Preserve credential field order

[masnwilliams]

Summary

• accept ordered named credential definitions in vaults credentials create
• preserve ordered definitions in display-safe output
• steer callers to follow the website's natural top-to-bottom order
• test against the generated Go SDK preview from kernel/kernel#4163

Rollout

• depends on kernel/kernel#4163
• the preview SDK pin must be replaced with the published SDK version during the coordinated release

Testing

• go test ./...

---

Note

Medium Risk
Breaking change for credentials create JSON (map → ordered array) tied to a preview SDK/API rollout; touches credential spec handling and public value redaction, though update/fill paths are largely unchanged.

Overview
Credential create specs now use an ordered fields array ([{"name":"username",...}]) instead of a name-keyed object, matching the updated Go SDK preview. Array order is preserved in display-safe JSON output and drives the hosted collection form layout.

Help text and README vault examples now tell callers to list fields in the site’s natural top-to-bottom order. preservePublicCredentialValues and vaultItemFields were updated for the array shape; tests and fixtures follow suit, including a check that definition order survives filtering. Credential update specs remain map-based for partial value changes.

go.mod pins kernel-go-sdk to a generated preview (kernel/kernel#4163) until a coordinated release replaces it with a published version.

^{Reviewed by Cursor Bugbot for commit dda95bf. Bugbot is set up for automated code reviews on this repo. Configure here.}

[rgarcia]

reviewed — implementation looks good and follows the architecture agreed in the related API PRs. two follow-ups:

rollout

• go.mod:12 — the preview SDK pin is fine for merge provided this PR merges after kernel/kernel#4163; once the official SDK is released, please follow up with a PR replacing the preview pin.

tests

• cmd/vaults_public_values_test.go:17-42 — non-blocking: create order is covered, but nothing asserts that display-safe JSON preserves spec.fields order. could we decode one output and assert the field-name sequence?

[masnwilliams]

added the suggested display-safe output test; it now decodes the projected credential item and asserts the exact field-name sequence.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​kernel/​kernel-go-sdk@​v0.107.0 ⏵ v0.0.0-20260917183146-34ba0a529b1d	+1

View full report