urun-cli 0.5.3__tar.gz → 0.5.4__tar.gz

{urun_cli-0.5.3 → urun_cli-0.5.4}/CHANGELOG.md

@@ -1,17 +1,44 @@
 # Changelog
 
-## 0.5.3
+## 0.5.4
 
-- Publish the previously-unreleased `urun app purge` and `urun build purge`
-  subcommands. Both landed on `main` after the `v0.5.2` tag was cut, and the
-  release workflow skips re-publishing when the `pyproject` version is unchanged,
-  so they were never available on PyPI. This is a version-bump-only release that
-  carries the existing, already-tested commands to PyPI so CI/operators can run
-  `uvx --from urun-cli==0.5.3 urun app purge <slug>` (hard-delete orphaned app
-  metadata after `urun app delete`) without a private git install. No CLI
-  behavior changes beyond making these commands installable.
+- Ship the serving-engine dependency map (`urun.catalog.ENGINE_DEPS`) additions
+  and pin syncs that landed on `main` after `v0.5.3` but were never released:
+  the `kyutai-moshi`, `moshi-vis`, `stt`, `tts`, `echo-stt`, and `echo-speak`
+  engine shapes (#98), the sphn 0.2.x / `moshi==0.2.13` pin syncs (#100, #101),
+  and the platform `llamacpp-diffusion` wheel pin (#104). The installed
+  `v0.5.3` CLI's strict fail-loud guard therefore refused live dev deploys of
+  `urun serve hibiki-zero-3b:bf16` / `urun serve moshivis:bf16` ("serve engine
+  'kyutai-moshi' is not in the CLI's known serving-engine set ...") even though
+  `main`'s map was already in sync with urun-python — the drift was the stale
+  RELEASE, not the source. This release carries the synced map to PyPI.
+- Make that strict refusal self-diagnosing: the error now names the RUNNING
+  CLI version and tells the operator to upgrade first (`uv tool upgrade
+  urun-cli`), and only then to suspect genuine source drift from urun-python's
+  `urun.serve.engines.extras.ENGINE_DEPS` (which the cross-repo parity test
+  guards in CI). The old text sent operators to edit a map that was already
+  correct at `origin/main`.
 
-## Unreleased
+- Make the org-secrets store the canonical source for app-declared
+  `Credentials(env=..., optional_env=...)`. On `urun deploy`, each declared name
+  is resolved against the org-secrets store FIRST — org-level secrets plus this
+  app's app-level secrets, exactly the set the control plane injects into the
+  runtime pod env. A name already in the store is used as-is and is NEVER read
+  from or overridden by the deployer's shell (no silent shadowing of an org
+  secret by a stray local value). Only declared names the store does not yet hold
+  are filled from the local environment and delivered through the documented
+  app-scoped fallback channel. A REQUIRED credential resolvable from NEITHER the
+  store NOR the local env fails loud at deploy (never a silent drop that
+  resurfaces as a 401 inside the cluster); a missing OPTIONAL credential is
+  skipped silently (its contract). Previously the deploy read declared
+  credentials ONLY from the deployer's shell and failed if they were unset there
+  even when the org secret existed — and pushed the local value as an app secret
+  that shadowed the canonical org secret. Secret values are never printed.
+- Add `urun get secret <NAME>` (metadata only — the store never returns values)
+  to round out the secret CRUD alongside `urun set secret` / `urun list secrets`
+  / `urun delete secret`. `urun set secret <NAME>` with neither `--value` nor
+  `--from-file` now reads the value from a non-echoing secure prompt so it never
+  lands in shell history / argv.
 
