@confighub/rtk-query 0.10.9 → 0.10.10

package/dist/index.d.ts

@@ -5636,6 +5636,8 @@ type InvokeFunctionsOnOrgApiArg = {
     clearance?: string;
     /** The guards this operation records on the paths it writes, as a JSON object of guard key to value -- the reasons those paths hold what they hold, so a later operation must be cleared for them before overwriting. The guard analogue of protect: protect claims the paths, this says why. It only ever adds and overwrites the keys it names -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). */
     guards?: string;
+    /** The guards this operation records on the paths it writes as inherited guards, in the form guards takes: a clone of the Unit receives them, and a merge carries them, and any later change to them, to the Units downstream of it. Guards set through guards stay with the Unit they are on. A key may not be in both. The clearance has to cover these as it covers guards. */
+    inheritedGuards?: string;
     /** Must match ChangeSetID of affected Units unless in dry run mode; not valid when invoked on Revisions */
     changeSetId?: string;
     /** ChangeOrder to promote, which must have UpdateType Invoke. What runs then comes from the ChangeOrder rather than from the request body, which may not carry functions, triggers or invocations of its own; that is what holds every Space in scope to the same change. Only the Units the ChangeOrder covers are reached, a Unit that has already taken it is passed over, and every Unit reached is marked with the ChangeOrder's start and end Tags -- both on the head, with no Revision made, where the invocation changed nothing. Not valid when invoked on Revisions. */
@@ -5914,7 +5916,7 @@ type BulkDeleteInvocationsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
+      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, Clearance, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Guards, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
       
       The functions an Invocation calls are addressed with dot notation into `FunctionInvocations`: `FunctionInvocations.*.FunctionName = 'set-image'` matches an Invocation that calls set-image anywhere in its list, and `FunctionInvocations.0.FunctionName` addresses the first function it calls.
       
@@ -6008,7 +6010,7 @@ type ListAllInvocationsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
+      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, Clearance, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Guards, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
       
       The functions an Invocation calls are addressed with dot notation into `FunctionInvocations`: `FunctionInvocations.*.FunctionName = 'set-image'` matches an Invocation that calls set-image anywhere in its list, and `FunctionInvocations.0.FunctionName` addresses the first function it calls.
       
@@ -6138,7 +6140,7 @@ type BulkPatchInvocationsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
+      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, Clearance, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Guards, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
       
       The functions an Invocation calls are addressed with dot notation into `FunctionInvocations`: `FunctionInvocations.*.FunctionName = 'set-image'` matches an Invocation that calls set-image anywhere in its list, and `FunctionInvocations.0.FunctionName` addresses the first function it calls.
       
@@ -6204,6 +6206,8 @@ type BulkPatchInvocationsApiArg = {
             [key: string]: string | null;
         } | null;
         ChannelID?: string | null;
+        /** Classes of guarded reason this Invocation's functions are cleared for; combined by union with the clearance of the Trigger or API call that runs it */
+        Clearance?: (object | null)[] | null;
         /** An optional set of gates that, if any is present, will block deletion */
         DeleteGates?: {
             [key: string]: boolean | null;
@@ -6211,6 +6215,10 @@ type BulkPatchInvocationsApiArg = {
         /** Friendly name for the entity. */
         DisplayName?: string | null;
         FunctionInvocations?: (object | null)[] | null;
+        /** Guards to record on the paths this Invocation's functions write, so a later operation must be cleared for them; combined with the guards of a Trigger running it, the Trigger's winning per key. Add and overwrite only -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). Clearance must cover them. */
+        Guards?: {
+            [key: string]: string | null;
+        } | null;
         /** The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another. */
         HiddenReason?: string | null;
         /** An optional map of Label key/value pairs to specify identifying attributes of entities for the purpose of grouping and filtering them. */
@@ -6264,7 +6272,7 @@ type BulkCreateInvocationsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
+      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, Clearance, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Guards, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
       
       The functions an Invocation calls are addressed with dot notation into `FunctionInvocations`: `FunctionInvocations.*.FunctionName = 'set-image'` matches an Invocation that calls set-image anywhere in its list, and `FunctionInvocations.0.FunctionName` addresses the first function it calls.
       
