Section API Reference

API Reference Language: C# Component: Auth Audience: developer

Keycloak

Type

OciReader

Source

Private bounded reader for exact, offline inspection of Docker save OCI archives.

Method

Read

ObservedOciImage Read(string ownedArchive, OciExpectedImage expected, CancellationToken cancellationToken = default)

Source

Reads and verifies one exact OCI image without extraction or caller supplied security evidence.

Method

ValidateExpectedFiles

void ValidateExpectedFiles(IReadOnlyDictionary<string, ObservedFile> observed, IReadOnlyDictionary<string, OciExpectedFile>? expected)

Source

Validates selected paths, ancestors, type, raw hash, mode and ownership against the expected image.

Method

ReadEnvironment

Dictionary<string, string> ReadEnvironment(JsonElement c)

Source

Reads the optional OCI environment array and rejects malformed entries.

Method

RemoveLower

void RemoveLower(SortedDictionary<string, ObservedFile> m, string victim, int layer, SelectionState? selectedState = null)

Source

Removes a lower-layer path subtree for a named or opaque whiteout.

Method

RemovePath

void RemovePath(SortedDictionary<string, ObservedFile> m, string p, SelectionState? selectedState = null)

Source

Removes a path and all descendants from the merged image view.

Method

SafePath

string SafePath(string p)

Source

Validates and canonicalizes one OCI archive path without aliasing.

Type

DebPayloadReader

Source

Private bounded Debian archive reader. It hashes payload streams and never extracts them.

Method

Read

PackageResult Read(Stream deb, string expectedSha256, PackageIdentity expected, CancellationToken cancellationToken = default)

Source

Verifies one captured package and parses control, conffile, regular, and link records.

Method

CompareInstalledInventory

void CompareInstalledInventory(IEnumerable<InstalledFile> baseline, IEnumerable<InstalledFile> actual, IEnumerable<string> excludes, IEnumerable<string> includes, IEnumerable<ExpectedChange> expectedChanges)

Source

Compares every included baseline path and permits only the explicit expected change set.

Type

ProcessObservation

Source

Observed bounded exit without exposing raw process output as a public diagnostic.

Type

BoundedProcessException

Source

Provides a safe process failure without preserving an unsafe nested exception.

Type

BoundedProcess

Source

Runs a single framework-owned argument vector with bounded output and no retry.

Type

KeycloakBuildContext

Source

The host build contract for one verified context; it grants no publication or deployment authority.

Method

CreateDockerBuildArguments

IReadOnlyList<string> CreateDockerBuildArguments(string imageTag, CancellationToken cancellationToken = default)

Source

Creates the fixed offline Docker build argument list after verifying the context.

Parameters

imageTag
An explicit local tag under the host's build policy.
cancellationToken
Cancels context verification before the host starts Docker.

Returns

Arguments for Docker 29; invoke with an argument-list API and no shell interpolation.

Method

Verify

void Verify(CancellationToken cancellationToken = default)

Source

Verifies the exact owned context immediately before the host invokes its builder.

Parameters

cancellationToken
Cancels verification before the host build.

Property

Digest

string Digest { get; } Source

Canonical context manifest identity, excluding the local directory path.

Property

DirectoryPath

string DirectoryPath { get; } Source

The owned context path used only by the host builder; excluded from portable identities and evidence.

Property

RepairedCliSha256

string? RepairedCliSha256 { get; } Source

Actual repaired CLI content identity, when archive replacement was requested.

Type

KeycloakSecurity

Captures supported recipe inputs and their independent host authorizations.

Method

MaterializeAsync

Task<KeycloakBuildContext> MaterializeAsync(CapturedKeycloakPlan plan, string absentContext, CancellationToken cancellationToken = default)

Source

Materializes only verified captured bytes into an absent host-owned build context.

Parameters

plan
The accepted captured plan.
absentContext
An absent local context directory; its parent must already exist.
cancellationToken
Cancels the complete invocation before publication.

Returns

A context identity and verification contract for the host-owned builder.

Exceptions

KeycloakSecurityException
Materialization failed; no passing context was returned.

