feat: Limit free organizations to three vaults

Stainless-Generated-From: ba7e1af409ddd0c708f01417cc714eb89c3739f0

Author: kernel-internal[bot]

src/kernel/resources/organization/limits.py

@@ -55,7 +55,7 @@ def retrieve(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> OrgLimits:
-        """Get the organization's effective limits and managed auth usage."""
+        """Get the organization's effective limits and managed auth and vault usage."""
         return self._get(
             "/org/limits",
             options=make_request_options(
@@ -138,7 +138,7 @@ async def retrieve(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> OrgLimits:
-        """Get the organization's effective limits and managed auth usage."""
+        """Get the organization's effective limits and managed auth and vault usage."""
         return await self._get(
             "/org/limits",
             options=make_request_options(

src/kernel/resources/vaults/vaults.py

@@ -176,7 +176,9 @@ def upsert(
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> Vault:
         """
-        Create or retrieve a vault by immutable name
+        Free organizations can store up to 3 non-deleted vaults across all projects.
+        Paid plans and active trials have no vault cap. Retrieving an existing vault by
+        name succeeds even at the limit.
 
         Args:
           name: Immutable name used to create or retrieve the vault.
@@ -345,7 +347,9 @@ async def upsert(
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> Vault:
         """
-        Create or retrieve a vault by immutable name
+        Free organizations can store up to 3 non-deleted vaults across all projects.
+        Paid plans and active trials have no vault cap. Retrieving an existing vault by
+        name succeeds even at the limit.
 
         Args:
           name: Immutable name used to create or retrieve the vault.

src/kernel/types/organization/org_entitlements.py

@@ -172,6 +172,12 @@ class Limits(BaseModel):
     max_concurrent_invocations: int
     """Effective organization-wide concurrent app invocation ceiling."""
 
+    max_vaults: Optional[int] = None
+    """Maximum non-deleted vaults allowed org-wide across all projects.
+
+    Null means unlimited. The vaults feature flag still controls access.
+    """
+
 
 class Plan(BaseModel):
     id: Literal["FREE", "HOBBYIST", "START_UP", "ENTERPRISE"]

src/kernel/types/organization/org_limits.py

@@ -22,13 +22,22 @@ class OrgLimits(BaseModel):
     projects.
     """
 
+    max_vaults: Optional[int] = None
+    """Maximum non-deleted vaults allowed org-wide across all projects.
+
+    Null means unlimited.
+    """
+
     min_health_check_interval_seconds: int
     """
     Smallest health_check_interval the organization's plan accepts on a managed auth
     connection. Requests below this are rejected with 400. Existing connections
     stored below the floor are grandfathered until edited.
     """
 
+    vaults_used: int
+    """Current non-deleted vault count across all projects in the organization."""
+
     default_project_max_concurrent_sessions: Optional[int] = None
     """
     Default maximum concurrent browsers applied to every project that has no