@panaversity/ksor 0.0.16 → 0.0.17

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # @panaversity/ksor
 
+## 0.0.17
+
+### Patch Changes
+
+- 44feada: Installing ksor no longer pulls 32 MB of vendor SDK
+
+  `npx @panaversity/ksor init` installed 54 MB across 52 packages. 32 MB of that
+  was `@google/genai` and its dependencies — carried by every adopter, including
+  the ones who only ever run `init` and `dev` and never reach a served rung.
+
+  It existed to make two HTTP calls, both already wrapped behind one
+  structurally-typed client boundary. Those calls are now spoken directly:
+
+  ```
+  before   54 MB   52 packages
+  after    22 MB   22 packages
+  ```
+
+  Nothing about the embedding changed, and that was checked first rather than
+  assumed: the SDK and the REST endpoint return **byte-identical vectors** for the
+  same text, model, dimensionality and task type — a maximum per-component
+  difference of 0.000e+0 at 1536 dimensions. So stored embeddings stay valid and a
+  calibrated `vector_floor` keeps its meaning. Had they differed by a rounding
+  step, this would have quietly invalidated abstention on every existing record.
+
+  The provider seam is unchanged: a deployment that prefers an SDK can still
+  supply one through `clientFactory`. The single live call to the real vendor
+  stays where it was, as the tripwire for API drift, and now meets Gemini with
+  nothing in between.
+
 ## 0.0.16
 
