kessel-sdk 1.13.0 → 1.13.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6a800ed3c85f59d9a3c3693b03a930d0c15c3f9469afcf7415439c1df6ce0ed5
-  data.tar.gz: 7af05d6be0c40cac48b26ce2a4e62168561b9b8291bbb320984676cc1a95385c
+  metadata.gz: 6889800072d9061b0fe09d8d401cbbf909257498ec70e8a67924be71c6b5173b
+  data.tar.gz: 622700d85991005cf8e06ac17de8089c1c1feeacb89836055a4cbf4700b75446
 SHA512:
-  metadata.gz: a2606225a968c861b8097c89f11076e111b48f2873cddcdce7784bb08e67c51df5cc7ef313686ebf4991c3d357323f8e35d751e68be2af27130aaa9faed99915
-  data.tar.gz: f9707c137cffaf0d86546da1986078baa60c887adde5e65835403e8fecd6f19ce3b781a9330c59455da3046e6cab80ef3163aea01b01cfad6e786657b5415689
+  metadata.gz: 3a7e0603336f496723d888a4ae1b366c1d1e4c3567f9f3cb970ab04a7f454e7006348681439eb4d7d8c234f953693943ee4c597b7ef526ca84a329f640be06bb
+  data.tar.gz: 1e4acb64ffb25c32816b9f5bfb3fec448cc02895552558a212d80404e9f8732009d5ef86719ba9d83319c5502b92fa60262b2cf78b85975b608f4b902c80b394

data/README.md

@@ -1,5 +1,7 @@
 # Kessel SDK for Ruby
 
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/project-kessel/kessel-sdk-ruby/badge)](https://securityscorecards.dev/viewer/?uri=github.com/project-kessel/kessel-sdk-ruby)
+
 [![CI](https://github.com/project-kessel/kessel-sdk-ruby/actions/workflows/ci.yml/badge.svg)](https://github.com/project-kessel/kessel-sdk-ruby/actions/workflows/ci.yml)
 
 The official Ruby gRPC client SDK for [Project Kessel](https://github.com/project-kessel) services. It provides generated protobuf/gRPC bindings for the Kessel Inventory API, a fluent client builder with credential validation, OAuth 2.0 Client Credentials authentication (via OIDC), and RBAC convenience helpers for workspace operations.

data/lib/kessel/inventory/v1beta2/add_resource_relationships_request_pb.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: kessel/inventory/v1beta2/add_resource_relationships_request.proto
+
+require 'google/protobuf'
+
+require 'google/protobuf/struct_pb'
+require 'kessel/inventory/v1beta2/write_visibility_pb'
+require 'buf/validate/validate_pb'
+
+
+descriptor_data = "\nAkessel/inventory/v1beta2/add_resource_relationships_request.proto\x12\x18kessel.inventory.v1beta2\x1a\x1cgoogle/protobuf/struct.proto\x1a/kessel/inventory/v1beta2/write_visibility.proto\x1a\x1b\x62uf/validate/validate.proto\"\xc2\x06\n\x1f\x41\x64\x64ResourceRelationshipsRequest\x12&\n\x0cinventory_id\x18\x01 \x01(\tH\x01R\x0binventoryId\x88\x01\x01\x12-\n\x04type\x18\x02 \x01(\tB\x19\xbaH\x16r\x14\x10\x01\x32\x10^[A-Za-z0-9_-]+$R\x04type\x12>\n\rreporter_type\x18\x03 \x01(\tB\x19\xbaH\x16r\x14\x10\x01\x32\x10^[A-Za-z0-9_-]+$R\x0creporterType\x12\x39\n\x14reporter_instance_id\x18\x04 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x12reporterInstanceId\x12\x33\n\x11local_resource_id\x18\x05 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0flocalResourceId\x12\x38\n\x08reporter\x18\x06 \x01(\x0b\x32\x17.google.protobuf.StructH\x02R\x08reporter\x88\x01\x01\x12\x34\n\x06\x63ommon\x18\x07 \x01(\x0b\x32\x17.google.protobuf.StructH\x03R\x06\x63ommon\x88\x01\x01\x12\'\n\x0etransaction_id\x18\x08 \x01(\tH\x00R\rtransactionId\x12^\n\x10write_visibility\x18\t \x01(\x0e\x32).kessel.inventory.v1beta2.WriteVisibilityB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0fwriteVisibility:\xe2\x01\xbaH\xde\x01\x1a\xdb\x01\n6add_resource_relationships.at_least_one_representation\x12\x41\x61t least one of reporter or common must be provided and non-empty\x1a^(has(this.reporter) && size(this.reporter) > 0) || (has(this.common) && size(this.common) > 0)B\x11\n\x0fidempotency_keyB\x0f\n\r_inventory_idB\x0b\n\t_reporterB\t\n\x07_commonBr\n(org.project_kessel.api.inventory.v1beta2P\x01ZDgithub.com/project-kessel/inventory-api/api/kessel/inventory/v1beta2b\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Kessel
+  module Inventory
+    module V1beta2
+      AddResourceRelationshipsRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("kessel.inventory.v1beta2.AddResourceRelationshipsRequest").msgclass
+    end
+  end
+end

