temper-rb 0.6.1 → 0.6.3

data/lib/temper/generated/api/machine_clients_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0
@@ -90,7 +90,7 @@ module Temper::Generated
     end
 
     # Issue a machine credential
-    # Mints a new machine principal with a temper-issued `client_id` and secret. The `client_secret` in the response is shown once and never stored; only its hash is kept, so it cannot be retrieved later. Requires a system admin or the owner of `owner_team_id`; a machine with no owning team can only be issued by a system admin. A team owner can confer only reach they could grant themselves, and no caller can give a machine a team role above `member`. Where an external identity provider mints this instance's tokens, the credential is returned with `dormant: true`: it authenticates once the instance runs temper's own authorization server.
+    # Mints a new machine principal with a temper-issued `client_id` and secret. The `client_secret` in the response is shown once and never stored; only its hash is kept, so it cannot be retrieved later. Requires a system admin (only its owner, on someone else's personal team) or the owner of `owner_team_id`; a machine with no owning team can only be issued by a system admin. A team owner can confer only reach they could grant themselves, and a cogmap grant only on a map where they hold the grant right in their own name (on their profile or their own personal team), not through a shared team. No caller can give a machine a team role above `member`. Where an external identity provider mints this instance's tokens, the credential is returned with `dormant: true`: it authenticates once the instance runs temper's own authorization server.
     # @param issue_machine_request [IssueMachineRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -101,7 +101,7 @@ module Temper::Generated
     end
 
     # Issue a machine credential
-    # Mints a new machine principal with a temper-issued `client_id` and secret. The `client_secret` in the response is shown once and never stored; only its hash is kept, so it cannot be retrieved later. Requires a system admin or the owner of `owner_team_id`; a machine with no owning team can only be issued by a system admin. A team owner can confer only reach they could grant themselves, and no caller can give a machine a team role above `member`. Where an external identity provider mints this instance's tokens, the credential is returned with `dormant: true`: it authenticates once the instance runs temper's own authorization server.
+    # Mints a new machine principal with a temper-issued `client_id` and secret. The `client_secret` in the response is shown once and never stored; only its hash is kept, so it cannot be retrieved later. Requires a system admin (only its owner, on someone else's personal team) or the owner of `owner_team_id`; a machine with no owning team can only be issued by a system admin. A team owner can confer only reach they could grant themselves, and a cogmap grant only on a map where they hold the grant right in their own name (on their profile or their own personal team), not through a shared team. No caller can give a machine a team role above `member`. Where an external identity provider mints this instance's tokens, the credential is returned with `dormant: true`: it authenticates once the instance runs temper's own authorization server.
     # @param issue_machine_request [IssueMachineRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -232,7 +232,7 @@ module Temper::Generated
     end
 
     # Register a machine client
-    # Registers an externally issued IdP `client_id` as a machine principal and creates its agent profile, enrolling it in the listed teams and cogmap grants. Requires a system admin. An instance that runs temper's own authorization server refuses it, because an externally issued client id could never authenticate there; issue a credential instead. No caller can give a machine a team role above `member`.
+    # Registers an externally issued IdP `client_id` as a machine principal and creates its agent profile, enrolling it in the listed teams and cogmap grants. Requires a system admin, and a listed personal team must be the caller's own, as must a listed cogmap that is personal space (an admin is told when it is someone else's: `FORBIDDEN_DETAIL`). An instance that runs temper's own authorization server refuses it, because an externally issued client id could never authenticate there; issue a credential instead. No caller can give a machine a team role above `member`.
     # @param provision_machine_request [ProvisionMachineRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -243,7 +243,7 @@ module Temper::Generated
     end
 
     # Register a machine client
-    # Registers an externally issued IdP `client_id` as a machine principal and creates its agent profile, enrolling it in the listed teams and cogmap grants. Requires a system admin. An instance that runs temper's own authorization server refuses it, because an externally issued client id could never authenticate there; issue a credential instead. No caller can give a machine a team role above `member`.
+    # Registers an externally issued IdP `client_id` as a machine principal and creates its agent profile, enrolling it in the listed teams and cogmap grants. Requires a system admin, and a listed personal team must be the caller's own, as must a listed cogmap that is personal space (an admin is told when it is someone else's: `FORBIDDEN_DETAIL`). An instance that runs temper's own authorization server refuses it, because an externally issued client id could never authenticate there; issue a credential instead. No caller can give a machine a team role above `member`.
     # @param provision_machine_request [ProvisionMachineRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -377,7 +377,7 @@ module Temper::Generated
     end
 
