@dharta/cli 0.6.77 → 0.6.78

package/node_modules/@dharta/sdk/src/resources.ts

@@ -1,13 +1,38 @@
 import type { HttpClient } from "./http.js";
+import type { MutationOptions } from "./idempotency.js";
 import type {
+  AgentChangeResponse,
+  AgentCodeUpdateParams,
+  AgentCodeUpdateResponse,
+  AgentCreateParams,
+  AgentCreateResponse,
+  AgentDeployResponse,
+  AgentFromTemplateParams,
+  AgentFromTemplateResponse,
+  AgentLinkGithubResponse,
   ApiKey,
+  ApiKeyBulkAction,
+  ApiKeyBulkUpdateResponse,
   ApiKeyCreateResponse,
+  ApiKeyRotateResponse,
+  ApiKeyRotationGracePeriod,
   ApiKeyScope,
+  ApiKeyStateResponse,
   BillingStatus,
-  ModelKey,
-  ModelKeyCreateParams,
-  ModelKeyProvider,
+  GithubRepository,
+  KartaShareCreateResponse,
+  MemberInvitation,
+  ModelConnection,
+  ModelConnectionCreateParams,
+  ModelConnectionOffers,
+  ModelConnectionOffersUpdateParams,
+  ModelConnectionProvider,
+  ModelConnectionRotateParams,
+  OrganizationModelSettings,
+  OrganizationModelSettingsUpdateParams,
+  ReleaseRetryResponse,
   UsageSummary,
+  WebhookDelivery,
   WebhookEndpoint,
   WebhookEndpointCreateResponse,
   WebhookEventType,
@@ -17,14 +42,180 @@ interface ListEnvelope<T> {
   data: T[];
 }
 
-interface ModelKeyEnvelope {
-  model_key: ModelKey;
+interface ModelConnectionEnvelope {
+  model_connection: ModelConnection;
 }
 
