@onkernel/sdk 0.100.0 → 0.102.0

package/resources/vaults/vaults.mjs

@@ -12,18 +12,38 @@ export class Vaults extends APIResource {
     }
     /**
      * Get a vault
+     *
+     * @example
+     * ```ts
+     * const vault = await client.vaults.retrieve('id_or_name');
+     * ```
      */
     retrieve(idOrName, options) {
         return this._client.get(path `/vaults/${idOrName}`, options);
     }
     /**
      * List vaults in the current project
+     *
+     * @example
+     * ```ts
+     * // Automatically fetches more pages as needed.
+     * for await (const vault of client.vaults.list()) {
+     *   // ...
+     * }
+     * ```
      */
     list(query = {}, options) {
         return this._client.getAPIList('/vaults', (OffsetPagination), { query, ...options });
     }
     /**
-     * Delete a vault and invalidate its items
+     * Unresolved payment operations block deletion. Reconcile the original attempt
+     * with the provider or support first; deleting or recreating an item is not proof
+     * that a payment did not occur.
+     *
+     * @example
+     * ```ts
+     * await client.vaults.delete('id_or_name');
+     * ```
      */
     delete(idOrName, options) {
         return this._client.delete(path `/vaults/${idOrName}`, {
@@ -32,7 +52,16 @@ export class Vaults extends APIResource {
         });
     }
     /**
-     * Create or retrieve a vault by immutable name
+     * Free organizations can store up to 3 non-deleted vaults across all projects.
+     * Paid plans and active trials have no vault cap. Retrieving an existing vault by
+     * name succeeds even at the limit.
+     *
+     * @example
+     * ```ts
+     * const vault = await client.vaults.upsert({
+     *   name: 'checkout',
+     * });
+     * ```
      */
     upsert(body, options) {
         return this._client.post('/vaults', { body, ...options });

package/resources/vaults/vaults.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"vaults.mjs","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,gCAA4B;AAClD,OAAO,KAAK,QAAQ,oBAAgB;AACpC,OAAO,EAYL,KAAK,GAQN,oBAAgB;AAEjB,OAAO,EAAE,gBAAgB,EAA4C,kCAA8B;AACnG,OAAO,EAAE,YAAY,EAAE,mCAA+B;AAEtD,OAAO,EAAE,IAAI,EAAE,sCAAkC;AAEjD,MAAM,OAAO,MAAO,SAAQ,WAAW;IAAvC;;QACE,UAAK,GAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAmC3D,CAAC;IAjCC;;OAEG;IACH,QAAQ,CAAC,QAAgB,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;OAEG;IACH,IAAI,CACF,QAA4C,EAAE,EAC9C,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAA,gBAAuB,CAAA,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,QAAgB,EAAE,OAAwB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE;YACpD,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,IAAuB,EAAE,OAAwB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AA0BD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC"}
+{"version":3,"file":"vaults.mjs","sourceRoot":"","sources":["../../src/resources/vaults/vaults.ts"],"names":[],"mappings":"AAAA,sFAAsF;AAEtF,OAAO,EAAE,WAAW,EAAE,gCAA4B;AAClD,OAAO,KAAK,QAAQ,oBAAgB;AACpC,OAAO,EAgBL,KAAK,GAaN,oBAAgB;AAEjB,OAAO,EAAE,gBAAgB,EAA4C,kCAA8B;AACnG,OAAO,EAAE,YAAY,EAAE,mCAA+B;AAEtD,OAAO,EAAE,IAAI,EAAE,sCAAkC;AAEjD,MAAM,OAAO,MAAO,SAAQ,WAAW;IAAvC;;QACE,UAAK,GAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAgE3D,CAAC;IA9DC;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAgB,EAAE,OAAwB;QACjD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED;;;;;;;;;;OAUG;IACH,IAAI,CACF,QAA4C,EAAE,EAC9C,OAAwB;QAExB,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE,CAAA,gBAAuB,CAAA,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CAAC,QAAgB,EAAE,OAAwB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAA,WAAW,QAAQ,EAAE,EAAE;YACpD,GAAG,OAAO;YACV,OAAO,EAAE,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;SAC7D,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,IAAuB,EAAE,OAAwB;QACtD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;IAC5D,CAAC;CACF;AA0BD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC"}

