release: 0.101.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.100.0"
+  ".": "0.101.0"
 }

.stats.yml

@@ -1 +1 @@
-configured_endpoints: 158
+configured_endpoints: 163

CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## [0.101.0](https://github.com/kernel/kernel-node-sdk/compare/v0.100.0...v0.101.0) (2026-09-11)
+
+
+### Features
+
+* Add config analysis lifecycle guarantees ([2468a0a](https://github.com/kernel/kernel-node-sdk/commit/2468a0a74d674ccfce2f3f301a5ca904ac689372))
+* Brand origin TLS timeouts and classify provider failures ([1f63d03](https://github.com/kernel/kernel-node-sdk/commit/1f63d031eb68f79ea268200c035a07c4623004db))
+* Clarify proxy country defaults ([43f283c](https://github.com/kernel/kernel-node-sdk/commit/43f283c8aecfc74b8daa9145cc0b8fe7a65d7a47))
+* Expose vault access in organization entitlements ([0594999](https://github.com/kernel/kernel-node-sdk/commit/05949995501dcbccffed74f80e60a0447e0ef105))
+* Integrate configurable vault providers across API and checkout ([406359a](https://github.com/kernel/kernel-node-sdk/commit/406359ab2f748f848631a9595af2bb6eddd9cd51))
+* Limit free organizations to three vaults ([5c17e2d](https://github.com/kernel/kernel-node-sdk/commit/5c17e2d9b5ecfbbb5c2a959c1ce1112d543fbdb1))
+* Populate safe failure reasons on invocation responses ([e86903d](https://github.com/kernel/kernel-node-sdk/commit/e86903d4934f27a5a332e151b5170a9c654e26c5))
+* Return vendor guidance with config registry recommendations ([548c574](https://github.com/kernel/kernel-node-sdk/commit/548c574ecd913aff68b3342012f4478316faf040))
+* Revert vendor guidance recommendations ([6dbf3c0](https://github.com/kernel/kernel-node-sdk/commit/6dbf3c0943160861cc7410f4958c885cff2c4077))
+* Support international ISP proxy countries ([833e524](https://github.com/kernel/kernel-node-sdk/commit/833e5240c705ab73d9160f0cd9c6117e2fe726d3))
+
 ## [0.100.0](https://github.com/kernel/kernel-node-sdk/compare/v0.99.0...v0.100.0) (2026-09-04)
 
 

api.md

@@ -433,6 +433,20 @@ Methods:
 - <code title="post /browser_pools/{id_or_name}/flush">client.browserPools.<a href="./src/resources/browser-pools.ts">flush</a>(idOrName) -> void</code>
 - <code title="post /browser_pools/{id_or_name}/release">client.browserPools.<a href="./src/resources/browser-pools.ts">release</a>(idOrName, { ...params }) -> void</code>
 
+# VaultProviderConfigs
+
+Types:
+
+- <code><a href="./src/resources/vault-provider-configs.ts">VaultProviderConfig</a></code>
+
+Methods:
+
+- <code title="post /vault-provider-configs">client.vaultProviderConfigs.<a href="./src/resources/vault-provider-configs.ts">create</a>({ ...params }) -> VaultProviderConfig</code>
+- <code title="get /vault-provider-configs/{id_or_name}">client.vaultProviderConfigs.<a href="./src/resources/vault-provider-configs.ts">retrieve</a>(idOrName) -> VaultProviderConfig</code>
+- <code title="patch /vault-provider-configs/{id_or_name}">client.vaultProviderConfigs.<a href="./src/resources/vault-provider-configs.ts">update</a>(idOrName, { ...params }) -> VaultProviderConfig</code>
+- <code title="get /vault-provider-configs">client.vaultProviderConfigs.<a href="./src/resources/vault-provider-configs.ts">list</a>({ ...params }) -> VaultProviderConfigsOffsetPagination</code>
+- <code title="delete /vault-provider-configs/{id_or_name}">client.vaultProviderConfigs.<a href="./src/resources/vault-provider-configs.ts">delete</a>(idOrName) -> void</code>
+
 # Vaults
 
