release: 0.101.0

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "0.100.0"
+  ".": "0.101.0"
 }

CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.101.0](https://github.com/kernel/kernel-python-sdk/compare/v0.100.0...v0.101.0) (2026-09-05)
+
+
+### Features
+
+* Expose vault access in organization entitlements ([1c3b388](https://github.com/kernel/kernel-python-sdk/commit/1c3b388f1a4597f65ed3926a8ec2646f5e0fc994))
+* Limit free organizations to three vaults ([b0d5628](https://github.com/kernel/kernel-python-sdk/commit/b0d5628acbe0a9d9d006a3349ba1338fdc3d4402))
+
 ## [0.100.0](https://github.com/kernel/kernel-python-sdk/compare/v0.99.0...v0.100.0) (2026-09-04)
 
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kernel"
-version = "0.100.0"
+version = "0.101.0"
 description = "The official Python library for the kernel API"
 dynamic = ["readme"]
 license = "Apache-2.0"

src/kernel/_version.py

@@ -1,4 +1,4 @@
 # File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
 
 __title__ = "kernel"
-__version__ = "0.100.0"  # x-release-please-version
+__version__ = "0.101.0"  # x-release-please-version

src/kernel/resources/organization/limits.py

@@ -55,7 +55,7 @@ def retrieve(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> OrgLimits:
-        """Get the organization's effective limits and managed auth usage."""
+        """Get the organization's effective limits and managed auth and vault usage."""
         return self._get(
             "/org/limits",
             options=make_request_options(
@@ -138,7 +138,7 @@ async def retrieve(
         extra_body: Body | None = None,
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> OrgLimits:
-        """Get the organization's effective limits and managed auth usage."""
+        """Get the organization's effective limits and managed auth and vault usage."""
         return await self._get(
             "/org/limits",
             options=make_request_options(

src/kernel/resources/vaults/vaults.py

@@ -176,7 +176,9 @@ def upsert(
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> Vault:
         """
-        Create or retrieve a vault by immutable name
+        Free organizations can store up to 3 non-deleted vaults across all projects.
+        Paid plans and active trials have no vault cap. Retrieving an existing vault by
+        name succeeds even at the limit.
 
         Args:
           name: Immutable name used to create or retrieve the vault.
@@ -345,7 +347,9 @@ async def upsert(
         timeout: float | httpx.Timeout | None | NotGiven = not_given,
     ) -> Vault:
         """
-        Create or retrieve a vault by immutable name
+        Free organizations can store up to 3 non-deleted vaults across all projects.
+        Paid plans and active trials have no vault cap. Retrieving an existing vault by
+        name succeeds even at the limit.
 
         Args:
           name: Immutable name used to create or retrieve the vault.

src/kernel/types/organization/org_entitlements.py

@@ -21,6 +21,7 @@
     "FeaturesManagedProxies",
     "FeaturesProfiles",
     "FeaturesProxyBypassHosts",
+    "FeaturesVaults",
     "Limits",
     "Plan",
 ]
@@ -114,6 +115,15 @@ class FeaturesProxyBypassHosts(BaseModel):
     """Whether the organization is entitled to use this feature."""
 
 
+class FeaturesVaults(BaseModel):
+    """
+    Whether the organization can access vaults, using the same access check as vault API routes.
+    """
+
+    enabled: bool
+    """Whether the organization is entitled to use this feature."""
+
+
 class Features(BaseModel):
     browser_extensions: FeaturesBrowserExtensions
 
@@ -139,6 +149,12 @@ class Features(BaseModel):
 
     proxy_bypass_hosts: FeaturesProxyBypassHosts
 
+    vaults: FeaturesVaults
+    """
+    Whether the organization can access vaults, using the same access check as vault
+    API routes.
+    """
+
 
 class Limits(BaseModel):
     default_max_concurrent_invocations_per_app: int
@@ -156,6 +172,12 @@ class Limits(BaseModel):
     max_concurrent_invocations: int
     """Effective organization-wide concurrent app invocation ceiling."""
 
+    max_vaults: Optional[int] = None
+    """Maximum non-deleted vaults allowed org-wide across all projects.
+
+    Null means unlimited. The vaults feature flag still controls access.
+    """
+
 
 class Plan(BaseModel):
     id: Literal["FREE", "HOBBYIST", "START_UP", "ENTERPRISE"]

src/kernel/types/organization/org_limits.py

@@ -22,13 +22,22 @@ class OrgLimits(BaseModel):
     projects.
     """
 
+    max_vaults: Optional[int] = None
+    """Maximum non-deleted vaults allowed org-wide across all projects.
+
+    Null means unlimited.
+    """
+
     min_health_check_interval_seconds: int
     """
     Smallest health_check_interval the organization's plan accepts on a managed auth
     connection. Requests below this are rejected with 400. Existing connections
     stored below the floor are grandfathered until edited.
     """
 
+    vaults_used: int
+    """Current non-deleted vault count across all projects in the organization."""
+
     default_project_max_concurrent_sessions: Optional[int] = None
     """
     Default maximum concurrent browsers applied to every project that has no