 interface WebhookEndpointEnvelope {
   webhook_endpoint: WebhookEndpoint;
 }
 
+export interface ApiKeyCreateParams {
+  expiresAt?: string;
+}
+
+// Per-call options every mutating method accepts.
+//
+// `idempotencyKey` is what makes an ambiguous network failure recoverable. A
+// request that times out may or may not have been performed; retrying it with
+// the SAME key lets the server tell the two apart - it replays the first
+// response instead of performing the mutation twice. Without one, each call
+// mints a fresh key, which protects a caller from its own duplicate calls but
+// cannot help a retry, because the retry looks like a new request.
+//
+// The agent control plane (RFC 0048 P4). Reads live on the CLI's own client
+// for now; these are the mutations, and every one of them is idempotent
+// server-side, so each carries an Idempotency-Key - minted per call unless the
+// caller supplies one through `MutationOptions`.
+export class AgentsResource {
+  constructor(private readonly http: HttpClient) {}
+
+  // Two forks, as the console has. With `githubRepositoryId` this LINKS that
+  // installed repository as the source of truth and answers a source_repo (the
+  // agent appears after the sync); without it, it creates an empty hosted
+  // agent. Use `isAgentLinkGithubResponse` to tell the two answers apart.
+  //
+  // The key matters on the GitHub fork: linking is NOT idempotent by
+  // construction the way the hosted fork is - a repeat re-links and re-syncs,
+  // bumping the sync attempt and queueing another mirror job - so a retry on a
+  // dropped connection would deploy twice without one. After a 503
+  // (`sync_not_queued`) the same key is the right one to retry with: the server
+  // never stores a 5xx, so the retry re-drives the sync.
+  async create(
+    params: AgentCreateParams = {},
+    options: MutationOptions = {},
+  ): Promise<AgentCreateResponse | AgentLinkGithubResponse> {
+    const body: Record<string, unknown> = {};
+    if (params.name !== undefined) body.name = params.name;
+    if (params.slug !== undefined) body.slug = params.slug;
+    if (params.githubRepositoryId !== undefined) {
+      body.github_repository_id = params.githubRepositoryId;
+    }
+    if (params.deployBranch !== undefined) body.deploy_branch = params.deployBranch;
+    return this.http.request<AgentCreateResponse | AgentLinkGithubResponse>({
+      method: "POST",
+      path: "/api/agents",
+      idempotencyKey: options.idempotencyKey,
+      body,
+    });
+  }
+
+  // Changes the DISPLAY name. The slug is the agent's identity in URLs,
+  // deploys and every other endpoint, and never changes here.
+  async rename(slug: string, name: string, options: MutationOptions = {}): Promise<AgentChangeResponse> {
+    return this.http.request<AgentChangeResponse>({
+      method: "PATCH",
+      path: `/api/agents/${encodeURIComponent(slug)}/name`,
+      idempotencyKey: options.idempotencyKey,
+      body: { name },
+    });
+  }
+
+  // A cost setting: it decides whether the agent's kartas write to the durable
+  // store, which is billed per GB and never garbage-collected. It takes effect
+  // on the agent's next release; stored data is untouched either way.
+  async setDurableWorkspace(
+    slug: string,
+    enabled: boolean,
+    options: MutationOptions = {},
+  ): Promise<AgentChangeResponse> {
+    return this.http.request<AgentChangeResponse>({
+      method: "PATCH",
+      path: `/api/agents/${encodeURIComponent(slug)}/durable_workspace`,
+      idempotencyKey: options.idempotencyKey,
+      body: { enabled },
+    });
+  }
+
+  // Creates the agent AND publishes release v1 from a built-in template, so it
+  // serves without a first push. 202 while v1 builds; the response says so.
+  async createFromTemplate(
+    params: AgentFromTemplateParams,
+    options: MutationOptions = {},
+  ): Promise<AgentFromTemplateResponse> {
+    const body: Record<string, unknown> = { template: params.template, name: params.name };
+    if (params.slug !== undefined) body.slug = params.slug;
+    if (params.description !== undefined) body.description = params.description;
+    if (params.harness !== undefined) body.harness = params.harness;
+    if (params.harnessVersion !== undefined) body.harness_version = params.harnessVersion;
+    return this.http.request<AgentFromTemplateResponse>({
+      method: "POST",
+      path: "/api/agents/from_template",
+      idempotencyKey: options.idempotencyKey,
+      body,
+    });
+  }
+
+  // Re-syncs the agent's source repository, which rebuilds it at deploy-branch
+  // HEAD. Answers when the sync is QUEUED, not when the release is built. A 503
+  // (`sync_not_queued`) is retryable under the SAME key: a 5xx is never stored,
+  // so the retry re-drives the sync.
+  async deploy(slug: string, options: MutationOptions = {}): Promise<AgentDeployResponse> {
+    return this.http.request<AgentDeployResponse>({
+      method: "POST",
+      path: `/api/agents/${encodeURIComponent(slug)}/deploy`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+
+  // Publishes the edited files as release vN+1. `baseVersion` is optimistic
+  // concurrency: a save against a stale version is a 409, never a clobber.
+  async updateCode(
+    slug: string,
+    params: AgentCodeUpdateParams,
+    options: MutationOptions = {},
+  ): Promise<AgentCodeUpdateResponse> {
+    return this.http.request<AgentCodeUpdateResponse>({
+      method: "PUT",
+      path: `/api/agents/${encodeURIComponent(slug)}/code`,
+      idempotencyKey: options.idempotencyKey,
+      body: { files: params.files, base_version: params.baseVersion },
+    });
+  }
+}
+
+// The ids `agents.create({ githubRepositoryId })` accepts: the repositories
+// the Dharta GitHub App is installed on for this organization.
+export class GithubRepositoriesResource {
+  constructor(private readonly http: HttpClient) {}
+
+  async list(): Promise<{ data: GithubRepository[] }> {
+    return this.http.request<{ data: GithubRepository[] }>({
+      method: "GET",
+      path: "/api/github_repositories",
+    });
+  }
+}
+
+export class ReleasesResource {
+  constructor(private readonly http: HttpClient) {}
+
+  // Republishes a FAILED browser-created release as release vN+1.
+  //
+  // The version is validated, not repaired. Stripping a leading `v` turned
+  // "vv2" into "v2" and "v0" into "0", so a typo reached the server as a
+  // DIFFERENT release id than the caller wrote. One optional `v`, then a
+  // positive integer with no leading zero - the same shape the server accepts.
+  async retry(
+    slug: string,
+    version: number | string,
+    options: MutationOptions = {},
+  ): Promise<ReleaseRetryResponse> {
+    const raw = String(version);
+    if (!/^v?[1-9]\d*$/.test(raw)) {
+      throw new Error(
+        `DhartaSDK: release version must be a positive integer, optionally prefixed with 'v'; got '${raw}'.`,
+      );
+    }
+    const normalized = raw.replace(/^v/, "");
+    return this.http.request<ReleaseRetryResponse>({
+      method: "POST",
+      path: `/api/agents/${encodeURIComponent(slug)}/releases/${encodeURIComponent(normalized)}/retry`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+}
+
 export class ApiKeysResource {
   constructor(private readonly http: HttpClient) {}
 