data/lib/kessel/inventory/v1beta2/add_resource_relationships_response_pb.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: kessel/inventory/v1beta2/add_resource_relationships_response.proto
+
+require 'google/protobuf'
+
+
+descriptor_data = "\nBkessel/inventory/v1beta2/add_resource_relationships_response.proto\x12\x18kessel.inventory.v1beta2\"\"\n AddResourceRelationshipsResponseBr\n(org.project_kessel.api.inventory.v1beta2P\x01ZDgithub.com/project-kessel/inventory-api/api/kessel/inventory/v1beta2b\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Kessel
+  module Inventory
+    module V1beta2
+      AddResourceRelationshipsResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("kessel.inventory.v1beta2.AddResourceRelationshipsResponse").msgclass
+    end
+  end
+end

data/lib/kessel/inventory/v1beta2/inventory_service_pb.rb

@@ -13,6 +13,10 @@ require 'kessel/inventory/v1beta2/report_resource_request_pb'
 require 'kessel/inventory/v1beta2/report_resource_response_pb'
 require 'kessel/inventory/v1beta2/delete_resource_request_pb'
 require 'kessel/inventory/v1beta2/delete_resource_response_pb'
+require 'kessel/inventory/v1beta2/add_resource_relationships_request_pb'
+require 'kessel/inventory/v1beta2/add_resource_relationships_response_pb'
+require 'kessel/inventory/v1beta2/remove_resource_relationships_request_pb'
+require 'kessel/inventory/v1beta2/remove_resource_relationships_response_pb'
 require 'kessel/inventory/v1beta2/streamed_list_objects_request_pb'
 require 'kessel/inventory/v1beta2/streamed_list_objects_response_pb'
 require 'kessel/inventory/v1beta2/streamed_list_subjects_request_pb'
@@ -27,7 +31,7 @@ require 'kessel/inventory/v1beta2/check_for_update_bulk_request_pb'
 require 'kessel/inventory/v1beta2/check_for_update_bulk_response_pb'
 