@@ -6434,6 +6442,8 @@ type BulkCreateInvocationsApiArg = {
             [key: string]: string | null;
         } | null;
         ChannelID?: string | null;
+        /** Classes of guarded reason this Invocation's functions are cleared for; combined by union with the clearance of the Trigger or API call that runs it */
+        Clearance?: (object | null)[] | null;
         /** An optional set of gates that, if any is present, will block deletion */
         DeleteGates?: {
             [key: string]: boolean | null;
@@ -6441,6 +6451,10 @@ type BulkCreateInvocationsApiArg = {
         /** Friendly name for the entity. */
         DisplayName?: string | null;
         FunctionInvocations?: (object | null)[] | null;
+        /** Guards to record on the paths this Invocation's functions write, so a later operation must be cleared for them; combined with the guards of a Trigger running it, the Trigger's winning per key. Add and overwrite only -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). Clearance must cover them. */
+        Guards?: {
+            [key: string]: string | null;
+        } | null;
         /** The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another. */
         HiddenReason?: string | null;
         /** An optional map of Label key/value pairs to specify identifying attributes of entities for the purpose of grouping and filtering them. */
@@ -6494,7 +6508,7 @@ type BulkMoveInvocationsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
+      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, Clearance, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Guards, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
       
       The whole string must be query-encoded. */
     where?: string;
@@ -11187,6 +11201,8 @@ type InvokeFunctionsApiArg = {
     clearance?: string;
     /** The guards this operation records on the paths it writes, as a JSON object of guard key to value -- the reasons those paths hold what they hold, so a later operation must be cleared for them before overwriting. The guard analogue of protect: protect claims the paths, this says why. It only ever adds and overwrites the keys it names -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). */
     guards?: string;
+    /** The guards this operation records on the paths it writes as inherited guards, in the form guards takes: a clone of the Unit receives them, and a merge carries them, and any later change to them, to the Units downstream of it. Guards set through guards stay with the Unit they are on. A key may not be in both. The clearance has to cover these as it covers guards. */
+    inheritedGuards?: string;
     /** Must match ChangeSetID of affected Units unless in dry run mode; not valid when invoked on Revisions */
     changeSetId?: string;
     /** ChangeOrder to promote, which must have UpdateType Invoke. What runs then comes from the ChangeOrder rather than from the request body, which may not carry functions, triggers or invocations of its own; that is what holds every Space in scope to the same change. Only the Units the ChangeOrder covers are reached, a Unit that has already taken it is passed over, and every Unit reached is marked with the ChangeOrder's start and end Tags -- both on the head, with no Revision made, where the invocation changed nothing. Not valid when invoked on Revisions. */
@@ -11314,7 +11330,7 @@ type ListInvocationsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
+      Supported attributes for filtering on Invocation: Annotations, BackingUnitID, ChannelID, Clearance, CreatedAt, DeleteGates, DisplayName, FunctionInvocations, Guards, Hash, HiddenReason, InvocationID, Labels, OrganizationID, Parameters, Permissions, Slug, SpaceID, ToolchainType, UpdatedAt, UpstreamInvocationID.
       
       The functions an Invocation calls are addressed with dot notation into `FunctionInvocations`: `FunctionInvocations.*.FunctionName = 'set-image'` matches an Invocation that calls set-image anywhere in its list, and `FunctionInvocations.0.FunctionName` addresses the first function it calls.
       
