MISSING_PROJECT_CONTEXT` when accessed without projectSlug bound.
-- `client.extensions` composed from `@k9o/extensions` — `client.extensions.extension(slug)` factory returning typed Trailblazer/Anchor/Keystone class extension bindings per ch13 §8.1.
-- `@k9o/gate` + `@k9o/extensions` added as workspace dependencies.
-- 6 new composition tests pass: gate namespace exposed when projectSlug bound; gate throws K9O_MISSING_PROJECT_CONTEXT without it; gate routes against same baseUrl + projectSlug as K9oClient; extensions.extension factory + paperless + cairn binding types resolve.
-- KError ↔ GateError alignment is still open. Until then both error types are shape-compatible; caller code narrowing on `.code` works against either.
-- Total @k9o/core suite: 78 pass / 0 fail across 6 test files.
-
-## v0.2.0 — 2026-05-25 (checkpoint B — migrations + functions + policies + audit + orgs)
-
-5 new namespaces wired to gateway routes:
-
-- `client.migrations` — apply / list / get / queue / listPending / applyPending / rejectPending / deletePending per ch04 §2 + gateway `routes/migrations.ts` (8 methods)
-- `client.functions` — deploy / list / get / delete / invoke per ch07 + gateway `routes/{functions,invoke}.ts` (5 methods)
-- `client.policies` — current / list / create / validate / get / update / delete / publish / deactivate per ch06 §9 + gateway `routes/policies.ts` (9 methods)
-- `client.audit` — query / tail per ch05 §4 + gateway `routes/audit-log.ts` (2 methods)
-- `client.orgs` — list / get / restore / current per ch02 + gateway `routes/orgs-crud.ts` (4 methods)
-
-20 new unit tests pass / 0 fail (covers URL composition + HTTP method + body shape + query string serialisation across all 5 namespaces). Total @k9o/core suite: 72 pass.
-
-Forward sub-cycles: pillar composition (client.gate + client.extensions re-exports), retry/backoff in HTTP client, subscription/streaming, kibo namespace (composes with future @k9o/kibo).
-
-## v0.1.0 — 2026-05-25 (first-pass scaffold)
-
-NEW package. Surfaces shipped:
-
-- `createClient(options)` factory with baseUrl validation
-- HTTP client (`request`) with envelope unwrap on 2xx + `KError` rehydration on non-2xx + bearer/project/org header injection + transport failure mapping per ch01 §1 + §2
-- `KError` class + `KErrorWire` type + `kerrorFromWire` rehydration per ch01 §2 + ch11
-- Envelope + meta accessor types (`Envelope<T>` / `MetaCursor` / `MetaSubscription` / `MetaIdempotency` / `MetaWarning` / `MetaCost` / `MetaTiming` / `MetaContext` / `PaginatedEnvelope<T>`) per ch01 §1 + ch13 §5
-- URL grammar v2.5.68 helpers: `validateBaseUrl` (rejects path/scheme/query/fragment per ch13 §7.2 → `K9O_INVALID_BASE_URL`), `validateSlug`, `projectPath` (member-plane `/@<slug>/...`), `orgPath`, `platformPath` per ch01 §5.4
-- Data-plane DSL `client.from(collection)` with chainable filter builder (eq / neq / gt / gte / lt / lte / in / notIn / like / ilike / is / filter), pagination (limit / cursor), counting (count: none / exact / estimated), and terminal verbs (select / insert / update / delete) per ch04 §3 + §6.4; `update` + `delete` require `.eq('id', '...')` filter (row-mass updates deferred)
-- Project lifecycle (`client.projects.list / create / get / update`) per ch02
-
-52 unit tests pass / 0 fail across 4 test files; tsc clean strict.
-
-Forward sub-cycles add: `client.migrations`, `client.functions`, `client.policies`, `client.audit`, `client.orgs`, `client.gate` (composition), `client.kibo` (composition), `client.extensions` (composition), retry/backoff per ch13 §7.1, subscription/streaming per ch04 §8.
+First public release. See the README for the full API overview.

package/README.md

@@ -1,61 +1,259 @@
 # @k9o/core
 
-Kilimanjaro platform SDK for TypeScript / JavaScript.
+The Kilimanjaro platform SDK for TypeScript and JavaScript. One client for your data, projects, functions, audit log and more.
 
-`createClient` + data-plane DSL + project lifecycle + cross-cutting `KError` + meta accessor sugar. Composes with `@k9o/gate` (auth pillar) and `@k9o/extensions` (extension consumption pillar).
+## Contents
 
-## Status
+- [Links](#links)
+- [Install](#install)
+- [Quick start](#quick-start)
+- [Authentication and project context](#authentication-and-project-context)
+- [Running queries](#running-queries)
+- [Handling errors](#handling-errors)
+- [Regional hosts](#regional-hosts)
+- [Appendix](#appendix)
 
-v0.1.0 — first-pass scaffold. Surfaces shipped:
+## Links
 
-- `createClient(options)` — factory + baseUrl validation per ch13 §7
-- `client.from(collection)` — data-plane DSL: `.select()` / `.insert()` / `.update()` / `.delete()` with filter chain (eq / neq / gt / gte / lt / lte / in / notIn / like / ilike / is / filter) + pagination (limit / cursor / count) per ch04 §3 + §6.4
-- `client.projects` — list / create / get / update per ch02
-- `KError` — closed-taxonomy error class + `kerrorFromWire` rehydration per ch01 §2
-- URL grammar v2.5.68 — `validateBaseUrl` / `validateSlug` / `projectPath` / `orgPath` / `platformPath` per ch01 §5.4
-
-Forward sub-cycles add: `client.migrations`, `client.functions`, `client.policies`, `client.audit`, `client.orgs`, `client.gate` (composition with `@k9o/gate`), `client.kibo` (composition with future `@k9o/kibo`), `client.extensions` (composition with `@k9o/extensions`), retry/backoff, subscription/streaming.
+- Website: <https://kilimanjaro.dev>
+- Documentation / Developer Hub: <https://docs.kilimanjaro.dev>
+- Platform API: <https://api.k9o.io>
+- Platform Console: <https://console.k9o.io>
 
 ## Install
 
+```bash
+npm install @k9o/core
+```
+
 ```bash
 bun add @k9o/core
 ```
 
+```bash
+pnpm add @k9o/core
+```
+
+Requires Node.js 18+, Bun 1.1+ or a browser with a global `fetch`. TypeScript 5.6+ is optional. See [Requirements](#requirements).
+
 ## Quick start
 
-```typescript
-import { createClient, KError } from "@k9o/core";
+The examples on this page use a `tasks` collection with a `title` and a `done` field.
+
+```ts
+import { createClient } from "@k9o/core";
 
 const client = createClient({
-  baseUrl: "https://acme.api.k9o.io",
   apiKey: process.env.K9O_API_KEY,
   orgSlug: "acme",
   projectSlug: "member-portal",
 });
 
+type Task = { id: string; title: string; done: boolean };
+
+const created = await client.from("tasks").insert<Task>({ title: "Write the README", done: false });
+const task = created.data;
+
+console.log(task.title);
+```
+
+```text
+Write the README
+```
+
+Every method resolves to `{ data, meta }`. `data` is the typed result and `meta` holds response metadata.
+
+## Authentication and project context
+
+Three options select who you are and where you work. See [Client options](#client-options) for the full list.
+
+| Option | What it does |
+| --- | --- |
+| `apiKey` | Bearer token sent on every request. |
+| `orgSlug` | Selects your organization. |
+| `projectSlug` | Selects the project. Required by project-scoped calls. |
+
+- On the default host, pass `orgSlug` and leave `baseUrl` out.
+- On a self-hosted or custom host, pass `baseUrl` and leave `orgSlug` out.
+
+```ts
+const client = createClient({
+  baseUrl: "https://acme.example.com",
+  apiKey: process.env.K9O_API_KEY,
+  projectSlug: "member-portal",
+});
+```
+
+To retry transient failures, add `retryConfig`. See [Retry settings](#retry-settings).
+
+## Running queries
+
+`client.from(collection)` reads and writes records. Chain filters and paging, then await the result.
