feat: Add passkey credential fields and PATCH field add/remove

Stainless-Generated-From: 8a555252c3a00ef277f917b1e70b8f3026866e77

Author: kernel-internal[bot]

api.md

@@ -576,6 +576,7 @@ from kernel.types.vaults import (
     CredentialAccountVaultItemRequest,
     CredentialCollectionAction,
     CredentialVaultFieldDefinition,
+    CredentialVaultFieldDefinitionInput,
     CredentialVaultFieldInput,
     CredentialVaultFieldState,
     CredentialVaultFieldType,

src/kernel/types/vaults/__init__.py

@@ -92,6 +92,9 @@
 from .authorize_vault_item_operation_request_param import (
     AuthorizeVaultItemOperationRequestParam as AuthorizeVaultItemOperationRequestParam,
 )
+from .credential_vault_field_definition_input_param import (
+    CredentialVaultFieldDefinitionInputParam as CredentialVaultFieldDefinitionInputParam,
+)
 from .kernel_credential_vault_item_spec_input_param import (
     KernelCredentialVaultItemSpecInputParam as KernelCredentialVaultItemSpecInputParam,
 )

src/kernel/types/vaults/collect_vault_item_operation_request_param.py

@@ -12,7 +12,7 @@ class CollectVaultItemOperationRequestParam(TypedDict, total=False):
 
     Supported for ready
     and pending_collection credential items. Always render the same form from
-    every form-supported field; totp fields have no form input and are omitted.
+    every form-supported field; totp and passkey fields have no form input and are omitted.
     No caller-selected field subsets or form overrides are accepted.
     Reuse an active Kernel-hosted session or renew an expired session atomically.
     Customer-hosted forms use their own backend and ordinary item GET/PATCH. Opening

src/kernel/types/vaults/credential_collection_action.py

@@ -11,14 +11,14 @@
 class CredentialCollectionAction(BaseModel):
     """
     One schema-derived form for the item, available in ready or pending_collection
-    state. Render every form-supported field as editable; omit totp fields and
-    preserve their stored seeds. Prefill non-sensitive values,
+    state. Render every form-supported field as editable; omit totp and passkey
+    fields and preserve their stored values. Prefill non-sensitive values,
     and allow existing sensitive values to be preserved or replaced without ever
     revealing them. No field subsets or per-request form configuration exist.
     Validate required fields against the resulting values, including preserved
     secrets. Submit changed values only, using the version used to render the form.
-    Scoped hosted submission rejects totp edits; seed writes require the ordinary
-    authenticated item API. Customer forms likewise omit totp from their payloads.
+    Scoped hosted submission rejects totp and passkey edits; those writes require the ordinary
+    authenticated item API. Customer forms likewise omit them from their payloads.
     Save edits atomically. A successful hosted submission increments the version,
     marks ready, and consumes the session; an empty edit may complete collection
     while preserving values. A customer form uses PATCH for changed values and

src/kernel/types/vaults/credential_vault_field_definition.py

@@ -25,14 +25,19 @@ class CredentialVaultFieldDefinition(BaseModel):
 
     type: CredentialVaultFieldType
     """
-    Text, email, and password have form inputs; totp does not and is omitted from
-    both Kernel-hosted and customer React forms. Password and totp must be
-    sensitive. A totp value is an RFC 4648 Base32 generator seed (case-insensitive,
-    optional trailing padding), not an otpauth URI or current code. Reject invalid
-    or empty decoded seeds. Browser fill generates an RFC 6238 code at execution
-    time using HMAC-SHA1, 6 digits, and a 30-second period. Preserve leading zeros;
-    never fill the seed. Custom algorithms, digits, periods, and form enrollment are
-    unsupported.
+    Text, email, and password have form inputs; totp and passkey do not and are
+    omitted from both Kernel-hosted and customer React forms. Password, totp, and
+    passkey must be sensitive. A totp value is an RFC 4648 Base32 generator seed
+    (case-insensitive, optional trailing padding), not an otpauth URI or current
+    code. Reject invalid or empty decoded seeds. Browser fill generates an RFC 6238
+    code at execution time using HMAC-SHA1, 6 digits, and a 30-second period.
+    Preserve leading zeros; never fill the seed. Custom algorithms, digits, periods,
+    and form enrollment are unsupported. A passkey value is a JSON-encoded FIDO
+    Credential Exchange Format passkey object with unpadded base64url
+    `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
+    private key), a lowercase `rpId` domain, and optional `username` and
+    `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
+    pages.
     """
 