@@ -11469,6 +11485,8 @@ type PatchInvocationApiArg = {
             [key: string]: string | null;
         } | null;
         ChannelID?: string | null;
+        /** Classes of guarded reason this Invocation's functions are cleared for; combined by union with the clearance of the Trigger or API call that runs it */
+        Clearance?: (object | null)[] | null;
         /** An optional set of gates that, if any is present, will block deletion */
         DeleteGates?: {
             [key: string]: boolean | null;
@@ -11476,6 +11494,10 @@ type PatchInvocationApiArg = {
         /** Friendly name for the entity. */
         DisplayName?: string | null;
         FunctionInvocations?: (object | null)[] | null;
+        /** Guards to record on the paths this Invocation's functions write, so a later operation must be cleared for them; combined with the guards of a Trigger running it, the Trigger's winning per key. Add and overwrite only -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). Clearance must cover them. */
+        Guards?: {
+            [key: string]: string | null;
+        } | null;
         /** The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another. */
         HiddenReason?: string | null;
         /** An optional map of Label key/value pairs to specify identifying attributes of entities for the purpose of grouping and filtering them. */
@@ -13018,6 +13040,8 @@ type PatchUnitApiArg = {
     clearance?: string;
     /** The guards this operation records on the paths it writes, as a JSON object of guard key to value -- the reasons those paths hold what they hold, so a later operation must be cleared for them before overwriting. The guard analogue of protect: protect claims the paths, this says why. It only ever adds and overwrites the keys it names -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). */
     guards?: string;
+    /** The guards this operation records on the paths it writes as inherited guards, in the form guards takes: a clone of the Unit receives them, and a merge carries them, and any later change to them, to the Units downstream of it. Guards set through guards stay with the Unit they are on. A key may not be in both. The clearance has to cover these as it covers guards. */
+    inheritedGuards?: string;
     /** Merge the range as one rebased diff and record it as one Revision, instead of walking it. By default a merge replays: it takes the source's Revisions in order and, where a Revision records function invocations that can be re-executed, runs them against this Unit rather than rebasing their recorded paths onto it -- so a change lands where this Unit's own structure puts it -- and records each source Revision that has an effect here as a Revision of its own, carrying that Revision's change description, its own conflicts, and one Mutation per source Mutation. Squashing gives up both: the range arrives as a single rebased patch in a single Revision, which is what a merge did before replay existed. Accepted with upgrade, merge_source, and resolve of an UpgradeUnit or MergeUnits Link, and refused elsewhere, since there is no range to walk. A Link can ask for it standingly with its Squash field. */
     squash?: boolean;
     /** Upgrade the unit to the latest version of its upstream unit */
@@ -13070,7 +13094,7 @@ type PatchUnitApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Mutation: ChannelID, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.Clearance, FunctionInvocation.FunctionName, FunctionInvocation.Guards, FunctionInvocation.WhereResource, FunctionName, HiddenReason, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
+      Supported attributes for filtering on Mutation: ChannelID, Clearance, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.FunctionName, FunctionInvocation.WhereResource, FunctionName, Guards, HiddenReason, InheritedGuards, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
       
       Selects Mutations of this Unit whose paths the merge must not overwrite, unioned with the Protected values stored on the Unit's MutationSources.
       
@@ -13160,6 +13184,8 @@ type UpdateUnitApiArg = {
     clearance?: string;
     /** The guards this operation records on the paths it writes, as a JSON object of guard key to value -- the reasons those paths hold what they hold, so a later operation must be cleared for them before overwriting. The guard analogue of protect: protect claims the paths, this says why. It only ever adds and overwrites the keys it names -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). */
     guards?: string;
+    /** The guards this operation records on the paths it writes as inherited guards, in the form guards takes: a clone of the Unit receives them, and a merge carries them, and any later change to them, to the Units downstream of it. Guards set through guards stay with the Unit they are on. A key may not be in both. The clearance has to cover these as it covers guards. */
+    inheritedGuards?: string;
     /** Merge the range as one rebased diff and record it as one Revision, instead of walking it. By default a merge replays: it takes the source's Revisions in order and, where a Revision records function invocations that can be re-executed, runs them against this Unit rather than rebasing their recorded paths onto it -- so a change lands where this Unit's own structure puts it -- and records each source Revision that has an effect here as a Revision of its own, carrying that Revision's change description, its own conflicts, and one Mutation per source Mutation. Squashing gives up both: the range arrives as a single rebased patch in a single Revision, which is what a merge did before replay existed. Accepted with upgrade, merge_source, and resolve of an UpgradeUnit or MergeUnits Link, and refused elsewhere, since there is no range to walk. A Link can ask for it standingly with its Squash field. */
     squash?: boolean;
     /** Upgrade the unit to the latest version of its upstream unit */
@@ -13212,7 +13238,7 @@ type UpdateUnitApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Mutation: ChannelID, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.Clearance, FunctionInvocation.FunctionName, FunctionInvocation.Guards, FunctionInvocation.WhereResource, FunctionName, HiddenReason, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
+      Supported attributes for filtering on Mutation: ChannelID, Clearance, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.FunctionName, FunctionInvocation.WhereResource, FunctionName, Guards, HiddenReason, InheritedGuards, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
       