 - Make `urun deploy` resilient to transient network blips. The manifest/blob
   push and the "Waiting for build to complete" build-status poll now retry on
@@ -45,17 +72,32 @@
   catalogue; `urun list sessions` for history). Supports `--limit`
   (default 100) and `--json`. Reads from a new control-plane
   endpoint `GET /compute` (server-side edge function not yet shipped).
-- Add experimental `urun app status|scale|delete|activate` lifecycle commands
+- Add experimental `urun app status|scale|disable|enable` lifecycle commands
   for managing a single deployed app (addressed by slug, org-scoped via the API
   key). `app status` shows the build/deployment/capacity/live-session rollup;
   `app scale --replicas N` sets the deployment's desired replica count (use 0 to
   drain; GPU/shape stay fixed at deploy time, so only `--replicas` is exposed);
-  `app delete` (alias `app rm`) retires an app — driving it to `paused`/
+  `app disable` disables an app — driving it to `paused`/
   `disabled` so the control-plane materializer stops recreating its runtime —
-  with an interactive confirmation (`--yes` to skip); `app activate` reverses a
-  retire. All accept `--environment` (default `prod`) and `--json`. Backed by a
+  with an interactive confirmation (`--yes` to skip); `app enable` reverses it.
+  All accept `--environment` (default `prod`) and `--json`. Backed by a
   new server-side `app` edge function (`GET /app/<slug>`,
   `POST /app/<slug>/scale`, `DELETE /app/<slug>`, `POST /app/<slug>/activate`).
+- Remove duplicate command surfaces in favor of one canonical spelling:
+  `urun app status` replaces `urun get app`, `urun app scale` replaces
+  `urun scale app`, and bare `urun org` replaces `urun org id` /
+  `urun get org-id`. `urun get org` remains for the richer org-config summary.
+
+## 0.5.3
+
+- Publish the previously-unreleased `urun app purge` and `urun build purge`
+  subcommands. Both landed on `main` after the `v0.5.2` tag was cut, and the
+  release workflow skips re-publishing when the `pyproject` version is unchanged,
+  so they were never available on PyPI. This is a version-bump-only release that
+  carries the existing, already-tested commands to PyPI so CI/operators can run
+  `uvx --from urun-cli==0.5.3 urun app purge <slug>` (hard-delete orphaned app
+  metadata after `urun app delete`) without a private git install. No CLI
+  behavior changes beyond making these commands installable.
 
 ## 0.3.0
 

{urun_cli-0.5.3 → urun_cli-0.5.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: urun-cli
-Version: 0.5.3
+Version: 0.5.4
 Summary: End-user CLI for deploying apps to urun
 Project-URL: Homepage, https://urun.sh
 Project-URL: Repository, https://github.com/urun-sh/urun-cli
@@ -98,6 +98,24 @@ In this release, `urun run` uses the same deploy pipeline as `urun deploy`.
 `deploy` remains available as the lower-level command while the full
 deploy/run/monitor workflow is being built.
 
+### Launch the prompt-canary browser demo
+
+For the official `urun-examples` prompt-canary app, the shortest browser stream
+path is:
+
+```bash
+cd ~/workspace/urun-examples
+urun deploy prompt_canary/backend/app.py --name prompt-canary --timeout 900
+urun demo prompt-canary
+```
+
+`urun demo` currently supports `prompt-canary` only. It uses your stored API key
+server-side to request a short-lived browser JWT, sets the required
+`NEXT_PUBLIC_URUN_*` environment variables, starts the local Next.js frontend,
+and opens it in your browser. Override the examples checkout with
+`--examples-root` or `URUN_EXAMPLES_ROOT`; override the session API with
+`--session-url` or `URUN_SESSION_BASE_URL`.
+
 ## Serve a model from the catalog
 
 `urun serve` deploys a model straight from the urun model catalog — no app code
@@ -279,20 +297,26 @@ urun app scale lingbot --replicas 0   # drain to zero without retiring
 GPU count and compute shape are fixed at deploy time per release (set via
 `@app.function`), so `scale` intentionally exposes only `--replicas`.
 
-Retire an app so the control plane stops running it (drives the deployment
+Disable an app so the control plane stops running it (drives the deployment
 to `paused` and the app to `disabled`, so the materializer stops recreating
 its runtime). This is the clean, reversible, API-driven alternative to a
 manual database edit:
 
 ```bash
-urun app delete lingbot-handle      # prompts for confirmation
-urun app delete lingbot-handle --yes  # or urun app rm lingbot-handle --yes
+urun app disable lingbot-handle        # prompts for confirmation
+urun app disable lingbot-handle --yes  # skip confirmation
+```
+
+Enable a disabled app and bring it back online:
+
+```bash
+urun app enable lingbot-handle
 ```
 
-Reverse a retire and bring the app back online:
+Stop a queued, starting, or live session:
 
 ```bash
-urun app activate lingbot-handle
+urun stop session sess_123 --yes
 ```
 
 All `app` subcommands accept `--environment` (default `prod`) and `--json`.