 
-descriptor_data = "\n0kessel/inventory/v1beta2/inventory_service.proto\x12\x18kessel.inventory.v1beta2\x1a\x1cgoogle/api/annotations.proto\x1a,kessel/inventory/v1beta2/check_request.proto\x1a-kessel/inventory/v1beta2/check_response.proto\x1a\x37kessel/inventory/v1beta2/check_for_update_request.proto\x1a\x38kessel/inventory/v1beta2/check_for_update_response.proto\x1a\x36kessel/inventory/v1beta2/report_resource_request.proto\x1a\x37kessel/inventory/v1beta2/report_resource_response.proto\x1a\x36kessel/inventory/v1beta2/delete_resource_request.proto\x1a\x37kessel/inventory/v1beta2/delete_resource_response.proto\x1a<kessel/inventory/v1beta2/streamed_list_objects_request.proto\x1a=kessel/inventory/v1beta2/streamed_list_objects_response.proto\x1a=kessel/inventory/v1beta2/streamed_list_subjects_request.proto\x1a>kessel/inventory/v1beta2/streamed_list_subjects_response.proto\x1a\x31kessel/inventory/v1beta2/check_bulk_request.proto\x1a\x32kessel/inventory/v1beta2/check_bulk_response.proto\x1a\x31kessel/inventory/v1beta2/check_self_request.proto\x1a\x32kessel/inventory/v1beta2/check_self_response.proto\x1a\x36kessel/inventory/v1beta2/check_self_bulk_request.proto\x1a\x37kessel/inventory/v1beta2/check_self_bulk_response.proto\x1a<kessel/inventory/v1beta2/check_for_update_bulk_request.proto\x1a=kessel/inventory/v1beta2/check_for_update_bulk_response.proto2\x86\x0c\n\x16KesselInventoryService\x12~\n\x05\x43heck\x12&.kessel.inventory.v1beta2.CheckRequest\x1a\'.kessel.inventory.v1beta2.CheckResponse\"$\x82\xd3\xe4\x93\x02\x1e\"\x19/api/kessel/v1beta2/check:\x01*\x12\x8e\x01\n\tCheckSelf\x12*.kessel.inventory.v1beta2.CheckSelfRequest\x1a+.kessel.inventory.v1beta2.CheckSelfResponse\"(\x82\xd3\xe4\x93\x02\"\"\x1d/api/kessel/v1beta2/checkself:\x01*\x12\xa2\x01\n\x0e\x43heckForUpdate\x12/.kessel.inventory.v1beta2.CheckForUpdateRequest\x1a\x30.kessel.inventory.v1beta2.CheckForUpdateResponse\"-\x82\xd3\xe4\x93\x02\'\"\"/api/kessel/v1beta2/checkforupdate:\x01*\x12\xb2\x01\n\x12\x43heckForUpdateBulk\x12\x33.kessel.inventory.v1beta2.CheckForUpdateBulkRequest\x1a\x34.kessel.inventory.v1beta2.CheckForUpdateBulkResponse\"1\x82\xd3\xe4\x93\x02+\"&/api/kessel/v1beta2/checkforupdatebulk:\x01*\x12\x8e\x01\n\tCheckBulk\x12*.kessel.inventory.v1beta2.CheckBulkRequest\x1a+.kessel.inventory.v1beta2.CheckBulkResponse\"(\x82\xd3\xe4\x93\x02\"\"\x1d/api/kessel/v1beta2/checkbulk:\x01*\x12\x9e\x01\n\rCheckSelfBulk\x12..kessel.inventory.v1beta2.CheckSelfBulkRequest\x1a/.kessel.inventory.v1beta2.CheckSelfBulkResponse\",\x82\xd3\xe4\x93\x02&\"!/api/kessel/v1beta2/checkselfbulk:\x01*\x12\x9d\x01\n\x0eReportResource\x12/.kessel.inventory.v1beta2.ReportResourceRequest\x1a\x30.kessel.inventory.v1beta2.ReportResourceResponse\"(\x82\xd3\xe4\x93\x02\"\"\x1d/api/kessel/v1beta2/resources:\x01*\x12\x9d\x01\n\x0e\x44\x65leteResource\x12/.kessel.inventory.v1beta2.DeleteResourceRequest\x1a\x30.kessel.inventory.v1beta2.DeleteResourceResponse\"(\x82\xd3\xe4\x93\x02\"*\x1d/api/kessel/v1beta2/resources:\x01*\x12\x84\x01\n\x13StreamedListObjects\x12\x34.kessel.inventory.v1beta2.StreamedListObjectsRequest\x1a\x35.kessel.inventory.v1beta2.StreamedListObjectsResponse0\x01\x12\x87\x01\n\x14StreamedListSubjects\x12\x35.kessel.inventory.v1beta2.StreamedListSubjectsRequest\x1a\x36.kessel.inventory.v1beta2.StreamedListSubjectsResponse0\x01\x42r\n(org.project_kessel.api.inventory.v1beta2P\x01ZDgithub.com/project-kessel/inventory-api/api/kessel/inventory/v1beta2b\x06proto3"