       Selects Mutations of this Unit whose paths the merge must not overwrite, unioned with the Protected values stored on the Unit's MutationSources.
       
@@ -13310,6 +13336,8 @@ type UploadUnitDataApiArg = {
     clearance?: string;
     /** The guards this operation records on the paths it writes, as a JSON object of guard key to value -- the reasons those paths hold what they hold, so a later operation must be cleared for them before overwriting. The guard analogue of protect: protect claims the paths, this says why. It only ever adds and overwrites the keys it names -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). */
     guards?: string;
+    /** The guards this operation records on the paths it writes as inherited guards, in the form guards takes: a clone of the Unit receives them, and a merge carries them, and any later change to them, to the Units downstream of it. Guards set through guards stay with the Unit they are on. A key may not be in both. The clearance has to cover these as it covers guards. */
+    inheritedGuards?: string;
     /** Merge base revision, which provides the base configuration data of the changes to merge. With merge_source, this is a revision of the merge source unit. With merge_external_source, this is a revision of the unit being updated and overrides the default selection of the latest MergeExternal revision. Supports: Named revisions ('HeadRevisionNum', 'LastReleasedRevisionNum'), direct revision number (e.g., '42'), or entity references ('Tag:uuid', 'ChangeSet:uuid', 'ChangeOrder:uuid', 'Revision:uuid'). Can be prefixed with 'Before:' to select the revision immediately before the specified one (e.g., 'Before:LastReleasedRevisionNum', 'Before:42'). When using Tag or ChangeSet references, the latest revision associated with that entity is selected. 'ChangeOrder:uuid' selects the revision the change order ended at on this Unit and 'Before:ChangeOrder:uuid' the one before it began, which is what undoes a promotion however many revisions it made. */
     mergeBase?: string;
     /** Identifier of the external source for merge-on-update. When set, computes mutations between the last MergeExternal revision and the provided data, then patches the current unit data with those mutations. */
@@ -13390,9 +13418,9 @@ type ListExtendedMutationsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Mutation: ChannelID, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.Clearance, FunctionInvocation.FunctionName, FunctionInvocation.Guards, FunctionInvocation.WhereResource, FunctionName, HiddenReason, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
+      Supported attributes for filtering on Mutation: ChannelID, Clearance, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.FunctionName, FunctionInvocation.WhereResource, FunctionName, Guards, HiddenReason, InheritedGuards, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
       
-      The function invoked is returned as a FunctionInvocation object, and `where` names its fields the same way: `FunctionInvocation.FunctionName`, `FunctionInvocation.Guards.<reason>`, and `FunctionInvocation.Arguments`, which is a list addressed with dot notation. `FunctionInvocation.Arguments.?ParameterName=container-image.Value LIKE 'nginx%'` reads the argument bound to a named parameter, `FunctionInvocation.Arguments.*.Value` matches any argument's value, and `FunctionInvocation.Arguments.0.Value` addresses the first argument. Arguments passed positionally have no ParameterName.
+      The function invoked is returned as a FunctionInvocation object, and `where` names its fields the same way: `FunctionInvocation.FunctionName` and `FunctionInvocation.Arguments`, which is a list addressed with dot notation. `FunctionInvocation.Arguments.?ParameterName=container-image.Value LIKE 'nginx%'` reads the argument bound to a named parameter, `FunctionInvocation.Arguments.*.Value` matches any argument's value, and `FunctionInvocation.Arguments.0.Value` addresses the first argument. Arguments passed positionally have no ParameterName. `Guards.<reason>` reads the guards the change recorded on the paths it wrote, as in `Guards.Link = 'TransformPaths'`, and `Clearance.*.Key = 'RunAsRoot'` finds the changes written under a clearance for that reason.
       
