From 05949995501dcbccffed74f80e60a0447e0ef105 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Sat, 5 Sep 2026 18:39:28 +0000
Subject: [PATCH 01/10] feat: Expose vault access in organization entitlements

Stainless-Generated-From: 6757a5098bb6f301f9675bd16893bf4e340fcad2
---
 src/resources/organization/entitlements.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/src/resources/organization/entitlements.ts b/src/resources/organization/entitlements.ts
index 1a5c70c..97f8bee 100644
--- a/src/resources/organization/entitlements.ts
+++ b/src/resources/organization/entitlements.ts
@@ -57,6 +57,12 @@ export namespace OrgEntitlements {
     profiles: Features.Profiles;
 
     proxy_bypass_hosts: Features.ProxyBypassHosts;
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    vaults: Features.Vaults;
   }
 
   export namespace Features {
@@ -176,6 +182,17 @@ export namespace OrgEntitlements {
        */
       enabled: boolean;
     }
+
+    /**
+     * Whether the organization can access vaults, using the same access check as vault
+     * API routes.
+     */
+    export interface Vaults {
+      /**
+       * Whether the organization is entitled to use this feature.
+       */
+      enabled: boolean;
+    }
   }
 
   export interface Limits {

From 5c17e2d9b5ecfbbb5c2a959c1ce1112d543fbdb1 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Sat, 5 Sep 2026 20:22:13 +0000
Subject: [PATCH 02/10] feat: Limit free organizations to three vaults

Stainless-Generated-From: c92a896c34a16833a715e578fbfbaa4f487bcc1c
---
 src/resources/organization/entitlements.ts |  6 ++++++
 src/resources/organization/limits.ts       | 13 ++++++++++++-
 src/resources/vaults/vaults.ts             |  4 +++-
 3 files changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/resources/organization/entitlements.ts b/src/resources/organization/entitlements.ts
index 97f8bee..3c29cf5 100644
--- a/src/resources/organization/entitlements.ts
+++ b/src/resources/organization/entitlements.ts
@@ -212,6 +212,12 @@ export namespace OrgEntitlements {
      * Effective organization-wide concurrent app invocation ceiling.
      */
     max_concurrent_invocations: number;
+
+    /**
+     * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+     * unlimited. The vaults feature flag still controls access.
+     */
+    max_vaults: number | null;
   }
 
   export interface Plan {
diff --git a/src/resources/organization/limits.ts b/src/resources/organization/limits.ts
index 15ca385..98ed542 100644
--- a/src/resources/organization/limits.ts
+++ b/src/resources/organization/limits.ts
@@ -9,7 +9,7 @@ import { RequestOptions } from '../../internal/request-options';
  */
 export class Limits extends APIResource {
   /**
-   * Get the organization's effective limits and managed auth usage.
+   * Get the organization's effective limits and managed auth and vault usage.
    */
   retrieve(options?: RequestOptions): APIPromise<OrgLimits> {
     return this._client.get('/org/limits', options);
@@ -39,6 +39,12 @@ export interface OrgLimits {
    */
   max_auth_connections: number | null;
 
+  /**
+   * Maximum non-deleted vaults allowed org-wide across all projects. Null means
+   * unlimited.
+   */
+  max_vaults: number | null;
+
   /**
    * Smallest health_check_interval the organization's plan accepts on a managed auth
    * connection. Requests below this are rejected with 400. Existing connections
@@ -46,6 +52,11 @@ export interface OrgLimits {
    */
   min_health_check_interval_seconds: number;
 
+  /**
+   * Current non-deleted vault count across all projects in the organization.
+   */
+  vaults_used: number;
+
   /**
    * Default maximum concurrent browsers applied to every project that has no
    * explicit per-project override. Null means no org-level default, so such projects
diff --git a/src/resources/vaults/vaults.ts b/src/resources/vaults/vaults.ts
index 3031f0b..8d0e7df 100644
--- a/src/resources/vaults/vaults.ts
+++ b/src/resources/vaults/vaults.ts
@@ -60,7 +60,9 @@ export class Vaults extends APIResource {
   }
 
   /**
-   * Create or retrieve a vault by immutable name
+   * Free organizations can store up to 3 non-deleted vaults across all projects.
+   * Paid plans and active trials have no vault cap. Retrieving an existing vault by
+   * name succeeds even at the limit.
    */
   upsert(body: VaultUpsertParams, options?: RequestOptions): APIPromise<Vault> {
     return this._client.post('/vaults', { body, ...options });