@@ -33,70 +224,239 @@ export class ApiKeysResource {
     return res.data;
   }
 
-  async create(name: string, scopes: ApiKeyScope[]): Promise<ApiKeyCreateResponse> {
+  // `expiresAt` is an ISO 8601 timestamp. Sensitive scopes
+  // (ApiKey::FORCED_EXPIRY_SCOPES server-side) require one within 90 days, and
+  // the server rejects the mint without it.
+  async create(
+    name: string,
+    scopes: ApiKeyScope[],
+    params: ApiKeyCreateParams = {},
+    options: MutationOptions = {},
+  ): Promise<ApiKeyCreateResponse> {
+    const body: Record<string, unknown> = { name, scopes };
+    if (params.expiresAt !== undefined) body.expires_at = params.expiresAt;
     return this.http.request<ApiKeyCreateResponse>({
       method: "POST",
       path: "/api_keys",
-      headers: idempotencyHeaders(),
-      body: { name, scopes },
+      idempotencyKey: options.idempotencyKey,
+      body,
     });
   }
 
-  async rename(id: string, name: string): Promise<ApiKey> {
+  // Every single-key method takes the numeric `ApiKey.id` the API answers, and
+  // accepts the string form for a caller that read the id out of argv or JSON.
+  async rename(id: number | string, name: string, options: MutationOptions = {}): Promise<ApiKey> {
     const res = await this.http.request<{ api_key: ApiKey }>({
       method: "PATCH",
-      path: `/api_keys/${encodeURIComponent(id)}`,
-      headers: idempotencyHeaders(),
+      path: `/api_keys/${encodeURIComponent(String(id))}`,
+      idempotencyKey: options.idempotencyKey,
       body: { name },
     });
     return res.api_key;
   }
 