     # Rotate a machine client secret
-    # Installs a fresh secret for a temper-issued machine client. The previous secret stays valid for `grace_seconds` (0 to 604800). The new `client_secret` in the response is shown once and never stored. Requires a system admin or the owner of the machine's owning team. Any other caller with system access is answered 404, exactly as for an id that does not exist. Where an external identity provider mints this instance's tokens, the credential is still `dormant: true`.
+    # Installs a fresh secret for a temper-issued machine client. The previous secret stays valid for `grace_seconds` (0 to 604800). The new `client_secret` in the response is shown once and never stored. Requires a system admin or the owner of the machine's owning team. When the machine sits on a person's personal team and anyone but that person makes this credential, the machine is removed from that personal team in the same transaction. Any other caller with system access is answered 404, exactly as for an id that does not exist. Where an external identity provider mints this instance's tokens, the credential is still `dormant: true`.
     # @param id [String] Machine client ID
     # @param rotate_secret_request [RotateSecretRequest] 
     # @param [Hash] opts the optional parameters
@@ -389,7 +389,7 @@ module Temper::Generated
     end
 
     # Rotate a machine client secret
-    # Installs a fresh secret for a temper-issued machine client. The previous secret stays valid for `grace_seconds` (0 to 604800). The new `client_secret` in the response is shown once and never stored. Requires a system admin or the owner of the machine's owning team. Any other caller with system access is answered 404, exactly as for an id that does not exist. Where an external identity provider mints this instance's tokens, the credential is still `dormant: true`.
+    # Installs a fresh secret for a temper-issued machine client. The previous secret stays valid for `grace_seconds` (0 to 604800). The new `client_secret` in the response is shown once and never stored. Requires a system admin or the owner of the machine's owning team. When the machine sits on a person's personal team and anyone but that person makes this credential, the machine is removed from that personal team in the same transaction. Any other caller with system access is answered 404, exactly as for an id that does not exist. Where an external identity provider mints this instance's tokens, the credential is still `dormant: true`.
     # @param id [String] Machine client ID
     # @param rotate_secret_request [RotateSecretRequest] 
     # @param [Hash] opts the optional parameters

data/lib/temper/generated/api/me_api.rb

@@ -0,0 +1,84 @@
+=begin
+#Temper Cloud API
+
+#Knowledge base management API for temper cloud
+
+The version of the OpenAPI document: 0.6.3
+
+Generated by: https://openapi-generator.tech
+Generator version: 7.23.0
+
+=end
+
+require 'cgi'
+
+module Temper::Generated
+  class MeApi
+    attr_accessor :api_client
+
+    def initialize(api_client = ApiClient.default)
+      @api_client = api_client
+    end
+    # When you last changed something in each context you can read
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<ContextActivity>]
+    def list_my_context_activity(opts = {})
+      data, _status_code, _headers = list_my_context_activity_with_http_info(opts)
+      data
+    end
+
+    # When you last changed something in each context you can read
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are &#x60;cli&#x60; and &#x60;sdk&#x60;; an absent or unrecognized value attributes the write to &#x60;web&#x60;. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(Array<ContextActivity>, Integer, Hash)>] Array<ContextActivity> data, response status code and response headers
+    def list_my_context_activity_with_http_info(opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: MeApi.list_my_context_activity ...'
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/me/context-activity'
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type] || 'Array<ContextActivity>'
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"MeApi.list_my_context_activity",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:GET, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: MeApi#list_my_context_activity\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+  end
+end

