PenguinConverters.Keyra.xml
|
<?xml version="1.0"?>
<doc> <assembly> <name>PenguinConverters.Keyra</name> </assembly> <members> <member name="T:PenguinConverters.Keyra.Decryptor"> <summary> Secret value decryptor providing a developer-friendly encrypt/decrypt API. Backed either by a Rust <see cref="T:PenguinConverters.CandyStore.KeyraVaultSession"/> (AES-GCM / portable keys — the master key stays inside the native engine and never lands on the managed heap) or, for DPAPI-NG keys, by the value cipher (<see cref="T:PenguinConverters.Keyra.Core.KeyStorageProvider.ISecretCipher"/>) opened from an <see cref="T:PenguinConverters.Keyra.Core.KeyStorageProvider.IKey"/> whose protection is unwrapped in .NET. The key itself is held only for its lifetime — no crypto call touches it directly. </summary> </member> <member name="P:PenguinConverters.Keyra.Decryptor.KeyId"> <summary> Unique key identifier </summary> </member> <member name="P:PenguinConverters.Keyra.Decryptor.Cipher"> <summary> Internal access to the value cipher for same-assembly consumers. Null when the decryptor is backed by a native vault session (the key lives only in Rust). </summary> </member> <member name="M:PenguinConverters.Keyra.Decryptor.#ctor(PenguinConverters.Keyra.Core.KeyStorageProvider.IKey)"> <summary> Creates a Decryptor wrapping the provided key (DPAPI-NG / .NET-unwrapped keys). The decryptor takes ownership of the key's lifetime but performs all value crypto through the cipher the key opens. </summary> <param name="key">Loaded IKey instance</param> </member> <member name="M:PenguinConverters.Keyra.Decryptor.#ctor(PenguinConverters.CandyStore.KeyraVaultSession,System.String)"> <summary> Creates a Decryptor backed by a Rust vault session (AES-GCM / portable keys). The session holds the master key; this decryptor takes ownership and disposes it. </summary> <param name="session">Unlocked native vault session</param> <param name="keyId">The key identifier (for <see cref="P:PenguinConverters.Keyra.Decryptor.KeyId"/>)</param> </member> <member name="M:PenguinConverters.Keyra.Decryptor.Decrypt(System.String)"> <summary> Decrypts BASE64 encoded ciphertext into plaintext char array. Compatible with <see cref="M:PenguinConverters.Keyra.Settings.Secret.TryGetValue(System.Func{System.String,System.Char[]},System.Char[]@)"/>. </summary> <param name="ciphertext">BASE64 encoded ciphertext</param> <returns>Decrypted plaintext as char array</returns> </member> <member name="M:PenguinConverters.Keyra.Decryptor.Encrypt(System.String)"> <summary> Encrypts plaintext string into BASE64 encoded ciphertext. </summary> <param name="plaintext">Plaintext value to encrypt</param> <returns>BASE64 encoded ciphertext</returns> </member> <member name="M:PenguinConverters.Keyra.Decryptor.Encrypt(System.Char[])"> <summary> Encrypts plaintext char array into BASE64 encoded ciphertext. </summary> <param name="plaintext">Plaintext value to encrypt</param> <returns>BASE64 encoded ciphertext</returns> </member> <member name="M:PenguinConverters.Keyra.Decryptor.DecryptBytes(System.String)"> <summary> Decrypts BASE64 encoded ciphertext into raw bytes. Suitable for decrypting encrypted file attachments. </summary> <param name="ciphertext">BASE64 encoded ciphertext</param> <returns>Decrypted bytes</returns> </member> <member name="M:PenguinConverters.Keyra.Decryptor.EncryptBytes(System.Byte[])"> <summary> Encrypts raw bytes into BASE64 encoded ciphertext. Suitable for encrypting file attachments. </summary> <param name="plaintext">Raw bytes to encrypt</param> <returns>BASE64 encoded ciphertext</returns> </member> <member name="M:PenguinConverters.Keyra.Decryptor.DecryptToBuffer(System.String)"> <summary> Decrypts BASE64-encoded ciphertext into a char buffer backed by a Rust-owned allocation — the plaintext never lands on the managed heap. </summary> <param name="ciphertext">BASE64 encoded ciphertext</param> <returns>The plaintext buffer; the caller must dispose it.</returns> </member> <member name="M:PenguinConverters.Keyra.Decryptor.DecryptBytesToBuffer(System.String)"> <summary> Decrypts BASE64-encoded ciphertext into a byte buffer backed by a Rust-owned allocation — the plaintext never lands on the managed heap. </summary> <param name="ciphertext">BASE64 encoded ciphertext</param> <returns>The plaintext buffer; the caller must dispose it.</returns> </member> <member name="M:PenguinConverters.Keyra.Decryptor.EncryptChars(System.Char[])"> <summary> Encrypts a char array by encoding it to UTF-8 (the value encoding shared by the session and every provider cipher), then zeroing the intermediate plaintext bytes. </summary> </member> <member name="M:PenguinConverters.Keyra.Decryptor.Dispose(System.Boolean)"> <summary> Disposes the wrapped key. </summary> <param name="disposing">True if called from Dispose()</param> </member> <member name="M:PenguinConverters.Keyra.Decryptor.Dispose"> <summary> Disposes the Decryptor and its wrapped key. </summary> </member> <member name="T:PenguinConverters.Keyra.DecryptorBuilder"> <summary> Fluent builder for creating <see cref="T:PenguinConverters.Keyra.Decryptor"/> instances. Discovers the right <see cref="T:PenguinConverters.Keyra.Core.KeyStorageProvider.IPortableKeyLoader"/> and delegates key loading to it. </summary> </member> <member name="F:PenguinConverters.Keyra.DecryptorBuilder.KEY_DOCUMENT_ENTRY"> <summary>The one key document in a package - chain and keys together.</summary> </member> <member name="F:PenguinConverters.Keyra.DecryptorBuilder.VAULT_MANIFEST_FILE"> <summary>The vault manifest file a key document sits beside on disk.</summary> </member> <member name="F:PenguinConverters.Keyra.DecryptorBuilder.MAX_KEY_SOURCE_BYTES"> <summary>Upper bound on a key source file read into memory (guards against a hostile path).