{urun_cli-0.5.3 → urun_cli-0.5.4}/README.md

@@ -76,6 +76,24 @@ In this release, `urun run` uses the same deploy pipeline as `urun deploy`.
 `deploy` remains available as the lower-level command while the full
 deploy/run/monitor workflow is being built.
 
+### Launch the prompt-canary browser demo
+
+For the official `urun-examples` prompt-canary app, the shortest browser stream
+path is:
+
+```bash
+cd ~/workspace/urun-examples
+urun deploy prompt_canary/backend/app.py --name prompt-canary --timeout 900
+urun demo prompt-canary
+```
+
+`urun demo` currently supports `prompt-canary` only. It uses your stored API key
+server-side to request a short-lived browser JWT, sets the required
+`NEXT_PUBLIC_URUN_*` environment variables, starts the local Next.js frontend,
+and opens it in your browser. Override the examples checkout with
+`--examples-root` or `URUN_EXAMPLES_ROOT`; override the session API with
+`--session-url` or `URUN_SESSION_BASE_URL`.
+
 ## Serve a model from the catalog
 
 `urun serve` deploys a model straight from the urun model catalog — no app code
@@ -257,20 +275,26 @@ urun app scale lingbot --replicas 0   # drain to zero without retiring
 GPU count and compute shape are fixed at deploy time per release (set via
 `@app.function`), so `scale` intentionally exposes only `--replicas`.
 
-Retire an app so the control plane stops running it (drives the deployment
+Disable an app so the control plane stops running it (drives the deployment
 to `paused` and the app to `disabled`, so the materializer stops recreating
 its runtime). This is the clean, reversible, API-driven alternative to a
 manual database edit:
 
 ```bash
-urun app delete lingbot-handle      # prompts for confirmation
-urun app delete lingbot-handle --yes  # or urun app rm lingbot-handle --yes
+urun app disable lingbot-handle        # prompts for confirmation
+urun app disable lingbot-handle --yes  # skip confirmation
+```
+
+Enable a disabled app and bring it back online:
+
+```bash
+urun app enable lingbot-handle
 ```
 
-Reverse a retire and bring the app back online:
+Stop a queued, starting, or live session:
 
 ```bash
-urun app activate lingbot-handle
+urun stop session sess_123 --yes
 ```
 
 All `app` subcommands accept `--environment` (default `prod`) and `--json`.

{urun_cli-0.5.3 → urun_cli-0.5.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "urun-cli"
-version = "0.5.3"
+version = "0.5.4"
 description = "End-user CLI for deploying apps to urun"
 readme = "README.md"
 requires-python = ">=3.11"

{urun_cli-0.5.3 → urun_cli-0.5.4}/src/urun/api.py

@@ -117,6 +117,12 @@ class ApiClient:
             {"reason": reason} if reason else {},
         )
 
+    def create_demo_token(self, app: str, function_name: str | None = None) -> dict[str, Any]:
+        body: dict[str, Any] = {"app": app}
+        if function_name:
+            body["function"] = function_name
+        return self._post("/cli/demo-token", body)
+
     def list_compute(self, limit: int | None = None) -> dict[str, Any]:
         """List currently-provisioned compute slices for the authenticated org.
 
@@ -163,12 +169,6 @@ class ApiClient:
     def get_capacity_lease(self, lease_id: str) -> dict[str, Any]:
         return self._get(f"/cli/capacity-leases/{urllib.parse.quote(lease_id, safe='')}")
 
-    def create_capacity_lease(self, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post("/cli/capacity-leases", payload)
-
-    def cancel_capacity_lease(self, lease_id: str) -> dict[str, Any]:
-        return self._post(f"/cli/capacity-leases/{urllib.parse.quote(lease_id, safe='')}/cancel")
-
     def list_builds(self, params: dict[str, Any] | None = None) -> dict[str, Any]:
         return self._get("/cli/builds", params)
 
@@ -185,6 +185,73 @@ class ApiClient:
             f"/cli/builds/{urllib.parse.quote(manifest_hash_or_prefix, safe='')}/purge"
         )
 
