@onkernel/sdk 0.99.0 → 0.101.0

package/src/resources/invocations.ts

@@ -197,8 +197,8 @@ export namespace InvocationStateEvent {
     finished_at?: string | null;
 
     /**
-     * Output produced by the action, rendered as a JSON string. This could be: string,
-     * number, boolean, array, object, or null.
+     * The action result or detailed failure output. Often a JSON-encoded value, but
+     * failures may contain plain text. May contain sensitive application data.
      */
     output?: string;
 
@@ -208,7 +208,13 @@ export namespace InvocationStateEvent {
     payload?: string;
 
     /**
-     * Status reason
+     * A nonempty, customer-safe summary of the recorded failure output, always present
+     * when status is failed and omitted otherwise, including in the first failed
+     * invocation_state event. Recognized messages receive a specific summary; other
+     * failures receive a generic summary. Message matching does not establish whether
+     * the failure originated in the platform or action code. Does not include raw
+     * action output or internal error details. Available for historical invocations as
+     * well. Human-readable text, not a stable identifier for retry logic.
      */
     status_reason?: string;
   }
@@ -231,13 +237,18 @@ export interface InvocationCreateResponse {
   status: 'queued' | 'running' | 'succeeded' | 'failed';
 
   /**
-   * The return value of the action that was invoked, rendered as a JSON string. This
-   * could be: string, number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise. Recognized messages receive a
+   * specific summary; other failures receive a generic summary. Message matching
+   * does not establish whether the failure originated in the platform or action
+   * code. Does not include raw action output or internal error details.
+   * Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -280,8 +291,8 @@ export interface InvocationRetrieveResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -291,7 +302,13 @@ export interface InvocationRetrieveResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -334,8 +351,8 @@ export interface InvocationUpdateResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -345,7 +362,13 @@ export interface InvocationUpdateResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -388,8 +411,8 @@ export interface InvocationListResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -399,7 +422,13 @@ export interface InvocationListResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }

package/src/resources/organization/entitlements.ts

@@ -57,6 +57,12 @@ export namespace OrgEntitlements {
     profiles: Features.Profiles;
 
     proxy_bypass_hosts: Features.ProxyBypassHosts;
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    vaults: Features.Vaults;
   }
 
   export namespace Features {
@@ -176,6 +182,17 @@ export namespace OrgEntitlements {
        */
       enabled: boolean;
     }
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    export interface Vaults {
+      /**
+       * Whether the organization is entitled to use this feature.
+       */
+      enabled: boolean;
+    }
   }
 
   export interface Limits {
@@ -195,6 +212,12 @@ export namespace OrgEntitlements {
      * Effective organization-wide concurrent app invocation ceiling.
      */
     max_concurrent_invocations: number;
+
+    /**
+     * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+     * unlimited. The vaults feature flag still controls access.
+     */
+    max_vaults: number | null;
   }
 
   export interface Plan {

package/src/resources/organization/limits.ts

@@ -9,7 +9,7 @@ import { RequestOptions } from '../../internal/request-options';
  */
 export class Limits extends APIResource {
   /**
-   * Get the organization's effective limits and managed auth usage.
+   * Get the organization's effective limits and managed auth and vault usage.
    */
   retrieve(options?: RequestOptions): APIPromise<OrgLimits> {
     return this._client.get('/org/limits', options);
@@ -39,6 +39,12 @@ export interface OrgLimits {
    */
   max_auth_connections: number | null;
 
+  /**
+   * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+   * unlimited.
+   */
+  max_vaults: number | null;
+
   /**
    * Smallest health_check_interval the organization's plan accepts on a managed auth
    * connection. Requests below this are rejected with 400. Existing connections
@@ -46,6 +52,11 @@ export interface OrgLimits {
    */
   min_health_check_interval_seconds: number;
 