Method

CaptureAsync

Task<CapturedKeycloakPlan> CaptureAsync(KeycloakSecurityRecipe recipe, KeycloakMaterialTrustPolicy trustPolicy, KeycloakCaptureInputs inputs, string ownedDirectory, CancellationToken cancellationToken = default)

Source

Captures approved exact inputs into a fresh caller-owned directory in one attempt.

Parameters

recipe
The explicit closed recipe including all source, runtime, profile and material pins.
trustPolicy
The separately approved host policy; the recipe cannot broaden it.
inputs
Explicit host-captured material bindings. Local paths are excluded from identity.
ownedDirectory
An absent snapshot directory on a supported local filesystem.
cancellationToken
Cancels the complete invocation, including acquisition and verification.

Returns

A handle only after all bytes, graph identities and provenance checks pass.

Exceptions

KeycloakSecurityException
Capture failed without a passing plan.

Method

ResolveLocalImageAsync

Task<KeycloakInspectionImage> ResolveLocalImageAsync(string hostImageReference, CancellationToken cancellationToken = default)

Source

Resolves a host-local Docker 29 image reference to a verified immutable platform identity.

Parameters

hostImageReference
The host's local tag or immutable image reference.
cancellationToken
Cancels the single bounded resolution/export.

Returns

The actual exported and verified manifest, config, platform and ordered rootfs identities.

Exceptions

KeycloakSecurityException
The local image store or identity mapping is unsupported or invalid.

Method

InspectAsync

Task<VerifiedKeycloakImageEvidence> InspectAsync(CapturedKeycloakPlan plan, KeycloakInspectionImage image, CancellationToken cancellationToken = default)

Source

Inspects actual immutable Docker content against the captured plan and runs bound read-only probes.

Parameters

plan
The captured plan defining all expected operations.
image
The explicit immutable final image identity, including ordered rootfs identities.
cancellationToken
Cancels the complete inspection and owned cleanup.

Returns

Passing observed evidence only after every declared check succeeds.

Exceptions

KeycloakSecurityException
An inspection or probe failed; no passing evidence is returned.

Type

KeycloakStageEvent

Source

A safe, bounded observation of a recipe stage. It contains no paths, process output, or exception text.

Type

KeycloakStageEvents

Source

Publishes structured stage events for diagnostics and bounded host progress displays.

Method

Begin

KeycloakStageScope Begin(KeycloakStagePhase phase, string? recipeDigest = null, string? policyDigest = null, string? profile = null, string? planDigest = null, string? operationId = null, string? checkId = null)

Source

Starts one correlated stage scope; disposing an unfinished scope emits a rejection.

Type

KeycloakStageScope

Source

Disposable stage scope that emits exactly one start and one terminal event.

Method

SetIdentity

void SetIdentity(string? recipeDigest, string? policyDigest, string? profile)

Source

Sets safe content identities and a bounded profile key.

Method

SetContext

void SetContext(string? planDigest = null, string? operationId = null, string? checkId = null)

Source

Sets optional bounded plan, operation, and check identities.

Method

SetCounts

void SetCounts(int? materialCount = null, long? materialBytes = null, int? checkCount = null)

Source

Sets bounded counters; negative values are rejected before publication.

Method

Complete

void Complete(KeycloakEffectState effect = KeycloakEffectState.Committed)

Source

Publishes a successful terminal event.

Method

Reject

2 overloads

void Reject(KeycloakSecurityException failure)

Source

Publishes a typed rejection using only stable diagnostic fields.

void Reject(string safeCode, KeycloakEffectState effect = KeycloakEffectState.Unknown)

Source

Publishes a safe rejection for a host boundary that has no typed package failure.

Method

Dispose

void Dispose()

Source

Ends an unfinished scope with a nonpassing outcome and releases its activity.

Property

CorrelationId

string CorrelationId { get; } Source

Stable correlation identity shared by this stage's start and terminal events.

Property

Phase

KeycloakStagePhase Phase { get; } Source

Stage represented by this scope.