From 2468a0a74d674ccfce2f3f301a5ca904ac689372 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 17:01:06 +0000
Subject: [PATCH 03/10] feat: Add config analysis lifecycle guarantees

Stainless-Generated-From: 861f9fcdb398e046309e549e910ba49ce36e1f22
---
 src/resources/config-registry/config-registry.ts | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/src/resources/config-registry/config-registry.ts b/src/resources/config-registry/config-registry.ts
index 8ac23ee..c797f8e 100644
--- a/src/resources/config-registry/config-registry.ts
+++ b/src/resources/config-registry/config-registry.ts
@@ -85,8 +85,13 @@ export interface Analysis {
   created_at: string;
 
   /**
-   * Present for failed or canceled analyses. Messages contain safe retry guidance
-   * rather than internal workflow errors.
+   * Deadline after which a still-running analysis becomes expired.
+   */
+  expires_at: string;
+
+  /**
+   * Present for failed, canceled, or expired analyses. Messages contain safe retry
+   * guidance rather than internal workflow errors.
    */
   failure: Shared.ErrorModel | null;
 
@@ -98,7 +103,7 @@ export interface Analysis {
   /**
    * Lifecycle status of a background analysis.
    */
-  status: 'running' | 'completed' | 'failed' | 'canceled';
+  status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 }
 
 export interface AnalysisSummary {
@@ -438,7 +443,7 @@ export interface RecommendationSummary {
   /**
    * Lifecycle status of the most recently requested analysis for this exact target.
    */
-  analysis_status: 'running' | 'completed' | 'failed' | 'canceled';
+  analysis_status: 'running' | 'completed' | 'failed' | 'canceled' | 'expired';
 
   /**
    * Most recent time the selected project requested an analysis for this exact

From 833e5240c705ab73d9160f0cd9c6117e2fe726d3 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 23:54:18 +0000
Subject: [PATCH 04/10] feat: Support international ISP proxy countries

Stainless-Generated-From: 1c6366fcc1558d8b6ccbaf32bf698811ba950faa
---
 .../config-registry/config-registry.ts         |  3 ++-
 src/resources/proxies.ts                       | 18 ++++++++++++------
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/src/resources/config-registry/config-registry.ts b/src/resources/config-registry/config-registry.ts
index c797f8e..5d73d08 100644
--- a/src/resources/config-registry/config-registry.ts
+++ b/src/resources/config-registry/config-registry.ts
@@ -300,7 +300,8 @@ export namespace Proxy {
        */
       export interface IspProxyConfig {
         /**
-         * ISO 3166 country code. Defaults to US if not provided.
+         * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+         * to US if not provided.
          */
         country?: string;
       }
diff --git a/src/resources/proxies.ts b/src/resources/proxies.ts
index 9b1dfff..3c3d9be 100644
--- a/src/resources/proxies.ts
+++ b/src/resources/proxies.ts
@@ -183,7 +183,8 @@ export namespace ProxyCreateResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -344,7 +345,8 @@ export namespace ProxyRetrieveResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -505,7 +507,8 @@ export namespace ProxyUpdateResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -666,7 +669,8 @@ export namespace ProxyListResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -827,7 +831,8 @@ export namespace ProxyCheckResponse {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }
@@ -968,7 +973,8 @@ export namespace ProxyCreateParams {
    */
   export interface IspProxyConfig {
     /**
-     * ISO 3166 country code. Defaults to US if not provided.
+     * ISO 3166 country code. Supported countries are US, GB, FR, DE, and SG. Defaults
+     * to US if not provided.
      */
     country?: string;
   }

From 43f283c8aecfc74b8daa9145cc0b8fe7a65d7a47 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 18:08:51 +0000
Subject: [PATCH 05/10] feat: Clarify proxy country defaults

Stainless-Generated-From: 4410e1f2078cf23f5aff88889b2f9ef93903b029
---
 .../config-registry/config-registry.ts        |  6 ++--
 src/resources/proxies.ts                      | 36 ++++++++++++-------
 2 files changed, 28 insertions(+), 14 deletions(-)

diff --git a/src/resources/config-registry/config-registry.ts b/src/resources/config-registry/config-registry.ts
index 5d73d08..67f94a0 100644
--- a/src/resources/config-registry/config-registry.ts
+++ b/src/resources/config-registry/config-registry.ts
@@ -322,7 +322,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code.
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
@@ -352,7 +353,8 @@ export namespace Proxy {
         city?: string;
 