+    def build_app(
+        self, prompt: str, app: str | None = None, visibility: str | None = None
+    ) -> dict[str, Any]:
+        """Enqueue a steerable builder-agent run.
+
+        Mirrors the uRun MCP builder surface (``build_app`` / ``iterate_app`` /
+        ``debug_app`` plus the builder steering tools). The MCP tools enqueue by
+        INSERTing rows directly into Supabase (``public.builder_runs`` /
+        ``public.builder_steering``) with a service-role key — there is no
+        costly-agents HTTP service. A CLI must never hold a service-role key, so
+        the CLI mirrors the same logical operations and the same request-body
+        field names but routes them through the org-API-key control-plane REST
+        plane (``/cli/builders...``), which performs the privileged insert
+        server-side (edge function TBD, same convention as
+        ``list_apps``/``list_sessions``).
+        """
+        body: dict[str, Any] = {"mode": "build", "prompt": prompt}
+        if app:
+            body["app"] = app
+        if visibility:
+            body["visibility"] = visibility
+        return self._post("/cli/builders", body)
+
+    def iterate_app(self, app: str, request: str, repo: str | None = None) -> dict[str, Any]:
+        body: dict[str, Any] = {"mode": "feature", "app": app, "request": request}
+        if repo:
+            body["repo"] = repo
+        return self._post("/cli/builders", body)
+
+    def debug_app(
+        self, app: str, symptom: str | None = None, repo: str | None = None
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"mode": "debug", "app": app}
+        if symptom:
+            body["symptom"] = symptom
+        if repo:
+            body["repo"] = repo
+        return self._post("/cli/builders", body)
+
+    def list_builders(self, limit: int | None = None) -> dict[str, Any]:
+        return self._get("/cli/builders", {"limit": limit})
+
+    def get_builder(self, agent_id: str) -> dict[str, Any]:
+        return self._get(f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}")
+
+    def message_builder(self, agent_id: str, message: str) -> dict[str, Any]:
+        return self._post(
+            f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}/message", {"message": message}
+        )
+
+    def resolve_builder_checkpoint(
+        self,
+        agent_id: str,
+        decision: str,
+        amend: dict[str, Any] | None = None,
+        reason: str | None = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"decision": decision}
+        if amend is not None:
+            body["amend"] = amend
+        if reason is not None:
+            body["reason"] = reason
+        return self._post(f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}/resolve", body)
+
+    def stop_builder(self, agent_id: str) -> dict[str, Any]:
+        return self._post(f"/cli/builders/{urllib.parse.quote(agent_id, safe='')}/stop")
+
     def list_releases(self, app: str, environment: str | None = None) -> dict[str, Any]:
         return self._get("/cli/releases", {"app": app, "environment": environment})
 
@@ -243,35 +310,15 @@ class ApiClient:
     def list_api_keys(self) -> dict[str, Any]:
         return self._get("/cli/api-keys")
 
-    def create_api_key(self, label: str, service_account: str | None = None) -> dict[str, Any]:
-        return self._post("/cli/api-keys", {"label": label, "service_account": service_account})
-
-    def revoke_api_key(self, key_id: str) -> dict[str, Any]:
-        return self._post(f"/cli/api-keys/{urllib.parse.quote(key_id, safe='')}/revoke")
-
     def list_service_accounts(self) -> dict[str, Any]:
         return self._get("/cli/service-accounts")
 
-    def create_service_account(self, name: str) -> dict[str, Any]:
-        return self._post("/cli/service-accounts", {"name": name})
-
-    def delete_service_account(self, account_id: str) -> dict[str, Any]:
-        return self._delete(f"/cli/service-accounts/{urllib.parse.quote(account_id, safe='')}")
-
     def list_members(self) -> dict[str, Any]:
         return self._get("/cli/members")
 
     def get_member(self, actor_id: str) -> dict[str, Any]:
         return self._get(f"/cli/members/{urllib.parse.quote(actor_id, safe='')}")
 
-    def invite_member(self, email: str, role: str) -> dict[str, Any]:
-        return self._post("/cli/members/invite", {"email": email, "role": role})
-
-    def set_member_role(self, actor_id: str, role: str) -> dict[str, Any]:
-        return self._post(
-            f"/cli/members/{urllib.parse.quote(actor_id, safe='')}/role", {"role": role}
-        )
-
     def list_activity(self, params: dict[str, Any] | None = None) -> dict[str, Any]:
         return self._get("/cli/activity", params)
 