</summary> </member> <member name="F:PenguinConverters.Keyra.DecryptorBuilder.MAX_SHARE_CHARS"> <summary>Upper bound on armored share text accepted by <see cref="M:PenguinConverters.Keyra.DecryptorBuilder.UseShare(System.String)"/>.</summary> </member> <member name="F:PenguinConverters.Keyra.DecryptorBuilder.ARMOR_MARKER"> <summary> The armor marker prefix, used only as a cheap screen before handing the text to the engine parser. Both kinds start with it (vault <c>KEYRA:</c>, secret <c>KEYRA::</c>); the engine decides which one it is. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.UseKeyFile(System.String)"> <summary> Sets the path to the key source. The file's content decides how it is read - the name and extension carry no meaning: <list type="bullet"> <item><description>a <c>.keyra</c> package (ZIP), whatever it is named;</description></item> <item><description>a text file holding an armored vault share (<c>KEYRA:</c> ... <c>:ARYEK</c>, plain or decoratively shaped);</description></item> <item><description>a raw key document (<c>key.json</c>) or single key entry (<c>.key</c>);</description></item> <item><description>a vault directory, or its <c>vault.json</c>, in which case the sibling <c>key.json</c> is loaded.</description></item> </list> Replaces any share text set by <see cref="M:PenguinConverters.Keyra.DecryptorBuilder.UseShare(System.String)"/>. </summary> <param name="filePath">Path to the key source</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.UseShare(System.String)"> <summary> Sets an armored vault share (<c>KEYRA:</c> ... <c>:ARYEK</c>) held in memory - for shares kept in an environment variable, a cloud secret store, or a CI secret rather than a file. Plain and decoratively shaped armor are accepted alike. Replaces any path set by <see cref="M:PenguinConverters.Keyra.DecryptorBuilder.UseKeyFile(System.String)"/>. </summary> <param name="armoredShare">The armored share text</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.WithPassword(System.String)"> <summary> Sets the password used to protect the key. </summary> <param name="password">Export password</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.WithPassword(System.Security.SecureString)"> <summary> Sets the password used to protect the key (SecureString overload). Avoids SecureString-to-string round-trip when caller already has a SecureString. </summary> <param name="password">Export password as SecureString</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.WithPasswords(System.Collections.Generic.IList{System.Security.SecureString})"> <summary> Sets multiple passwords for authenticator chains that require more than one password. </summary> <param name="passwords">Ordered list of passwords matching the authenticator chain</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.UseKeyLoader(PenguinConverters.Keyra.Core.KeyStorageProvider.IPortableKeyLoader)"> <summary> Explicitly registers a key loader, skipping auto-discovery. </summary> <param name="loader">Key loader instance</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.Build"> <summary> Builds the <see cref="T:PenguinConverters.Keyra.Decryptor"/> by loading the key from the configured source (<see cref="M:PenguinConverters.Keyra.DecryptorBuilder.UseKeyFile(System.String)"/> or <see cref="M:PenguinConverters.Keyra.DecryptorBuilder.UseShare(System.String)"/>). When the key document records a chain, passwords are automatically derived through the authenticator chain (per-password Argon2id + XOR + HMAC-SHA256). </summary> <example> <code> using Decryptor decryptor = new DecryptorBuilder() .UseKeyFile(@"D:\secure\myapp.share") // .keyra, key.json, vault.json, or KEYRA:...:ARYEK .WithPassword(password) .Build(); string protectedValue = decryptor.Encrypt(connectionString); char[] plaintext = decryptor.Decrypt(protectedValue); </code> </example> <returns>Ready-to-use Decryptor instance</returns> <exception cref="T:System.InvalidOperationException">Thrown when no key source is set or no matching loader is found</exception> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.BuildSessionDecryptor(System.Byte[],System.Security.SecureString)"> <summary> Builds a session-backed <see cref="T:PenguinConverters.Keyra.Decryptor"/>: opens a native vault session and recovers the AES-GCM master key from the <c>.key</c> JSON inside Rust using the derived password. The derived password bytes are zeroed after the unlock; the session owns the master key. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ReadKeyId(System.Byte[])"> <summary> Reads the <c>keyId</c> from the <c>.key</c> JSON metadata, or empty if absent/malformed. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.PasswordToUtf8(System.Security.SecureString)"> <summary> Marshals a <see cref="T:System.Security.SecureString"/> to its UTF-8 bytes (matching how the AES-GCM provider hands the password to the native keystore). Caller must zero the returned buffer. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.DeriveEffectivePassword(PenguinConverters.Keyra.Core.Authentication.VaultKeyProtection)"> <summary> Derives the effective password to use for key loading, based on key protection configuration. The derivation is Core's (<see cref="M:PenguinConverters.Keyra.Core.Authentication.KeyDerivation.DeriveChainCredential(PenguinConverters.Keyra.Core.Authentication.VaultKeyProtection,System.Collections.Generic.IReadOnlyList{System.Security.SecureString})"/>), so a Windows / Active Directory package needs no password (Core derives the deterministic pass-through credential and the DPAPI-NG loader supplies the Windows-identity factor), while a password-protected package still requires its password(s). </summary> <param name="keyProtection">Key protection from the package, or null if not present.