 Types:

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.100.0",
+  "version": "0.101.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",

src/client.ts

@@ -136,6 +136,14 @@ import {
   ProxyUpdateParams,
   ProxyUpdateResponse,
 } from './resources/proxies';
+import {
+  VaultProviderConfig,
+  VaultProviderConfigCreateParams,
+  VaultProviderConfigListParams,
+  VaultProviderConfigUpdateParams,
+  VaultProviderConfigs,
+  VaultProviderConfigsOffsetPagination,
+} from './resources/vault-provider-configs';
 import {
   AuditLogEntriesPageTokenPagination,
   AuditLogEntry,
@@ -1067,6 +1075,7 @@ export class Kernel {
    * Create and manage browser pools for acquiring and releasing browsers.
    */
   browserPools: API.BrowserPools = new API.BrowserPools(this);
+  vaultProviderConfigs: API.VaultProviderConfigs = new API.VaultProviderConfigs(this);
   vaults: API.Vaults = new API.Vaults(this);
   /**
    * Create and manage credentials for authentication.
@@ -1105,6 +1114,7 @@ Kernel.Telemetry = Telemetry;
 Kernel.Proxies = Proxies;
 Kernel.Extensions = Extensions;
 Kernel.BrowserPools = BrowserPools;
+Kernel.VaultProviderConfigs = VaultProviderConfigs;
 Kernel.Vaults = Vaults;
 Kernel.Credentials = Credentials;
 Kernel.Projects = Projects;
@@ -1263,6 +1273,15 @@ export declare namespace Kernel {
     type BrowserPoolReleaseParams as BrowserPoolReleaseParams,
   };
 
+  export {
+    VaultProviderConfigs as VaultProviderConfigs,
+    type VaultProviderConfig as VaultProviderConfig,
+    type VaultProviderConfigsOffsetPagination as VaultProviderConfigsOffsetPagination,
+    type VaultProviderConfigCreateParams as VaultProviderConfigCreateParams,
+    type VaultProviderConfigUpdateParams as VaultProviderConfigUpdateParams,
+    type VaultProviderConfigListParams as VaultProviderConfigListParams,
+  };
+
   export {
     Vaults as Vaults,
     type Vault as Vault,

src/resources/browsers/telemetry.ts

@@ -4338,13 +4338,16 @@ export namespace BrowserProxyErrorEvent {
      * Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
      * branded 5xx error page served by the metro egress host-proxy. Values mirror what
      * the proxy emits: destination_blocked, provider_blacklisted,
-     * provider_unreachable, proxy_unavailable, upstream_timeout, upstream_dns_failure,
-     * upstream_connect_failed. Unknown header values are dropped.
+     * provider_unreachable, provider_rejected, origin_tls_timeout, proxy_unavailable,
+     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. Unknown header
+     * values are dropped.
      */
     code:
       | 'destination_blocked'
       | 'provider_blacklisted'
       | 'provider_unreachable'
+      | 'provider_rejected'
+      | 'origin_tls_timeout'
       | 'proxy_unavailable'
       | 'upstream_timeout'
       | 'upstream_dns_failure'

src/resources/config-registry/config-registry.ts

@@ -85,8 +85,13 @@ export interface Analysis {
   created_at: string;
 
   /**
-   * Present for failed or canceled analyses. Messages contain safe retry guidance
-   * rather than internal workflow errors.
+   * Deadline after which a still-running analysis becomes expired.
+   */
+  expires_at: string;
+
+  /**
+   * Present for failed, canceled, or expired analyses. Messages contain safe retry
+   * guidance rather than internal workflow errors.
    */
   failure: Shared.ErrorModel | null;
 