       The whole string must be query-encoded. */
     where?: string;
@@ -16793,6 +16821,8 @@ type BulkPatchUnitsApiArg = {
     clearance?: string;
     /** The guards this operation records on the paths it writes, as a JSON object of guard key to value -- the reasons those paths hold what they hold, so a later operation must be cleared for them before overwriting. The guard analogue of protect: protect claims the paths, this says why. It only ever adds and overwrites the keys it names -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). */
     guards?: string;
+    /** The guards this operation records on the paths it writes as inherited guards, in the form guards takes: a clone of the Unit receives them, and a merge carries them, and any later change to them, to the Units downstream of it. Guards set through guards stay with the Unit they are on. A key may not be in both. The clearance has to cover these as it covers guards. */
+    inheritedGuards?: string;
     /** Merge the range as one rebased diff and record it as one Revision, instead of walking it. By default a merge replays: it takes the source's Revisions in order and, where a Revision records function invocations that can be re-executed, runs them against this Unit rather than rebasing their recorded paths onto it -- so a change lands where this Unit's own structure puts it -- and records each source Revision that has an effect here as a Revision of its own, carrying that Revision's change description, its own conflicts, and one Mutation per source Mutation. Squashing gives up both: the range arrives as a single rebased patch in a single Revision, which is what a merge did before replay existed. Accepted with upgrade, merge_source, and resolve of an UpgradeUnit or MergeUnits Link, and refused elsewhere, since there is no range to walk. A Link can ask for it standingly with its Squash field. */
     squash?: boolean;
     /** Upgrade the unit to the latest version of its upstream unit */
@@ -16845,7 +16875,7 @@ type BulkPatchUnitsApiArg = {
       An example conjunction is:
       `CreatedAt >= '2025-01-07' AND Slug = 'test' AND Labels.mykey = 'myvalue'`.
       
-      Supported attributes for filtering on Mutation: ChannelID, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.Clearance, FunctionInvocation.FunctionName, FunctionInvocation.Guards, FunctionInvocation.WhereResource, FunctionName, HiddenReason, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
+      Supported attributes for filtering on Mutation: ChannelID, Clearance, CreatedAt, FunctionInvocation.Arguments, FunctionInvocation.FunctionName, FunctionInvocation.WhereResource, FunctionName, Guards, HiddenReason, InheritedGuards, InvocationID, InvocationParams, LinkID, MergeBaseRevisionNum, MergeEndRevisionNum, MergeSourceID, MutationID, MutationNum, OrganizationID, ReplayOutcome, ReplayReason, RestoredRevisionNum, RevisionID, RevisionNum, SpaceID, Subgroup, TriggerID, UnitID, UpdatedAt.
       
       Selects Mutations of this Unit whose paths the merge must not overwrite, unioned with the Protected values stored on the Unit's MutationSources.
       