-  async revoke(id: string): Promise<void> {
+  async revoke(id: number | string, options: MutationOptions = {}): Promise<void> {
+    await this.http.request<void>({
+      method: "DELETE",
+      path: `/api_keys/${encodeURIComponent(String(id))}`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+
+  // Mints a replacement carrying this key's scopes, mode, IP allowlist and
+  // limits, then retires the original: immediately with `gracePeriod: "now"`,
+  // otherwise at the end of the window (24 hours by default). The replacement's
+  // secret is returned once and is never readable again.
+  async rotate(
+    id: number | string,
+    params: { gracePeriod?: ApiKeyRotationGracePeriod } = {},
+    options: MutationOptions = {},
+  ): Promise<ApiKeyRotateResponse> {
+    const body: Record<string, unknown> = {};
+    if (params.gracePeriod !== undefined) body.grace_period = params.gracePeriod;
+    return this.http.request<ApiKeyRotateResponse>({
+      method: "POST",
+      path: `/api_keys/${encodeURIComponent(String(id))}/rotate`,
+      idempotencyKey: options.idempotencyKey,
+      body,
+    });
+  }
+
+  // `changed` is false when the key was already disabled, which is a no-op
+  // rather than an error.
+  async disable(id: number | string, options: MutationOptions = {}): Promise<ApiKeyStateResponse> {
+    return this.http.request<ApiKeyStateResponse>({
+      method: "POST",
+      path: `/api_keys/${encodeURIComponent(String(id))}/disable`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+
+  async enable(id: number | string, options: MutationOptions = {}): Promise<ApiKeyStateResponse> {
+    return this.http.request<ApiKeyStateResponse>({
+      method: "POST",
+      path: `/api_keys/${encodeURIComponent(String(id))}/enable`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+
+  // Atomic: every key changes or none does. Keys the action cannot apply to
+  // come back in `skipped` rather than failing the request.
+  async bulkUpdate(
+    action: ApiKeyBulkAction,
+    ids: number[],
+    options: MutationOptions = {},
+  ): Promise<ApiKeyBulkUpdateResponse> {
+    return this.http.request<ApiKeyBulkUpdateResponse>({
+      method: "POST",
+      path: "/api_keys/bulk_update",
+      idempotencyKey: options.idempotencyKey,
+      body: { action_name: action, ids },
+    });
+  }
+}
+
+// Only the share link lives here. The rest of the karta surface predates the
+// SDK resource pattern and is reached through `HttpClient` directly; moving it
+// is a separate change from adding an endpoint.
+export class KartasResource {
+  constructor(private readonly http: HttpClient) {}
+
+  // Mints an origin-fenced publishable key pinned to this karta. Anyone with
+  // the link gets their own session against the same durable workspace and
+  // spends from its budget, so the secret and the link are returned once and
+  // are never readable again.
+  async createShare(kartaId: string, options: MutationOptions = {}): Promise<KartaShareCreateResponse> {
+    return this.http.request<KartaShareCreateResponse>({
+      method: "POST",
+      path: `/api/kartas/${encodeURIComponent(kartaId)}/share`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+
+  async revokeShare(
+    kartaId: string,
+    shareId: string | number,
+    options: MutationOptions = {},
+  ): Promise<void> {
     await this.http.request<void>({
       method: "DELETE",
-      path: `/api_keys/${encodeURIComponent(id)}`,
-      headers: idempotencyHeaders(),
+      path: `/api/kartas/${encodeURIComponent(kartaId)}/shares/${encodeURIComponent(String(shareId))}`,
+      idempotencyKey: options.idempotencyKey,
     });
   }
 }
 
-export class ModelKeysResource {
+export class ModelConnectionsResource {
   constructor(private readonly http: HttpClient) {}
 
-  async list(): Promise<ModelKey[]> {
-    const res = await this.http.request<ListEnvelope<ModelKey>>({ path: "/model_keys" });
+  async list(): Promise<ModelConnection[]> {
+    const res = await this.http.request<ListEnvelope<ModelConnection>>({ path: "/model_connections" });
     return res.data;
   }
 