+
+```ts
+const response = await client.from("tasks").select<Task>().eq("done", false).limit(10);
+
+for (const openTask of response.data) {
+  console.log(openTask.title);
+}
+```
+
+Update or delete one record by id:
+
+```ts
+const updated = await client.from("tasks").update<Task>({ done: true }).eq("id", task.id);
+
+console.log(updated.data.done);
+```
+
+```text
+true
+```
+
+- `update` and `delete` need an `eq("id", ...)` filter. They never change many rows at once.
+- See [Data methods](#data-methods) for filters and paging.
+- Other namespaces such as projects, migrations and audit are listed in [Methods by namespace](#methods-by-namespace).
+
+## Handling errors
+
+Every method throws `KError` when a request fails or the SDK rejects your input. Switch on `code`.
+
+```ts
+import { KError } from "@k9o/core";
+
 try {
-  const { data, meta } = await client.from("posts").select().limit(10);
-  console.log(data);
-  console.log("next cursor:", (meta as { cursor?: { next: string | null } }).cursor?.next);
-} catch (e) {
-  if (e instanceof KError && e.code === "K9O_TIER_CAP_HIT") {
-    console.warn(e.message, e.recommendation);
+  await client.from("tasks").insert<Task>({ title: "One more task", done: false });
+} catch (error) {
+  if (error instanceof KError && error.code === "K9O_TIER_CAP_HIT") {
+    console.warn(error.message, error.recommendation);
   } else {
-    throw e;
+    throw error;
   }
 }
 ```
 
-## Architecture
+- `KError` also carries `context`, `status` and `requestId`. See [Error fields](#error-fields).
+- The gateway can send many codes. See [Error codes](#error-codes) for the ones the SDK raises itself.
+
+## Regional hosts
+
+- On an organization host such as `https://acme.api.k9o.io`, the client sends one `HEAD` request first.
+- The request carries no credentials. It finds the regional host for your organization.
+- All later requests go to that host. The answer is cached for the life of the client.
+- Any other `baseUrl` is used as given. If the lookup fails, the configured host is used.
+
+## Appendix
+
+### Requirements
+
+| Requirement | Version |
+| --- | --- |
+| Node.js | 18 or newer |
+| Bun | 1.1 or newer |
+| TypeScript (optional) | 5.6 or newer |
+| Browser | Any with a global `fetch` |
+
+### Client options
+
+| Option | What it does |
+| --- | --- |
+| `apiKey` | Bearer token sent on every request. |
+| `orgSlug` | Selects your organization. On the default host it builds `https://<orgSlug>.api.k9o.io`. |
+| `projectSlug` | Selects the project. Required by project-scoped calls. |
+| `baseUrl` | Gateway host, no path. Defaults to `https://api.k9o.io`. |
+| `fetch` | Custom `fetch` implementation. |
+| `defaultHeaders` | Headers added to every request. |
+| `retryConfig` | Retry policy. See [Retry settings](#retry-settings). |
+
+- A `baseUrl` with a path, query or fragment throws `K9O_INVALID_BASE_URL`.
+- Slugs use 2 to 63 lowercase letters, digits and hyphens. They start with a letter and do not end with a hyphen.
+
+### Retry settings
+
+| Field | Meaning |
+| --- | --- |
+| `maxRetries` | How many times to retry. |
+| `backoff` | `"exponential"`, `"linear"` or `"none"`. |
+| `initialDelayMs` | First delay. Optional. |
+| `maxDelayMs` | Delay cap. Optional. |
+
+- Only GET, HEAD, OPTIONS and DELETE are retried.
+- Retries happen on network failure and on HTTP 429, 502, 503 and 504.
+
+### Methods by namespace
+
+| Namespace | Methods |
+| --- | --- |
+| `client.from(collection)` | See [Data methods](#data-methods). |
+| `client.projects` | `list`, `create`, `get`, `update` |
+| `client.migrations` | `apply`, `list`, `get`, `queue`, `listPending`, `applyPending`, `rejectPending`, `deletePending` |
+| `client.functions` | `deploy`, `list`, `get`, `delete` |
+| `client.audit` | `query`, `tail` (needs `projectSlug`) |
+| `client.policies` | Policy bundle lifecycle |
+| `client.storage` | Storage locations and buckets |
+| `client.metadata` | Metadata queries across surfaces |
+| `client.orgs` | `list`, `get`, `restore`, `current` |
+| `client.org` | Members, groups, SMTP settings, audit log, identity providers |
+| `client.me` | Your profile, sessions, API tokens, notifications |
+| `client.studio` | `workflows` and `dashboards` |
+| `client.compute.llms` | `list`, `read`, `invoke` |
+| `client.ai` | `embed` |
+| `client.realtime` | `subscribe`, `replay` |
+| `client.gate` | End-user sign-in from `@k9o/gate` (needs `projectSlug`) |
+| `client.kibo` | Vault and key operations from `@k9o/kibo` |
+| `client.extensions` | `extension(slug)` from `@k9o/extensions` |
+
+### Data methods
+
+| Method | What it does |
+| --- | --- |
+| `select<T>()` | Starts a query. Await it to get the rows. |
+| `insert<T>(record)` | Creates one record. |
+| `update<T>(patch)` | Updates one record by id. |
+| `delete<T>()` | Deletes one record by id. |
+| `eq`, `neq` | Equal, not equal. |
+| `gt`, `gte`, `lt`, `lte` | Comparisons. |
+| `in`, `notIn` | Value is in, or not in, a list. |
+| `like`, `ilike` | Pattern match, case-sensitive or not. |
+| `is` | Compare with `"null"`, `"true"` or `"false"`. |
+| `filter(column, op, value)` | Generic form of the filters above. |
+| `limit(n)` | Maximum rows to return. |
+| `cursor(token)` | Continue from a cursor. |
+| `count(mode)` | `"none"`, `"exact"` or `"estimated"`. |
+
+Filters combine with AND.
+
+### Error fields
+
+| Field | Meaning |
+| --- | --- |
+| `code` | Stable string such as `K9O_PROJECT_NOT_FOUND`. Switch on this. |
+| `message` | Human-readable explanation. |
+| `context` | Read-only per-code details. |
+| `recommendation` | Suggested next step, or `null`. |
+| `status` | HTTP status, or `null` if no request was sent. |
+| `requestId` | Gateway trace id for support, or `null`. |
+
+### Error codes
+
+The gateway can send other codes. The SDK passes them through unchanged.
 
-`@k9o/core` is the umbrella TypeScript factory that:
+| Code | When |
+| --- | --- |
+| `K9O_INVALID_BASE_URL` | `baseUrl` is not a plain http or https host. |
+| `K9O_INVALID_FIELD_VALUE` | An argument or slug failed validation. |
+| `K9O_INVALID_FILTER` | A realtime subscription filter was malformed. |
+| `K9O_MISSING_PROJECT_CONTEXT` | A project-scoped call was made without `projectSlug`. |
+| `K9O_UPSTREAM_UNAVAILABLE` | The gateway could not be reached. |
+| `K9O_INTERNAL_ERROR` | No `fetch` is available, or the response was unexpected. |
 
-- Constructs the `K9oClient` with cross-cutting HTTP, KError, and URL grammar
-- Hosts pillars that don't have their own dedicated package (data-plane, projects, migrations, functions, policies, audit, orgs)
-- Composes pillar packages (`@k9o/gate`, `@k9o/extensions`, future `@k9o/kibo`) under namespaces on the client
+### Related packages
 
-Customers may import pillar packages directly when they only need one slice — `@k9o/gate` standalone for Auth0-parity deployments, `@k9o/extensions` standalone for extension-only consumption — or import `@k9o/core` for the full platform surface.