@@ -20234,11 +20264,6 @@ type TagRead = {
     /** An entity-specific sequence number used for optimistic concurrency control. The value read must be sent in calls to Update. */
     Version?: number;
 };
-type FunctionArgument = {
-    Evaluator?: string;
-    ParameterName?: string;
-    Value?: string | number | boolean;
-};
 type ClearanceRequirement = {
     /** The guard key this requirement is about */
     Key?: string;
@@ -20248,18 +20273,16 @@ type ClearanceRequirement = {
     Values?: string[];
 };
 type Clearance = ClearanceRequirement[];
-type GuardStamp = {
-    [key: string]: string;
+type FunctionArgument = {
+    Evaluator?: string;
+    ParameterName?: string;
+    Value?: string | number | boolean;
 };
 type FunctionInvocation = {
     /** Function arguments */
     Arguments?: FunctionArgument[] | null;
-    /** Classes of guarded reason this invocation is cleared for; combined by union with the clearance of whatever drove the execution */
-    Clearance?: Clearance;
     /** Function name */
     FunctionName?: string;
-    /** Guards to record on the paths this invocation writes, so a later operation must be cleared for them; combined with the guards of whatever drove the execution, later winning per key */
-    Guards?: GuardStamp;
     /** Caller-supplied parameter values for expanding templated argument Values; transient, not persisted */
     Params?: {
         [key: string]: any;
@@ -20268,6 +20291,9 @@ type FunctionInvocation = {
     WhereResource?: string;
 };
 type FunctionInvocationList = FunctionInvocation[] | null;
+type GuardStamp = {
+    [key: string]: string;
+};
 type Invocation = {
     /** An optional map of Annotation key/value pairs for tools to attach information to entities. */
     Annotations?: {
@@ -20275,6 +20301,8 @@ type Invocation = {
     };
     /** Unique identifier for a Channel whose client executes the functions specified by the Invocation. If it is not specified, the builtin function executor is used. */
     ChannelID?: string;
+    /** Classes of guarded reason this Invocation's functions are cleared for; combined by union with the clearance of the Trigger or API call that runs it */
+    Clearance?: Clearance;
     /** An optional set of gates that, if any is present, will block deletion. */
     DeleteGates?: {
         [key: string]: boolean;
@@ -20282,6 +20310,8 @@ type Invocation = {
     /** Friendly name for the entity. */
     DisplayName?: string;
     FunctionInvocations: FunctionInvocationList;
+    /** Guards to record on the paths this Invocation's functions write, so a later operation must be cleared for them; combined with the guards of a Trigger running it, the Trigger's winning per key. Add and overwrite only -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). Clearance must cover them. */
+    Guards?: GuardStamp;
     /** The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another. */
     HiddenReason?: string;
     /** InvocationID uniquely identifies a invocation within the system. */
@@ -20313,6 +20343,8 @@ type InvocationRead = {
     BackingUnitID?: string;
     /** Unique identifier for a Channel whose client executes the functions specified by the Invocation. If it is not specified, the builtin function executor is used. */
     ChannelID?: string;
+    /** Classes of guarded reason this Invocation's functions are cleared for; combined by union with the clearance of the Trigger or API call that runs it */
+    Clearance?: Clearance;
     /** The timestamp when the entity was created in "2023-01-01T12:00:00Z" format. */
     CreatedAt?: string;
     /** An optional set of gates that, if any is present, will block deletion. */
@@ -20324,6 +20356,8 @@ type InvocationRead = {
     /** The type of entity. */
     EntityType?: string;
     FunctionInvocations: FunctionInvocationList;
+    /** Guards to record on the paths this Invocation's functions write, so a later operation must be cleared for them; combined with the guards of a Trigger running it, the Trigger's winning per key. Add and overwrite only -- retiring a guard is the /guard API (cub unit set-guard --remove-guard). Clearance must cover them. */
+    Guards?: GuardStamp;
     /** SHA256 hash of the functions and their arguments encoded as hexadecimal. */
     Hash?: string;
     /** The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another. */
@@ -21308,11 +21342,11 @@ type WithheldGuard = {
     Value?: string;
 };
 type GuardDelta = {
-    /** The path whose guards changed; empty for the resource as a whole */
+    /** The path whose inherited guards changed; empty for the resource as a whole */
     Path?: string;
-    /** Guard keys removed */
+    /** Inherited guard keys removed */
     Remove?: string[];
-    /** Guard keys added or changed, with their new values */
+    /** Inherited guard keys added or changed, with their new values */
     Set?: {
         [key: string]: string;
     };
@@ -23549,10 +23583,16 @@ type ExtendedTriggerRead = {
 };
 type Mutation = {
     ChannelID?: string;
+    /** The classes of guarded reason the change was filtered with. On a function invocation that is the request's clearance together with that of every Trigger and Invocation that wrote in the same execution; on a Link's change, the Link's */
+    Clearance?: Clearance;
     /** The function invoked if the change was made by a function. */
     FunctionInvocation?: FunctionInvocation;
+    /** The guards the change recorded on the paths it wrote: the operation's merged with those of the Trigger, Invocation, or Link that produced it */
+    Guards?: GuardStamp;