data/lib/temper/generated/api/meta_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/profile_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/query_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/reblocking_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/relationships_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/resources_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0
@@ -696,12 +696,14 @@ module Temper::Generated
     # @option opts [String] :context_ref Context filter: UUID string or `@owner/slug` decorated ref. Bare context names are rejected server-side (spec Decision 1).
     # @option opts [String] :doc_type_name Doc-type filter: one name, or a comma-separated list of them, in which case the filter is the UNION (a row matching any listed name is kept). Multi-select is the odd one out among the filters here — `tags` narrows with each addition because a resource has many tags, while a resource has exactly one doc type, so ANDing two names could only ever match nothing. A single name behaves exactly as it always has.  A CSV string rather than a `Vec` for the same reason as `tags` and `cogmap_ids`: the list endpoint is a GET whose params ride the query string, and serde_urlencoded does not encode sequences. Each piece is trimmed and empties are dropped; a CSV that trims away entirely is no filter at all rather than a filter matching nothing.  Unknown names are **not** rejected — an unrecognized doc type matches no row, as it always has. See `ResourceFacets::doc_type` for the histogram that makes the reachable set visible.
     # @option opts [String] :owner 
+    # @option opts [String] :changed_by `\"@me\"`: only resources the caller changed — themselves, or an agent writing under their profile, on any surface. A change counts when it reaches the resource through its element trail's arms (names it, owns a property of it, names one of its blocks) and is an AUTHORED event the caller's profile emitted: events the system computes, such as a region materialization stamped with a writer's emitter, never count. A machine client is its own profile, and its changes are not the caller's.  **Only `\"@me\"`.** Any other non-empty value is a `400`: naming someone else would make this a read of another principal's activity, which no door offers. Composes with every other filter as one more AND, under the same visibility join, so a resource the caller changed and can no longer read is absent from the rows and from every count. An empty value is no filter, as for `tags` and `ids`.
     # @option opts [String] :q 
     # @option opts [String] :stage 
     # @option opts [String] :status Goal-status filter (goal only): matches `temper-status` via the `kb_resource_workflow_props` pivot, exactly as `stage` does. Validated against the goal schema's enum surface-side, so an unknown value is an error rather than a silent full scan — which is what this field's absence used to produce.
     # @option opts [String] :goal Goal filter (task only): the resolved goal `ResourceId` (as UUID). Returns only resources joined to this goal via a live `advances`→goal edge. The CLI/MCP resolve the caller's `--goal <ref>` to this UUID (trailing-UUID-only) before the query. `None` = no goal filter.
     # @option opts [String] :tags Tag filter: a comma-separated list of tags. Returns only resources whose `open_meta.tags` contains **every** tag listed (AND, so each added tag narrows — the same direction every other filter here composes in). Matching is exact per tag and **case-insensitive**: the fold happens receive-side in `filtered_visible_page`, so the CLI, MCP and raw HTTP cannot disagree about it.  A CSV string rather than a `Vec` for the same reason as `cogmap_ids`: the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences). No tag in the corpus contains a comma (verified against production, 580 distinct tags), and a tag containing one cannot be expressed through this transport — which is a constraint on the tag vocabulary, not a silent truncation: the split is on `,` and each piece is trimmed.  Unlike `stage` (task-only) and `status` (goal-only), tags are **not** doc-type-scoped — 14 doc types carry them in production. So there is deliberately no mismatched-filter refusal for this field; pairing it with any `doc_type_name`, or with none, is meaningful.
     # @option opts [String] :cogmap_ids Cognitive-map scope: a comma-separated list of cogmap UUIDs. Returns only resources homed in one of these maps (`anchor_table = 'kb_cogmaps'`), intersected with the caller's visible set. A CSV string rather than a `Vec` because the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences); the CLI/MCP resolve each `--cogmap <ref>` (trailing-UUID-only) and join here. `None`/empty = no cogmap filter.
+    # @option opts [String] :ids Resource scope: a comma-separated list of resource UUIDs, at most 256 of them (the id-set bound, `MAX_ID_SET_IDS`). Returns the caller's visible resources among them and nothing else — an id that does not exist, was deleted, is not visible, or names an unfinished upload is simply absent from the rows, with no other trace in the response. Rows are the list's own, with no body. A CSV for the same transport reason as `cogmap_ids`; `None`/empty = no filter. Composes with every other filter as one more AND.
     # @option opts [Boolean] :has_artifacts Artifact-ownership filter: `true` → only resources owning at least one data artifact; `false` → only resources owning none. **Ownership, not liveness** — a folded artifact still means \"owns\", because the clause this serves says \"own at least one artifact and which own none\", with no liveness qualifier. Absent = no narrowing.  Evaluated inside the caller's visible set (the predicate sits under the same `resources_visible_to` join as every other filter here), so the answer can never widen what the caller can read — and a caller who cannot read a resource gets no existence signal about its artifacts either way.
     # @option opts [ResourceSortField] :sort 
     # @option opts [SortOrder] :order 
@@ -722,12 +724,14 @@ module Temper::Generated
     # @option opts [String] :context_ref Context filter: UUID string or `@owner/slug` decorated ref. Bare context names are rejected server-side (spec Decision 1).