+| Package | What it does |
+| --- | --- |
+| `@k9o/gate` | End-user sign-up, sign-in, sessions and JWT verification. |
+| `@k9o/extensions` | Typed bindings for platform extensions. |
+| `@k9o/kibo` | Vault and key operations. |
 
 ## License
 

package/dist/{chunk-OE2MMUIG.js → chunk-2NDFTHUB.js}

@@ -1,6 +1,6 @@
 import {
   KError
-} from "./chunk-2VSTF5UU.js";
+} from "./chunk-LJZ45UA2.js";
 
 // src/url-grammar.ts
 function validateBaseUrl(baseUrl) {
@@ -90,4 +90,4 @@ export {
   orgPath,
   platformPath
 };
-//# sourceMappingURL=chunk-OE2MMUIG.js.map
+//# sourceMappingURL=chunk-2NDFTHUB.js.map

package/dist/chunk-2NDFTHUB.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/url-grammar.ts"],"sourcesContent":["/**\n * URL grammar.\n *\n * Canonical URL shapes:\n *   - Member-plane (project-scoped): `<orgSlug>.api.k9o.io/@<projectSlug>/<sub-resource>/...`\n *   - Org-plane (org-scoped):        `<orgSlug>.api.k9o.io/<resource>/...`\n *   - Platform-plane (cross-org):    `api.k9o.io/discovery/...` + `api.k9o.io/auth/...` etc.\n *\n * The `baseUrl` passed to `createClient` is the gateway host root —\n * scheme + host (+ optional port). Path-bearing baseUrls\n * are rejected with `K9O_INVALID_BASE_URL`.\n *\n * The SDK constructs URLs by composing `baseUrl + path-from-builder`.\n * Per-resource SDK methods use the builders below to assemble their\n * `path` argument before handing to the HTTP client.\n */\n\nimport { KError } from \"./kerror.ts\";\n\n/**\n * Validate a `baseUrl`. Returns the normalised form\n * (trailing-slash stripped) on success; throws `K9O_INVALID_BASE_URL`\n * on any violation.\n *\n * Accepted shapes:\n *   - `https://api.k9o.io`\n *   - `https://acme.api.k9o.io`\n *   - `http://localhost:8080`\n *   - `https://api.k9o.io:443`\n *\n * Rejected shapes:\n *   - path segments (`https://api.k9o.io/v2`)\n *   - missing scheme (`api.k9o.io`)\n *   - non-http(s) scheme (`wss://api.k9o.io`)\n *   - query / fragment (`https://api.k9o.io?x=1`)\n */\nexport function validateBaseUrl(baseUrl: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(baseUrl);\n  } catch {\n    throw new KError({\n      code: \"K9O_INVALID_BASE_URL\",\n      message: `baseUrl \"${baseUrl}\" is not a valid URL`,\n      context: { baseUrl },\n      recommendation: \"Pass a scheme + host like `https://api.k9o.io` or `https://<orgSlug>.api.k9o.io`\",\n      status: null,\n    });\n  }\n  if (parsed.protocol !== \"http:\" && parsed.protocol !== \"https:\") {\n    throw new KError({\n      code: \"K9O_INVALID_BASE_URL\",\n      message: `baseUrl \"${baseUrl}\" uses unsupported scheme \"${parsed.protocol}\"; expected http: or https:`,\n      context: { baseUrl, scheme: parsed.protocol },\n      recommendation: \"Use http:// or https://. WebSocket subscriptions are wired internally over SSE on the same host.\",\n      status: null,\n    });\n  }\n  if (parsed.pathname !== \"/\" && parsed.pathname !== \"\") {\n    throw new KError({\n      code: \"K9O_INVALID_BASE_URL\",\n      message: `baseUrl \"${baseUrl}\" must not contain a path segment; got \"${parsed.pathname}\"`,\n      context: { baseUrl, path: parsed.pathname },\n      recommendation: \"Strip the path segment — pass host only. URL paths are composed by the SDK.\",\n      status: null,\n    });\n  }\n  if (parsed.search.length > 0 || parsed.hash.length > 0) {\n    throw new KError({\n      code: \"K9O_INVALID_BASE_URL\",\n      message: `baseUrl \"${baseUrl}\" must not contain query or fragment`,\n      context: { baseUrl, query: parsed.search, fragment: parsed.hash },\n      recommendation: \"Pass host only.\",\n      status: null,\n    });\n  }\n  // Normalise — strip trailing slash so concatenation is predictable.\n  const normalised = `${parsed.protocol}//${parsed.host}`;\n  return normalised;\n}\n\n/**\n * The bare platform apex hosts org-subdomain derivation applies to. `api.k9o.io`\n * (production) and `api-staging.k9o.io` (staging) share the same\n * `<orgSlug>.<apex>` wire-routing scheme — confirmed live (conformance,\n * `k9o login` examples, staging demo configs all address orgs this way on\n * both). A THIRD apex here needs the same confirmation before joining this\n * set — never inferred from a hostname merely looking apex-shaped.\n */\nconst K9O_ORG_DERIVABLE_APEXES = new Set([\"api.k9o.io\", \"api-staging.k9o.io\"]);\n\n/**\n * Resolve the effective baseUrl. `baseUrl` is\n * OPTIONAL — it defaults to the platform apex `https://api.k9o.io`. When the\n * (validated) host is a bare apex in `K9O_ORG_DERIVABLE_APEXES` and `orgSlug`\n * is supplied, the SDK composes the canonical org-subdomain wire root\n * `https://<orgSlug>.<apex>`. An explicit `<orgSlug>` subdomain, a\n * self-hosted / Sovereign host, or a dev host (anything not in that set)\n * passes through unchanged — `orgSlug` is intentionally NOT validated or\n * composed onto a non-apex host (fixed 2026-08-30: this used to silently\n * ignore `orgSlug` for `api-staging.k9o.io` too, not just genuine\n * self-hosted/custom hosts, since only the literal production apex string\n * was checked).\n */\nexport function resolveBaseUrl(baseUrl: string | undefined, orgSlug?: string): string {\n  const validated = validateBaseUrl(baseUrl ?? \"https://api.k9o.io\");\n  const parsed = new URL(validated);\n  if (K9O_ORG_DERIVABLE_APEXES.has(parsed.hostname) && orgSlug) {\n    validateSlug(orgSlug, \"org\");\n    return `${parsed.protocol}//${orgSlug}.${parsed.hostname}`;\n  }\n  return validated;\n}\n\n/**\n * Slug format validator:\n *   `[a-z][a-z0-9-]{1,62}` and must not end with `-`.\n */\nconst SLUG_RE = /^[a-z][a-z0-9-]{1,62}$/;\n\nexport function validateSlug(slug: string, kind: \"org\" | \"project\"): void {\n  if (!SLUG_RE.test(slug) || slug.endsWith(\"-\")) {\n    throw new KError({\n      code: \"K9O_INVALID_FIELD_VALUE\",\n      message: `${kind}Slug \"${slug}\" does not match required format ^[a-z][a-z0-9-]{1,62}$ (must not end with '-')`,\n      context: { slug, kind },\n      recommendation: `Pass a slug matching the format — lowercase letters / digits / hyphens; 2-63 chars; starts with a letter; does not end with hyphen.`,\n      status: null,\n    });\n  }\n}\n\n/**\n * Build a project-scoped (member-plane) URL path per the URL grammar\n * E.g. `projectPath('member-portal', 'collections/posts/documents')`\n *      → `/@member-portal/collections/posts/documents`.\n *\n * The caller is responsible for normalising sub-resource components\n * (URL-encoding goes through the caller's path construction; this\n * helper handles only the prefix + slug shape).\n */\nexport function projectPath(projectSlug: string, subResource: string): string {\n  validateSlug(projectSlug, \"project\");\n  const cleaned = subResource.startsWith(\"/\") ? subResource.slice(1) : subResource;\n  return `/@${projectSlug}/${cleaned}`;\n}\n\n/**\n * Build an org-plane path. E.g. `orgPath('org')` → `/org`,\n * `orgPath('projects')` → `/projects`.