+descriptor_data = "\n0kessel/inventory/v1beta2/inventory_service.proto\x12\x18kessel.inventory.v1beta2\x1a\x1cgoogle/api/annotations.proto\x1a,kessel/inventory/v1beta2/check_request.proto\x1a-kessel/inventory/v1beta2/check_response.proto\x1a\x37kessel/inventory/v1beta2/check_for_update_request.proto\x1a\x38kessel/inventory/v1beta2/check_for_update_response.proto\x1a\x36kessel/inventory/v1beta2/report_resource_request.proto\x1a\x37kessel/inventory/v1beta2/report_resource_response.proto\x1a\x36kessel/inventory/v1beta2/delete_resource_request.proto\x1a\x37kessel/inventory/v1beta2/delete_resource_response.proto\x1a\x41kessel/inventory/v1beta2/add_resource_relationships_request.proto\x1a\x42kessel/inventory/v1beta2/add_resource_relationships_response.proto\x1a\x44kessel/inventory/v1beta2/remove_resource_relationships_request.proto\x1a\x45kessel/inventory/v1beta2/remove_resource_relationships_response.proto\x1a<kessel/inventory/v1beta2/streamed_list_objects_request.proto\x1a=kessel/inventory/v1beta2/streamed_list_objects_response.proto\x1a=kessel/inventory/v1beta2/streamed_list_subjects_request.proto\x1a>kessel/inventory/v1beta2/streamed_list_subjects_response.proto\x1a\x31kessel/inventory/v1beta2/check_bulk_request.proto\x1a\x32kessel/inventory/v1beta2/check_bulk_response.proto\x1a\x31kessel/inventory/v1beta2/check_self_request.proto\x1a\x32kessel/inventory/v1beta2/check_self_response.proto\x1a\x36kessel/inventory/v1beta2/check_self_bulk_request.proto\x1a\x37kessel/inventory/v1beta2/check_self_bulk_response.proto\x1a<kessel/inventory/v1beta2/check_for_update_bulk_request.proto\x1a=kessel/inventory/v1beta2/check_for_update_bulk_response.proto2\xa7\x0f\n\x16KesselInventoryService\x12~\n\x05\x43heck\x12&.kessel.inventory.v1beta2.CheckRequest\x1a\'.kessel.inventory.v1beta2.CheckResponse\"$\x82\xd3\xe4\x93\x02\x1e\"\x19/api/kessel/v1beta2/check:\x01*\x12\x8e\x01\n\tCheckSelf\x12*.kessel.inventory.v1beta2.CheckSelfRequest\x1a+.kessel.inventory.v1beta2.CheckSelfResponse\"(\x82\xd3\xe4\x93\x02\"\"\x1d/api/kessel/v1beta2/checkself:\x01*\x12\xa2\x01\n\x0e\x43heckForUpdate\x12/.kessel.inventory.v1beta2.CheckForUpdateRequest\x1a\x30.kessel.inventory.v1beta2.CheckForUpdateResponse\"-\x82\xd3\xe4\x93\x02\'\"\"/api/kessel/v1beta2/checkforupdate:\x01*\x12\xb2\x01\n\x12\x43heckForUpdateBulk\x12\x33.kessel.inventory.v1beta2.CheckForUpdateBulkRequest\x1a\x34.kessel.inventory.v1beta2.CheckForUpdateBulkResponse\"1\x82\xd3\xe4\x93\x02+\"&/api/kessel/v1beta2/checkforupdatebulk:\x01*\x12\x8e\x01\n\tCheckBulk\x12*.kessel.inventory.v1beta2.CheckBulkRequest\x1a+.kessel.inventory.v1beta2.CheckBulkResponse\"(\x82\xd3\xe4\x93\x02\"\"\x1d/api/kessel/v1beta2/checkbulk:\x01*\x12\x9e\x01\n\rCheckSelfBulk\x12..kessel.inventory.v1beta2.CheckSelfBulkRequest\x1a/.kessel.inventory.v1beta2.CheckSelfBulkResponse\",\x82\xd3\xe4\x93\x02&\"!/api/kessel/v1beta2/checkselfbulk:\x01*\x12\x9d\x01\n\x0eReportResource\x12/.kessel.inventory.v1beta2.ReportResourceRequest\x1a\x30.kessel.inventory.v1beta2.ReportResourceResponse\"(\x82\xd3\xe4\x93\x02\"\"\x1d/api/kessel/v1beta2/resources:\x01*\x12\x9d\x01\n\x0e\x44\x65leteResource\x12/.kessel.inventory.v1beta2.DeleteResourceRequest\x1a\x30.kessel.inventory.v1beta2.DeleteResourceResponse\"(\x82\xd3\xe4\x93\x02\"*\x1d/api/kessel/v1beta2/resources:\x01*\x12\xc9\x01\n\x18\x41\x64\x64ResourceRelationships\x12\x39.kessel.inventory.v1beta2.AddResourceRelationshipsRequest\x1a:.kessel.inventory.v1beta2.AddResourceRelationshipsResponse\"6\x82\xd3\xe4\x93\x02\x30\"+/api/kessel/v1beta2/resources/relationships:\x01*\x12\xd2\x01\n\x1bRemoveResourceRelationships\x12<.kessel.inventory.v1beta2.RemoveResourceRelationshipsRequest\x1a=.kessel.inventory.v1beta2.RemoveResourceRelationshipsResponse\"6\x82\xd3\xe4\x93\x02\x30*+/api/kessel/v1beta2/resources/relationships:\x01*\x12\x84\x01\n\x13StreamedListObjects\x12\x34.kessel.inventory.v1beta2.StreamedListObjectsRequest\x1a\x35.kessel.inventory.v1beta2.StreamedListObjectsResponse0\x01\x12\x87\x01\n\x14StreamedListSubjects\x12\x35.kessel.inventory.v1beta2.StreamedListSubjectsRequest\x1a\x36.kessel.inventory.v1beta2.StreamedListSubjectsResponse0\x01\x42r\n(org.project_kessel.api.inventory.v1beta2P\x01ZDgithub.com/project-kessel/inventory-api/api/kessel/inventory/v1beta2b\x06proto3"
 