-  async create(provider: ModelKeyProvider, plaintext: string, name?: string): Promise<ModelKey>;
-  async create(params: ModelKeyCreateParams): Promise<ModelKey>;
   async create(
-    providerOrParams: ModelKeyProvider | ModelKeyCreateParams,
-    plaintext?: string,
+    provider: ModelConnectionProvider,
+    plaintext: string,
     name?: string,
-  ): Promise<ModelKey> {
-    const body = typeof providerOrParams === "string"
-      ? { provider: providerOrParams, plaintext, name }
+    options?: MutationOptions,
+  ): Promise<ModelConnection>;
+  async create(params: ModelConnectionCreateParams, options?: MutationOptions): Promise<ModelConnection>;
+  async create(
+    providerOrParams: ModelConnectionProvider | ModelConnectionCreateParams,
+    plaintextOrOptions?: string | MutationOptions,
+    name?: string,
+    maybeOptions?: MutationOptions,
+  ): Promise<ModelConnection> {
+    const positional = typeof providerOrParams === "string";
+    const body = positional
+      ? { provider: providerOrParams, plaintext: plaintextOrOptions as string, name }
       : providerOrParams;
-    const res = await this.http.request<ModelKeyEnvelope>({
+    const options = (positional ? maybeOptions : (plaintextOrOptions as MutationOptions)) ?? {};
+    const res = await this.http.request<ModelConnectionEnvelope>({
       method: "POST",
-      path: "/model_keys",
-      headers: idempotencyHeaders(),
+      path: "/model_connections",
+      idempotencyKey: options.idempotencyKey,
       body,
     });
-    return res.model_key;
+    return res.model_connection;
+  }
+
+  // Replace a connector's stored credential. Address the connector by its
+  // numeric id or its slug.
+  async rotate(
+    idOrSlug: string | number,
+    params: ModelConnectionRotateParams,
+    options: MutationOptions = {},
+  ): Promise<ModelConnection> {
+    const res = await this.http.request<ModelConnectionEnvelope>({
+      method: "PATCH",
+      path: `/model_connections/${encodeURIComponent(String(idOrSlug))}`,
+      idempotencyKey: options.idempotencyKey,
+      body: params,
+    });
+    return res.model_connection;
+  }
+
+  // List the models the connector can serve, with the enabled set and the
+  // connector default.
+  async models(idOrSlug: string | number): Promise<ModelConnectionOffers> {
+    return this.http.request<ModelConnectionOffers>({
+      path: `/model_connections/${encodeURIComponent(String(idOrSlug))}/models`,
+    });
+  }
+
+  // Replace the whole enabled set and the connector default.
+  async configureModels(
+    idOrSlug: string | number,
+    params: ModelConnectionOffersUpdateParams,
+    options: MutationOptions = {},
+  ): Promise<ModelConnectionOffers> {
+    return this.http.request<ModelConnectionOffers>({
+      method: "PUT",
+      path: `/model_connections/${encodeURIComponent(String(idOrSlug))}/models`,
+      idempotencyKey: options.idempotencyKey,
+      body: params,
+    });
   }
 
-  async revoke(id: string | number): Promise<void> {
+  async revoke(id: string | number, options: MutationOptions = {}): Promise<void> {
     await this.http.request<void>({
       method: "DELETE",
-      path: `/model_keys/${encodeURIComponent(String(id))}`,
-      headers: idempotencyHeaders(),
+      path: `/model_connections/${encodeURIComponent(String(id))}`,
+      idempotencyKey: options.idempotencyKey,
     });
   }
 }
 
+interface OrganizationModelSettingsEnvelope {
+  model_settings: OrganizationModelSettings;
+}
+
+export class OrganizationModelSettingsResource {
+  constructor(private readonly http: HttpClient) {}
+
+  async get(): Promise<OrganizationModelSettings> {
+    const res = await this.http.request<OrganizationModelSettingsEnvelope>({
+      path: "/api/organization/model_settings",
+    });
+    return res.model_settings;
+  }
+
+  async update(
+    params: OrganizationModelSettingsUpdateParams,
+    options: MutationOptions = {},
+  ): Promise<OrganizationModelSettings> {
+    const res = await this.http.request<OrganizationModelSettingsEnvelope>({
+      method: "PATCH",
+      path: "/api/organization/model_settings",
+      idempotencyKey: options.idempotencyKey,
+      body: params,
+    });
+    return res.model_settings;
+  }
+}
+
 export interface WebhookEndpointCreateParams {
   url: string;
   name?: string;
@@ -109,6 +469,15 @@ export interface WebhookEndpointUpdateParams {
   event_types?: WebhookEventType[];
 }
 
+// Reads take `webhooks:read`. Every mutation here takes `webhooks:write`, which
+// is a tenant-administration scope: the key must carry an expiry within 90 days.
+// A destination is an egress trust root, not a delivery detail - any URL is
+// accepted, and an endpoint created with no `event_types` receives every event
+// type, which carries billing, API-key, session and turn data.
+// The ids are integers on the wire (WebhookEndpoint.id is a number), so
+// `create(...).webhook_endpoint.id` feeds straight into these. `string` is
+// still accepted because an id read back out of a config file or an argv is a
+// string, and the only thing that reaches the URL is its decimal form.
 export class WebhookEndpointsResource {
   constructor(private readonly http: HttpClient) {}
 