+  /**
+   * Current non-deleted vault count across all projects in the organization.
+   */
+  vaults_used: number;
+
   /**
    * Default maximum concurrent browsers applied to every project that has no
    * explicit per-project override. Null means no org-level default, so such projects

package/src/resources/proxies.ts

@@ -183,7 +183,8 @@ export namespace ProxyCreateResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -204,7 +205,8 @@ export namespace ProxyCreateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -234,7 +236,8 @@ export namespace ProxyCreateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -344,7 +347,8 @@ export namespace ProxyRetrieveResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -365,7 +369,8 @@ export namespace ProxyRetrieveResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -395,7 +400,8 @@ export namespace ProxyRetrieveResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -505,7 +511,8 @@ export namespace ProxyUpdateResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -526,7 +533,8 @@ export namespace ProxyUpdateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -556,7 +564,8 @@ export namespace ProxyUpdateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -666,7 +675,8 @@ export namespace ProxyListResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -687,7 +697,8 @@ export namespace ProxyListResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -717,7 +728,8 @@ export namespace ProxyListResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -827,7 +839,8 @@ export namespace ProxyCheckResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -848,7 +861,8 @@ export namespace ProxyCheckResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -878,7 +892,8 @@ export namespace ProxyCheckResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -968,7 +983,8 @@ export namespace ProxyCreateParams {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -989,7 +1005,8 @@ export namespace ProxyCreateParams {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -1019,7 +1036,8 @@ export namespace ProxyCreateParams {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 