 pool = ::Google::Protobuf::DescriptorPool.generated_pool
 pool.add_serialized_file(descriptor_data)

data/lib/kessel/inventory/v1beta2/inventory_service_services_pb.rb

@@ -121,6 +121,48 @@ module Kessel
           #
           # As an example, it can revoke previously granted access across the system.
           rpc :DeleteResource, ::Kessel::Inventory::V1beta2::DeleteResourceRequest, ::Kessel::Inventory::V1beta2::DeleteResourceResponse
+          # Adds one or more relationships to an existing *Resource*.
+          #
+          # If the *Resource* does not yet exist for this *Reporter*, it is created with
+          # the provided relationship fields as its initial representation. All other
+          # relationships already reported for that *Resource* are unaffected.
+          #
+          # Unlike `ReportResource`, which asserts the complete state of a *Resource*,
+          # this operation is a targeted mutation: it only touches the specific
+          # relationship fields and values named in the request. Attribute fields,
+          # other relationship fields, and metadata are left exactly as they were.
+          #
+          # Only relationship-typed fields from the *Resource's* schema are accepted;
+          # attribute fields are rejected.
+          #
+          # The relationships added through this API are used to determine relationship
+          # check outcomes via the Check and CheckForUpdate APIs.
+          #
+          # This API does **not** guarantee immediate read-your-writes consistency by default.
+          # If a reporter requires newly added relationships to be visible in subsequent
+          # checks (e.g., `Check`), the request must explicitly set `write_visibility = IMMEDIATE`.
+          rpc :AddResourceRelationships, ::Kessel::Inventory::V1beta2::AddResourceRelationshipsRequest, ::Kessel::Inventory::V1beta2::AddResourceRelationshipsResponse
+          # Removes one or more specific relationships from an existing *Resource*.
+          #
+          # All other relationships for the *Resource* are unaffected. If the *Resource*
+          # does not exist, this operation returns `NOT_FOUND` — matching the behaviour
+          # of `DeleteResource`.
+          #
+          # Unlike `ReportResource`, which asserts the complete state of a *Resource*,
+          # this operation is a targeted mutation: it only removes the specific
+          # relationship values named in the request. Attribute fields and other
+          # relationship fields are left exactly as they were.
+          #
+          # Only relationship-typed fields from the *Resource's* schema are accepted;
+          # attribute fields are rejected.
+          #
+          # The relationships removed through this API are used to determine relationship
+          # check outcomes via the Check and CheckForUpdate APIs.
+          #
+          # This API does **not** guarantee immediate read-your-writes consistency by default.
+          # If a reporter requires removed relationships to no longer be visible in subsequent
+          # checks (e.g., `Check`), the request must explicitly set `write_visibility = IMMEDIATE`.
+          rpc :RemoveResourceRelationships, ::Kessel::Inventory::V1beta2::RemoveResourceRelationshipsRequest, ::Kessel::Inventory::V1beta2::RemoveResourceRelationshipsResponse
           # Streams a list of objects where the given subject has the specified relation.
           #
           # This relationship query answers the question:

data/lib/kessel/inventory/v1beta2/remove_resource_relationships_request_pb.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: kessel/inventory/v1beta2/remove_resource_relationships_request.proto
+
+require 'google/protobuf'
+
+require 'google/protobuf/struct_pb'
+require 'kessel/inventory/v1beta2/write_visibility_pb'
+require 'buf/validate/validate_pb'
+
+
+descriptor_data = "\nDkessel/inventory/v1beta2/remove_resource_relationships_request.proto\x12\x18kessel.inventory.v1beta2\x1a\x1cgoogle/protobuf/struct.proto\x1a/kessel/inventory/v1beta2/write_visibility.proto\x1a\x1b\x62uf/validate/validate.proto\"\xc8\x06\n\"RemoveResourceRelationshipsRequest\x12&\n\x0cinventory_id\x18\x01 \x01(\tH\x01R\x0binventoryId\x88\x01\x01\x12-\n\x04type\x18\x02 \x01(\tB\x19\xbaH\x16r\x14\x10\x01\x32\x10^[A-Za-z0-9_-]+$R\x04type\x12>\n\rreporter_type\x18\x03 \x01(\tB\x19\xbaH\x16r\x14\x10\x01\x32\x10^[A-Za-z0-9_-]+$R\x0creporterType\x12\x39\n\x14reporter_instance_id\x18\x04 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x12reporterInstanceId\x12\x33\n\x11local_resource_id\x18\x05 \x01(\tB\x07\xbaH\x04r\x02\x10\x01R\x0flocalResourceId\x12\x38\n\x08reporter\x18\x06 \x01(\x0b\x32\x17.google.protobuf.StructH\x02R\x08reporter\x88\x01\x01\x12\x34\n\x06\x63ommon\x18\x07 \x01(\x0b\x32\x17.google.protobuf.StructH\x03R\x06\x63ommon\x88\x01\x01\x12\'\n\x0etransaction_id\x18\x08 \x01(\tH\x00R\rtransactionId\x12^\n\x10write_visibility\x18\t \x01(\x0e\x32).kessel.inventory.v1beta2.WriteVisibilityB\x08\xbaH\x05\x82\x01\x02\x10\x01R\x0fwriteVisibility:\xe5\x01\xbaH\xe1\x01\x1a\xde\x01\n9remove_resource_relationships.at_least_one_representation\x12\x41\x61t least one of reporter or common must be provided and non-empty\x1a^(has(this.reporter) && size(this.reporter) > 0) || (has(this.common) && size(this.common) > 0)B\x11\n\x0fidempotency_keyB\x0f\n\r_inventory_idB\x0b\n\t_reporterB\t\n\x07_commonBr\n(org.project_kessel.api.inventory.v1beta2P\x01ZDgithub.com/project-kessel/inventory-api/api/kessel/inventory/v1beta2b\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Kessel
+  module Inventory
+    module V1beta2
+      RemoveResourceRelationshipsRequest = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("kessel.inventory.v1beta2.RemoveResourceRelationshipsRequest").msgclass
+    end
+  end
+end

data/lib/kessel/inventory/v1beta2/remove_resource_relationships_response_pb.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+# Generated by the protocol buffer compiler.  DO NOT EDIT!
+# source: kessel/inventory/v1beta2/remove_resource_relationships_response.proto
+
+require 'google/protobuf'
+
+
+descriptor_data = "\nEkessel/inventory/v1beta2/remove_resource_relationships_response.proto\x12\x18kessel.inventory.v1beta2\"%\n#RemoveResourceRelationshipsResponseBr\n(org.project_kessel.api.inventory.v1beta2P\x01ZDgithub.com/project-kessel/inventory-api/api/kessel/inventory/v1beta2b\x06proto3"
+
+pool = ::Google::Protobuf::DescriptorPool.generated_pool
+pool.add_serialized_file(descriptor_data)
+
+module Kessel
+  module Inventory
+    module V1beta2
+      RemoveResourceRelationshipsResponse = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("kessel.inventory.v1beta2.RemoveResourceRelationshipsResponse").msgclass
+    end
+  end
+end

data/lib/kessel/rbac/GUIDELINES.md

@@ -47,9 +47,10 @@ All factory methods in `v2_helpers.rb` follow these rules:
 