Property

CheckId

string? CheckId { get; } Source

The most recently selected bounded check identity, when a stage has one.

Type

KeycloakDiagnostics

Source

Creates bounded, secret-safe failures at each supported public boundary.

Method

MarkUnknownEffect

void MarkUnknownEffect(Exception primary)

Source

Preserves a private primary failure while recording an unconfirmed owned cleanup effect.

Remarks

The marker contains no process output or host identity and is consumed only by the public diagnostic mapper.

Type

RuntimeConformance

Source

Private, evidence-based comparison of a captured runtime baseline and final OCI observation.

Method

ReadPolicy

Policy ReadPolicy(ObservedOciImage baselineObserved, ObservedOciImage actualObserved)

Source

Reads and compares the captured dpkg policy bytes, preserving rule order.

Method

Verify

Result Verify(ObservedOciImage baselineObserved, ObservedOciImage actualObserved, IReadOnlyList<DebPayloadReader.PackageResult> signedPackages, IReadOnlyList<KeycloakRemovedPackageSpec> removed, Policy policy)

Source

Compares package status, package payload dispositions, conffiles, ownership, links, and fixed runtime profile facts.

Type

TarBudgetReadStream

Source

Read-only tar transport that rejects oversized headers and payloads before TarReader sees them.

Type

ArchiveTransformer

Source

Method

TryDelete

void TryDelete(string path)

Source

Deletes an engine-owned archive staging file, tolerating expected I/O and access failures.

Parameters

path
An engine-created staging-file path owned by the current operation.

Remarks

Internal visibility permits real filesystem failure tests; unexpected path or programming errors propagate.

Type

BoundedSeekableWriteStream

Source

Seekable output guard that rejects any operation which could extend the owned file past its cap.

Type

KeycloakImageIdentity

Source

Exact image identity, including the index and selected platform manifest.

Method

Create

KeycloakImageIdentity Create(string index, string platformManifest, string platform)

Source

Creates a declaration; recipe validation checks its digest identities and platform before effects.

Property

IndexMaterialId

string? IndexMaterialId { get; init; } Source

Material ID containing the exact upstream index JSON.

Property

ArchiveMaterialId

string? ArchiveMaterialId { get; init; } Source

Material ID containing the exact selected platform archive.

Property

ConfigDigest

string? ConfigDigest { get; init; } Source

Exact config digest observed in the selected platform manifest.

Property

DiffIds

ImmutableArray<string> DiffIds { get; init; } Source

Ordered exact layer diff IDs observed in the selected platform image.

Type

OciIdentity

Source

A safe OCI image reference and its exact content digest.

Property

Id

string? Id { get; init; } Source

Stable recipe-local role identity used to select runtime or frontend OCI input.

Property

Platform

string? Platform { get; init; } Source

Explicit OCI platform, either linux/amd64 or linux/arm64.

Property

ArchiveMaterialId

string? ArchiveMaterialId { get; init; } Source

Recipe material ID containing the exact OCI archive or manifest bytes.

Property

PlatformManifestDigest

string? PlatformManifestDigest { get; init; } Source

Exact platform manifest digest selected from the index.

Property

ConfigDigest

string? ConfigDigest { get; init; } Source

Exact OCI config digest.

Property

DiffIds

ImmutableArray<string> DiffIds { get; init; } Source

Ordered OCI layer diff IDs.

Property

IndexMaterialId

string? IndexMaterialId { get; init; } Source

Recipe material ID containing the exact upstream index JSON.

Type

KeycloakMaterialReference

Source

One explicitly authorized, bounded material input.

Property

CapturedHostInput

bool CapturedHostInput { get; init; } Source

True when bytes are host-captured and have no downloadable HTTPS URI.

Type

SignedRepositorySnapshot

Source

Signed repository snapshot identity and its finite package authority.

Property

KeyringMaterialId

string? KeyringMaterialId { get; init; } Source

Policy material ID containing the approved signing keyring.

Property

PackageIndexMaterialIds

ImmutableDictionary<string, string> PackageIndexMaterialIds { get; init; } Source

Relative package-index paths mapped to exact policy material IDs.