\n */\nexport function orgPath(resource: string): string {\n  const cleaned = resource.startsWith(\"/\") ? resource.slice(1) : resource;\n  return `/${cleaned}`;\n}\n\n/**\n * Build a platform-plane path (cross-org). E.g.\n * `platformPath('discovery/projects')` → `/discovery/projects`,\n * `platformPath('auth/sign-in')` → `/auth/sign-in`.\n *\n * Composes with the platform baseUrl (`https://api.k9o.io`) — not the\n * org-subdomain baseUrl.\n */\nexport function platformPath(resource: string): string {\n  const cleaned = resource.startsWith(\"/\") ? resource.slice(1) : resource;\n  return `/${cleaned}`;\n}\n"],"mappings":";;;;;AAoCO,SAAS,gBAAgB,SAAyB;AACvD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,OAAO;AAAA,EAC1B,QAAQ;AACN,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,YAAY,OAAO;AAAA,MAC5B,SAAS,EAAE,QAAQ;AAAA,MACnB,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,MAAI,OAAO,aAAa,WAAW,OAAO,aAAa,UAAU;AAC/D,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,YAAY,OAAO,8BAA8B,OAAO,QAAQ;AAAA,MACzE,SAAS,EAAE,SAAS,QAAQ,OAAO,SAAS;AAAA,MAC5C,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,MAAI,OAAO,aAAa,OAAO,OAAO,aAAa,IAAI;AACrD,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,YAAY,OAAO,2CAA2C,OAAO,QAAQ;AAAA,MACtF,SAAS,EAAE,SAAS,MAAM,OAAO,SAAS;AAAA,MAC1C,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACA,MAAI,OAAO,OAAO,SAAS,KAAK,OAAO,KAAK,SAAS,GAAG;AACtD,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,YAAY,OAAO;AAAA,MAC5B,SAAS,EAAE,SAAS,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAK;AAAA,MAChE,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAEA,QAAM,aAAa,GAAG,OAAO,QAAQ,KAAK,OAAO,IAAI;AACrD,SAAO;AACT;AAUA,IAAM,2BAA2B,oBAAI,IAAI,CAAC,cAAc,oBAAoB,CAAC;AAetE,SAAS,eAAe,SAA6B,SAA0B;AACpF,QAAM,YAAY,gBAAgB,WAAW,oBAAoB;AACjE,QAAM,SAAS,IAAI,IAAI,SAAS;AAChC,MAAI,yBAAyB,IAAI,OAAO,QAAQ,KAAK,SAAS;AAC5D,iBAAa,SAAS,KAAK;AAC3B,WAAO,GAAG,OAAO,QAAQ,KAAK,OAAO,IAAI,OAAO,QAAQ;AAAA,EAC1D;AACA,SAAO;AACT;AAMA,IAAM,UAAU;AAET,SAAS,aAAa,MAAc,MAA+B;AACxE,MAAI,CAAC,QAAQ,KAAK,IAAI,KAAK,KAAK,SAAS,GAAG,GAAG;AAC7C,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,GAAG,IAAI,SAAS,IAAI;AAAA,MAC7B,SAAS,EAAE,MAAM,KAAK;AAAA,MACtB,gBAAgB;AAAA,MAChB,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AACF;AAWO,SAAS,YAAY,aAAqB,aAA6B;AAC5E,eAAa,aAAa,SAAS;AACnC,QAAM,UAAU,YAAY,WAAW,GAAG,IAAI,YAAY,MAAM,CAAC,IAAI;AACrE,SAAO,KAAK,WAAW,IAAI,OAAO;AACpC;AAMO,SAAS,QAAQ,UAA0B;AAChD,QAAM,UAAU,SAAS,WAAW,GAAG,IAAI,SAAS,MAAM,CAAC,IAAI;AAC/D,SAAO,IAAI,OAAO;AACpB;AAUO,SAAS,aAAa,UAA0B;AACrD,QAAM,UAAU,SAAS,WAAW,GAAG,IAAI,SAAS,MAAM,CAAC,IAAI;AAC/D,SAAO,IAAI,OAAO;AACpB;","names":[]}

package/dist/{chunk-2VSTF5UU.js → chunk-LJZ45UA2.js}

@@ -30,4 +30,4 @@ export {
   KError,
   kerrorFromWire
 };
-//# sourceMappingURL=chunk-2VSTF5UU.js.map
+//# sourceMappingURL=chunk-LJZ45UA2.js.map

package/dist/chunk-LJZ45UA2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/kerror.ts"],"sourcesContent":["/**\n * `KError` — the closed-taxonomy error class returned by every `@k9o/core`\n * surface on non-2xx gateway responses or SDK-side validation failures.\n *\n * TypeScript / JavaScript throw on error; the per-language SDKs deliver this same payload\n * via their idiomatic mechanism (Go tuple-return; Rust Result; Python\n * raise; etc.) without changing the field shape.\n *\n * Fields:\n *   - `code`     — closed-taxonomy string (e.g. `K9O_TIER_CAP_HIT`,\n *                  `K9O_PROJECT_NOT_FOUND`); unknown codes pass through\n *                  with `code` preserved + `INTERNAL_ERROR` family\n *                  classification recorded in `context.originalCode`.\n *   - `message`  — human-readable explanation.\n *   - `context`  — structured per-code payload (immutable; frozen).\n *   - `recommendation` — actionable next step (may be null when the\n *                  gateway didn't return one).\n *   - `status`   — HTTP status the gateway returned (or null for\n *                  SDK-side construct-time errors like\n *                  `K9O_INVALID_BASE_URL`).\n *   - `requestId` — gateway-emitted trace ID for downstream correlation.\n *\n * Standalone `@k9o/gate` ships its own `GateError` for the Auth0-parity\n * deployment shape; when `@k9o/gate` is composed inside `@k9o/core`,\n * `GateError` semantics align with `KError extends KError` (alignment still open).\n * Until then `KError` is the canonical error type returned by `@k9o/core` surfaces; `GateError` thrown by\n * `@k9o/gate`-delegated surfaces remain `KError`-shape-compatible\n * (both expose the same `code` / `message` / `context` / `recommendation`\n * fields) so caller code that narrows on `code` works against either.\n */\n\n/**\n * Wire-shape sentinel matching the gateway's `KError` JSON payload. The HTTP client recognises this on non-2xx responses\n * and rehydrates it into a `KError` instance.\n */\nexport type KErrorWire = {\n  code: string;\n  message: string;\n  context?: Record<string, unknown>;\n  recommendation?: string | null;\n  requestId?: string;\n};\n\n/**\n * The customer-facing error type. Every `@k9o/core` surface throws this\n * on non-2xx upstream responses, transport failures, or SDK-side\n * validation failures.\n */\nexport class KError extends Error {\n  readonly code: string;\n  readonly context: Readonly<Record<string, unknown>>;\n  readonly recommendation: string | null;\n  readonly status: number | null;\n  readonly requestId: string | null;\n\n  constructor(init: {\n    code: string;\n    message: string;\n    context?: Record<string, unknown>;\n    recommendation?: string | null;\n    status?: number | null;\n    requestId?: string | null;\n  }) {\n    super(init.message);\n    this.name = \"KError\";\n    this.code = init.code;\n    this.context = Object.freeze({ ...(init.context ?? {}) });\n    this.recommendation = init.recommendation ?? null;\n    this.status = init.status ?? null;\n    this.requestId = init.requestId ?? null;\n  }\n}\n\n/**\n * Rehydrate a wire `KError` payload into a typed `KError` instance.\n * Unlike `@k9o/gate.gateErrorFromWire`, `@k9o/core` does not maintain\n * a hand-curated allow-list of known codes — the gateway's KError\n * code-space is open-ended and curated centrally; the SDK\n * preserves whatever code the gateway sends. Code-narrowing in caller\n * code uses string-literal comparison against the well-known codes\n * (e.g. `if (e.code === 'K9O_TIER_CAP_HIT')`).\n */\nexport function kerrorFromWire(wire: KErrorWire, status: number): KError {\n  return new KError({\n    code: wire.code,\n    message: wire.message,\n    context: wire.context ?? {},\n    recommendation: wire.recommendation ?? null,\n    status,\n    requestId: wire.requestId ?? null,\n  });\n}\n"],"mappings":";AAgDO,IAAM,SAAN,cAAqB,MAAM;AAAA,EACvB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAOT;AACD,UAAM,KAAK,OAAO;AAClB,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,UAAU,OAAO,OAAO,EAAE,GAAI,KAAK,WAAW,CAAC,EAAG,CAAC;AACxD,SAAK,iBAAiB,KAAK,kBAAkB;AAC7C,SAAK,SAAS,KAAK,UAAU;AAC7B,SAAK,YAAY,KAAK,aAAa;AAAA,EACrC;AACF;AAWO,SAAS,eAAe,MAAkB,QAAwB;AACvE,SAAO,IAAI,OAAO;AAAA,IAChB,MAAM,KAAK;AAAA,IACX,SAAS,KAAK;AAAA,IACd,SAAS,KAAK,WAAW,CAAC;AAAA,IAC1B,gBAAgB,KAAK,kBAAkB;AAAA,IACvC;AAAA,IACA,WAAW,KAAK,aAAa;AAAA,EAC/B,CAAC;AACH;","names":[]}