 ### Patch Changes

package/dist/cli.mjs

@@ -7,7 +7,6 @@ import { z } from "zod";
 import pg from "pg";
 import path, { basename, dirname, join, resolve, sep } from "node:path";
 import { createHash, createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-import { GoogleGenAI } from "@google/genai";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createRemoteJWKSet, errors, jwtVerify } from "jose";
 import { serve } from "@hono/node-server";
@@ -16,7 +15,7 @@ import { bodyLimit } from "hono/body-limit";
 import { execFileSync, spawnSync } from "node:child_process";
 import { parseArgs } from "node:util";
 import { readFile, readdir, stat } from "node:fs/promises";
-//#region ../content-gateway/dist/main-BFWvQ6vY.mjs
+//#region ../content-gateway/dist/main-BtKmcm72.mjs
 /**
 * A connection could not be ESTABLISHED in time — retryable.
 *
@@ -1526,8 +1525,58 @@ var FakeEmbeddingProvider$1 = class {
 	}
 	reset() {}
 };
+const DEFAULT_BASE$1 = "https://generativelanguage.googleapis.com/v1beta";
 /**
-* The Gemini transport — the ONE place `@google/genai` is imported (converted
+* An HTTP-shaped failure carrying the status the retry classifier reads.
+*
+* `isRetryable` in `gemini.ts` asks for a numeric `status` and nothing else, by
+* design — it was written to survive SDK refactors. This keeps that contract
+* when the SDK is gone.
+*/
+var GeminiHttpError$1 = class extends Error {
+	status;
+	constructor(status, detail) {
+		super(`Gemini API error ${status}: ${detail}`);
+		this.name = "GeminiHttpError";
+		this.status = status;
+	}
+};
+/** One POST, with the key in a HEADER — never the query string, which is logged. */
+async function post$1(opts, apiKey, path, body, timeoutMs) {
+	const res = await (opts.fetchImpl ?? fetch)(`${opts.baseUrl ?? DEFAULT_BASE$1}${path}`, {
+		method: "POST",
+		headers: {
+			"x-goog-api-key": apiKey,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(timeoutMs)
+	});
+	const text = await res.text();
+	if (!res.ok) {
+		let detail = text.slice(0, 300);
+		try {
+			const message = JSON.parse(text).error?.message;
+			if (typeof message === "string") detail = message;
+		} catch {}
+		throw new GeminiHttpError$1(res.status, detail);
+	}
+	return JSON.parse(text);
+}
+/** The embedding half of the slice, spoken over `batchEmbedContents`. */
+function geminiRestEmbedClient$1(apiKey, opts = {}) {
+	return { models: { async embedContent(params) {
+		const payload = { requests: params.contents.map((text) => ({
+			model: `models/${params.model}`,
+			content: { parts: [{ text }] },
+			taskType: params.config.taskType,
+			outputDimensionality: params.config.outputDimensionality
+		})) };
+		return { embeddings: (await post$1(opts, apiKey, `/models/${params.model}:batchEmbedContents`, payload, params.config.httpOptions.timeout)).embeddings ?? [] };
+	} } };
+}
+/**
+* The Gemini transport — the ONE place the vendor is spoken to (converted
 * from the oracle's sor_content/lib/providers/gemini.py; decision 6).
 * Identity (model, dim, task labels) is CONSTRUCTOR-INJECTED — this module
 * never imports config, so the same adapter serves any Gemini embedding
@@ -1547,7 +1596,7 @@ var FakeEmbeddingProvider$1 = class {
 *   clock. (The oracle's one divergence — a sync query-intent embed keeping
 *   the batch clock, an eval-harness case — has no TS call site.)
 * - The oracle's "has been closed" stale-client RuntimeError predicate is a
-*   Python-SDK failure mode with no @google/genai JS equivalent; `reset()`
+*   Python-SDK failure mode with no JS equivalent; `reset()`
 *   keeps its drop-never-close contract regardless.
 */
 function httpStatusOf$1(exc) {
@@ -1601,7 +1650,7 @@ var GeminiEmbeddingProvider$1 = class {
 		this.queryTaskLabel = opts.queryTaskLabel;
 		this.documentTimeoutMs = Math.trunc(opts.documentTimeoutS * 1e3);
 		this.queryTimeoutMs = Math.trunc(opts.queryTimeoutS * 1e3);
-		this.clientFactory = opts.clientFactory ?? (() => new GoogleGenAI({ apiKey: opts.apiKey }));
+		this.clientFactory = opts.clientFactory ?? (() => geminiRestEmbedClient$1(opts.apiKey));
 	}
 	get recipe() {
 		return `${this.modelId}/d${this.dim}/${this.documentTaskLabel}`;
@@ -4452,7 +4501,7 @@ async function withPgRetry(op, options = {}) {
 	throw lastError;
 }
 //#endregion
-//#region ../content/dist/commands-B3-NrLiw.mjs
+//#region ../content/dist/commands-CXqK2c2f.mjs
 /**
 * EVAL-LOCKED constants, quarried verbatim from the oracle
 * (sor-agentfactory @ b554f91, config.py) — changing any of these is a
@@ -5423,8 +5472,72 @@ var FakeEmbeddingProvider = class {
 	}
 	reset() {}
 };
+const DEFAULT_BASE = "https://generativelanguage.googleapis.com/v1beta";
+/**
+* An HTTP-shaped failure carrying the status the retry classifier reads.