@@ -284,74 +331,27 @@ class ApiClient:
     def get_issue(self, issue: str) -> dict[str, Any]:
         return self._get(f"/cli/issues/{urllib.parse.quote(issue, safe='')}")
 
-    def set_issue_status(self, issue: str, status: str, note: str | None = None) -> dict[str, Any]:
-        return self._post(
-            f"/cli/issues/{urllib.parse.quote(issue, safe='')}/status",
-            {"status": status, "note": note},
-        )
-
     def list_alert_rules(self) -> dict[str, Any]:
         return self._get("/cli/alert-rules")
 
     def get_alert_rule(self, rule_id: str) -> dict[str, Any]:
         return self._get(f"/cli/alert-rules/{urllib.parse.quote(rule_id, safe='')}")
 
-    def create_alert_rule(self, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post("/cli/alert-rules", payload)
-
-    def update_alert_rule(self, rule_id: str, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post(f"/cli/alert-rules/{urllib.parse.quote(rule_id, safe='')}", payload)
-
-    def delete_alert_rule(self, rule_id: str) -> dict[str, Any]:
-        return self._delete(f"/cli/alert-rules/{urllib.parse.quote(rule_id, safe='')}")
-
     def list_alert_channels(self) -> dict[str, Any]:
         return self._get("/cli/alert-channels")
 
-    def create_alert_channel(self, kind: str, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post(f"/cli/alert-channels/{urllib.parse.quote(kind, safe='')}", payload)
-
-    def set_alert_channel_enabled(self, channel_id: str, enabled: bool) -> dict[str, Any]:
-        return self._post(
-            f"/cli/alert-channels/{urllib.parse.quote(channel_id, safe='')}/enabled",
-            {"enabled": enabled},
-        )
-
-    def delete_alert_channel(self, channel_id: str) -> dict[str, Any]:
-        return self._delete(f"/cli/alert-channels/{urllib.parse.quote(channel_id, safe='')}")
-
     def list_git_installations(self) -> dict[str, Any]:
         return self._get("/cli/git-installations")
 
     def list_git_repos(self) -> dict[str, Any]:
         return self._get("/cli/git-repos")
 
-    def link_app(self, app: str, payload: dict[str, Any]) -> dict[str, Any]:
-        return self._post(f"/cli/apps/{urllib.parse.quote(app, safe='')}/git", payload)
-
-    def unlink_app(self, app: str) -> dict[str, Any]:
-        return self._delete(f"/cli/apps/{urllib.parse.quote(app, safe='')}/git")
-
-    def deploy_app_from_git(self, app: str, branch: str | None = None) -> dict[str, Any]:
-        body: dict[str, Any] = {}
-        if branch is not None:
-            body["branch"] = branch
-        return self._post(f"/cli/apps/{urllib.parse.quote(app, safe='')}/deploy", body)
-
     def list_marketplace_apps(self, params: dict[str, Any] | None = None) -> dict[str, Any]:
         return self._get("/cli/marketplace-apps", params)
 
     def get_marketplace_app(self, slug: str) -> dict[str, Any]:
         return self._get(f"/cli/marketplace-apps/{urllib.parse.quote(slug, safe='')}")
 
-    def install_app(self, slug: str, environment: str | None = None) -> dict[str, Any]:
-        body: dict[str, Any] = {}
-        if environment is not None:
-            body["environment"] = environment
-        return self._post(
-            f"/cli/marketplace-apps/{urllib.parse.quote(slug, safe='')}/install", body
-        )
-
     def app_status(self, app: str, environment: str | None = None) -> dict[str, Any]:
         """Fetch the detailed lifecycle status for a single app.
 
@@ -383,19 +383,19 @@ class ApiClient:
         return self._json("POST", f"/app/{urllib.parse.quote(app, safe='')}/scale", body)
 
     def delete_app(self, app: str, environment: str | None = None) -> dict[str, Any]:
-        """Retire (deactivate) an app deployment.
+        """Disable an app deployment.
 