     /** The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another. */
     HiddenReason?: string;
+    /** The guards the change recorded as inherited on the paths it wrote, which clones receive and merges carry to the units downstream */
+    InheritedGuards?: GuardStamp;
     /** InvocationID is the identifier of the function invoked, if there is a corresponding Invocation. */
     InvocationID?: string;
     InvocationParams?: {
@@ -23597,14 +23637,20 @@ type Mutation = {
 };
 type MutationRead = {
     ChannelID?: string;
+    /** The classes of guarded reason the change was filtered with. On a function invocation that is the request's clearance together with that of every Trigger and Invocation that wrote in the same execution; on a Link's change, the Link's */
+    Clearance?: Clearance;
     /** The timestamp when the entity was created in "2023-01-01T12:00:00Z" format. */
     CreatedAt?: string;
     /** The type of entity. */
     EntityType?: string;
     /** The function invoked if the change was made by a function. */
     FunctionInvocation?: FunctionInvocation;
+    /** The guards the change recorded on the paths it wrote: the operation's merged with those of the Trigger, Invocation, or Link that produced it */
+    Guards?: GuardStamp;
     /** The reason the entity is hidden, if it is. A hidden entity is left out of List and Search results, and of what bulk operations act on, unless the include_hidden parameter names its reason or is *, or the where parameter names the entity by Slug or ID. ConfigHub/YAML Units are created hidden with the reason BackingUnit unless given another. */
     HiddenReason?: string;
+    /** The guards the change recorded as inherited on the paths it wrote, which clones receive and merges carry to the units downstream */
+    InheritedGuards?: GuardStamp;
     /** InvocationID is the identifier of the function invoked, if there is a corresponding Invocation. */
     InvocationID?: string;
     InvocationParams?: {
@@ -23960,6 +24006,8 @@ type BlameField = {
     Guards?: {
         [key: string]: string;
     };
+    /** The keys of Guards that are inherited: copied to the unit's clones and carried by merges to the units downstream of it. The others stay with this unit. */
+    InheritedGuards?: string[];
     /** The unit's needed paths that are the field: a value it is to take from an upstream unit through a NeedsProvides Link. */
     Needed?: BlameNeededPath[];
     /** The field's path, in the syntax functions and Links take. Empty on the row about the resource as a whole, which comes first among the resource's fields and carries what is recorded about the resource rather than one of its fields: the change that added or deleted it, whether it is protected as a whole, its guards, and its conflicts, findings and failed checks that name no path. */
@@ -24083,12 +24131,18 @@ type ResourceGuards = {
     };
     /** The resource whose guards are being edited: ResourceName, its whole name (namespace/name) or a name it had before a rename, or ResourceNameWithoutScope, a name without its namespace that has to match one resource; ResourceType, in any API version, is optional. A resource the unit does not have yet is named by ResourceType and ResourceName. */
     Resource?: ResourceInfo;
-    /** Guard key/value pairs to add or overwrite, by path. The empty path addresses the resource as a whole. A list element is named by merge key or by position, and * stands for every element or key there is; a path that does not exist yet is kept as written */
+    /** Guard key/value pairs to add or overwrite, by path, as guards of this unit alone: clones and downstream units do not receive them, and one that was inherited stops being. The empty path addresses the resource as a whole. A list element is named by merge key or by position, and * stands for every element or key there is; a path that does not exist yet is kept as written */
     Set?: {
         [key: string]: {
             [key: string]: string;
         };
     };
+    /** Guard key/value pairs to add or overwrite, by path, as inherited guards: a clone of the unit receives them, and a merge carries them, and any later change to them, to the units downstream of it. Named as in Set; a key may not be in both at the same path */
+    SetInherited?: {
+        [key: string]: {
+            [key: string]: string;
+        };
+    };
 };
 type UnitGuardRequest = {
     /** Recorded on the Revision the edit creates. Defaults to "Set path guards". */
@@ -24155,7 +24209,7 @@ type BlamePathChangeRead = {
     Value?: string;
 };
 type UnitPathReport = {
-    /** The path's own annotations other than guards and conflict dismissals, by kind. The field's Guards are those that apply to it, its ancestors' and its resource's included. */
+    /** The path's own annotations other than guards, their inheritance and conflict dismissals, by kind. The field's Guards are those that apply to it, its ancestors' and its resource's included. */
     Annotations?: {
         [key: string]: {
             [key: string]: string;
@@ -24179,7 +24233,7 @@ type UnitPathReport = {
     ReleaseState?: string;
 };
 type UnitPathReportRead = {
-    /** The path's own annotations other than guards and conflict dismissals, by kind. The field's Guards are those that apply to it, its ancestors' and its resource's included. */
+    /** The path's own annotations other than guards, their inheritance and conflict dismissals, by kind. The field's Guards are those that apply to it, its ancestors' and its resource's included. */
     Annotations?: {
         [key: string]: {
             [key: string]: string;

