Namespace Kuestenlogik.Bowire.Keyring

Classes

BowireKeyringEndpointContribution

Auto-discovered endpoint registration — mounts the keyring endpoints into the workbench's auth-gated route group at MapBowire() time.

BowireKeyringEndpoints

HTTP surface for the optional Kuestenlogik.Bowire.Keyring package (#208 Phase 5). Two endpoints, both under the workbench's auth-gated route group:

  • GET {base}/api/vars/keyring/status — whether the store read is enabled and which backend is active, so the vars UI can render a "keyring available / disabled" affordance without leaking any values.
  • POST {base}/api/vars/keyring — batch-resolve the keyring.* refs a template touched, mirroring the AI package's prefetch shape. The response carries resolved values (for the current in-memory substitution only) plus a redaction-safe error map for refs the store couldn't satisfy.
BowireKeyringModuleContribution

Module descriptor so the workbench shell knows the keyring source is installed. The JS resolver's {{keyring.*}} prefetch is gated on this module id showing up in BOWIRE_CONFIG.modules, so a host that doesn't reference the package never issues the prefetch call.

BowireKeyringServiceContribution

Auto-discovered service registration for the keyring package (#208 Phase 5). Binds KeyringOptions from Bowire:Keyring and registers the OS backend + resolver so both the endpoint and the CLI flow resolver share one configured instance. Idempotent via TryAdd.

KeyringOptions

Configuration knobs for the optional Kuestenlogik.Bowire.Keyring package (#208 Phase 5). Bound from the Bowire:Keyring configuration section; the CLI's --keyring / --no-keyring flags feed the same Enabled key via the in-memory configuration overlay.

KeyringResolver

The single resolution entry point shared by the workbench endpoint (POST /api/vars/keyring) and the CLI's flow variable resolver. Applies the Enabled gate, parses the reference, and delegates the store read to the injected IKeyringBackend.

OsKeyringBackend

The one shipped IKeyringBackend — reads the running OS's native credential store with zero NuGet dependencies:

  • Windows — CredReadW P/Invoke against advapi32.dll, target name service (generic credential). The password blob is decoded UTF-16LE, matching the convention used by PowerShell's CredentialManager module, node-keytar, and Python's keyring.
  • macOS — security find-generic-password -s service [-a account] -w, the value printed on stdout.
  • Linux — secret-tool lookup service <service> [account <account>] (libsecret), the value printed on stdout with no trailing newline.

The Backend override forces one of these ids; the default auto selects by OperatingSystem.

The two OS-integration surfaces — the CLI shell-out and the Windows P/Invoke — sit behind injectable seams (ProcessRunner and WindowsCredReader) so the dispatch + result-mapping logic is unit-testable on any host with a fake; the public constructor wires the real OS implementations.

Structs

KeyringReadResult

Outcome of a single Read(KeyringReference).

KeyringReference

A parsed {{keyring.service/account}} reference. The text after the keyring. prefix is split on the first slash into a mandatory Service and an optional Account; a bare {{keyring.service}} leaves Account null, which each backend maps to "any account under this service".

Interfaces

IKeyringBackend

The platform-specific credential-store read seam. The one shipped implementation is OsKeyringBackend (Windows Credential Manager / macOS Keychain / libsecret); tests inject an in-memory fake so the resolver, endpoint, and CLI paths can be exercised without touching a real store.

Enums

KeyringReadStatus

Discriminates the three KeyringReadResult cases.