package/dist/{chunk-FVWKL5UQ.js → chunk-O2ZTV6YN.js}

@@ -1,7 +1,7 @@
 import {
   KError,
   kerrorFromWire
-} from "./chunk-2VSTF5UU.js";
+} from "./chunk-LJZ45UA2.js";
 
 // src/retry.ts
 var RETRYABLE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS", "DELETE"]);
@@ -231,4 +231,4 @@ export {
   requestOnce,
   requestStream
 };
-//# sourceMappingURL=chunk-FVWKL5UQ.js.map
+//# sourceMappingURL=chunk-O2ZTV6YN.js.map

package/dist/chunk-O2ZTV6YN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/retry.ts","../src/region.ts","../src/http.ts"],"sourcesContent":["/**\n * Retry + backoff for the HTTP client.\n *\n * Configured via `retryConfig: { maxRetries, backoff }`. Retries are\n * scoped to transient failures only — never retry on KError-carrying\n * non-2xx responses (those are semantic; the caller must handle them).\n *\n * Retryable conditions (transient; safe to retry idempotently):\n *   - Transport error (`K9O_UPSTREAM_UNAVAILABLE` from `request()`) — network down,\n *     DNS fail, connection refused, etc.\n *   - HTTP 502 / 503 / 504 (gateway-up but downstream unavailable)\n *   - HTTP 429 with `Retry-After` header (rate-limit; backoff by header value)\n *\n * Non-retryable (semantic; caller must handle):\n *   - HTTP 4xx other than 429 (caller bug; retry won't help)\n *   - HTTP 5xx other than 502/503/504 (gateway-side bug; surface immediately)\n *   - KError on success-shape (rare; malformed envelope)\n *\n * Retry method discipline: only GET / HEAD / OPTIONS / DELETE are\n * retried by default — these are RFC-7231 idempotent. POST / PATCH /\n * PUT are NOT retried (caller can opt in via `idempotencyKey` header\n * when they assert idempotency).\n *\n * Backoff:\n *   - `exponential` (default) — `initialDelayMs * 2^attempt`, capped at maxDelayMs; jittered ±25%\n *   - `linear` — `initialDelayMs * (attempt + 1)`, capped at maxDelayMs; jittered ±25%\n *   - `none` — no delay between attempts\n */\n\nimport { KError } from \"./kerror.ts\";\nimport type { RetryConfig } from \"./types.ts\";\n\nconst RETRYABLE_METHODS = new Set([\"GET\", \"HEAD\", \"OPTIONS\", \"DELETE\"]);\nconst RETRYABLE_STATUS = new Set([502, 503, 504]);\n\nexport const DEFAULT_RETRY_CONFIG: Required<RetryConfig> = {\n  maxRetries: 3,\n  backoff: \"exponential\",\n  initialDelayMs: 100,\n  maxDelayMs: 5000,\n};\n\n/**\n * Decide if a thrown error is retryable.\n * Only KError instances are inspected; other thrown values propagate\n * (programmer error / unrecoverable state).\n */\nexport function isRetryable(error: unknown, method: string): boolean {\n  if (!RETRYABLE_METHODS.has(method.toUpperCase())) return false;\n  if (!(error instanceof KError)) return false;\n  if (error.code === \"K9O_UPSTREAM_UNAVAILABLE\") return true;\n  if (error.status !== null && RETRYABLE_STATUS.has(error.status)) return true;\n  if (error.status === 429) return true; // rate-limit; respect Retry-After if surfaced in context\n  return false;\n}\n\n/**\n * Compute the backoff delay for a given attempt index (0-based).\n */\nexport function computeDelay(config: Required<RetryConfig>, attempt: number): number {\n  let base: number;\n  if (config.backoff === \"none\") return 0;\n  if (config.backoff === \"linear\") base = config.initialDelayMs * (attempt + 1);\n  else base = config.initialDelayMs * Math.pow(2, attempt);\n  const capped = Math.min(base, config.maxDelayMs);\n  // ±25% jitter\n  const jitter = capped * 0.25 * (Math.random() * 2 - 1);\n  return Math.max(0, Math.floor(capped + jitter));\n}\n\n/**\n * Sleep helper. Pulled out so tests can stub it via injection.\n */\nexport function sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms));\n}\n\n/**\n * Execute a function with retry. The function is called up to\n * `maxRetries + 1` times; non-retryable failures throw immediately.\n *\n * @param fn - The function to execute (typically the HTTP request)\n * @param method - HTTP method (used to gate retry per RETRYABLE_METHODS)\n * @param config - Retry config; defaults applied if partial\n * @param sleepImpl - Sleep implementation (tests inject a no-op or fast variant)\n */\nexport async function withRetry<T>(\n  fn: () => Promise<T>,\n  method: string,\n  config: RetryConfig | undefined,\n  sleepImpl: (ms: number) => Promise<void> = sleep,\n): Promise<T> {\n  const c: Required<RetryConfig> = {\n    ...DEFAULT_RETRY_CONFIG,\n    ...(config ?? {}),\n  };\n  let lastError: unknown;\n  for (let attempt = 0; attempt <= c.maxRetries; attempt++) {\n    try {\n      return await fn();\n    } catch (e) {\n      lastError = e;\n      if (attempt === c.maxRetries) break;\n      if (!isRetryable(e, method)) break;\n      const delay = computeDelay(c, attempt);\n      if (delay > 0) await sleepImpl(delay);\n    }\n  }\n  throw lastError;\n}\n","/**\n * Regional host resolution lives in `@k9o/gate` (which `@k9o/core` composes), so the Gate client and the core client\n * share one implementation of the probe and of the `Location` validation. See `packages/gate/src/region.ts`.\n */\nexport { resolveRegionalOrigin, regionalOriginFromLocation, type RegionConfig } from \"@k9o/gate\";\n","/**\n * HTTP client abstraction for `@k9o/core`.\n *\n * Lifted + generalised from `@k9o/gate/client.ts` (the auth-pillar SDK's\n * proven pattern). This client is per-instance — `createClient` constructs\n * one bound to its config; per-call options merge into the bound defaults.\n *\n * Responsibilities:\n *   - URL construction against bound `baseUrl` + per-call `path` + query\n *   - Envelope unwrap on 2xx (rejects malformed envelopes as INTERNAL_ERROR)\n *   - KError rehydration on non-2xx\n *   - Bearer token injection (from per-call override OR bound default)\n *   - Project context header (`x-k9o-project-slug`) injection when bound\n *   - Retry with exponential backoff per RetryConfig (see retry.ts) — not available\n *     yet; requests are currently a single attempt\n *\n * The client is intentionally minimal — per-resource SDK methods compose\n * the path + body + bearer themselves and hand to `request()`. This keeps\n * the HTTP layer dumb and the per-resource logic auditable.