package/src/client.ts

@@ -136,6 +136,14 @@ import {
   ProxyUpdateParams,
   ProxyUpdateResponse,
 } from './resources/proxies';
+import {
+  VaultProviderConfig,
+  VaultProviderConfigCreateParams,
+  VaultProviderConfigListParams,
+  VaultProviderConfigUpdateParams,
+  VaultProviderConfigs,
+  VaultProviderConfigsOffsetPagination,
+} from './resources/vault-provider-configs';
 import {
   AuditLogEntriesPageTokenPagination,
   AuditLogEntry,
@@ -1067,6 +1075,7 @@ export class Kernel {
    * Create and manage browser pools for acquiring and releasing browsers.
    */
   browserPools: API.BrowserPools = new API.BrowserPools(this);
+  vaultProviderConfigs: API.VaultProviderConfigs = new API.VaultProviderConfigs(this);
   vaults: API.Vaults = new API.Vaults(this);
   /**
    * Create and manage credentials for authentication.
@@ -1105,6 +1114,7 @@ Kernel.Telemetry = Telemetry;
 Kernel.Proxies = Proxies;
 Kernel.Extensions = Extensions;
 Kernel.BrowserPools = BrowserPools;
+Kernel.VaultProviderConfigs = VaultProviderConfigs;
 Kernel.Vaults = Vaults;
 Kernel.Credentials = Credentials;
 Kernel.Projects = Projects;
@@ -1263,6 +1273,15 @@ export declare namespace Kernel {
     type BrowserPoolReleaseParams as BrowserPoolReleaseParams,
   };
 
+  export {
+    VaultProviderConfigs as VaultProviderConfigs,
+    type VaultProviderConfig as VaultProviderConfig,
+    type VaultProviderConfigsOffsetPagination as VaultProviderConfigsOffsetPagination,
+    type VaultProviderConfigCreateParams as VaultProviderConfigCreateParams,
+    type VaultProviderConfigUpdateParams as VaultProviderConfigUpdateParams,
+    type VaultProviderConfigListParams as VaultProviderConfigListParams,
+  };
+
   export {
     Vaults as Vaults,
     type Vault as Vault,

package/src/lib/browser-routing.ts

@@ -47,6 +47,8 @@ const DEFAULT_BROWSER_ROUTING_SUBRESOURCES = [
   'computer',
   'playwright',
   'process',
+  'fs',
+  'logs/stream',
 ];
 const BROWSER_ROUTE_CACHEABLE_PATH = /^\/(?:v\d+\/)?browsers(?:\/[^/]+)?\/?$/;
 const BROWSER_POOL_ACQUIRE_PATH = /^\/(?:v\d+\/)?browser_pools\/[^/]+\/acquire\/?$/;
@@ -278,9 +280,13 @@ async function routeRequest(
 
   const headers = new Headers(request.headers);
   headers.delete('authorization');
+  const body = requestBodyForFetch(request, init);
   const routed = await innerFetch(target.toString(), buildRoutedInit(input, request, init, headers));
   if ((routed.status === 401 || routed.status === 403) && target.searchParams.get('jwt')) {
     cache.deleteIfJwt(sessionId, target.searchParams.get('jwt') ?? '');
+    if (isStreamingBody(body)) {
+      return routed;
+    }
     await CancelReadableStream(routed.body);
     return innerFetch(input, init);
   }
@@ -294,6 +300,14 @@ function buildRoutedInit(
   headers: Headers,
 ): RequestInit {
   const method = request.method.toUpperCase();
+  const body = method === 'GET' || method === 'HEAD' ? undefined : requestBodyForFetch(request, originalInit);
+  if (derivesOwnContentType(body) && !new Headers(originalInit?.headers).get('content-type')) {
+    // `request` was constructed from the same body, so its content-type carries
+    // that construction's multipart boundary. The routed fetch re-encodes the
+    // body with a new boundary, so let it derive the header again.
+    headers.delete('content-type');
+  }
+
   const routedInit = {
     ...((originalInit ?? {}) as Record<string, unknown>),
     method,
@@ -305,14 +319,13 @@ function buildRoutedInit(
   delete routedInit['body'];
   delete routedInit['duplex'];
 