package/dist/index.js

@@ -1028,6 +1028,7 @@ var injectedRtkApi = confighubApi.enhanceEndpoints({
           protect: queryArg.protect,
           clearance: queryArg.clearance,
           guards: queryArg.guards,
+          inherited_guards: queryArg.inheritedGuards,
           change_set_id: queryArg.changeSetId,
           change_order: queryArg.changeOrder,
           subgroup: queryArg.subgroup,
@@ -2489,6 +2490,7 @@ var injectedRtkApi = confighubApi.enhanceEndpoints({
           protect: queryArg.protect,
           clearance: queryArg.clearance,
           guards: queryArg.guards,
+          inherited_guards: queryArg.inheritedGuards,
           change_set_id: queryArg.changeSetId,
           change_order: queryArg.changeOrder,
           subgroup: queryArg.subgroup,
@@ -3107,6 +3109,7 @@ var injectedRtkApi = confighubApi.enhanceEndpoints({
           protect: queryArg.protect,
           clearance: queryArg.clearance,
           guards: queryArg.guards,
+          inherited_guards: queryArg.inheritedGuards,
           squash: queryArg.squash,
           upgrade: queryArg.upgrade,
           restore: queryArg.restore,
@@ -3141,6 +3144,7 @@ var injectedRtkApi = confighubApi.enhanceEndpoints({
           protect: queryArg.protect,
           clearance: queryArg.clearance,
           guards: queryArg.guards,
+          inherited_guards: queryArg.inheritedGuards,
           squash: queryArg.squash,
           upgrade: queryArg.upgrade,
           restore: queryArg.restore,
@@ -3207,6 +3211,7 @@ var injectedRtkApi = confighubApi.enhanceEndpoints({
           protect: queryArg.protect,
           clearance: queryArg.clearance,
           guards: queryArg.guards,
+          inherited_guards: queryArg.inheritedGuards,
           merge_base: queryArg.mergeBase,
           merge_external_source: queryArg.mergeExternalSource,
           merge_enable_subtraction: queryArg.mergeEnableSubtraction,
@@ -3908,6 +3913,7 @@ var injectedRtkApi = confighubApi.enhanceEndpoints({
           protect: queryArg.protect,
           clearance: queryArg.clearance,
           guards: queryArg.guards,
+          inherited_guards: queryArg.inheritedGuards,
           squash: queryArg.squash,
           upgrade: queryArg.upgrade,
           restore: queryArg.restore,