     label: Optional[str] = None

src/kernel/types/vaults/credential_vault_field_definition_input_param.py

@@ -0,0 +1,55 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import Required, TypedDict
+
+from .credential_vault_field_type import CredentialVaultFieldType
+
+__all__ = ["CredentialVaultFieldDefinitionInputParam"]
+
+
+class CredentialVaultFieldDefinitionInputParam(TypedDict, total=False):
+    """A field definition without a value.
+
+    Field updates add fields with this shape and set their values in `fields`.
+    """
+
+    name: Required[str]
+    """Unique stable field name used to key values, updates, and browser fills."""
+
+    type: Required[CredentialVaultFieldType]
+    """
+    Text, email, and password have form inputs; totp and passkey do not and are
+    omitted from both Kernel-hosted and customer React forms. Password, totp, and
+    passkey must be sensitive. A totp value is an RFC 4648 Base32 generator seed
+    (case-insensitive, optional trailing padding), not an otpauth URI or current
+    code. Reject invalid or empty decoded seeds. Browser fill generates an RFC 6238
+    code at execution time using HMAC-SHA1, 6 digits, and a 30-second period.
+    Preserve leading zeros; never fill the seed. Custom algorithms, digits, periods,
+    and form enrollment are unsupported. A passkey value is a JSON-encoded FIDO
+    Credential Exchange Format passkey object with unpadded base64url
+    `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
+    private key), a lowercase `rpId` domain, and optional `username` and
+    `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
+    pages.
+    """
+
+    label: str
+    """Optional human-readable display label.
+
+    It is returned as non-secret metadata and never affects value keys, updates, or
+    browser fills. Use single-line, trimmed display text without control or
+    formatting characters. The server enforces a 128-byte UTF-8 limit.
+    """
+
+    required: bool
+
+    sensitive: bool
+    """
+    Set false explicitly for ordinary usernames, email addresses, and other
+    non-secret identifiers. Reserve true for secrets such as passwords, API tokens,
+    and TOTP seeds. Password, totp, and passkey fields must be true. Omission
+    defaults to true for safety; do not rely on that default for every field. False
+    permits API reads and form prefilling.
+    """

src/kernel/types/vaults/credential_vault_field_input_param.py

@@ -15,14 +15,19 @@ class CredentialVaultFieldInputParam(TypedDict, total=False):
 
     type: Required[CredentialVaultFieldType]
     """
-    Text, email, and password have form inputs; totp does not and is omitted from
-    both Kernel-hosted and customer React forms. Password and totp must be
-    sensitive. A totp value is an RFC 4648 Base32 generator seed (case-insensitive,
-    optional trailing padding), not an otpauth URI or current code. Reject invalid
-    or empty decoded seeds. Browser fill generates an RFC 6238 code at execution
-    time using HMAC-SHA1, 6 digits, and a 30-second period. Preserve leading zeros;
-    never fill the seed. Custom algorithms, digits, periods, and form enrollment are
-    unsupported.
+    Text, email, and password have form inputs; totp and passkey do not and are
+    omitted from both Kernel-hosted and customer React forms. Password, totp, and
+    passkey must be sensitive. A totp value is an RFC 4648 Base32 generator seed
+    (case-insensitive, optional trailing padding), not an otpauth URI or current
+    code. Reject invalid or empty decoded seeds. Browser fill generates an RFC 6238
+    code at execution time using HMAC-SHA1, 6 digits, and a 30-second period.
+    Preserve leading zeros; never fill the seed. Custom algorithms, digits, periods,
+    and form enrollment are unsupported. A passkey value is a JSON-encoded FIDO
+    Credential Exchange Format passkey object with unpadded base64url
+    `credentialId`, `userHandle` (at most 64 bytes), and `key` (a PKCS#8 ECDSA P-256
+    private key), a lowercase `rpId` domain, and optional `username` and
+    `userDisplayName`. Other CXF members are ignored. Passkeys are never filled into
+    pages.
     """
 
     encrypted_value: str
@@ -55,9 +60,9 @@ class CredentialVaultFieldInputParam(TypedDict, total=False):
     """
     Set false explicitly for ordinary usernames, email addresses, and other
     non-secret identifiers. Reserve true for secrets such as passwords, API tokens,
-    and TOTP seeds. Password and totp fields must be true. Omission defaults to true
-    for safety; do not rely on that default for every field. False permits API reads
-    and form prefilling.
+    and TOTP seeds. Password, totp, and passkey fields must be true. Omission
+    defaults to true for safety; do not rely on that default for every field. False
+    permits API reads and form prefilling.
     """
 