+  if (body !== undefined) {
+    routedInit.body = body;
+  }
   if (method !== 'GET' && method !== 'HEAD') {
-    const body = requestBodyForFetch(request, originalInit);
-    if (body !== undefined) {
-      routedInit.body = body;
-    }
     if (originalInit?.duplex !== undefined) {
       routedInit.duplex = originalInit.duplex;
-    } else if (requiresHalfDuplex(body)) {
+    } else if (isStreamingBody(body)) {
       routedInit.duplex = 'half';
     }
   }
@@ -331,7 +344,15 @@ function requestBodyForFetch(
   return request.body ?? undefined;
 }
 
-function requiresHalfDuplex(body: RequestInit['body'] | undefined): boolean {
+function derivesOwnContentType(body: RequestInit['body'] | undefined): boolean {
+  return (
+    ((globalThis as any).FormData && body instanceof (globalThis as any).FormData) ||
+    ((globalThis as any).URLSearchParams && body instanceof (globalThis as any).URLSearchParams) ||
+    ((globalThis as any).Blob && body instanceof (globalThis as any).Blob)
+  );
+}
+
+function isStreamingBody(body: RequestInit['body'] | undefined): boolean {
   return (
     ((globalThis as any).ReadableStream && body instanceof (globalThis as any).ReadableStream) ||
     (typeof body === 'object' && body !== null && Symbol.asyncIterator in body)

package/src/resources/auth/connections.ts

@@ -904,6 +904,13 @@ export interface ManagedAuthBrowserConfig {
    */
   proxy?: BrowsersAPI.BrowserProxyConfig;
 
+  /**
+   * Browser region. Omit on create to use us-east, on update to keep the current
+   * region, or on login to inherit it. Login overrides apply only to that login.
+   * Non-default regions require an eligible plan and organization access.
+   */
+  region?: 'us-east' | 'eu-west' | 'ap-southeast';
+
   /**
    * Whether managed auth browser sessions use stealth mode. Defaults to true when
    * omitted.

package/src/resources/browsers/computer.ts

@@ -439,7 +439,9 @@ export namespace ComputerBatchParams {
        * List of key symbols to press. Each item should be a key symbol supported by
        * xdotool (see X11 keysym definitions). Examples include "Return", "Shift",
        * "Ctrl", "Alt", "F5". Items in this list could also be combinations, e.g.
-       * "Ctrl+t" or "Ctrl+Shift+Tab".
+       * "Ctrl+t" or "Ctrl+Shift+Tab". Use X11 names for punctuation in combinations,
+       * such as "Ctrl+minus" or "Ctrl+plus". A literal hyphen is also accepted as an
+       * alias, so "Ctrl+-" is normalized to "Ctrl+minus".
        */
       keys: Array<string>;
 
@@ -654,7 +656,9 @@ export interface ComputerPressKeyParams {
    * List of key symbols to press. Each item should be a key symbol supported by
    * xdotool (see X11 keysym definitions). Examples include "Return", "Shift",
    * "Ctrl", "Alt", "F5". Items in this list could also be combinations, e.g.
-   * "Ctrl+t" or "Ctrl+Shift+Tab".
+   * "Ctrl+t" or "Ctrl+Shift+Tab". Use X11 names for punctuation in combinations,
+   * such as "Ctrl+minus" or "Ctrl+plus". A literal hyphen is also accepted as an
+   * alias, so "Ctrl+-" is normalized to "Ctrl+minus".
    */
   keys: Array<string>;
 

package/src/resources/browsers/telemetry.ts

@@ -4338,13 +4338,16 @@ export namespace BrowserProxyErrorEvent {
      * Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
      * branded 5xx error page served by the metro egress host-proxy. Values mirror what
      * the proxy emits: destination_blocked, provider_blacklisted,
-     * provider_unreachable, proxy_unavailable, upstream_timeout, upstream_dns_failure,
-     * upstream_connect_failed. Unknown header values are dropped.
+     * provider_unreachable, provider_rejected, origin_tls_timeout, proxy_unavailable,
+     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. Unknown header
+     * values are dropped.
      */
     code:
       | 'destination_blocked'
       | 'provider_blacklisted'
       | 'provider_unreachable'
+      | 'provider_rejected'
+      | 'origin_tls_timeout'
       | 'proxy_unavailable'
       | 'upstream_timeout'
       | 'upstream_dns_failure'

package/src/resources/config-registry/config-registry.ts

@@ -85,8 +85,13 @@ export interface Analysis {
   created_at: string;
 