         Hits ``DELETE /app/<slug>``, which drives the deployment to ``paused``
         (and the app to ``disabled``) so the control-plane materializer stops
         recreating the app's runtime StatefulSet. Reversible with
         :meth:`activate_app`. The org is derived from the API key. Returns
-        ``{"app": {...}}`` with the retired deployment.
+        ``{"app": {...}}`` with the disabled deployment.
         """
         body: dict[str, Any] | None = {"environment": environment} if environment else None
         return self._json("DELETE", f"/app/{urllib.parse.quote(app, safe='')}", body)
 
     def activate_app(self, app: str, environment: str | None = None) -> dict[str, Any]:
-        """Reverse a retire: reactivate a previously-deleted app deployment.
+        """Enable a previously disabled app deployment.
 
         Hits ``POST /app/<slug>/activate`` (status back to ``active``), so the
         materializer resumes recreating the app's StatefulSet. The org is
@@ -429,6 +429,73 @@ class ApiClient:
         """
         return self._json("POST", "/org-config/auth-connections", payload)
 
+    # --- MCP-parity reads -------------------------------------------------- #
+    # The uRun MCP reads GPU metrics straight from cube and runtime/deploy state
+    # straight from Supabase PostgREST with privileged server-only credentials
+    # (cube API secret / service-role key). The CLI cannot and must not hold
+    # those, so — exactly like the existing query_logs -> /cli/logs and
+    # list_failure_groups -> /cli/failure-groups mirrors — it routes the SAME
+    # semantics through the org-API-key control-plane edge surface (/cli/...).
+
+    def get_gpu_metrics(self, app: str, params: dict[str, Any] | None = None) -> dict[str, Any]:
+        return self._get(f"/cli/gpu-metrics/{urllib.parse.quote(app, safe='')}", params)
+
+    def get_runtime_health(self, app: str, function_name: str | None = None) -> dict[str, Any]:
+        return self._get(
+            f"/cli/runtime-health/{urllib.parse.quote(app, safe='')}",
+            {"function": function_name},
+        )
+
+    def get_deploy_status(self, app: str, environment: str | None = None) -> dict[str, Any]:
+        return self._get(
+            f"/cli/deploy-status/{urllib.parse.quote(app, safe='')}",
+            {"environment": environment},
+        )
+
+    # --- Platform feedback ------------------------------------------------- #
+    def raise_feedback(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/cli/feedback", payload)
+
+    def comment_feedback(self, feedback_id: str, body: str) -> dict[str, Any]:
+        return self._post(
+            f"/cli/feedback/{urllib.parse.quote(feedback_id, safe='')}/comments",
+            {"body": body},
+        )
+
+    def get_feedback(self, feedback_id: str) -> dict[str, Any]:
+        return self._get(f"/cli/feedback/{urllib.parse.quote(feedback_id, safe='')}")
+
+    def list_feedback(self) -> dict[str, Any]:
+        return self._get("/cli/feedback")
+
+    # --- Dev gate ---------------------------------------------------------- #
+    def run_dev_gate(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/cli/dev-gate", payload)
+
+    # --- Console: dashboards + view defaults ------------------------------- #
+    def create_dashboard(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/cli/dashboards", payload)
+
+    def save_dashboard_config(self, dashboard_ref: str, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post(
+            f"/cli/dashboards/{urllib.parse.quote(dashboard_ref, safe='')}/config", payload
+        )
+
+    def set_view_default(self, surface: str, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post(f"/cli/view-defaults/{urllib.parse.quote(surface, safe='')}", payload)
+
+    def clear_view_default(self, surface: str, scope: str) -> dict[str, Any]:
+        return self._delete(
+            f"/cli/view-defaults/{urllib.parse.quote(surface, safe='')}", {"scope": scope}
+        )
+
+    # --- Org config deltas ------------------------------------------------- #
+    def set_org_limits(self, payload: dict[str, Any]) -> dict[str, Any]:
+        return self._post("/org-config/limits", payload)
+
+    def remove_auth_connection(self, issuer: str) -> dict[str, Any]:
+        return self._delete("/org-config/auth-connections", {"issuer": issuer})
+
     def _json(self, method: str, path: str, body: dict[str, Any] | None) -> dict[str, Any]:
         data = (
             None