         /**
-         * ISO 3166 country code
+         * ISO 3166 country code. If omitted, the proxy uses the global pool without
+         * country targeting.
          */
         country?: string;
 
diff --git a/src/resources/proxies.ts b/src/resources/proxies.ts
index 3c3d9be..f366374 100644
--- a/src/resources/proxies.ts
+++ b/src/resources/proxies.ts
@@ -205,7 +205,8 @@ export namespace ProxyCreateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -235,7 +236,8 @@ export namespace ProxyCreateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -367,7 +369,8 @@ export namespace ProxyRetrieveResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -397,7 +400,8 @@ export namespace ProxyRetrieveResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -529,7 +533,8 @@ export namespace ProxyUpdateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -559,7 +564,8 @@ export namespace ProxyUpdateResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -691,7 +697,8 @@ export namespace ProxyListResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -721,7 +728,8 @@ export namespace ProxyListResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -853,7 +861,8 @@ export namespace ProxyCheckResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -883,7 +892,8 @@ export namespace ProxyCheckResponse {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -995,7 +1005,8 @@ export namespace ProxyCreateParams {
     city?: string;
 
     /**
-     * ISO 3166 country code.
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 
@@ -1025,7 +1036,8 @@ export namespace ProxyCreateParams {
     city?: string;
 
     /**
-     * ISO 3166 country code
+     * ISO 3166 country code. If omitted, the proxy uses the global pool without
+     * country targeting.
      */
     country?: string;
 

From e86903d4934f27a5a332e151b5170a9c654e26c5 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 18:24:09 +0000
Subject: [PATCH 06/10] feat: Populate safe failure reasons on invocation
 responses

Stainless-Generated-From: c59f5dd0fdc9c43b55289cf25434265cf93cd117
---
 src/resources/invocations.ts | 59 +++++++++++++++++++++++++++---------
 1 file changed, 44 insertions(+), 15 deletions(-)

diff --git a/src/resources/invocations.ts b/src/resources/invocations.ts
index 0ba6cd8..300caac 100644
--- a/src/resources/invocations.ts
+++ b/src/resources/invocations.ts
@@ -197,8 +197,8 @@ export namespace InvocationStateEvent {
     finished_at?: string | null;
 
     /**
-     * Output produced by the action, rendered as a JSON string. This could be: string,
-     * number, boolean, array, object, or null.
+     * The action result or detailed failure output. Often a JSON-encoded value, but
+     * failures may contain plain text. May contain sensitive application data.
      */
     output?: string;
 
@@ -208,7 +208,13 @@ export namespace InvocationStateEvent {
     payload?: string;
 
     /**
-     * Status reason
+     * A nonempty, customer-safe summary of the recorded failure output, always present
+     * when status is failed and omitted otherwise, including in the first failed
+     * invocation_state event. Recognized messages receive a specific summary; other
+     * failures receive a generic summary. Message matching does not establish whether
+     * the failure originated in the platform or action code. Does not include raw
+     * action output or internal error details. Available for historical invocations as
+     * well. Human-readable text, not a stable identifier for retry logic.
      */
     status_reason?: string;
   }
@@ -231,13 +237,18 @@ export interface InvocationCreateResponse {
   status: 'queued' | 'running' | 'succeeded' | 'failed';
 
   /**
-   * The return value of the action that was invoked, rendered as a JSON string. This
-   * could be: string, number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise. Recognized messages receive a
+   * specific summary; other failures receive a generic summary. Message matching
+   * does not establish whether the failure originated in the platform or action
+   * code. Does not include raw action output or internal error details.
+   * Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -280,8 +291,8 @@ export interface InvocationRetrieveResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -291,7 +302,13 @@ export interface InvocationRetrieveResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -334,8 +351,8 @@ export interface InvocationUpdateResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -345,7 +362,13 @@ export interface InvocationUpdateResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }
@@ -388,8 +411,8 @@ export interface InvocationListResponse {
   finished_at?: string | null;
 