\n */\n\nimport { KError, kerrorFromWire, type KErrorWire } from \"./kerror.ts\";\nimport type { Envelope } from \"./envelope.ts\";\nimport { withRetry } from \"./retry.ts\";\nimport type { RetryConfig } from \"./types.ts\";\nimport { resolveRegionalOrigin } from \"./region.ts\";\n\n/**\n * Per-instance HTTP client config. Constructed by `createClient`; passed\n * to `request()` per call.\n */\nexport type HttpClientConfig = {\n  /** Normalised baseUrl (scheme + host); set via createClient. */\n  baseUrl: string;\n  /** Default bearer token (per-call override wins). */\n  apiKey?: string | undefined;\n  /** Active project slug — injected as `x-k9o-project-slug` header on every request. */\n  projectSlug?: string | undefined;\n  /** Active org slug — injected as `x-k9o-org-slug` header on every request. */\n  orgSlug?: string | undefined;\n  /** Custom fetch impl (defaults to globalThis.fetch); use for tests + non-standard runtimes. */\n  fetch?: typeof globalThis.fetch | undefined;\n  /** Default headers merged into every request. */\n  defaultHeaders?: Record<string, string> | undefined;\n  /** Retry config; idempotent methods only (GET/HEAD/OPTIONS/DELETE) — applied when transport fails or upstream returns 502/503/504/429. */\n  retryConfig?: RetryConfig | undefined;\n};\n\n/**\n * Per-call request options.\n */\nexport type RequestInit = {\n  method: \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n  path: string;\n  body?: unknown;\n  /** Per-call bearer override (wins over config.apiKey). */\n  bearerToken?: string | undefined;\n  /** Per-call additional headers (merged with config.defaultHeaders + auth). */\n  headers?: Record<string, string> | undefined;\n  /** Per-call query params. */\n  query?: Record<string, string | number | boolean | undefined> | undefined;\n};\n\n/**\n * Issue a request against the gateway. Returns the unwrapped Envelope\n * on 2xx; throws KError on non-2xx, transport failures, or malformed\n * responses.\n */\nexport async function request<T>(\n  config: HttpClientConfig,\n  init: RequestInit,\n): Promise<Envelope<T>> {\n  return withRetry(() => requestOnce<T>(config, init), init.method, config.retryConfig);\n}\n\n/**\n * Single-attempt request implementation. `request` wraps this in\n * retry-with-backoff per `config.retryConfig`. Exported for tests that\n * want to bypass retry semantics.\n */\nexport async function requestOnce<T>(\n  config: HttpClientConfig,\n  init: RequestInit,\n): Promise<Envelope<T>> {\n  const fetchImpl = config.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new KError({\n      code: \"K9O_INTERNAL_ERROR\",\n      message:\n        \"No fetch implementation available — pass {fetch} in createClient options for runtimes without a global fetch\",\n      context: {},\n      recommendation: \"Use Node 18+, Bun 1.1+, or a modern browser; otherwise supply a fetch polyfill via the fetch option.\",\n    });\n  }\n\n  const url = buildUrl(await resolveRegionalOrigin(config), init.path, init.query);\n  const headers: Record<string, string> = {\n    accept: \"application/json\",\n    ...(config.defaultHeaders ?? {}),\n    ...(config.projectSlug ? { \"x-k9o-project-slug\": config.projectSlug } : {}),\n    ...(config.orgSlug ? { \"x-k9o-org-slug\": config.orgSlug } : {}),\n    ...(init.headers ?? {}),\n  };\n  const bearer = init.bearerToken ?? config.apiKey;\n  if (typeof bearer === \"string\" && bearer.length > 0) {\n    headers[\"authorization\"] = `Bearer ${bearer}`;\n  }\n  const requestInit: Record<string, unknown> = {\n    method: init.method,\n    headers,\n  };\n  if (init.body !== undefined) {\n    if (typeof FormData !== \"undefined\" && init.body instanceof FormData) {\n      // Multipart: the runtime sets the content type (with its boundary); never JSON-encode it.\n      requestInit[\"body\"] = init.body;\n    } else {\n      headers[\"content-type\"] = \"application/json\";\n      requestInit[\"body\"] = JSON.stringify(init.body);\n    }\n  }\n\n  let response: Response;\n  try {\n    response = await fetchImpl(url, requestInit as Parameters<typeof fetchImpl>[1]);\n  } catch (e) {\n    throw new KError({\n      code: \"K9O_UPSTREAM_UNAVAILABLE\",\n      message: `Network error reaching ${url}: ${e instanceof Error ? e.message : String(e)}`,\n      context: { url },\n      recommendation: \"Check connectivity to the gateway; retry with backoff if transient.\",\n    });\n  }\n\n  // 204 No Content — synthesize an empty envelope (some DELETE / PUT endpoints).\n  if (response.status === 204) {\n    return { data: undefined as unknown as T, meta: {} };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = await response.json();\n  } catch (e) {\n    throw new KError({\n      code: \"K9O_INTERNAL_ERROR\",\n      message: `Failed to parse JSON response from ${url}: ${e instanceof Error ? e.message : String(e)}`,\n      context: { url, status: response.status },\n      status: response.status,\n    });\n  }\n\n  if (response.status >= 200 && response.status < 300) {\n    if (!isEnvelope<T>(parsed)) {\n      throw new KError({\n        code: \"K9O_INTERNAL_ERROR\",\n        message: `Malformed envelope from ${url}: expected {data, meta}`,\n        context: { url, status: response.status },\n        status: response.status,\n      });\n    }\n    return parsed;\n  }\n\n  if (isKErrorWire(parsed)) {\n    throw kerrorFromWire(parsed, response.status);\n  }\n  throw new KError({\n    code: \"K9O_INTERNAL_ERROR\",\n    message: `Upstream returned ${response.status} with non-KError body`,\n    context: { url, status: response.status, body: parsed },\n    status: response.status,\n  });\n}\n\n/**\n * Open a streaming request against the gateway. Returns the raw\n * `Response` on 2xx (caller consumes `response.body` as an SSE / chunked\n * stream); throws `KError` on non-2xx, transport failures, or a missing\n * body. Used by streaming surfaces — `client.compute.llms.invokeStream`\n * + `client.realtime.subscribe` SSE transport.\n *\n * Unlike `request()`, this does NOT unwrap the JSON envelope or apply\n * retry — streaming responses are consumed incrementally and retry on a\n * half-consumed stream is unsafe.\n */\nexport async function requestStream(\n  config: HttpClientConfig,\n  init: RequestInit & { accept?: string },\n): Promise<Response> {\n  const fetchImpl = config.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new KError({\n      code: \"K9O_INTERNAL_ERROR\",\n      message: \"No fetch implementation available — pass {fetch} in createClient options\",\n      context: {},\n      recommendation: \"Use Node 18+, Bun 1.1+, or a modern browser; otherwise supply a fetch polyfill via the fetch option.\",\n    });\n  }\n\n  const url = buildUrl(await resolveRegionalOrigin(config), init.path, init.query);\n  const headers: Record<string, string> = {\n    accept: init.accept ?? \"text/event-stream\",\n    ...