 ### HTTP Client Handling
 
-- When `http_client` is `nil`, a new `Net::HTTP` is created per call (one TCP connection per fetch).
-- When `http_client` is provided, `check_http_client` validates that its `address` and `port` match the endpoint URI. Mismatches raise `RuntimeError`.
-- For multiple workspace fetches, pass a pre-started `Net::HTTP` to avoid repeated TCP handshakes.
+- When `http_client` is `nil`, a new `Net::HTTP` is created per call (one TCP connection per fetch). TLS is automatically enabled when the endpoint scheme is `https` via `use_ssl = (uri.scheme == 'https')`.
+- When `http_client` is provided, `check_http_client` validates that its `address` and `port` match the endpoint URI **and** that its `use_ssl?` setting matches the endpoint scheme. Host/port mismatches and SSL mismatches both raise `RuntimeError`.
+- For multiple workspace fetches, pass a pre-started `Net::HTTP` to avoid repeated TCP handshakes. Ensure the client's `use_ssl` setting matches the endpoint scheme.
+- Plaintext (`http://`) connections work unchanged for existing internal-URL consumers. No explicit opt-in is required for `http://` endpoints — TLS is only enforced when the scheme is `https`.
 
 ### Response Processing
 

data/lib/kessel/rbac/v2.rb

@@ -111,6 +111,7 @@ module Kessel
         uri.query = URI.encode_www_form(query)
         if http_client.nil?
           http_client = Net::HTTP.new(uri.host, uri.port)
+          http_client.use_ssl = (uri.scheme == 'https')
         else
           check_http_client(http_client, uri)
         end

data/lib/kessel/rbac/v2_http.rb

@@ -17,9 +17,13 @@ module Kessel
       end
 
       def check_http_client(http_client, uri)
-        return if uri.host == http_client.address && uri.port == http_client.port
+        unless uri.host == http_client.address && uri.port == http_client.port
+          raise 'http client host and port do not match rbac_base_endpoint'
+        end
 
-        raise 'http client host and port do not match rbac_base_endpoint'
+        return if http_client.use_ssl? == (uri.scheme == 'https')
+
+        raise 'http client SSL configuration does not match endpoint scheme'
       end
     end
   end

data/lib/kessel/version.rb

@@ -2,6 +2,6 @@
 
 module Kessel
   module Inventory
-    VERSION = '1.13.0'
+    VERSION = '1.13.1'
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kessel-sdk
 version: !ruby/object:Gem::Version
-  version: 1.13.0
+  version: 1.13.1
 platform: ruby
 authors:
 - Project Kessel
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: base64
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: grpc
   requirement: !ruby/object:Gem::Requirement
@@ -169,14 +183,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.0
+        version: 2.1.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.0
+        version: 2.1.0
 - !ruby/object:Gem::Dependency
   name: typeprof
   requirement: !ruby/object:Gem::Requirement
@@ -239,6 +253,8 @@ files:
 - lib/kessel/inventory/v1beta2.rb
 - lib/kessel/inventory/v1beta2/acquire_lock_request_pb.rb
 - lib/kessel/inventory/v1beta2/acquire_lock_response_pb.rb
+- lib/kessel/inventory/v1beta2/add_resource_relationships_request_pb.rb
+- lib/kessel/inventory/v1beta2/add_resource_relationships_response_pb.rb
 - lib/kessel/inventory/v1beta2/allowed_pb.rb
 - lib/kessel/inventory/v1beta2/check_bulk_request_pb.rb
 - lib/kessel/inventory/v1beta2/check_bulk_response_pb.rb
@@ -271,6 +287,8 @@ files:
 - lib/kessel/inventory/v1beta2/relation_subject_reference_pb.rb
 - lib/kessel/inventory/v1beta2/relation_tuple_filter_pb.rb
 - lib/kessel/inventory/v1beta2/relationship_pb.rb
+- lib/kessel/inventory/v1beta2/remove_resource_relationships_request_pb.rb
+- lib/kessel/inventory/v1beta2/remove_resource_relationships_response_pb.rb
 - lib/kessel/inventory/v1beta2/report_resource_request_pb.rb
 - lib/kessel/inventory/v1beta2/report_resource_response_pb.rb
 - lib/kessel/inventory/v1beta2/reporter_reference_pb.rb