     # @option opts [String] :doc_type_name Doc-type filter: one name, or a comma-separated list of them, in which case the filter is the UNION (a row matching any listed name is kept). Multi-select is the odd one out among the filters here — `tags` narrows with each addition because a resource has many tags, while a resource has exactly one doc type, so ANDing two names could only ever match nothing. A single name behaves exactly as it always has.  A CSV string rather than a `Vec` for the same reason as `tags` and `cogmap_ids`: the list endpoint is a GET whose params ride the query string, and serde_urlencoded does not encode sequences. Each piece is trimmed and empties are dropped; a CSV that trims away entirely is no filter at all rather than a filter matching nothing.  Unknown names are **not** rejected — an unrecognized doc type matches no row, as it always has. See `ResourceFacets::doc_type` for the histogram that makes the reachable set visible.
     # @option opts [String] :owner 
+    # @option opts [String] :changed_by `\"@me\"`: only resources the caller changed — themselves, or an agent writing under their profile, on any surface. A change counts when it reaches the resource through its element trail's arms (names it, owns a property of it, names one of its blocks) and is an AUTHORED event the caller's profile emitted: events the system computes, such as a region materialization stamped with a writer's emitter, never count. A machine client is its own profile, and its changes are not the caller's.  **Only `\"@me\"`.** Any other non-empty value is a `400`: naming someone else would make this a read of another principal's activity, which no door offers. Composes with every other filter as one more AND, under the same visibility join, so a resource the caller changed and can no longer read is absent from the rows and from every count. An empty value is no filter, as for `tags` and `ids`.
     # @option opts [String] :q 
     # @option opts [String] :stage 
     # @option opts [String] :status Goal-status filter (goal only): matches `temper-status` via the `kb_resource_workflow_props` pivot, exactly as `stage` does. Validated against the goal schema's enum surface-side, so an unknown value is an error rather than a silent full scan — which is what this field's absence used to produce.
     # @option opts [String] :goal Goal filter (task only): the resolved goal `ResourceId` (as UUID). Returns only resources joined to this goal via a live `advances`→goal edge. The CLI/MCP resolve the caller's `--goal <ref>` to this UUID (trailing-UUID-only) before the query. `None` = no goal filter.
     # @option opts [String] :tags Tag filter: a comma-separated list of tags. Returns only resources whose `open_meta.tags` contains **every** tag listed (AND, so each added tag narrows — the same direction every other filter here composes in). Matching is exact per tag and **case-insensitive**: the fold happens receive-side in `filtered_visible_page`, so the CLI, MCP and raw HTTP cannot disagree about it.  A CSV string rather than a `Vec` for the same reason as `cogmap_ids`: the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences). No tag in the corpus contains a comma (verified against production, 580 distinct tags), and a tag containing one cannot be expressed through this transport — which is a constraint on the tag vocabulary, not a silent truncation: the split is on `,` and each piece is trimmed.  Unlike `stage` (task-only) and `status` (goal-only), tags are **not** doc-type-scoped — 14 doc types carry them in production. So there is deliberately no mismatched-filter refusal for this field; pairing it with any `doc_type_name`, or with none, is meaningful.
     # @option opts [String] :cogmap_ids Cognitive-map scope: a comma-separated list of cogmap UUIDs. Returns only resources homed in one of these maps (`anchor_table = 'kb_cogmaps'`), intersected with the caller's visible set. A CSV string rather than a `Vec` because the list endpoint is a GET whose params ride the query string (serde_urlencoded, which does not encode sequences); the CLI/MCP resolve each `--cogmap <ref>` (trailing-UUID-only) and join here. `None`/empty = no cogmap filter.
+    # @option opts [String] :ids Resource scope: a comma-separated list of resource UUIDs, at most 256 of them (the id-set bound, `MAX_ID_SET_IDS`). Returns the caller's visible resources among them and nothing else — an id that does not exist, was deleted, is not visible, or names an unfinished upload is simply absent from the rows, with no other trace in the response. Rows are the list's own, with no body. A CSV for the same transport reason as `cogmap_ids`; `None`/empty = no filter. Composes with every other filter as one more AND.
     # @option opts [Boolean] :has_artifacts Artifact-ownership filter: `true` → only resources owning at least one data artifact; `false` → only resources owning none. **Ownership, not liveness** — a folded artifact still means \"owns\", because the clause this serves says \"own at least one artifact and which own none\", with no liveness qualifier. Absent = no narrowing.  Evaluated inside the caller's visible set (the predicate sits under the same `resources_visible_to` join as every other filter here), so the answer can never widen what the caller can read — and a caller who cannot read a resource gets no existence signal about its artifacts either way.
     # @option opts [ResourceSortField] :sort 
     # @option opts [SortOrder] :order 
@@ -753,12 +757,14 @@ module Temper::Generated
       query_params[:'context_ref'] = opts[:'context_ref'] if !opts[:'context_ref'].nil?
       query_params[:'doc_type_name'] = opts[:'doc_type_name'] if !opts[:'doc_type_name'].nil?
       query_params[:'owner'] = opts[:'owner'] if !opts[:'owner'].nil?
+      query_params[:'changed_by'] = opts[:'changed_by'] if !opts[:'changed_by'].nil?
       query_params[:'q'] = opts[:'q'] if !opts[:'q'].nil?
       query_params[:'stage'] = opts[:'stage'] if !opts[:'stage'].nil?
       query_params[:'status'] = opts[:'status'] if !opts[:'status'].nil?
       query_params[:'goal'] = opts[:'goal'] if !opts[:'goal'].nil?
       query_params[:'tags'] = opts[:'tags'] if !opts[:'tags'].nil?
       query_params[:'cogmap_ids'] = opts[:'cogmap_ids'] if !opts[:'cogmap_ids'].nil?
+      query_params[:'ids'] = opts[:'ids'] if !opts[:'ids'].nil?
       query_params[:'has_artifacts'] = opts[:'has_artifacts'] if !opts[:'has_artifacts'].nil?
       query_params[:'sort'] = opts[:'sort'] if !opts[:'sort'].nil?
       query_params[:'order'] = opts[:'order'] if !opts[:'order'].nil?