   /**
-   * Output produced by the action, rendered as a JSON string. This could be: string,
-   * number, boolean, array, object, or null.
+   * The action result or detailed failure output. Often a JSON-encoded value, but
+   * failures may contain plain text. May contain sensitive application data.
    */
   output?: string;
 
@@ -399,7 +422,13 @@ export interface InvocationListResponse {
   payload?: string;
 
   /**
-   * Status reason
+   * A nonempty, customer-safe summary of the recorded failure output, always present
+   * when status is failed and omitted otherwise, including in the first failed
+   * invocation_state event. Recognized messages receive a specific summary; other
+   * failures receive a generic summary. Message matching does not establish whether
+   * the failure originated in the platform or action code. Does not include raw
+   * action output or internal error details. Available for historical invocations as
+   * well. Human-readable text, not a stable identifier for retry logic.
    */
   status_reason?: string;
 }

From 1f63d031eb68f79ea268200c035a07c4623004db Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 19:52:09 +0000
Subject: [PATCH 07/10] feat: Brand origin TLS timeouts and classify provider
 failures

Stainless-Generated-From: 1f05f45588aaa826f1a64b16b257c5189ddfc44b
---
 src/resources/browsers/telemetry.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/resources/browsers/telemetry.ts b/src/resources/browsers/telemetry.ts
index bd08cde..be14c18 100644
--- a/src/resources/browsers/telemetry.ts
+++ b/src/resources/browsers/telemetry.ts
@@ -4338,13 +4338,16 @@ export namespace BrowserProxyErrorEvent {
      * Proxy-layer error code: the X-Kernel-Proxy-Error response header value from a
      * branded 5xx error page served by the metro egress host-proxy. Values mirror what
      * the proxy emits: destination_blocked, provider_blacklisted,
-     * provider_unreachable, proxy_unavailable, upstream_timeout, upstream_dns_failure,
-     * upstream_connect_failed. Unknown header values are dropped.
+     * provider_unreachable, provider_rejected, origin_tls_timeout, proxy_unavailable,
+     * upstream_timeout, upstream_dns_failure, upstream_connect_failed. Unknown header
+     * values are dropped.
      */
     code:
       | 'destination_blocked'
       | 'provider_blacklisted'
       | 'provider_unreachable'
+      | 'provider_rejected'
+      | 'origin_tls_timeout'
       | 'proxy_unavailable'
       | 'upstream_timeout'
       | 'upstream_dns_failure'

From 548c574ecd913aff68b3342012f4478316faf040 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 20:18:31 +0000
Subject: [PATCH 08/10] feat: Return vendor guidance with config registry
 recommendations

Stainless-Generated-From: 371b9a5e494f1dab24014e90da9fa0565094c45c
---
 src/resources/config-registry/config-registry.ts | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/src/resources/config-registry/config-registry.ts b/src/resources/config-registry/config-registry.ts
index 67f94a0..6a4d917 100644
--- a/src/resources/config-registry/config-registry.ts
+++ b/src/resources/config-registry/config-registry.ts
@@ -152,6 +152,14 @@ export interface ConfigRegistryResponse {
   recommendation: RecommendationResult | null;
 
   target: Target;
+
+  /**
+   * Short advisory markdown to facilitate navigating this target. Returned even when
+   * no configuration reached the target, since knowing what prevented success is
+   * useful without a configuration. Not verified against this target. Null when
+   * nothing applicable was observed or no notes exist.
+   */
+  guidance?: string | null;
 }
 
 export interface Evidence {
@@ -204,6 +212,14 @@ export interface LookupResponse {
   recommendation: Recommendation | null;
 
   target: Target;
+
+  /**
+   * Short advisory markdown to facilitate navigating this target. Returned even when
+   * no configuration reached the target, since knowing what prevented success is
+   * useful without a configuration. Not verified against this target. Null when
+   * nothing applicable was observed or no notes exist.
+   */
+  guidance?: string | null;
 }
 
 export interface NoRecommendation {

From 6dbf3c0943160861cc7410f4958c885cff2c4077 Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 21:31:08 +0000
Subject: [PATCH 09/10] feat: Revert vendor guidance recommendations