</param> <returns>The derived password, or the raw first password for backward compatibility, or null.</returns> <exception cref="T:System.InvalidOperationException">Fewer passwords supplied than the chain requires.</exception> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ReadKeyFromPath(System.String)"> <summary> Reads the key from whatever the path points at, deciding by content rather than by file name or extension: a <c>.keyra</c> package (ZIP), an armored share text file, or a raw key document / key entry. A directory or a <c>vault.json</c> path resolves to the sibling <c>key.json</c> first. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ResolveKeySourcePath(System.String)"> <summary> Resolves a directory or <c>vault.json</c> path to the vault's <c>key.json</c> beside it; any other path is returned unchanged. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ReadKeyFromShareText(System.String,System.String)"> <summary> Reads the key from armored share text (<see cref="M:PenguinConverters.Keyra.DecryptorBuilder.UseShare(System.String)"/>). </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.TryUnwrapArmor(System.Byte[])"> <summary> Attempts to read the content as armored share text. Returns null when the content carries no Keyra marker; the engine (<see cref="M:PenguinConverters.CandyStore.KeyraNativeCrypto.ArmorUnwrap(System.String)"/>) is the single parser of the armor format, so plain, shaped, space- and dot-spacer shares all decode identically. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ReadKeyFromUnwrappedShare(PenguinConverters.CandyStore.KeyraNativeCrypto.ArmorUnwrapResult,System.String)"> <summary> Decodes an unwrapped vault share into its <c>.keyra</c> package bytes and reads the key document out of it. The decoded package holds the protected key document, so the buffer is zeroed as soon as the key entry has been extracted. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.LooksLikeZip(System.Byte[])"> <summary> True when the content starts with a ZIP signature (local file header, empty archive, or spanned archive marker). </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ReadKeyDocument(PenguinConverters.Keyra.Core.Package,System.String)"> <summary> Reads the key out of an open <c>.keyra</c> package. <para> A package carries one <c>key.json</c>: the chain and the key it protects, the same document the vault keeps on disk (<c>docs/storage-format.md</c> §9). The entry <b>names</b> its provider, so nothing is inferred here. This replaced scanning package entries for a file extension some loader happened to claim - the guess-from-the-name pattern the key document exists to remove, and the reason a desktop export could stop being readable without any test noticing. </para> </summary> </member> <member name="F:PenguinConverters.Keyra.DecryptorBuilder._providerAssembliesProbed"> <summary> Tracks whether provider assemblies next to the SDK have been force-loaded yet. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.EnsureProviderLoadersLoaded"> <summary> Force-loads key storage provider assemblies sitting next to the SDK so their <see cref="T:PenguinConverters.Keyra.Core.KeyStorageProvider.IPortableKeyLoader"/> implementations (notably the DPAPI-NG loader) become discoverable by <see cref="M:PenguinConverters.Keyra.DecryptorBuilder.GetAvailableLoaders"/>. The SDK references no provider (architecture rule 5), so on the read path a DPAPI-NG package would otherwise find no loader unless the host process happened to have already loaded the provider. This mirrors <c>ProviderRegistry</c>'s force-load, which the writable <see cref="T:PenguinConverters.Keyra.VaultRepository"/> path already benefits from. Runs once; failures are non-fatal — a provider may be absent on this platform (e.g. DPAPI-NG off Windows), in which case the package simply has no loader here. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.SerializeEntry(PenguinConverters.Keyra.Core.SecretStorageProvider.VaultKeyEntry)"> <summary> Renders a key entry as the key metadata document loaders and the native engine consume. </summary> <remarks> These property names are the contract <c>keyra-ffi</c> parses, so they are spelled out rather than left to whatever naming policy happens to be in force. </remarks> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ReadKeyFromFile(System.Byte[])"> <summary> Normalizes a key file on disk to a single key entry plus the chain that protects it. <para> A vault stores its key in the same <c>key.json</c> a package carries, so pointing <see cref="M:PenguinConverters.Keyra.DecryptorBuilder.UseKeyFile(System.String)"/> at that file is an obvious thing to do. Reading it as a bare entry would find no provider and report the key as nameless, which is an actively wrong diagnosis for a perfectly well-formed document. </para> </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.ReadProviderTypeId(System.Byte[])"> <summary> Reads the <c>providerTypeId</c> a key states about itself, or null if it states none. </summary> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.DiscoverLoader(System.String)"> <summary> Finds the loader for a provider id. </summary> <remarks> Dispatch is the id the key records, never a file extension. An id no loader claims is reported <b>by name</b> - "this key uses the 'tpm' provider" - because no credential could ever open it, and saying "wrong password" would send the caller in circles (issue #45). </remarks> </member> <member name="M:PenguinConverters.Keyra.DecryptorBuilder.GetAvailableLoaders"> <summary> Scans loaded assemblies for types implementing