data/lib/temper/generated/api/schema_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/search_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/slack_link_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/steward_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api/subscriptions_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0
@@ -20,7 +20,7 @@ module Temper::Generated
       @api_client = api_client
     end
     # Create a subscription
-    # Declares that a team, context or cogmap wants the events a connection emits that match `selector`. Requires a system admin or an owner or maintainer of `authoring_team_id`, and, for every caller, that the authoring team holds read-reach on the connection. A context or cogmap subscriber must be linked to the authoring team; a team subscriber must be the authoring team itself. A selector that can never match the connection's registered webhook events is refused.
+    # Declares that a team, context or cogmap wants the events a connection emits that match `selector`. Requires a system admin (not on someone else's personal team, nor for someone else's personal context as subscriber) or an owner or maintainer of `authoring_team_id`, and, for every caller, that the authoring team holds read-reach on the connection. A context or cogmap subscriber must be linked to the authoring team; a team subscriber must be the authoring team itself. A selector that can never match the connection's registered webhook events is refused.
     # @param create_subscription_request [CreateSubscriptionRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -31,7 +31,7 @@ module Temper::Generated
     end
 
     # Create a subscription
-    # Declares that a team, context or cogmap wants the events a connection emits that match `selector`. Requires a system admin or an owner or maintainer of `authoring_team_id`, and, for every caller, that the authoring team holds read-reach on the connection. A context or cogmap subscriber must be linked to the authoring team; a team subscriber must be the authoring team itself. A selector that can never match the connection's registered webhook events is refused.
+    # Declares that a team, context or cogmap wants the events a connection emits that match `selector`. Requires a system admin (not on someone else's personal team, nor for someone else's personal context as subscriber) or an owner or maintainer of `authoring_team_id`, and, for every caller, that the authoring team holds read-reach on the connection. A context or cogmap subscriber must be linked to the authoring team; a team subscriber must be the authoring team itself. A selector that can never match the connection's registered webhook events is refused.
     # @param create_subscription_request [CreateSubscriptionRequest] 
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -95,7 +95,7 @@ module Temper::Generated
     end
 
     # Get a subscription
-    # Returns one subscription. Requires a system admin or an owner or maintainer of the subscription's authoring team. Any other caller with system access is answered 404, exactly as for an id that does not exist.
+    # Returns one subscription. Requires a system admin (not on someone else's personal team) or an owner or maintainer of the subscription's authoring team. Any other caller with system access is answered 404, exactly as for an id that does not exist.
     # @param id [String] Subscription ID
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -106,7 +106,7 @@ module Temper::Generated
     end
 
     # Get a subscription
-    # Returns one subscription. Requires a system admin or an owner or maintainer of the subscription's authoring team. Any other caller with system access is answered 404, exactly as for an id that does not exist.
+    # Returns one subscription. Requires a system admin (not on someone else's personal team) or an owner or maintainer of the subscription's authoring team. Any other caller with system access is answered 404, exactly as for an id that does not exist.
     # @param id [String] Subscription ID
     # @param [Hash] opts the optional parameters
     # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
@@ -165,7 +165,7 @@ module Temper::Generated
     end
 