@@ -98,7 +103,7 @@ export interface Analysis {
   /**
    * Lifecycle status of a background analysis.
    */
-  status: 'running' | 'completed' | 'failed' | 'canceled';
+  status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 }
 
 export interface AnalysisSummary {
@@ -295,7 +300,8 @@ export namespace Proxy {
        */
       export interface IspProxyConfig {
         /**
-         * ISO 3166 country code. Defaults to US if not provided.
+         * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+         * to US if not provided.
          */
         country?: string;
       }
@@ -316,7 +322,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code.
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
@@ -346,7 +353,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
@@ -438,7 +446,7 @@ export interface RecommendationSummary {
   /**
    * Lifecycle status of the most recently requested analysis for this exact target.
    */
-  analysis_status: 'running' | 'completed' | 'failed' | 'canceled';
+  analysis_status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 
   /**
    * Most recent time the selected project requested an analysis for this exact

src/resources/index.ts

@@ -180,6 +180,14 @@ export {
   type ProxyListResponsesOffsetPagination,
 } from './proxies';
 export { Telemetry } from './telemetry/telemetry';
+export {
+  VaultProviderConfigs,
+  type VaultProviderConfig,
+  type VaultProviderConfigCreateParams,
+  type VaultProviderConfigUpdateParams,
+  type VaultProviderConfigListParams,
+  type VaultProviderConfigsOffsetPagination,
+} from './vault-provider-configs';
 export {
   Vaults,
   type Vault,

src/resources/invocations.ts

@@ -197,8 +197,8 @@ export namespace InvocationStateEvent {
     finished_at?: string | null;
 
     /**
-     * Output produced by the action, rendered as a JSON string. This could be: string,
-     * number, boolean, array, object, or null.
+     * The action result or detailed failure output. Often a JSON-encoded value, but
+     * failures may contain plain text. May contain sensitive application data.
      */
     output?: string;
 
@@ -208,7 +208,13 @@ export namespace InvocationStateEvent {
     payload?: string;
 
     /**
-     * Status reason
+     * A nonempty, customer-safe summary of the recorded failure output, always present
+     * when status is failed and omitted otherwise, including in the first failed
+     * invocation_state event. Recognized messages receive a specific summary; other
+     * failures receive a generic summary. Message matching does not establish whether
+     * the failure originated in the platform or action code. Does not include raw
+     * action output or internal error details. Available for historical invocations as
+     * well. Human-readable text, not a stable identifier for retry logic.
      */
     status_reason?: string;
   }
@@ -231,13 +237,18 @@ export interface InvocationCreateResponse {
   status: 'queued' | 'running' | 'succeeded' | 'failed';
 
   /**
-   * The return value of the action that was invoked, rendered as a JSON string. This
-   * could be: string, number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise. Recognized messages receive a
+   * specific summary; other failures receive a generic summary. Message matching
+   * does not establish whether the failure originated in the platform or action
+   * code. Does not include raw action output or internal error details.
+   * Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -280,8 +291,8 @@ export interface InvocationRetrieveResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -291,7 +302,13 @@ export interface InvocationRetrieveResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -334,8 +351,8 @@ export interface InvocationUpdateResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -345,7 +362,13 @@ export interface InvocationUpdateResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -388,8 +411,8 @@ export interface InvocationListResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -399,7 +422,13 @@ export interface InvocationListResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }

src/resources/organization/entitlements.ts

@@ -57,6 +57,12 @@ export namespace OrgEntitlements {
     profiles: Features.Profiles;
 
     proxy_bypass_hosts: Features.ProxyBypassHosts;
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    vaults: Features.Vaults;
   }
 
   export namespace Features {
@@ -176,6 +182,17 @@ export namespace OrgEntitlements {
        */
       enabled: boolean;
     }
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    export interface Vaults {
+      /**
+       * Whether the organization is entitled to use this feature.
+       */
+      enabled: boolean;
+    }
   }
 
   export interface Limits {
@@ -195,6 +212,12 @@ export namespace OrgEntitlements {
      * Effective organization-wide concurrent app invocation ceiling.
      */
     max_concurrent_invocations: number;
+
+    /**
+     * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+     * unlimited. The vaults feature flag still controls access.
+     */
+    max_vaults: number | null;
   }
 
   export interface Plan {