package/src/resources/vault-provider-configs.ts

@@ -0,0 +1,250 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../core/resource';
+import { APIPromise } from '../core/api-promise';
+import { OffsetPagination, type OffsetPaginationParams, PagePromise } from '../core/pagination';
+import { buildHeaders } from '../internal/headers';
+import { RequestOptions } from '../internal/request-options';
+import { path } from '../internal/utils/path';
+
+export class VaultProviderConfigs extends APIResource {
+  /**
+   * Register a configuration shared across the organization's projects. Names are
+   * unique within the organization; duplicate names return 409 without replacing
+   * credentials. A configuration serves many wallets. Secret credentials are never
+   * returned. Requires an organization-scoped credential or dashboard
+   * authentication; project-scoped credentials receive 403.
+   *
+   * @example
+   * ```ts
+   * const vaultProviderConfig =
+   *   await client.vaultProviderConfigs.create({
+   *     credentials: {
+   *       client_id: 'example-client-id',
+   *       client_secret: 'example-client-secret',
+   *     },
+   *     name: 'my-link-client',
+   *     provider: 'link',
+   *   });
+   * ```
+   */
+  create(body: VaultProviderConfigCreateParams, options?: RequestOptions): APIPromise<VaultProviderConfig> {
+    return this._client.post('/vault-provider-configs', { body, ...options });
+  }
+
+  /**
+   * Look up a configuration by ID or name. Returns 404 when it does not exist in the
+   * organization.
+   *
+   * @example
+   * ```ts
+   * const vaultProviderConfig =
+   *   await client.vaultProviderConfigs.retrieve('id_or_name');
+   * ```
+   */
+  retrieve(idOrName: string, options?: RequestOptions): APIPromise<VaultProviderConfig> {
+    return this._client.get(path`/vault-provider-configs/${idOrName}`, options);
+  }
+
+  /**
+   * Update the supplied fields; omitted fields remain unchanged. Names must remain
+   * unique within the organization. Requires an organization-scoped credential or
+   * dashboard authentication; project-scoped credentials receive 403.
+   *
+   * @example
+   * ```ts
+   * const vaultProviderConfig =
+   *   await client.vaultProviderConfigs.update('id_or_name', {
+   *     name: 'renamed-link-client',
+   *   });
+   * ```
+   */
+  update(
+    idOrName: string,
+    body: VaultProviderConfigUpdateParams,
+    options?: RequestOptions,
+  ): APIPromise<VaultProviderConfig> {
+    return this._client.patch(path`/vault-provider-configs/${idOrName}`, { body, ...options });
+  }
+
+  /**
+   * Secret credentials are never returned.
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const vaultProviderConfig of client.vaultProviderConfigs.list()) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    query: VaultProviderConfigListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<VaultProviderConfigsOffsetPagination, VaultProviderConfig> {
+    return this._client.getAPIList('/vault-provider-configs', OffsetPagination<VaultProviderConfig>, {
+      query,
+      ...options,
+    });
+  }
+
+  /**
+   * Delete a configuration in the organization. Returns 409 while any non-deleted
+   * vault item references the configuration, regardless of connection status. Does
+   * not delete the external OAuth client or revoke unrelated grants. Requires an
+   * organization-scoped credential or dashboard authentication; project-scoped
+   * credentials receive 403.
+   *
+   * @example
+   * ```ts
+   * await client.vaultProviderConfigs.delete('id_or_name');
+   * ```
+   */
+  delete(idOrName: string, options?: RequestOptions): APIPromise<void> {
+    return this._client.delete(path`/vault-provider-configs/${idOrName}`, {
+      ...options,
+      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
+    });
+  }
+}
+
+export type VaultProviderConfigsOffsetPagination = OffsetPagination<VaultProviderConfig>;
+
+/**
+ * Response schema for a Link configuration, without secret credentials. Kernel
+ * generates the ID and timestamps. Configuration creation uses
+ * VaultLinkProviderConfigRequest.
+ */
+export type VaultProviderConfig =
+  | VaultProviderConfig.VaultLinkProviderConfig
+  | VaultProviderConfig.VaultAgentCardProviderConfig;
+
+export namespace VaultProviderConfig {
+  /**
+   * Response schema for a Link configuration, without secret credentials. Kernel
+   * generates the ID and timestamps. Configuration creation uses
+   * VaultLinkProviderConfigRequest.
+   */
+  export interface VaultLinkProviderConfig {
+    id: string;
+
+    /**
+     * OAuth client identity; immutable. Secret credentials are never returned.
+     */
+    client_id: string;
+
+    created_at: string;
+
+    /**
+     * Unique within the organization.
+     */
+    name: string;
+
+    provider: 'link';
+
+    updated_at: string;
+  }
+
+  /**
+   * Response schema for an AgentCard configuration, without secret credentials.
+   * Kernel generates the ID and timestamps and introspects test_mode from the
+   * credentials. Configuration creation uses VaultAgentCardProviderConfigRequest.
+   */
+  export interface VaultAgentCardProviderConfig {
+    id: string;
+
+    client_id: string;
+
+    created_at: string;
+
+    name: string;
+
+    provider: 'agentcard';
+
+    /**
+     * Introspected mode of the selected credential; true means sandbox objects.
+     */
+    test_mode: boolean;
+
+    updated_at: string;
+  }
+}
+
+export type VaultProviderConfigCreateParams =
+  | VaultProviderConfigCreateParams.VaultLinkProviderConfigRequest
+  | VaultProviderConfigCreateParams.VaultAgentCardProviderConfigRequest;
+
+export declare namespace VaultProviderConfigCreateParams {
+  export interface VaultLinkProviderConfigRequest {
+    credentials: VaultLinkProviderConfigRequest.Credentials;
+
+    /**
+     * Unique within the organization.
+     */
+    name: string;
+
+    provider: 'link';
+  }
+
+  export namespace VaultLinkProviderConfigRequest {
+    export interface Credentials {
+      client_id: string;
+
+      client_secret: string;
+    }
+  }
+
+  export interface VaultAgentCardProviderConfigRequest {
+    credentials: VaultAgentCardProviderConfigRequest.Credentials;
+
+    /**
+     * Unique within the organization.
+     */
+    name: string;
+
+    provider: 'agentcard';
+  }
+
+  export namespace VaultAgentCardProviderConfigRequest {
+    export interface Credentials {
+      client_id: string;
+
+      client_secret: string;
+    }
+  }
+}
+
+export interface VaultProviderConfigUpdateParams {
+  /**
+   * Fields to update. Omitted credentials are left unchanged. A rejected update
+   * leaves existing credentials unchanged.
+   */
+  credentials?: VaultProviderConfigUpdateParams.Credentials;
+
+  /**
+   * Unique within the organization.
+   */
+  name?: string;
+}
+
+export namespace VaultProviderConfigUpdateParams {
+  /**
+   * Fields to update. Omitted credentials are left unchanged. A rejected update
+   * leaves existing credentials unchanged.
+   */
+  export interface Credentials {
+    client_secret?: string;
+  }
+}
+
+export interface VaultProviderConfigListParams extends OffsetPaginationParams {}
+
+export declare namespace VaultProviderConfigs {
+  export {
+    type VaultProviderConfig as VaultProviderConfig,
+    type VaultProviderConfigsOffsetPagination as VaultProviderConfigsOffsetPagination,
+    type VaultProviderConfigCreateParams as VaultProviderConfigCreateParams,
+    type VaultProviderConfigUpdateParams as VaultProviderConfigUpdateParams,
+    type VaultProviderConfigListParams as VaultProviderConfigListParams,
+  };
+}