     # List subscriptions
-    # Lists the subscriptions the caller may manage, newest first. A system admin sees every subscription; any other caller sees only those whose authoring team they own or maintain. Revoked subscriptions are omitted unless `include_revoked` is set.
+    # Lists the subscriptions the caller may manage, newest first. A system admin sees every subscription except those inside someone else's personal space; any other caller sees only those whose authoring team they own or maintain. Revoked subscriptions are omitted unless `include_revoked` is set.
     # @param [Hash] opts the optional parameters
     # @option opts [Boolean] :include_revoked Include revoked subscriptions. Default `false`.
     # @option opts [String] :connection_id Optional filter: only subscriptions against this connection.
@@ -177,7 +177,7 @@ module Temper::Generated
     end
 
     # List subscriptions
-    # Lists the subscriptions the caller may manage, newest first. A system admin sees every subscription; any other caller sees only those whose authoring team they own or maintain. Revoked subscriptions are omitted unless `include_revoked` is set.
+    # Lists the subscriptions the caller may manage, newest first. A system admin sees every subscription except those inside someone else's personal space; any other caller sees only those whose authoring team they own or maintain. Revoked subscriptions are omitted unless `include_revoked` is set.
     # @param [Hash] opts the optional parameters
     # @option opts [Boolean] :include_revoked Include revoked subscriptions. Default `false`.
     # @option opts [String] :connection_id Optional filter: only subscriptions against this connection.

data/lib/temper/generated/api/teams_api.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0
@@ -324,6 +324,82 @@ module Temper::Generated
       return data, status_code, headers
     end
 
+    # Detach a child team from this team
+    # Removes the parent link, so the child's members stop reaching what is attached to this team and its ancestors. The child and its roster survive; only this link is cut. Recorded on the admin ledger as `team_parent_link_changed`.
+    # @param id [String] Parent team ID
+    # @param child_id [String] Child team ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [nil]
+    def detach_child_team(id, child_id, opts = {})
+      detach_child_team_with_http_info(id, child_id, opts)
+      nil
+    end
+
+    # Detach a child team from this team
+    # Removes the parent link, so the child's members stop reaching what is attached to this team and its ancestors. The child and its roster survive; only this link is cut. Recorded on the admin ledger as `team_parent_link_changed`.
+    # @param id [String] Parent team ID
+    # @param child_id [String] Child team ID
+    # @param [Hash] opts the optional parameters
+    # @option opts [String] :x_temper_surface The calling surface, for event-ledger attribution. Accepted values are `cli` and `sdk`; an absent or unrecognized value attributes the write to `web`. This is provenance, never authorization — an unrecognized value degrades, it never rejects.
+    # @return [Array<(nil, Integer, Hash)>] nil, response status code and response headers
+    def detach_child_team_with_http_info(id, child_id, opts = {})
+      if @api_client.config.debugging
+        @api_client.config.logger.debug 'Calling API: TeamsApi.detach_child_team ...'
+      end
+      # verify the required parameter 'id' is set
+      if @api_client.config.client_side_validation && id.nil?
+        fail ArgumentError, "Missing the required parameter 'id' when calling TeamsApi.detach_child_team"
+      end
+      # verify the required parameter 'child_id' is set
+      if @api_client.config.client_side_validation && child_id.nil?
+        fail ArgumentError, "Missing the required parameter 'child_id' when calling TeamsApi.detach_child_team"
+      end
+      allowable_values = ["cli", "sdk"]
+      if @api_client.config.client_side_validation && opts[:'x_temper_surface'] && !allowable_values.include?(opts[:'x_temper_surface'])
+        fail ArgumentError, "invalid value for \"x_temper_surface\", must be one of #{allowable_values}"
+      end
+      # resource path
+      local_var_path = '/api/teams/{id}/children/{child_id}'.sub('{id}', CGI.escape(id.to_s).gsub('.', '%2E')).sub('{child_id}', CGI.escape(child_id.to_s).gsub('.', '%2E'))
+
+      # query parameters
+      query_params = opts[:query_params] || {}
+
+      # header parameters
+      header_params = opts[:header_params] || {}
+      # HTTP header 'Accept' (if needed)
+      header_params['Accept'] = @api_client.select_header_accept(['application/json']) unless header_params['Accept']
+      header_params[:'X-Temper-Surface'] = opts[:'x_temper_surface'] if !opts[:'x_temper_surface'].nil?
+
+      # form parameters
+      form_params = opts[:form_params] || {}
+
+      # http body (model)
+      post_body = opts[:debug_body]
+
+      # return_type
+      return_type = opts[:debug_return_type]
+
+      # auth_names
+      auth_names = opts[:debug_auth_names] || ['bearer_auth']
+
+      new_options = opts.merge(
+        :operation => :"TeamsApi.detach_child_team",
+        :header_params => header_params,
+        :query_params => query_params,
+        :form_params => form_params,
+        :body => post_body,
+        :auth_names => auth_names,
+        :return_type => return_type
+      )
+
+      data, status_code, headers = @api_client.call_api(:DELETE, local_var_path, new_options)
+      if @api_client.config.debugging
+        @api_client.config.logger.debug "API called: TeamsApi#detach_child_team\nData: #{data.inspect}\nStatus code: #{status_code}\nHeaders: #{headers}"
+      end
+      return data, status_code, headers
+    end
+
     # Get one team
     # @param id [String] Team ID
     # @param [Hash] opts the optional parameters
@@ -455,6 +531,7 @@ module Temper::Generated
     end
 