     value: str

src/kernel/types/vaults/credential_vault_field_type.py

@@ -4,4 +4,4 @@
 
 __all__ = ["CredentialVaultFieldType"]
 
-CredentialVaultFieldType: TypeAlias = Literal["text", "email", "password", "totp"]
+CredentialVaultFieldType: TypeAlias = Literal["text", "email", "password", "totp", "passkey"]

src/kernel/types/vaults/credential_vault_field_update_param.py

@@ -36,6 +36,7 @@ class CredentialVaultFieldUpdateParam(TypedDict, total=False):
     immediately clear the stored value. Clearing a required form-supported field
     reopens collection; clearing an optional field does not prevent readiness.
     Values must satisfy the declared field type. For totp, value is the generator
-    seed, never a current code. Clearing a required totp field returns 400 because
-    it cannot be collected in a form.
+    seed, never a current code. For passkey, value is the JSON-encoded CXF passkey
+    object. Clearing a required totp or passkey field returns 400 because it cannot
+    be collected in a form.
     """

src/kernel/types/vaults/credential_vault_item.py

@@ -116,28 +116,29 @@ class CredentialVaultItem(BaseModel):
     action: Optional[Action] = None
     """
     One schema-derived form for the item, available in ready or pending_collection
-    state. Render every form-supported field as editable; omit totp fields and
-    preserve their stored seeds. Prefill non-sensitive values, and allow existing
-    sensitive values to be preserved or replaced without ever revealing them. No
-    field subsets or per-request form configuration exist. Validate required fields
-    against the resulting values, including preserved secrets. Submit changed values
-    only, using the version used to render the form. Scoped hosted submission
-    rejects totp edits; seed writes require the ordinary authenticated item API.
-    Customer forms likewise omit totp from their payloads. Save edits atomically. A
-    successful hosted submission increments the version, marks ready, and consumes
-    the session; an empty edit may complete collection while preserving values. A
-    customer form uses PATCH for changed values and does not send an empty PATCH
-    when nothing changed. Kernel-hosted bearer sessions require no Kernel account
-    and are bound to the item version. Expired, superseded, consumed, or
-    deleted-item sessions cannot submit. Authenticated item GET renews expired
-    active sessions for ready or pending items; pending items always receive an
-    action. A ready item with no active session omits the action until collect is
-    invoked. Concurrent renewals return the same link. Renewal changes neither
-    values nor item version. An expired link cannot renew itself. The hosted form
-    handles its collection protocol; callers only open the returned URL and do not
-    extract or submit its token through the public API. For customer-hosted forms,
-    use @onkernel/vault-react and an authenticated customer backend calling the
-    ordinary item GET/PATCH API. Kernel does not store customer collection URLs or
-    authenticate the customer's end users. Treat URLs and submitted values as
-    secrets and exclude them from logs, traces, and errors.
+    state. Render every form-supported field as editable; omit totp and passkey
+    fields and preserve their stored values. Prefill non-sensitive values, and allow
+    existing sensitive values to be preserved or replaced without ever revealing
+    them. No field subsets or per-request form configuration exist. Validate
+    required fields against the resulting values, including preserved secrets.
+    Submit changed values only, using the version used to render the form. Scoped
+    hosted submission rejects totp and passkey edits; those writes require the
+    ordinary authenticated item API. Customer forms likewise omit them from their
+    payloads. Save edits atomically. A successful hosted submission increments the
+    version, marks ready, and consumes the session; an empty edit may complete
+    collection while preserving values. A customer form uses PATCH for changed
+    values and does not send an empty PATCH when nothing changed. Kernel-hosted
+    bearer sessions require no Kernel account and are bound to the item version.
+    Expired, superseded, consumed, or deleted-item sessions cannot submit.
+    Authenticated item GET renews expired active sessions for ready or pending
+    items; pending items always receive an action. A ready item with no active
+    session omits the action until collect is invoked. Concurrent renewals return
+    the same link. Renewal changes neither values nor item version. An expired link
+    cannot renew itself. The hosted form handles its collection protocol; callers
+    only open the returned URL and do not extract or submit its token through the
+    public API. For customer-hosted forms, use @onkernel/vault-react and an
+    authenticated customer backend calling the ordinary item GET/PATCH API. Kernel
+    does not store customer collection URLs or authenticate the customer's end
+    users. Treat URLs and submitted values as secrets and exclude them from logs,
+    traces, and errors.
     """