Stainless-Generated-From: 902e1c8e4967c9dc4f094fec13d1710b9ff8b73b
---
 src/resources/config-registry/config-registry.ts | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/src/resources/config-registry/config-registry.ts b/src/resources/config-registry/config-registry.ts
index 6a4d917..67f94a0 100644
--- a/src/resources/config-registry/config-registry.ts
+++ b/src/resources/config-registry/config-registry.ts
@@ -152,14 +152,6 @@ export interface ConfigRegistryResponse {
   recommendation: RecommendationResult | null;
 
   target: Target;
-
-  /**
-   * Short advisory markdown to facilitate navigating this target. Returned even when
-   * no configuration reached the target, since knowing what prevented success is
-   * useful without a configuration. Not verified against this target. Null when
-   * nothing applicable was observed or no notes exist.
-   */
-  guidance?: string | null;
 }
 
 export interface Evidence {
@@ -212,14 +204,6 @@ export interface LookupResponse {
   recommendation: Recommendation | null;
 
   target: Target;
-
-  /**
-   * Short advisory markdown to facilitate navigating this target. Returned even when
-   * no configuration reached the target, since knowing what prevented success is
-   * useful without a configuration. Not verified against this target. Null when
-   * nothing applicable was observed or no notes exist.
-   */
-  guidance?: string | null;
 }
 
 export interface NoRecommendation {

From 80d21400f04f115ce106894f46e9db754195d60b Mon Sep 17 00:00:00 2001
From: "kernel-internal[bot]"
 <260533166+kernel-internal[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 21:35:36 +0000
Subject: [PATCH 10/10] release: 0.101.0

---
 .release-please-manifest.json |  2 +-
 CHANGELOG.md                  | 15 +++++++++++++++
 package.json                  |  2 +-
 src/version.ts                |  2 +-
 4 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index d3f5c73..31cc64e 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.100.0"
+  ".": "0.101.0"
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18f83bc..a80dda9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,20 @@
 # Changelog
 
+## [0.101.0](https://github.com/kernel/kernel-node-sdk/compare/v0.100.0...v0.101.0) (2026-09-10)
+
+
+### Features
+
+* Add config analysis lifecycle guarantees ([2468a0a](https://github.com/kernel/kernel-node-sdk/commit/2468a0a74d674ccfce2f3f301a5ca904ac689372))
+* Brand origin TLS timeouts and classify provider failures ([1f63d03](https://github.com/kernel/kernel-node-sdk/commit/1f63d031eb68f79ea268200c035a07c4623004db))
+* Clarify proxy country defaults ([43f283c](https://github.com/kernel/kernel-node-sdk/commit/43f283c8aecfc74b8daa9145cc0b8fe7a65d7a47))
+* Expose vault access in organization entitlements ([0594999](https://github.com/kernel/kernel-node-sdk/commit/05949995501dcbccffed74f80e60a0447e0ef105))
+* Limit free organizations to three vaults ([5c17e2d](https://github.com/kernel/kernel-node-sdk/commit/5c17e2d9b5ecfbbb5c2a959c1ce1112d543fbdb1))
+* Populate safe failure reasons on invocation responses ([e86903d](https://github.com/kernel/kernel-node-sdk/commit/e86903d4934f27a5a332e151b5170a9c654e26c5))
+* Return vendor guidance with config registry recommendations ([548c574](https://github.com/kernel/kernel-node-sdk/commit/548c574ecd913aff68b3342012f4478316faf040))
+* Revert vendor guidance recommendations ([6dbf3c0](https://github.com/kernel/kernel-node-sdk/commit/6dbf3c0943160861cc7410f4958c885cff2c4077))
+* Support international ISP proxy countries ([833e524](https://github.com/kernel/kernel-node-sdk/commit/833e5240c705ab73d9160f0cd9c6117e2fe726d3))
+
 ## [0.100.0](https://github.com/kernel/kernel-node-sdk/compare/v0.99.0...v0.100.0) (2026-09-04)
 
 
diff --git a/package.json b/package.json
index a27ea1a..63ca6b1 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@onkernel/sdk",
-  "version": "0.100.0",
+  "version": "0.101.0",
   "description": "The official TypeScript library for the Kernel API",
   "author": "Kernel <>",
   "types": "dist/index.d.ts",
diff --git a/src/version.ts b/src/version.ts
index 60f4455..bdc4cd8 100644
--- a/src/version.ts
+++ b/src/version.ts
@@ -1 +1 @@
-export const VERSION = '0.100.0'; // x-release-please-version
+export const VERSION = '0.101.0'; // x-release-please-version