(config.defaultHeaders ?? {}),\n    ...(config.projectSlug ? { \"x-k9o-project-slug\": config.projectSlug } : {}),\n    ...(config.orgSlug ? { \"x-k9o-org-slug\": config.orgSlug } : {}),\n    ...(init.headers ?? {}),\n  };\n  const bearer = init.bearerToken ?? config.apiKey;\n  if (typeof bearer === \"string\" && bearer.length > 0) {\n    headers[\"authorization\"] = `Bearer ${bearer}`;\n  }\n  const requestInit: Record<string, unknown> = { method: init.method, headers };\n  if (init.body !== undefined) {\n    headers[\"content-type\"] = \"application/json\";\n    requestInit[\"body\"] = JSON.stringify(init.body);\n  }\n\n  let response: Response;\n  try {\n    response = await fetchImpl(url, requestInit as Parameters<typeof fetchImpl>[1]);\n  } catch (e) {\n    throw new KError({\n      code: \"K9O_UPSTREAM_UNAVAILABLE\",\n      message: `Network error reaching ${url}: ${e instanceof Error ? e.message : String(e)}`,\n      context: { url },\n      recommendation: \"Check connectivity to the gateway; retry with backoff if transient.\",\n    });\n  }\n\n  if (response.status < 200 || response.status >= 300) {\n    let parsed: unknown = null;\n    try {\n      parsed = await response.json();\n    } catch {\n      /* non-JSON error body */\n    }\n    if (isKErrorWire(parsed)) throw kerrorFromWire(parsed, response.status);\n    throw new KError({\n      code: \"K9O_INTERNAL_ERROR\",\n      message: `Upstream returned ${response.status} opening stream`,\n      context: { url, status: response.status, body: parsed },\n      status: response.status,\n    });\n  }\n\n  if (response.body === null) {\n    throw new KError({\n      code: \"K9O_INTERNAL_ERROR\",\n      message: `Stream response from ${url} has no body`,\n      context: { url, status: response.status },\n      status: response.status,\n    });\n  }\n\n  return response;\n}\n\nfunction buildUrl(\n  baseUrl: string,\n  path: string,\n  query: RequestInit[\"query\"],\n): string {\n  const trimmedBase = baseUrl.endsWith(\"/\") ? baseUrl.slice(0, -1) : baseUrl;\n  const trimmedPath = path.startsWith(\"/\") ? path : `/${path}`;\n  let url = `${trimmedBase}${trimmedPath}`;\n  if (query !== undefined) {\n    const params = new URLSearchParams();\n    for (const [k, v] of Object.entries(query)) {\n      if (v !== undefined) params.set(k, String(v));\n    }\n    const qs = params.toString();\n    if (qs.length > 0) url += `?${qs}`;\n  }\n  return url;\n}\n\nfunction isEnvelope<T>(value: unknown): value is Envelope<T> {\n  if (value === null || typeof value !== \"object\") return false;\n  const v = value as { data?: unknown; meta?: unknown };\n  return \"data\" in v && \"meta\" in v && typeof v.meta === \"object\" && v.meta !== null;\n}\n\nfunction isKErrorWire(value: unknown): value is KErrorWire {\n  if (value === null || typeof value !== \"object\") return false;\n  const v = value as { code?: unknown; message?: unknown };\n  return typeof v.code === \"string\" && typeof v.message === \"string\";\n}\n"],"mappings":";;;;;;AAgCA,IAAM,oBAAoB,oBAAI,IAAI,CAAC,OAAO,QAAQ,WAAW,QAAQ,CAAC;AACtE,IAAM,mBAAmB,oBAAI,IAAI,CAAC,KAAK,KAAK,GAAG,CAAC;AAEzC,IAAM,uBAA8C;AAAA,EACzD,YAAY;AAAA,EACZ,SAAS;AAAA,EACT,gBAAgB;AAAA,EAChB,YAAY;AACd;AAOO,SAAS,YAAY,OAAgB,QAAyB;AACnE,MAAI,CAAC,kBAAkB,IAAI,OAAO,YAAY,CAAC,EAAG,QAAO;AACzD,MAAI,EAAE,iBAAiB,QAAS,QAAO;AACvC,MAAI,MAAM,SAAS,2BAA4B,QAAO;AACtD,MAAI,MAAM,WAAW,QAAQ,iBAAiB,IAAI,MAAM,MAAM,EAAG,QAAO;AACxE,MAAI,MAAM,WAAW,IAAK,QAAO;AACjC,SAAO;AACT;AAKO,SAAS,aAAa,QAA+B,SAAyB;AACnF,MAAI;AACJ,MAAI,OAAO,YAAY,OAAQ,QAAO;AACtC,MAAI,OAAO,YAAY,SAAU,QAAO,OAAO,kBAAkB,UAAU;AAAA,MACtE,QAAO,OAAO,iBAAiB,KAAK,IAAI,GAAG,OAAO;AACvD,QAAM,SAAS,KAAK,IAAI,MAAM,OAAO,UAAU;AAE/C,QAAM,SAAS,SAAS,QAAQ,KAAK,OAAO,IAAI,IAAI;AACpD,SAAO,KAAK,IAAI,GAAG,KAAK,MAAM,SAAS,MAAM,CAAC;AAChD;AAKO,SAAS,MAAM,IAA2B;AAC/C,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAWA,eAAsB,UACpB,IACA,QACA,QACA,YAA2C,OAC/B;AACZ,QAAM,IAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,GAAI,UAAU,CAAC;AAAA,EACjB;AACA,MAAI;AACJ,WAAS,UAAU,GAAG,WAAW,EAAE,YAAY,WAAW;AACxD,QAAI;AACF,aAAO,MAAM,GAAG;AAAA,IAClB,SAAS,GAAG;AACV,kBAAY;AACZ,UAAI,YAAY,EAAE,WAAY;AAC9B,UAAI,CAAC,YAAY,GAAG,MAAM,EAAG;AAC7B,YAAM,QAAQ,aAAa,GAAG,OAAO;AACrC,UAAI,QAAQ,EAAG,OAAM,UAAU,KAAK;AAAA,IACtC;AAAA,EACF;AACA,QAAM;AACR;;;ACzGA,SAAS,uBAAuB,kCAAqD;;;ACgErF,eAAsB,QACpB,QACA,MACsB;AACtB,SAAO,UAAU,MAAM,YAAe,QAAQ,IAAI,GAAG,KAAK,QAAQ,OAAO,WAAW;AACtF;AAOA,eAAsB,YACpB,QACA,MACsB;AACtB,QAAM,YAAY,OAAO,SAAS,WAAW;AAC7C,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SACE;AAAA,MACF,SAAS,CAAC;AAAA,MACV,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,SAAS,MAAM,sBAAsB,MAAM,GAAG,KAAK,MAAM,KAAK,KAAK;AAC/E,QAAM,UAAkC;AAAA,IACtC,QAAQ;AAAA,IACR,GAAI,OAAO,kBAAkB,CAAC;AAAA,IAC9B,GAAI,OAAO,cAAc,EAAE,sBAAsB,OAAO,YAAY,IAAI,CAAC;AAAA,IACzE,GAAI,OAAO,UAAU,EAAE,kBAAkB,OAAO,QAAQ,IAAI,CAAC;AAAA,IAC7D,GAAI,KAAK,WAAW,CAAC;AAAA,EACvB;AACA,QAAM,SAAS,KAAK,eAAe,OAAO;AAC1C,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,GAAG;AACnD,YAAQ,eAAe,IAAI,UAAU,MAAM;AAAA,EAC7C;AACA,QAAM,cAAuC;AAAA,IAC3C,QAAQ,KAAK;AAAA,IACb;AAAA,EACF;AACA,MAAI,KAAK,SAAS,QAAW;AAC3B,QAAI,OAAO,aAAa,eAAe,KAAK,gBAAgB,UAAU;AAEpE,kBAAY,MAAM,IAAI,KAAK;AAAA,IAC7B,OAAO;AACL,cAAQ,cAAc,IAAI;AAC1B,kBAAY,MAAM,IAAI,KAAK,UAAU,KAAK,IAAI;AAAA,IAChD;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,KAAK,WAA8C;AAAA,EAChF,SAAS,GAAG;AACV,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,0BAA0B,GAAG,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrF,SAAS,EAAE,IAAI;AAAA,MACf,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAGA,MAAI,SAAS,WAAW,KAAK;AAC3B,WAAO,EAAE,MAAM,QAA2B,MAAM,CAAC,EAAE;AAAA,EACrD;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,SAAS,KAAK;AAAA,EAC/B,SAAS,GAAG;AACV,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,sCAAsC,GAAG,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACjG,SAAS,EAAE,KAAK,QAAQ,SAAS,OAAO;AAAA,MACxC,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,QAAI,CAAC,WAAc,MAAM,GAAG;AAC1B,YAAM,IAAI,OAAO;AAAA,QACf,MAAM;AAAA,QACN,SAAS,2BAA2B,GAAG;AAAA,QACvC,SAAS,EAAE,KAAK,QAAQ,SAAS,OAAO;AAAA,QACxC,QAAQ,SAAS;AAAA,MACnB,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,MAAM,GAAG;AACxB,UAAM,eAAe,QAAQ,SAAS,MAAM;AAAA,EAC9C;AACA,QAAM,IAAI,OAAO;AAAA,IACf,MAAM;AAAA,IACN,SAAS,qBAAqB,SAAS,MAAM;AAAA,IAC7C,SAAS,EAAE,KAAK,QAAQ,SAAS,QAAQ,MAAM,OAAO;AAAA,IACtD,QAAQ,SAAS;AAAA,EACnB,CAAC;AACH;AAaA,eAAsB,cACpB,QACA,MACmB;AACnB,QAAM,YAAY,OAAO,SAAS,WAAW;AAC7C,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS;AAAA,MACT,SAAS,CAAC;AAAA,MACV,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,SAAS,MAAM,sBAAsB,MAAM,GAAG,KAAK,MAAM,KAAK,KAAK;AAC/E,QAAM,UAAkC;AAAA,IACtC,QAAQ,KAAK,UAAU;AAAA,IACvB,GAAI,OAAO,kBAAkB,CAAC;AAAA,IAC9B,GAAI,OAAO,cAAc,EAAE,sBAAsB,OAAO