   /**
-   * Present for failed or canceled analyses. Messages contain safe retry guidance
-   * rather than internal workflow errors.
+   * Deadline after which a still-running analysis becomes expired.
+   */
+  expires_at: string;
+
+  /**
+   * Present for failed, canceled, or expired analyses. Messages contain safe retry
+   * guidance rather than internal workflow errors.
    */
   failure: Shared.ErrorModel | null;
 
@@ -98,7 +103,7 @@ export interface Analysis {
   /**
    * Lifecycle status of a background analysis.
    */
-  status: 'running' | 'completed' | 'failed' | 'canceled';
+  status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 }
 
 export interface AnalysisSummary {
@@ -147,6 +152,28 @@ export interface ConfigRegistryResponse {
   recommendation: RecommendationResult | null;
 
   target: Target;
+
+  /**
+   * Short advisory markdown to facilitate navigating this target. Returned even when
+   * no configuration reached the target, since knowing what prevented success is
+   * useful without a configuration. Not verified against this target. Null when
+   * nothing applicable was observed or no notes exist.
+   */
+  guidance?: string | null;
+
+  /**
+   * How far the workload pass got, when an intent was supplied and a pass ran. A run
+   * outcome rather than advice, so it is reported whether or not any guidance could
+   * be assembled. Null when no intent was supplied or no pass ran.
+   */
+  workload_outcome?:
+    | 'completed'
+    | 'turn_limit'
+    | 'auth_required'
+    | 'payment_required'
+    | 'blocked'
+    | 'error'
+    | null;
 }
 
 export interface Evidence {
@@ -196,9 +223,20 @@ export interface LookupRequest {
 }
 
 export interface LookupResponse {
-  recommendation: Recommendation | null;
+  /**
+   * A recommendation or a structured no-recommendation result.
+   */
+  recommendation: RecommendationResult | null;
 
   target: Target;
+
+  /**
+   * Short advisory markdown to facilitate navigating this target. Returned even when
+   * no configuration reached the target, since knowing what prevented success is
+   * useful without a configuration. Not verified against this target. Null when
+   * nothing applicable was observed or no notes exist.
+   */
+  guidance?: string | null;
 }
 
 export interface NoRecommendation {
@@ -295,7 +333,8 @@ export namespace Proxy {
        */
       export interface IspProxyConfig {
         /**
-         * ISO 3166 country code. Defaults to US if not provided.
+         * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+         * to US if not provided.
          */
         country?: string;
       }
@@ -316,7 +355,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code.
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
@@ -346,7 +386,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
@@ -438,7 +479,7 @@ export interface RecommendationSummary {
   /**
    * Lifecycle status of the most recently requested analysis for this exact target.
    */
-  analysis_status: 'running' | 'completed' | 'failed' | 'canceled';
+  analysis_status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 
   /**
    * Most recent time the selected project requested an analysis for this exact
@@ -482,6 +523,17 @@ export interface ResolveRequest {
    * Kernel uses its default country selection.
    */
   allowed_proxy_countries?: Array<string>;
+
+  /**
+   * Plain-language description of the workload you intend to run against this
+   * target, in a sentence or two. Requires an https target, because the pass treats
+   * any non-HTTPS destination as off-site and will not drive an http one. Kernel
+   * uses it to drive the browser further into the site, where it can observe
+   * protections that only appear once a session interacts. When this target already
+   * has a verified configuration, the run confirms that one instead of re-deriving
+   * the whole matrix, so supplying an intent narrows what can be recommended.
+   */
+  intent?: string;
 }
 
 export interface Target {
@@ -538,6 +590,17 @@ export interface ConfigRegistryResolveParams {
    * Kernel uses its default country selection.
    */
   allowed_proxy_countries?: Array<string>;
+
+  /**
+   * Plain-language description of the workload you intend to run against this
+   * target, in a sentence or two. Requires an https target, because the pass treats
+   * any non-HTTPS destination as off-site and will not drive an http one. Kernel
+   * uses it to drive the browser further into the site, where it can observe
+   * protections that only appear once a session interacts. When this target already
+   * has a verified configuration, the run confirms that one instead of re-deriving
+   * the whole matrix, so supplying an intent narrows what can be recommended.
+   */
+  intent?: string;
 }
 