Type

RuntimePackageSpec

Source

One package in a captured runtime closure.

Property

MaterialId

string? MaterialId { get; init; } Source

Policy material ID containing the exact package bytes.

Type

KeycloakRemovedPackageSpec

Source

Identity of a package that must be absent from the resulting runtime; removed bytes are not captured.

Type

ArtifactCoordinate

Source

Coordinates for one Maven or package artifact.

Type

ArtifactReference

Source

A content-addressed artifact and its intended image destination.

Type

ArtifactReplacement

Source

One exact replacement in an alignment group.

Type

ArtifactReplacementGroup

Source

Complete, closed replacement membership; no implicit or extra members are allowed.

Method

Create

ArtifactReplacementGroup Create(string id, IEnumerable<ArtifactReplacement> replacements, IEnumerable<ArtifactCoordinate> requiredMembers)

Source

Copies caller collections into immutable storage.

Type

RuntimeProfile

Source

Versioned built-in runtime profile selection.

Method

Create

RuntimeProfile Create(string id, string version, string templateName, IEnumerable<string> supportedSourceProfiles)

Source

Copies source-profile identities into immutable storage.

Property

RuntimeOciIdentities

ImmutableArray<OciIdentity> RuntimeOciIdentities { get; init; } Source

Exact runtime OCI identities selected by platform.

Property

RepositorySnapshots

ImmutableArray<SignedRepositorySnapshot> RepositorySnapshots { get; init; } Source

Signed repository snapshots used by this profile.

Property

RequiredPackages

ImmutableArray<RuntimePackageSpec> RequiredPackages { get; init; } Source

Complete installed package closure.

Property

RemovedPackages

ImmutableArray<KeycloakRemovedPackageSpec> RemovedPackages { get; init; } Source

Packages that must be absent from the resulting runtime.

Property

ExpectedObservations

ImmutableArray<string> ExpectedObservations { get; init; } Source

Expected runtime user, entrypoint, certificates, and other observation IDs.

Type

EmbeddedArchiveReplacement

Source

Versioned built-in embedded archive transformation selection.

Property

ModuleSet

EmbeddedArchiveModuleSet? ModuleSet { get; init; } Source

Complete content-addressed source/replacement modules and image destination.

Type

EmbeddedArchiveModuleSet

Source

Complete source and replacement archive module material and destination.

Type

KeycloakOperation

Source

One of the deliberately closed recipe operation kinds.

Type

ArtifactReplacementGroupOperation

Source

Artifact alignment replacement operation.

Type

RuntimeProfileOperation

Source

Runtime profile operation.

Type

EmbeddedArchiveReplacementOperation

Source

Embedded archive replacement operation.

Type

KeycloakThemeInput

Source

Reviewed theme or captured-host input identified by a safe content digest.

Property

LocalInputId

string? LocalInputId { get; init; } Source

Recipe material ID for the exact local or remote bytes.

Property

DestinationPath

string? DestinationPath { get; init; } Source

Safe absolute image-internal destination for the reviewed theme input.

Type

KeycloakLocalInputBinding

Source

One explicitly bound local input used only during capture, never recipe identity.

Type

KeycloakCaptureInputs

Source

Host-owned capture bindings for a reviewed recipe; local paths never enter canonical recipe JSON.

Method

Create

KeycloakCaptureInputs Create(string reviewedRecipeId, IEnumerable<KeycloakLocalInputBinding> localInputs)

Source

Copies local capture bindings into immutable storage.

Type

KeycloakTemplateBaseline

Source

Reviewed upstream template baseline whose archive member and captured bytes must agree.

Type

KeycloakSecurityRecipe

Source

Immutable recipe declaration for a supported Keycloak transformation.

Method

Create

KeycloakSecurityRecipe Create(int schemaVersion, KeycloakImageIdentity sourceImage, IEnumerable<OciIdentity> runtimeFrontendOciIdentities, IEnumerable<KeycloakOperation> operations, KeycloakRecipeMode mode, IEnumerable<KeycloakThemeInput> themeInputs, IEnumerable<string> capturedHostInputs)

Source

Creates a recipe while copying all enumerable inputs.