     # Bulk reassign a team's resources
+    # Moves every live resource owned by `from_profile_id` (a current or former member of the team) and homed in a context the team owns to `to_profile_id` (a member). Contexts merely shared to the team are out of scope: a share confers read, never authority over the container.
     # @param id [String] Team ID
     # @param bulk_reassign_request [BulkReassignRequest] 
     # @param [Hash] opts the optional parameters
@@ -466,6 +543,7 @@ module Temper::Generated
     end
 
     # Bulk reassign a team&#39;s resources
+    # Moves every live resource owned by &#x60;from_profile_id&#x60; (a current or former member of the team) and homed in a context the team owns to &#x60;to_profile_id&#x60; (a member). Contexts merely shared to the team are out of scope: a share confers read, never authority over the container.
     # @param id [String] Team ID
     # @param bulk_reassign_request [BulkReassignRequest] 
     # @param [Hash] opts the optional parameters

data/lib/temper/generated/api_client.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api_error.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/api_model_base.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/configuration.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/models/accept_invitation_response.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/models/act_input.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0

data/lib/temper/generated/models/act_invocation.rb

@@ -3,7 +3,7 @@
 
 #Knowledge base management API for temper cloud
 
-The version of the OpenAPI document: 0.6.1
+The version of the OpenAPI document: 0.6.3
 
 Generated by: https://openapi-generator.tech
 Generator version: 7.23.0
@@ -18,6 +18,9 @@ module Temper::Generated
   class ActInvocation < ApiModelBase
     attr_accessor :act
 
+    # Narrowing by what a resource's data artifacts hold: each ask names a shape and predicates over the paths it declares, and the resource must own an artifact satisfying it.  Predicates within one ask hold of one artifact; different asks may be satisfied by different artifacts of the resource. Every ask in one filter must name a shape homed where the stage is — a resource has one home — or the stage is refused `ask_scope_conflict`.
+    attr_accessor :artifact_filter
+
     attr_accessor :edge_filter
 