@@ -117,39 +486,177 @@ export class WebhookEndpointsResource {
     return res.data;
   }
 
-  async create(params: WebhookEndpointCreateParams): Promise<WebhookEndpointCreateResponse> {
+  async create(
+    params: WebhookEndpointCreateParams,
+    options: MutationOptions = {},
+  ): Promise<WebhookEndpointCreateResponse> {
     return this.http.request<WebhookEndpointCreateResponse>({
       method: "POST",
       path: "/api/webhook_endpoints",
-      headers: idempotencyHeaders(),
+      idempotencyKey: options.idempotencyKey,
       body: params,
     });
   }
 
-  async update(id: string, params: WebhookEndpointUpdateParams): Promise<WebhookEndpoint> {
+  async update(
+    id: string | number,
+    params: WebhookEndpointUpdateParams,
+    options: MutationOptions = {},
+  ): Promise<WebhookEndpoint> {
     const res = await this.http.request<WebhookEndpointEnvelope>({
       method: "PATCH",
-      path: `/api/webhook_endpoints/${encodeURIComponent(id)}`,
-      headers: idempotencyHeaders(),
+      path: `/api/webhook_endpoints/${encodeURIComponent(String(id))}`,
+      idempotencyKey: options.idempotencyKey,
       body: params,
     });
     return res.webhook_endpoint;
   }
 
-  async enable(id: string): Promise<WebhookEndpoint> {
+  async enable(id: string | number, options: MutationOptions = {}): Promise<WebhookEndpoint> {
     const res = await this.http.request<WebhookEndpointEnvelope>({
       method: "POST",
-      path: `/api/webhook_endpoints/${encodeURIComponent(id)}/enable`,
-      headers: idempotencyHeaders(),
+      path: `/api/webhook_endpoints/${encodeURIComponent(String(id))}/enable`,
+      idempotencyKey: options.idempotencyKey,
     });
     return res.webhook_endpoint;
   }
 