+*
+* `isRetryable` in `gemini.ts` asks for a numeric `status` and nothing else, by
+* design — it was written to survive SDK refactors. This keeps that contract
+* when the SDK is gone.
+*/
+var GeminiHttpError = class extends Error {
+	status;
+	constructor(status, detail) {
+		super(`Gemini API error ${status}: ${detail}`);
+		this.name = "GeminiHttpError";
+		this.status = status;
+	}
+};
+/** One POST, with the key in a HEADER — never the query string, which is logged. */
+async function post(opts, apiKey, path, body, timeoutMs) {
+	const res = await (opts.fetchImpl ?? fetch)(`${opts.baseUrl ?? DEFAULT_BASE}${path}`, {
+		method: "POST",
+		headers: {
+			"x-goog-api-key": apiKey,
+			"content-type": "application/json"
+		},
+		body: JSON.stringify(body),
+		signal: AbortSignal.timeout(timeoutMs)
+	});
+	const text = await res.text();
+	if (!res.ok) {
+		let detail = text.slice(0, 300);
+		try {
+			const message = JSON.parse(text).error?.message;
+			if (typeof message === "string") detail = message;
+		} catch {}
+		throw new GeminiHttpError(res.status, detail);
+	}
+	return JSON.parse(text);
+}
+/** The embedding half of the slice, spoken over `batchEmbedContents`. */
+function geminiRestEmbedClient(apiKey, opts = {}) {
+	return { models: { async embedContent(params) {
+		const payload = { requests: params.contents.map((text) => ({
+			model: `models/${params.model}`,
+			content: { parts: [{ text }] },
+			taskType: params.config.taskType,
+			outputDimensionality: params.config.outputDimensionality
+		})) };
+		return { embeddings: (await post(opts, apiKey, `/models/${params.model}:batchEmbedContents`, payload, params.config.httpOptions.timeout)).embeddings ?? [] };
+	} } };
+}
+/** The text half of the slice, spoken over `generateContent`. */
+function geminiRestTextClient(apiKey, opts = {}) {
+	return { models: { async generateContent(params) {
+		const payload = {
+			contents: [{ parts: [{ text: params.contents }] }],
+			generationConfig: {
+				temperature: params.config.temperature,
+				maxOutputTokens: params.config.maxOutputTokens,
+				thinkingConfig: params.config.thinkingConfig
+			}
+		};
+		return { text: ((await post(opts, apiKey, `/models/${params.model}:generateContent`, payload, 12e4)).candidates?.[0]?.content?.parts ?? []).map((p) => p.text ?? "").join("") };
+	} } };
+}
 /**
-* The Gemini transport — the ONE place `@google/genai` is imported (converted
+* The Gemini transport — the ONE place the vendor is spoken to (converted
 * from the oracle's sor_content/lib/providers/gemini.py; decision 6).
 * Identity (model, dim, task labels) is CONSTRUCTOR-INJECTED — this module
 * never imports config, so the same adapter serves any Gemini embedding
@@ -5444,7 +5557,7 @@ var FakeEmbeddingProvider = class {
 *   clock. (The oracle's one divergence — a sync query-intent embed keeping
 *   the batch clock, an eval-harness case — has no TS call site.)
 * - The oracle's "has been closed" stale-client RuntimeError predicate is a
-*   Python-SDK failure mode with no @google/genai JS equivalent; `reset()`
+*   Python-SDK failure mode with no JS equivalent; `reset()`
 *   keeps its drop-never-close contract regardless.
 */
 function httpStatusOf(exc) {
@@ -5498,7 +5611,7 @@ var GeminiEmbeddingProvider = class {
 		this.queryTaskLabel = opts.queryTaskLabel;
 		this.documentTimeoutMs = Math.trunc(opts.documentTimeoutS * 1e3);
 		this.queryTimeoutMs = Math.trunc(opts.queryTimeoutS * 1e3);
-		this.clientFactory = opts.clientFactory ?? (() => new GoogleGenAI({ apiKey: opts.apiKey }));
+		this.clientFactory = opts.clientFactory ?? (() => geminiRestEmbedClient(opts.apiKey));
 	}
 	get recipe() {
 		return `${this.modelId}/d${this.dim}/${this.documentTaskLabel}`;
@@ -5541,7 +5654,7 @@ var GeminiTextGenerator = class {
 	client = null;
 	constructor(opts) {
 		this.model = opts.model ?? "gemini-2.5-flash";
-		this.clientFactory = opts.clientFactory ?? (() => new GoogleGenAI({ apiKey: opts.apiKey }));
+		this.clientFactory = opts.clientFactory ?? (() => geminiRestTextClient(opts.apiKey));
 	}
 	getClient() {
 		this.client ??= this.clientFactory();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@panaversity/ksor",
-  "version": "0.0.16",
+  "version": "0.0.17",
   "description": "Knowledge System of Record — compile governed markdown into a static site for people and an MCP server for AI agents, with citations and measured abstention.",
   "keywords": [
     "abstention",
@@ -51,7 +51,6 @@
     "provenance": true
   },
   "dependencies": {
-    "@google/genai": "^2.17.1",
     "@hono/node-server": "2.1.1",
     "@modelcontextprotocol/server": "^2.0.0",
     "@types/pg": "^8.21.0",