Property

TemplateBaseline

KeycloakTemplateBaseline? TemplateBaseline { get; init; } Source

Reviewed upstream template baseline, required when a captured theme replaces FreeMarker templates.

Property

KeycloakVersion

string KeycloakVersion { get; init; } Source

Exact supported Keycloak version, such as 26.7.2.

Property

EntrypointPath

string EntrypointPath { get; init; } Source

Reviewed image-internal entrypoint path; never a command string.

Property

MaterialReferences

ImmutableArray<KeycloakMaterialReference> MaterialReferences { get; init; } Source

Explicit content-addressed materials referenced by this recipe.

Property

SourceProfiles

ImmutableArray<string> SourceProfiles { get; init; } Source

Explicit source profile identities selected by the recipe.

Property

ResourceLimits

KeycloakResourceLimits ResourceLimits { get; init; } Source

Finite acquisition and transformation bounds.

Type

KeycloakMaterialTrustPolicy

Source

Exact HTTPS origin authorization and material digest binding.

Method

Create

KeycloakMaterialTrustPolicy Create(string version, string ownerApprovalReference, IEnumerable<string> origins, IEnumerable<string> paths, IEnumerable<string> coordinates, IEnumerable<KeyValuePair<string, string>> materialDigests, IEnumerable<string> fingerprints, IEnumerable<string> algorithms, IEnumerable<string> withdrawnKeys, IEnumerable<string> historicalExactReleaseBytes)

Source

Creates a policy with immutable copies of all collection inputs.

Type

KeycloakResourceLimits

Source

Explicit finite limits that participate in recipe identity.

Type

KeycloakCorrelationId

Source

Opaque correlation identity suitable for logs and support requests.

Type

KeycloakSecurityException

Source

Safe, noninteractive typed failure. Cause text and machine paths are intentionally excluded.

Property

Code

KeycloakFailureCode Code { get; } Source

Stable failure code.

Property

Phase

KeycloakSafePhase Phase { get; } Source

Safe phase.

Property

OperationId

string OperationId { get; } Source

Safe operation identity.

Property

Effect

KeycloakEffectState Effect { get; } Source

Observed side-effect state.

Property

Recovery

KeycloakRecoveryClass Recovery { get; } Source

Permitted recovery class.

Property

NextAction

string NextAction { get; } Source

Safe corrective action.

Property

CorrelationId

KeycloakCorrelationId CorrelationId { get; } Source

Opaque correlation value.

Property

DiagnosticReference

string DiagnosticReference { get; } Source

Stable documentation reference for this failure code.

Property

ProfileKey

string ProfileKey { get; } Source

Safe profile or operation key for boundary diagnostics.

Property

RetryMetadata

KeycloakRetryMetadata RetryMetadata { get; } Source

Retry guidance computed from the stable recovery and effect fields.

Type

KeycloakRetryMetadata

Source

Whether one explicit fresh invocation may be attempted after a transient result.

Method

For

KeycloakRetryMetadata For(KeycloakRecoveryClass recovery, KeycloakEffectState effect)

Source

Computes bounded retry guidance from the exception's stable fields.

Property

None

KeycloakRetryMetadata None { get; } Source

No automatic retry metadata, as required by the recipe contract.

Property

ExplicitTransientOnce

KeycloakRetryMetadata ExplicitTransientOnce { get; } Source

Metadata for an eligible transient acquisition or read-only probe failure.

Property

InspectBeforeRetry

KeycloakRetryMetadata InspectBeforeRetry { get; } Source

Metadata for an uncertain effect.

Type

ContextMaterialization

Source

Method

TryDelete

void TryDelete(string path)

Source

Deletes an owned staging directory, tolerating only expected filesystem cleanup failures.

Type

CapturedKeycloakPlan

Source

A read-only captured plan whose accepted operations own their private verified input copies.

Remarks

Disposal prevents new consumers. It never deletes the caller-owned snapshot; remove it only after all operations return.