 ConfigRegistry.Analyses = Analyses;

package/src/resources/index.ts

@@ -180,6 +180,14 @@ export {
   type ProxyListResponsesOffsetPagination,
 } from './proxies';
 export { Telemetry } from './telemetry/telemetry';
+export {
+  VaultProviderConfigs,
+  type VaultProviderConfig,
+  type VaultProviderConfigCreateParams,
+  type VaultProviderConfigUpdateParams,
+  type VaultProviderConfigListParams,
+  type VaultProviderConfigsOffsetPagination,
+} from './vault-provider-configs';
 export {
   Vaults,
   type Vault,

package/src/resources/invocations.ts

@@ -197,8 +197,8 @@ export namespace InvocationStateEvent {
     finished_at?: string | null;
 
     /**
-     * Output produced by the action, rendered as a JSON string. This could be: string,
-     * number, boolean, array, object, or null.
+     * The action result or detailed failure output. Often a JSON-encoded value, but
+     * failures may contain plain text. May contain sensitive application data.
      */
     output?: string;
 
@@ -208,7 +208,13 @@ export namespace InvocationStateEvent {
     payload?: string;
 
     /**
-     * Status reason
+     * A nonempty, customer-safe summary of the recorded failure output, always present
+     * when status is failed and omitted otherwise, including in the first failed
+     * invocation_state event. Recognized messages receive a specific summary; other
+     * failures receive a generic summary. Message matching does not establish whether
+     * the failure originated in the platform or action code. Does not include raw
+     * action output or internal error details. Available for historical invocations as
+     * well. Human-readable text, not a stable identifier for retry logic.
      */
     status_reason?: string;
   }
@@ -231,13 +237,18 @@ export interface InvocationCreateResponse {
   status: 'queued' | 'running' | 'succeeded' | 'failed';
 
   /**
-   * The return value of the action that was invoked, rendered as a JSON string. This
-   * could be: string, number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise. Recognized messages receive a
+   * specific summary; other failures receive a generic summary. Message matching
+   * does not establish whether the failure originated in the platform or action
+   * code. Does not include raw action output or internal error details.
+   * Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -280,8 +291,8 @@ export interface InvocationRetrieveResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -291,7 +302,13 @@ export interface InvocationRetrieveResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -334,8 +351,8 @@ export interface InvocationUpdateResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -345,7 +362,13 @@ export interface InvocationUpdateResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -388,8 +411,8 @@ export interface InvocationListResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -399,7 +422,13 @@ export interface InvocationListResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }

package/src/resources/organization/entitlements.ts

@@ -57,6 +57,12 @@ export namespace OrgEntitlements {
     profiles: Features.Profiles;
 
     proxy_bypass_hosts: Features.ProxyBypassHosts;
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    vaults: Features.Vaults;
   }
 
   export namespace Features {
@@ -176,6 +182,17 @@ export namespace OrgEntitlements {
        */
       enabled: boolean;
     }
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    export interface Vaults {
+      /**
+       * Whether the organization is entitled to use this feature.
+       */
+      enabled: boolean;
+    }
   }
 
   export interface Limits {
@@ -195,6 +212,12 @@ export namespace OrgEntitlements {
      * Effective organization-wide concurrent app invocation ceiling.
      */
     max_concurrent_invocations: number;
+
+    /**
+     * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+     * unlimited. The vaults feature flag still controls access.
+     */
+    max_vaults: number | null;
   }
 
   export interface Plan {

package/src/resources/organization/limits.ts

@@ -9,7 +9,7 @@ import { RequestOptions } from '../../internal/request-options';
  */
 export class Limits extends APIResource {
   /**
-   * Get the organization's effective limits and managed auth usage.
+   * Get the organization's effective limits and managed auth and vault usage.
    */
   retrieve(options?: RequestOptions): APIPromise<OrgLimits> {
     return this._client.get('/org/limits', options);
@@ -39,6 +39,12 @@ export interface OrgLimits {
    */
   max_auth_connections: number | null;
 
+  /**
+   * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+   * unlimited.
+   */
+  max_vaults: number | null;
+
   /**
    * Smallest health_check_interval the organization's plan accepts on a managed auth
    * connection. Requests below this are rejected with 400. Existing connections
@@ -46,6 +52,11 @@ export interface OrgLimits {
    */
   min_health_check_interval_seconds: number;
 
+  /**
+   * Current non-deleted vault count across all projects in the organization.
+   */
+  vaults_used: number;
+
   /**
    * Default maximum concurrent browsers applied to every project that has no
    * explicit per-project override. Null means no org-level default, so such projects