IPortableKeyLoader. </summary> </member> <member name="T:PenguinConverters.Keyra.SecretAccessType"> <summary> The type of secret access that was performed. </summary> </member> <member name="F:PenguinConverters.Keyra.SecretAccessType.Value"> <summary> The main secret value was decrypted. </summary> </member> <member name="F:PenguinConverters.Keyra.SecretAccessType.SecretProperty"> <summary> An encrypted secret property was decrypted. </summary> </member> <member name="F:PenguinConverters.Keyra.SecretAccessType.SecretFile"> <summary> An encrypted file attachment was decrypted. </summary> </member> <member name="T:PenguinConverters.Keyra.SecretAccessEventArgs"> <summary> Event arguments for secret access auditing. Raised when a secret's encrypted data is decrypted. </summary> </member> <member name="P:PenguinConverters.Keyra.SecretAccessEventArgs.SecretIdentifier"> <summary> The identifier of the secret that was accessed. </summary> </member> <member name="P:PenguinConverters.Keyra.SecretAccessEventArgs.AccessType"> <summary> The type of access performed (value, property, or file). </summary> </member> <member name="P:PenguinConverters.Keyra.SecretAccessEventArgs.TargetName"> <summary> The name of the property or file that was decrypted. Null when <see cref="P:PenguinConverters.Keyra.SecretAccessEventArgs.AccessType"/> is <see cref="F:PenguinConverters.Keyra.SecretAccessType.Value"/>. </summary> </member> <member name="P:PenguinConverters.Keyra.SecretAccessEventArgs.Timestamp"> <summary> When the access occurred. </summary> </member> <member name="M:PenguinConverters.Keyra.SecretAccessEventArgs.#ctor(System.String,PenguinConverters.Keyra.SecretAccessType,System.String)"> <summary> Creates a new SecretAccessEventArgs. </summary> </member> <member name="T:PenguinConverters.Keyra.SecureBuffer`1"> <summary> A disposable buffer for sensitive data (char or byte), backed by a Rust-owned allocation (<see cref="T:PenguinConverters.CandyStore.KeyraSecureBuffer"/>) — the plaintext lives in native memory, is never moved by the GC, and is zeroized inside Rust on disposal. It reaches the managed heap only through an explicit <see cref="M:PenguinConverters.Keyra.SecureBuffer`1.ToArray"/>, whose copy the caller owns and must clear. </summary> <typeparam name="T">Element type (char or byte)</typeparam> <example> <code> using SecureBuffer<char> value = secret.DecryptValue(); string password = new string(value.Span); // the native buffer is zeroized when disposed </code> </example> </member> <member name="M:PenguinConverters.Keyra.SecureBuffer`1.#ctor(PenguinConverters.CandyStore.KeyraSecureBuffer)"> <summary> Creates a SecureBuffer over a Rust-owned allocation. The buffer takes ownership and disposes (zeroizes) it. For <c>char</c> buffers the allocation must hold UTF-16LE data (see <see cref="M:PenguinConverters.CandyStore.KeyraSecureBuffer.ToUtf16"/>). </summary> <param name="native">The Rust-owned plaintext allocation</param> </member> <member name="P:PenguinConverters.Keyra.SecureBuffer`1.Length"> <summary> Gets the length of the data (in elements). </summary> </member> <member name="P:PenguinConverters.Keyra.SecureBuffer`1.Span"> <summary> Gets a read-only span over the native data. Preferred for zero-copy access; valid only until disposal — do not store it. </summary> </member> <member name="M:PenguinConverters.Keyra.SecureBuffer`1.ToArray"> <summary> Copies the data to a new managed array. The caller is responsible for clearing the returned array. Prefer using <see cref="P:PenguinConverters.Keyra.SecureBuffer`1.Span"/> for zero-copy access when possible. </summary> <returns>A copy of the data</returns> </member> <member name="M:PenguinConverters.Keyra.SecureBuffer`1.Dispose"> <summary> Zeroizes the native memory (inside Rust) and releases the buffer. </summary> </member> <member name="T:PenguinConverters.Keyra.Settings.Secret"> <summary> Defines class for secret string value. </summary> </member> <member name="P:PenguinConverters.Keyra.Settings.Secret.Value"> <summary> Stores Secret value. Plaintext if Encrypted property set to false. </summary> </member> <member name="P:PenguinConverters.Keyra.Settings.Secret.Protected"> <summary> Indicates whether stored value is encrypted. </summary> </member> <member name="M:PenguinConverters.Keyra.Settings.Secret.#ctor"> <summary> Defines basic constructor. </summary> </member> <member name="M:PenguinConverters.Keyra.Settings.Secret.TryGetValue(System.Func{System.String,System.Char[]},System.Char[]@)"> <summary> Tries to disclose secret value. A protected value with no decryption method available fails rather than surfacing the ciphertext as though it were the plaintext. </summary> <param name="decrypt">Decryption or other secret mechanism method</param> <param name="plaintext">Plaintext value</param> <returns>True when the value was disclosed (or there is none); false when disclosure failed.</returns> </member> <member name="M:PenguinConverters.Keyra.Settings.Secret.TryGetValue(PenguinConverters.Keyra.Decryptor,System.Char[]@)"> <summary> Tries to disclose secret value using a <see cref="T:PenguinConverters.Keyra.Decryptor"/>. </summary> <example> <code> Secret node = JsonSerializer.Deserialize<MySettings>(json).ConnectionString; if (node.TryGetValue(decryptor, out char[] plaintext)) { try { /* use plaintext */ } finally { Array.Clear(plaintext, 0, plaintext.Length); } } </code> </example> <param name="decryptor">Decryptor holding the vault key</param> <param name="plaintext">Plaintext value</param> <returns>True when the value was disclosed (or there is none); false when disclosure failed.