     # Where this stage's sets come from, and what this act does with each: caller-supplied ids or an upstream stage, each carrying its own [`super::stage::StageRelation`]. Empty for a root act that takes no incoming set (e.g. `find-exact`). Replaces the incumbent literal `bounds: Option<IdSet>`, whose caller case survives as [`StageInput::Caller`].  There is deliberately no sibling `bounds_mode` here `[decided — 2026-08-08, Pete]`. It was an `Option<BoundsMode>` whose \"required whenever an input is present\" invariant lived in prose, which admitted a meaningless state the validator then read as `bound`. The relation belongs to the edge, and nesting it there makes the meaningless state unrepresentable rather than merely invalid.  # A LIST, and at most one per relation  `[widened — 2026-08-14, Pete]` This was `Option<StageInput>` — **one** set, carrying **one** relation. That made a bounded walk inexpressible: `follow-from` needs seeds to start from *and* a bound to stay inside, at the same time, and a single slot can hold one or the other. The fragment (`20260814000030`) had the `p_bound_ids` parameter and no caller could fill it, so `accepts_bounds: [Resource]` would have declared a capability nothing could reach.  **The cardinality rule is one per RELATION, not one per source.** Two seeds is malformed ([`super::disposition::RefusalReason::DuplicateInputRelation`]) rather than a union — a union is `CombineOp::Union`, which is an existing, visible stage rather than a silent merge inside one. So the list is short by construction and is not a general fan-in.  **Why a list rather than a second `bound` field beside this one.** The relation already distinguishes them, so a list gives a bound exactly one spelling; a sibling field would give it two — the new field, and this one with a `Bound` relation — which is the incumbent literal `bounds: Option<IdSet>` shape this contract deliberately replaced `[decided — 2026-08-14, Pete]`, returning under a different name.  At most two, one per relation (`list_too_long` past that).
@@ -32,7 +35,7 @@ module Temper::Generated
     # # A tombstone  Every predicate here is refused, and the refusal says where the capability went.  **Keep this heading to one line** `[found in review — 2026-08-15]`. schemars takes the first heading LINE as the schema `title` and the remainder as `description`, so a heading that wraps ships a truncated sentence as the title and an orphan word as the start of the description — into `act_invocation.schema.json`, `openapi.json`, and every generated client. A mechanical constraint of the generator, not a style preference.  `[2026-08-15]` **Both halves now have containers** — [`super::filter::ResourceFilter`]'s `properties` and [`super::filter::EdgeFilter`]'s — so a property predicate has a home that names its own subject, and this field has nothing left to mean. The subject tag it carried (`PropertySubject`), that tag's open arm, the `UnknownFilterValue` refusal the open arm existed to raise, and the subject-tagged predicate type are all **deleted**.  **The field is not deleted with them, and that is the whole decision** `[decided — 2026-08-15, Pete]`. [`ActInvocation`] carries `deny_unknown_fields`, and serde short-circuits before `validate` runs — so removing the field would turn a named `FilterNotApplicable` inside `ErrorBody` into a deserializer 400 **outside** that shape. A stale caller would go from being told where to move their predicate to being told their body is unparseable. Retyping to [`super::filter::PropertyPredicate`], which carries no `deny_unknown_fields`, keeps a stale `{\"subject\":…,\"key\":…,\"op\":…}` parsing: the tag is ignored and the redirect still fires.  **The residue:** with the tag gone the redirect cannot name *which* container, so it names both and lets the caller pick. That is a real loss of fidelity in the refusal, accepted as the price of deleting the type.
     attr_accessor :properties
 
-    # Narrowing by what a thing IS. At most one slot applies per act; supplying the other is `RefusalReason::FilterNotApplicable`.
+    # Narrowing by what a thing IS. At most one slot applies per candidate population; a slot the act does not admit is `RefusalReason::FilterNotApplicable`. `resource_filter` and `artifact_filter` both narrow the resources a selection considers, and AND together; `edge_filter` narrows the edges a walk follows.
     attr_accessor :resource_filter
 
     # Act-level bound terms. A term this act does not admit is refused STATICALLY (`RefusalReason::BoundTermNotApplicable`), never reinterpreted to fit.
@@ -42,6 +45,7 @@ module Temper::Generated
     def self.attribute_map
       {
         :'act' => :'act',
+        :'artifact_filter' => :'artifact_filter',
         :'edge_filter' => :'edge_filter',
         :'inputs' => :'inputs',
         :'intention' => :'intention',
@@ -66,6 +70,7 @@ module Temper::Generated
     def self.openapi_types
       {
         :'act' => :'ActName',
+        :'artifact_filter' => :'Array<ArtifactAsk>',
         :'edge_filter' => :'EdgeFilter',
         :'inputs' => :'Array<StageInput>',
         :'intention' => :'Intention',
@@ -107,6 +112,12 @@ module Temper::Generated
         self.act = nil
       end
 
+      if attributes.key?(:'artifact_filter')
+        if (value = attributes[:'artifact_filter']).is_a?(Array)
+          self.artifact_filter = value
+        end
+      end
+
       if attributes.key?(:'edge_filter')
         self.edge_filter = attributes[:'edge_filter']
       end
@@ -225,6 +236,7 @@ module Temper::Generated
       return true if self.equal?(o)
       self.class == o.class &&
           act == o.act &&
+          artifact_filter == o.artifact_filter &&
           edge_filter == o.edge_filter &&
           inputs == o.inputs &&
           intention == o.intention &&
@@ -243,7 +255,7 @@ module Temper::Generated
     # Calculates hash code according to all attributes.
     # @return [Integer] Hash code
     def hash
-      [act, edge_filter, inputs, intention, name, properties, resource_filter, terms].hash
+      [act, artifact_filter, edge_filter, inputs, intention, name, properties, resource_filter, terms].hash
     end
 
     # Builds the object from hash