-  async delete(id: string): Promise<void> {
+  // Queues one probe through the production delivery path: the same delivery
+  // row, the same signature, the same retries. The result is the QUEUED
+  // delivery, not its outcome, which lands on the delivery row later.
+  async test(id: string | number, options: MutationOptions = {}): Promise<WebhookDelivery> {
+    const res = await this.http.request<{ delivery: WebhookDelivery }>({
+      method: "POST",
+      path: `/api/webhook_endpoints/${encodeURIComponent(String(id))}/test`,
+      idempotencyKey: options.idempotencyKey,
+    });
+    return res.delivery;
+  }
+
+  async delete(id: string | number, options: MutationOptions = {}): Promise<void> {
+    await this.http.request<void>({
+      method: "DELETE",
+      path: `/api/webhook_endpoints/${encodeURIComponent(String(id))}`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+}
+
+export class MembersResource {
+  constructor(private readonly http: HttpClient) {}
+
+  // Pending invitations only. An accepted invitation is history, so the server
+  // answers 404 rather than silently doing nothing.
+  async revokeInvitation(id: string | number, options: MutationOptions = {}): Promise<void> {
     await this.http.request<void>({
       method: "DELETE",
-      path: `/api/webhook_endpoints/${encodeURIComponent(id)}`,
-      headers: idempotencyHeaders(),
+      path: `/api/members/invitations/${encodeURIComponent(String(id))}`,
+      idempotencyKey: options.idempotencyKey,
+    });
+  }
+
+  // Re-arms the expiry window and mails the invitee again, keeping the token
+  // the original email carried. The idempotency key is what stops a retry
+  // sending a second email.
+  async resendInvitation(
+    id: string | number,
+    options: MutationOptions = {},
+  ): Promise<MemberInvitation> {
+    const res = await this.http.request<{ invitation: MemberInvitation }>({
+      method: "POST",
+      path: `/api/members/invitations/${encodeURIComponent(String(id))}/resend`,
+      idempotencyKey: options.idempotencyKey,
+    });
+    return res.invitation;
+  }
+}
+
+export interface OrganizationIdentity {
+  slug: string;
+  name: string;
+}
+
+export interface OrganizationRenameResult {
+  organization: OrganizationIdentity;
+  changed: boolean;
+}
+
+export interface SupportAccessResult {
+  support_access: { allowed: boolean };
+  changed: boolean;
+}
+
+export interface TranscriptAccessResult {
+  transcript_access: { enabled: boolean };
+  changed: boolean;
+}
+
+export class OrganizationResource {
+  readonly modelSettings: OrganizationModelSettingsResource;
+
+  constructor(private readonly http: HttpClient) {
+    this.modelSettings = new OrganizationModelSettingsResource(http);
+  }
+
+  // Display name only. The slug is the API and audit identity and cannot be
+  // changed. Renaming to the current name returns `changed: false`.
+  async rename(name: string, options: MutationOptions = {}): Promise<OrganizationRenameResult> {
+    return this.http.request<OrganizationRenameResult>({
+      method: "PATCH",
+      path: "/api/organization",
+      idempotencyKey: options.idempotencyKey,
+      body: { name },
+    });
+  }
+
+  // Owner-only: needs `organization:support_access:write` on a key created by
+  // a current owner. Free-plan organizations cannot change the setting.
+  async setSupportAccess(
+    allowed: boolean,
+    options: MutationOptions = {},
+  ): Promise<SupportAccessResult> {
+    return this.http.request<SupportAccessResult>({
+      method: "PATCH",
+      path: "/api/organization/support_access",
+      idempotencyKey: options.idempotencyKey,
+      body: { allowed },
+    });
+  }
+
+  // Whether API keys may read end-user transcript content. Same owner-only
+  // gate; off by default.
+  async setTranscriptAccess(
+    enabled: boolean,
+    options: MutationOptions = {},
+  ): Promise<TranscriptAccessResult> {
+    return this.http.request<TranscriptAccessResult>({
+      method: "PATCH",
+      path: "/api/organization/support_access/transcripts",
+      idempotencyKey: options.idempotencyKey,
+      body: { enabled },
+    });
+  }
+}
+
+export interface SourceRepoDisconnectResult {
+  source_repo: { slug: string; deploy_branch: string };
+  github_repository: string | null;
+  changed: boolean;
+}
+
+export class SourceReposResource {
+  constructor(private readonly http: HttpClient) {}
+
+  // Stops pushes to the linked GitHub repository from producing releases.
+  // Current releases stay live. Already disconnected returns `changed: false`.
+  async disconnectGithub(
+    slug: string,
+    options: MutationOptions = {},
+  ): Promise<SourceRepoDisconnectResult> {
+    return this.http.request<SourceRepoDisconnectResult>({
+      method: "DELETE",
+      path: `/api/source_repos/${encodeURIComponent(slug)}/github`,
+      idempotencyKey: options.idempotencyKey,
     });
   }
 }
@@ -169,29 +676,3 @@ export class BillingResource {
     return this.http.request<BillingStatus>({ path: "/api/billing" });
   }
 }
-
-function idempotencyHeaders(): Record<string, string> {
-  return { "Idempotency-Key": randomIdempotencyKey() };
-}
-
-function randomIdempotencyKey(): string {
-  if (globalThis.crypto?.randomUUID) return globalThis.crypto.randomUUID();
-  const bytes = new Uint8Array(16);
-  if (globalThis.crypto?.getRandomValues) {
-    globalThis.crypto.getRandomValues(bytes);
-  } else {
-    for (let i = 0; i < bytes.length; i += 1) {
-      bytes[i] = Math.floor(Math.random() * 256);
-    }
-  }
-  bytes[6] = (bytes[6] & 0x0f) | 0x40;
-  bytes[8] = (bytes[8] & 0x3f) | 0x80;
-  const hex = [...bytes].map((byte) => byte.toString(16).padStart(2, "0"));
-  return [
-    hex.slice(0, 4).join(""),
-    hex.slice(4, 6).join(""),
-    hex.slice(6, 8).join(""),
-    hex.slice(8, 10).join(""),
-    hex.slice(10, 16).join(""),
-  ].join("-");
-}