</returns> </member> <member name="M:PenguinConverters.Keyra.Settings.Secret.TryGetValue(PenguinConverters.Keyra.Settings.Secret,System.Func{System.String,System.Char[]},System.Char[]@)"> <summary> Tries to decrypt secret value. </summary> <param name="value">Secret string</param> <param name="decrypt">Decryption or other secret mechanism method</param> <param name="plaintext">Plaintext value</param> <returns></returns> </member> <member name="M:PenguinConverters.Keyra.Settings.Secret.Protect(PenguinConverters.Keyra.Decryptor,System.Char[])"> <summary> Creates a protected node by encrypting the plaintext with the <see cref="T:PenguinConverters.Keyra.Decryptor"/>. The node serializes as <c>{"Value": "<ciphertext>", "Protected": true}</c>. </summary> <param name="decryptor">Decryptor holding the vault key</param> <param name="plaintext">Plaintext value to protect</param> <returns>A node carrying the ciphertext</returns> </member> <member name="M:PenguinConverters.Keyra.Settings.Secret.Protect(PenguinConverters.Keyra.Decryptor,System.String)"> <summary> Creates a protected node by encrypting the plaintext with the <see cref="T:PenguinConverters.Keyra.Decryptor"/>. Convenience overload; prefer the <c>char[]</c> overload when the plaintext is already held in an erasable buffer. </summary> <param name="decryptor">Decryptor holding the vault key</param> <param name="plaintext">Plaintext value to protect</param> <returns>A node carrying the ciphertext</returns> </member> <member name="M:PenguinConverters.Keyra.Settings.Secret.FromPlaintext(System.String)"> <summary> Creates an unprotected node carrying the value as-is. </summary> <param name="value">Plaintext value</param> <returns>A node carrying the plaintext</returns> </member> <member name="T:PenguinConverters.Keyra.VaultMetadata"> <summary> Read-only metadata from a vault export package (vault.json). </summary> </member> <member name="P:PenguinConverters.Keyra.VaultMetadata.Name"> <summary> Name of the exported vault. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultMetadata.Identifier"> <summary> Unique identifier of the exported vault. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultMetadata.Created"> <summary> Date when the vault was originally created. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultMetadata.ExportType"> <summary> The type of export that was performed (e.g., "Full", "SecretsOnly"). </summary> </member> <member name="P:PenguinConverters.Keyra.VaultMetadata.ExportedUtc"> <summary> UTC timestamp of when the export was created. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultMetadata.KeyIdentifier"> <summary> Identifier of the key used by this vault. </summary> </member> <member name="T:PenguinConverters.Keyra.SecretEntryInfo"> <summary> Lightweight index entry for a secret in the package. Stores only the entry path and folder — no deserialized data. </summary> </member> <member name="T:PenguinConverters.Keyra.VaultReader"> <summary> Provides read access to secrets in a loaded vault export package. Secrets are deserialized lazily on first access to avoid loading all ciphertext into memory at once. The underlying package file remains open until Dispose is called. </summary> </member> <member name="F:PenguinConverters.Keyra.VaultReader.MAX_SECRET_ENTRIES"> <summary> Maximum number of secret entries allowed in a package. Prevents resource exhaustion from malformed or malicious packages. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultReader.Metadata"> <summary> Vault metadata from vault.json. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultReader.IsDisposed"> <summary> Whether the VaultReader has been disposed. Used by VaultSecret to guard against decryption after disposal. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultReader.#ctor(PenguinConverters.Keyra.Decryptor,PenguinConverters.Keyra.VaultMetadata,PenguinConverters.Keyra.Core.Package,System.Collections.Generic.Dictionary{System.String,PenguinConverters.Keyra.SecretEntryInfo})"> <summary> Creates a VaultReader with the given decryptor, metadata, open package, and secret index. </summary> </member> <member name="E:PenguinConverters.Keyra.VaultReader.SecretAccessed"> <summary> Raised when a secret's encrypted data is decrypted. Subscribe to this event for audit logging of secret access. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultReader.GetSecretIdentifiers"> <summary> Gets identifiers for all secrets in the vault. Does not deserialize any secret data. </summary> <returns>List of secret identifiers</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReader.GetSecret(System.String)"> <summary> Gets a secret by its identifier. The secret is deserialized from the package on each call. </summary> <param name="identifier">Secret identifier</param> <returns>The vault secret</returns> <exception cref="T:System.Collections.Generic.KeyNotFoundException">Thrown when the identifier is not found</exception> </member> <member name="M:PenguinConverters.Keyra.VaultReader.GetSecrets(System.Threading.CancellationToken)"> <summary> Gets all secrets in the vault. Each secret is deserialized from the package. </summary> <param name="cancellationToken">Token to cancel the operation</param> <returns>List of all vault secrets</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReader.GetSecrets(System.String,System.Threading.CancellationToken)"> <summary> Gets secrets in a specific folder. Each matching secret is deserialized from the package. </summary> <param name="folder">Folder name</param> <param name="cancellationToken">Token to cancel the operation</param> <returns>List of secrets in the specified folder</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReader.GetFolders"> <summary> Gets all distinct folder names. Does not deserialize any secret data. </summary> <returns>List of folder names</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReader.OnSecretAccessed(PenguinConverters.Keyra.SecretAccessEventArgs)"> <summary> Raises the <see cref="E:PenguinConverters.Keyra.VaultReader.SecretAccessed"/> event. Called by <see cref="T:PenguinConverters.Keyra.VaultSecret"/> decrypt methods. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultReader.LoadSecret(System.String,PenguinConverters.Keyra.SecretEntryInfo)"> <summary> Deserializes a single secret from the package on demand and verifies its identity. </summary> <param name="expectedIdentifier">The identifier derived from the entry filename</param> <param name="info">The secret entry info from the index</param> <exception cref="T:System.InvalidOperationException">Thrown when the secret's serialized identifier doesn't match the expected identifier</exception> </member> <member name="M:PenguinConverters.Keyra.VaultReader.Dispose(System.Boolean)"> <summary> Disposes the VaultReader, its underlying package, and the Decryptor. </summary> <param name="disposing">True if called from Dispose()</param> </member> <member name="M:PenguinConverters.Keyra.VaultReader.Dispose"> <summary> Disposes the VaultReader, its underlying package, and the Decryptor. </summary> </member> <member name="T:PenguinConverters.Keyra.VaultReaderBuilder"> <summary> Fluent builder for creating <see cref="T:PenguinConverters.Keyra.VaultReader"/> instances. Opens a vault export .keyra package, loads the key, and builds a lightweight secret index. Secrets are not deserialized until accessed through VaultReader. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.UsePackage(System.String)"> <summary> Sets the path to the vault export .keyra package. </summary> <param name="filePath">Path to the .keyra vault export file</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.WithPassword(System.String)"> <summary> Sets the password used to protect the vault key. </summary> <param name="password">Export password</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.WithPassword(System.Security.SecureString)"> <summary> Sets the password used to protect the vault key (SecureString overload). </summary> <param name="password">Export password as SecureString</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.WithPasswords(System.Collections.Generic.IList{System.Security.SecureString})"> <summary> Sets multiple passwords for authenticator chains that require more than one password. </summary> <param name="passwords">Ordered list of passwords matching the authenticator chain</param> <returns>This builder instance</returns> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.Build(System.Threading.CancellationToken)"> <summary> Builds the <see cref="T:PenguinConverters.Keyra.VaultReader"/> by loading the key and building a secret index from the package. The package remains open for lazy secret deserialization and is closed when VaultReader is disposed. </summary> <param name="cancellationToken">Token to cancel the build operation</param> <returns>Ready-to-use VaultReader instance</returns> <exception cref="T:System.InvalidOperationException">Thrown when package path is not set or package is invalid</exception> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.ReadMetadata(PenguinConverters.Keyra.Core.Package,PenguinConverters.Keyra.Decryptor)"> <summary> Reads vault metadata from vault.json in the package, through the shared manifest codec. <para> The SDK used to hand-walk <c>JsonDocument</c> properties here — a third, ad-hoc reading of the manifest (issue #88). It now goes through <see cref="T:PenguinConverters.Keyra.Core.Export.ManifestCodec"/>, the engine-backed reader every head binds to (issue #87), so the SDK cannot drift from what the desktop wrote and unknown fields written by a newer client survive into the model's extension data instead of being a parse hazard. </para> </summary> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.BuildSecretIndex(PenguinConverters.Keyra.Core.Package,System.Threading.CancellationToken)"> <summary> Builds a lightweight index of secret entries from the package without deserializing any secret data. Only scans the ZIP central directory for matching entry paths. </summary> <param name="package">The open package to scan</param> <param name="cancellationToken">Token to cancel the operation</param> <exception cref="T:System.InvalidOperationException">Thrown when the package contains more entries than <see cref="F:PenguinConverters.Keyra.VaultReader.MAX_SECRET_ENTRIES"/>.</exception> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.ExtractFolderName(System.String)"> <summary> Extracts the folder name from a normalized entry path. Expected format: SecretStorageProvider/folders/{folderName}/secrets/{file}.json </summary> </member> <member name="M:PenguinConverters.Keyra.VaultReaderBuilder.NormalizePath(System.String)"> <summary> Normalizes path separators to forward slashes. </summary> </member> <member name="T:PenguinConverters.Keyra.VaultRepository"> <summary> A Keyra repository on disk, opened for reading <b>and writing</b>. This is the read/write counterpart to <see cref="T:PenguinConverters.Keyra.VaultReader"/>. They address different things and are not interchangeable: <see cref="T:PenguinConverters.Keyra.VaultReader"/> opens an exported <c>.keyra</c> <em>package</em> and is read-only by design, whereas this opens the live repository directory — the same thing the desktop app and CMDKEYRA work against — so secrets written here are secrets the app will see. Vaults are locked until you open one: call <see cref="M:PenguinConverters.Keyra.VaultRepository.OpenVault(System.String,System.Security.SecureString[])"/> with the vault's credentials to get a writable <see cref="T:PenguinConverters.Keyra.VaultSession"/>. </summary> <example> <code> using VaultRepository repository = new VaultRepositoryBuilder().UsePath(@"C:\keyra").Build(); using VaultSession vault = repository.OpenVault("Prod", password); vault.SetSecret("api-key", newValue); </code> </example> </member> <member name="M:PenguinConverters.Keyra.VaultRepository.