,YAAY,IAAI,CAAC;AAAA,IACzE,GAAI,OAAO,UAAU,EAAE,kBAAkB,OAAO,QAAQ,IAAI,CAAC;AAAA,IAC7D,GAAI,KAAK,WAAW,CAAC;AAAA,EACvB;AACA,QAAM,SAAS,KAAK,eAAe,OAAO;AAC1C,MAAI,OAAO,WAAW,YAAY,OAAO,SAAS,GAAG;AACnD,YAAQ,eAAe,IAAI,UAAU,MAAM;AAAA,EAC7C;AACA,QAAM,cAAuC,EAAE,QAAQ,KAAK,QAAQ,QAAQ;AAC5E,MAAI,KAAK,SAAS,QAAW;AAC3B,YAAQ,cAAc,IAAI;AAC1B,gBAAY,MAAM,IAAI,KAAK,UAAU,KAAK,IAAI;AAAA,EAChD;AAEA,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,UAAU,KAAK,WAA8C;AAAA,EAChF,SAAS,GAAG;AACV,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,0BAA0B,GAAG,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACrF,SAAS,EAAE,IAAI;AAAA,MACf,gBAAgB;AAAA,IAClB,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,SAAS,OAAO,SAAS,UAAU,KAAK;AACnD,QAAI,SAAkB;AACtB,QAAI;AACF,eAAS,MAAM,SAAS,KAAK;AAAA,IAC/B,QAAQ;AAAA,IAER;AACA,QAAI,aAAa,MAAM,EAAG,OAAM,eAAe,QAAQ,SAAS,MAAM;AACtE,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,qBAAqB,SAAS,MAAM;AAAA,MAC7C,SAAS,EAAE,KAAK,QAAQ,SAAS,QAAQ,MAAM,OAAO;AAAA,MACtD,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,MAAI,SAAS,SAAS,MAAM;AAC1B,UAAM,IAAI,OAAO;AAAA,MACf,MAAM;AAAA,MACN,SAAS,wBAAwB,GAAG;AAAA,MACpC,SAAS,EAAE,KAAK,QAAQ,SAAS,OAAO;AAAA,MACxC,QAAQ,SAAS;AAAA,IACnB,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAEA,SAAS,SACP,SACA,MACA,OACQ;AACR,QAAM,cAAc,QAAQ,SAAS,GAAG,IAAI,QAAQ,MAAM,GAAG,EAAE,IAAI;AACnE,QAAM,cAAc,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AAC1D,MAAI,MAAM,GAAG,WAAW,GAAG,WAAW;AACtC,MAAI,UAAU,QAAW;AACvB,UAAM,SAAS,IAAI,gBAAgB;AACnC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,UAAI,MAAM,OAAW,QAAO,IAAI,GAAG,OAAO,CAAC,CAAC;AAAA,IAC9C;AACA,UAAM,KAAK,OAAO,SAAS;AAC3B,QAAI,GAAG,SAAS,EAAG,QAAO,IAAI,EAAE;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,WAAc,OAAsC;AAC3D,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,IAAI;AACV,SAAO,UAAU,KAAK,UAAU,KAAK,OAAO,EAAE,SAAS,YAAY,EAAE,SAAS;AAChF;AAEA,SAAS,aAAa,OAAqC;AACzD,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO;AACxD,QAAM,IAAI;AACV,SAAO,OAAO,EAAE,SAAS,YAAY,OAAO,EAAE,YAAY;AAC5D;","names":[]}

package/dist/envelope.d.ts

@@ -1,5 +1,5 @@
 /**
- * Standard ch01 §1 envelope + meta namespace types.
+ * Standard envelope + meta namespace types.
  *
  * The `meta` namespace surfaces structured per-namespace
  * accessors (cursor / subscription / idempotency / warnings / cost /
@@ -22,7 +22,7 @@ type Envelope<T> = {
     meta: Record<string, unknown>;
 };
 /**
- * Cursor pagination accessor per ch01 §6.4. `next` is the opaque cursor
+ * Cursor pagination accessor. `next` is the opaque cursor
  * for the next page (null when no more); `totalCount` populated only
  * when the caller passes `?count=exact` (otherwise undefined).
  */
@@ -31,7 +31,7 @@ type MetaCursor = {
     totalCount?: number;
 };
 /**
- * Subscription delivery metadata per ch04 §8. `isInitial` is true on
+ * Subscription delivery metadata. `isInitial` is true on
  * the first batch of an initial-load subscription; false on subsequent
  * live deltas.
  */
@@ -39,7 +39,7 @@ type MetaSubscription = {
     isInitial: boolean;
 };
 /**
- * Idempotency replay metadata per ch01 §10.2. `replayed` is true when
+ * Idempotency replay metadata. `replayed` is true when
  * the gateway recognised a previously-seen idempotency key and returned
  * the original response.
  */
@@ -47,7 +47,7 @@ type MetaIdempotency = {
     replayed: boolean;
 };
 /**
- * Non-fatal warning shape per ch01 §1.3. Surfaced on responses where
+ * Non-fatal warning shape. Surfaced on responses where
  * the operation succeeded but the caller should know about caveats
  * (e.g. tier-approaching-cap; deprecated field used).
  */
@@ -56,8 +56,8 @@ type MetaWarning = {
     message: string;
 };
 /**
- * Cost metadata per ch10 — per-dimension consumption attribution.
- * Field names per ch10 cost dimensions (waypoints, storageGbHours, egress,
+ * Cost metadata — per-dimension consumption attribution.
+ * Field names (waypoints, storageGbHours, egress,
  * apiCalls, vaultOps, etc.). Dimensions are sparsely populated and values
  * may be scalars (e.g. `waypoints: 3`) or structured objects (e.g.
  * `egress: { gb, zone }`, `vaultOps: { encrypt, decrypt, ... }`), so the
@@ -66,14 +66,14 @@ type MetaWarning = {
  */
 type MetaCost = Record<string, unknown>;
 /**
- * Timing metadata per ch01 §1.3. `totalMs` is the gateway-side wall-clock
+ * Timing metadata. `totalMs` is the gateway-side wall-clock
  * for the request.
  */
 type MetaTiming = {
     totalMs: number;
 };
 /**
- * Request-correlation metadata per ch01 §1.3. `requestId` is the
+ * Request-correlation metadata. `requestId` is the
  * gateway-emitted trace ID; surface in error reports for support.
  */
 type MetaContext = {

package/dist/http.d.ts

@@ -14,8 +14,8 @@ import { RetryConfig } from './types.js';
  *   - KError rehydration on non-2xx
  *   - Bearer token injection (from per-call override OR bound default)
  *   - Project context header (`x-k9o-project-slug`) injection when bound
- *   - Retry with exponential backoff per RetryConfig (see retry.ts) — TBD
- *     in next sub-cycle; v0.1.0 ships single-attempt
+ *   - Retry with exponential backoff per RetryConfig (see retry.ts) — not available
+ *     yet; requests are currently a single attempt
  *
  * The client is intentionally minimal — per-resource SDK methods compose
  * the path + body + bearer themselves and hand to `request()`. This keeps
@@ -39,7 +39,7 @@ type HttpClientConfig = {
     fetch?: typeof globalThis.fetch | undefined;
     /** Default headers merged into every request. */
     defaultHeaders?: Record<string, string> | undefined;
-    /** Retry config per ch13 §7.1; idempotent methods only (GET/HEAD/OPTIONS/DELETE) — applied when transport fails or upstream returns 502/503/504/429. */
+    /** Retry config; idempotent methods only (GET/HEAD/OPTIONS/DELETE) — applied when transport fails or upstream returns 502/503/504/429. */
     retryConfig?: RetryConfig | undefined;
 };
 /**
@@ -73,7 +73,7 @@ declare function requestOnce<T>(config: HttpClientConfig, init: RequestInit): Pr
  * `Response` on 2xx (caller consumes `response.body` as an SSE / chunked
  * stream); throws `KError` on non-2xx, transport failures, or a missing
  * body. Used by streaming surfaces — `client.compute.llms.invokeStream`
- * (ch07 §10.2) + `client.realtime.subscribe` SSE transport (ch07 §11.3).
+ * + `client.realtime.subscribe` SSE transport.
  *
  * Unlike `request()`, this does NOT unwrap the JSON envelope or apply
  * retry — streaming responses are consumed incrementally and retry on a

package/dist/http.js

@@ -2,8 +2,8 @@ import {
   request,
   requestOnce,
   requestStream
-} from "./chunk-FVWKL5UQ.js";
-import "./chunk-2VSTF5UU.js";
+} from "./chunk-O2ZTV6YN.js";
+import "./chunk-LJZ45UA2.js";
 export {
   request,
   requestOnce,