#ctor(System.String,System.String)"> <summary> Opens the repository at the given path. Prefer <see cref="T:PenguinConverters.Keyra.VaultRepositoryBuilder"/>. </summary> <param name="repositoryPath">Path to the Keyra repository directory (the one holding <c>vaults/</c>).</param> <param name="pluginDirectory"> Directory to discover key/secret storage provider plugins in. Null uses the directory the SDK itself was loaded from, which is what a normal application layout wants. </param> </member> <member name="P:PenguinConverters.Keyra.VaultRepository.RepositoryPath"> <summary> The repository directory this instance is bound to. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultRepository.GetVaultNames"> <summary> Lists the names of the vaults in this repository. Does not unlock anything. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultRepository.OpenVault(System.String,System.Security.SecureString[])"> <summary> Opens and unlocks a vault for reading and writing. </summary> <param name="vaultName">The vault's name, matched case-insensitively.</param> <param name="passwords"> One password per authenticator in the vault's chain, in order. Pass none for a vault with no authenticators — its key is then derived deterministically and no credential is needed. </param> <returns>An unlocked, writable session. Dispose it (or this repository) when done.</returns> <exception cref="T:System.Collections.Generic.KeyNotFoundException">No vault by that name.</exception> <exception cref="T:System.UnauthorizedAccessException">The credentials did not unlock the key.</exception> </member> <member name="M:PenguinConverters.Keyra.VaultRepository.DeriveCredential(PenguinConverters.Keyra.Core.Services.VaultLoadResult,System.Security.SecureString[],System.String)"> <summary> Turns the caller's raw passwords into the single credential the key was protected with. The derivation is Core's (<see cref="M:PenguinConverters.Keyra.Core.Authentication.KeyDerivation.DeriveChainCredential(PenguinConverters.Keyra.Core.Authentication.VaultKeyProtection,System.Collections.Generic.IReadOnlyList{System.Security.SecureString})"/>) — the SDK must not invent its own, or a key written by the app would not open here. A Windows / Active Directory vault needs no password: Core derives the deterministic pass-through credential and the DPAPI-NG provider supplies the Windows-identity factor at unlock. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultRepository.Dispose"> <summary> Disposes every session opened from this repository, releasing their key material. </summary> </member> <member name="T:PenguinConverters.Keyra.VaultRepositoryBuilder"> <summary> Fluent builder for <see cref="T:PenguinConverters.Keyra.VaultRepository"/> — a live Keyra repository opened for reading and writing. (For a read-only exported <c>.keyra</c> package, use <see cref="T:PenguinConverters.Keyra.VaultReaderBuilder"/>.) </summary> <example> <code> using VaultRepository repository = new VaultRepositoryBuilder() .UsePath(@"C:\keyra") .Build(); </code> </example> </member> <member name="M:PenguinConverters.Keyra.VaultRepositoryBuilder.UsePath(System.String)"> <summary> Sets the repository directory — the one containing <c>vaults/</c> and <c>keys/</c>. </summary> <param name="repositoryPath">Path to the Keyra repository.</param> <returns>This builder instance.</returns> </member> <member name="M:PenguinConverters.Keyra.VaultRepositoryBuilder.UsePluginDirectory(System.String)"> <summary> Overrides where key/secret storage provider plugins are discovered. Rarely needed: by default the SDK probes its own directory, which is where a normal application layout puts them. </summary> <param name="pluginDirectory">Directory to probe for provider assemblies.</param> <returns>This builder instance.</returns> </member> <member name="M:PenguinConverters.Keyra.VaultRepositoryBuilder.Build"> <summary> Opens the repository. </summary> <returns>The opened repository. Dispose it to release any vault keys it unlocked.</returns> <exception cref="T:System.InvalidOperationException">No path was set.</exception> </member> <member name="T:PenguinConverters.Keyra.VaultSecret"> <summary> Read-only wrapper for a vault secret with decryption methods. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.Identifier"> <summary> Unique identifier of this secret. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.Created"> <summary> When this secret was created. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.Expires"> <summary> When this secret expires. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.HasValue"> <summary> Whether this secret has an encrypted value. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.Properties"> <summary> Plaintext properties (e.g., Username, Description). </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.SecretPropertyNames"> <summary> Names of encrypted secret properties. Values require decryption via <see cref="M:PenguinConverters.Keyra.VaultSecret.DecryptSecretProperty(System.String)"/>. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.Files"> <summary> Plaintext file attachment names and their Base64-encoded content. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.SecretFileNames"> <summary> Names of encrypted file attachments. Content requires decryption via <see cref="M:PenguinConverters.Keyra.VaultSecret.DecryptSecretFile(System.String)"/>. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSecret.Folder"> <summary> Folder path if this secret is in a folder, otherwise null. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultSecret.#ctor(PenguinConverters.Keyra.VaultReader,PenguinConverters.Keyra.Decryptor,PenguinConverters.Keyra.Core.Entities.Secret,System.String)"> <summary> Creates a VaultSecret wrapping the given Core secret entity. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultSecret.DecryptValue"> <summary> Decrypts the main secret value. The returned buffer zeroes its memory on disposal. </summary> <returns>Decrypted plaintext in a <see cref="T:PenguinConverters.Keyra.SecureBuffer`1"/>. Dispose when done to zero memory.</returns> <exception cref="T:System.InvalidOperationException">Thrown when the secret has no value</exception> </member> <member name="M:PenguinConverters.Keyra.VaultSecret.DecryptSecretProperty(System.String)"> <summary> Decrypts a secret property by key. The returned buffer zeroes its memory on disposal. </summary> <param name="key">Secret property key</param> <returns>Decrypted plaintext in a <see cref="T:PenguinConverters.Keyra.SecureBuffer`1"/>. Dispose when done to zero memory.</returns> <exception cref="T:System.Collections.Generic.KeyNotFoundException">Thrown when the property key is not found</exception> </member> <member name="M:PenguinConverters.Keyra.VaultSecret.DecryptSecretFile(System.String)"> <summary> Decrypts an encrypted file attachment. The returned buffer zeroes its memory on disposal. </summary> <param name="filename">File attachment name</param> <returns>Decrypted file content in a <see cref="T:PenguinConverters.Keyra.SecureBuffer`1"/>. Dispose when done to zero memory.</returns> <exception cref="T:System.Collections.Generic.KeyNotFoundException">Thrown when the file is not found</exception> </member> <member name="M:PenguinConverters.Keyra.VaultSecret.ThrowIfVaultDisposed"> <summary> Throws ObjectDisposedException if the parent VaultReader has been disposed. </summary> </member> <member name="T:PenguinConverters.Keyra.VaultSession"> <summary> An unlocked vault inside a <see cref="T:PenguinConverters.Keyra.VaultRepository"/>, which secrets can be read from and written to. Every write goes through Core's <see cref="T:PenguinConverters.Keyra.Core.Services.ISecretService"/> — the same path the desktop app and CMDKEYRA use — so the on-disk bytes are authored once, by the Rust engine, with a collision-safe filename. The SDK deliberately does not write secret files itself. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultSession.#ctor(PenguinConverters.Keyra.Core.Entities.IVault,PenguinConverters.Keyra.Core.Services.ISecretService)"> <summary> Wraps an unlocked vault. Obtained from <see cref="M:PenguinConverters.Keyra.VaultRepository.OpenVault(System.String,System.Security.SecureString[])"/>. </summary> </member> <member name="P:PenguinConverters.Keyra.VaultSession.Name"> <summary>The vault's name.</summary> </member> <member name="P:PenguinConverters.Keyra.VaultSession.Identifier"> <summary>The vault's identifier (its path within the repository).</summary> </member> <member name="M:PenguinConverters.Keyra.VaultSession.GetSecretNames"> <summary> Lists the names of the secrets in this vault. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultSession.GetSecretValue(System.String)"> <summary> Decrypts a secret's value. </summary> <param name="name">The secret's name.</param> <returns>The plaintext, in a buffer the caller must dispose — it is zeroed on disposal.</returns> <exception cref="T:System.Collections.Generic.KeyNotFoundException">No secret by that name.</exception> <exception cref="T:System.InvalidOperationException">The value could not be decrypted.</exception> </member> <member name="M:PenguinConverters.Keyra.VaultSession.SetSecret(System.String,System.Security.SecureString,System.String,System.String,System.String,System.Nullable{System.DateTimeOffset})"> <summary> Writes a secret: adds it, or updates it in place when it already exists. </summary> <param name="name"> The secret's name. Stored verbatim — any characters are allowed, because the storage provider derives a filesystem-safe filename from it. </param> <param name="value"> The plaintext value, encrypted under the vault key before it is written. Null leaves an existing secret's value untouched, so metadata can be edited without knowing the secret. </param> <param name="username">Optional username property; null leaves any existing one alone.</param> <param name="url">Optional URL property; null leaves any existing one alone.</param> <param name="notes">Optional notes property; null leaves any existing one alone.</param> <param name="expires">When the secret expires; null uses the key algorithm's default.</param> <exception cref="T:System.InvalidOperationException">The write failed.</exception> </member> <member name="M:PenguinConverters.Keyra.VaultSession.RemoveSecret(System.String)"> <summary> Deletes a secret. </summary> <param name="name">The secret's name.</param> <exception cref="T:System.Collections.Generic.KeyNotFoundException">No secret by that name.</exception> <exception cref="T:System.InvalidOperationException">The delete failed.</exception> </member> <member name="M:PenguinConverters.Keyra.VaultSession.DescribeFailure(PenguinConverters.Keyra.Core.Services.SecretWriteResult,System.String)"> <summary> Turns Core's reason code into a message. Core returns a code, never display text, precisely so each consumer can word it — this is the SDK's wording. </summary> </member> <member name="M:PenguinConverters.Keyra.VaultSession.Dispose"> <summary> Releases the vault's key material. </summary> </member> </members> </doc> |