Method

Dispose

void Dispose()

Source

Prevents new consumers while preserving accepted operations and caller-owned files.

Property

Digest

string Digest { get; } Source

The canonical content identity including recipe, host policy, and captured bytes.

Property

RecipeDigest

string RecipeDigest { get; } Source

The canonical recipe content identity.

Property

PolicyDigest

string PolicyDigest { get; } Source

The host policy content identity accepted during capture.

Property

Platform

string Platform { get; } Source

The explicit target image platform.

Property

Mode

KeycloakRecipeMode Mode { get; } Source

The declared inspection scope.

Type

KeycloakInspectionImage

Source

Exact final image identity selected by the host for inspection.

Parameters

ManifestDigest
The immutable selected platform manifest digest.
ConfigDigest
The exact OCI config digest.
Platform
The explicit Linux image platform.
DiffIds
The ordered uncompressed rootfs layer identities.

Type

DockerInspection

Source

The supported Docker 29 immutable export and read-only runtime handoff.

Type

OciLayout

Source

Copies a verified, finite OCI graph into an owned local builder input.

Type

KeycloakObservedCheck

Source

One observed conformance check; no release or vulnerability policy is implied.

Parameters

Id
Stable check identity.
Expected
Safe expected content or configuration identity.
Observed
Actual safe observed identity.

Property

OperationId

string OperationId { get; init; } Source

The declared operation, theme input, or fixed profile owning this observation.

Property

Outcome

string Outcome { get; } Source

Only passing observations belong to returned evidence; failures throw a typed diagnostic.

Type

KeycloakObservedImageInput

Source

Safe input-image identity retained with an inspection result.

Parameters

Role
The recipe-local input role.
IndexDigest
Exact upstream index digest.
ManifestDigest
Selected platform manifest digest.
ConfigDigest
Exact image config digest.
Platform
The explicit image platform.

Type

KeycloakObservedProfile

Source

Versioned framework operation that was evaluated.

Parameters

OperationId
Declared stable operation identity.
Family
The closed operation family.
Version
The evaluated profile or transformer version.

Type

VerifiedKeycloakImageEvidence

Source

Passing observations created only by the supported exact-image inspector.

Method

WriteAsync

Task<string> WriteAsync(string absentFile, CancellationToken cancellationToken = default)

Source

Writes observations once to a fresh caller-owned evidence path.

Parameters

absentFile
The absent local evidence file.
cancellationToken
Cancels before publication.

Returns

The absolute published evidence path.

Property

Schema

string Schema { get; } Source

Stable evidence schema; unknown versions require a coordinated upgrade.

Property

PlanDigest

string PlanDigest { get; } Source

The exact captured plan content identity.

Property

RecipeDigest

string RecipeDigest { get; } Source

The canonical recipe accepted during capture.

Property

PolicyDigest

string PolicyDigest { get; } Source

The independently approved host policy accepted during capture.

Property

InputImages

ImmutableArray<KeycloakObservedImageInput> InputImages { get; } Source

Safe source, runtime and frontend input identities evaluated by this inspection.

Property

Profiles

ImmutableArray<KeycloakObservedProfile> Profiles { get; } Source

The evaluated closed operation profile versions.

Property

TemplateBaselineSha256

string? TemplateBaselineSha256 { get; } Source

The reviewed upstream template hash, when required by the recipe.

Property

InspectorVersion

string InspectorVersion { get; } Source

The exact framework inspector implementation profile.

Property

TransformerVersion

string TransformerVersion { get; } Source

The deterministic archive transformer implementation profile.

Property

Image

KeycloakInspectionImage Image { get; } Source

The exact inspected image content, config, platform, and rootfs identities.

Property

Mode

KeycloakRecipeMode Mode { get; } Source

The scope actually evaluated by this inspection.

Property

Checks

ImmutableArray<KeycloakObservedCheck> Checks { get; } Source

Complete passing observations for the declared scope.

Property

Outcome

string Outcome { get; } Source

Human-readable outcome with an explicit release boundary.

Type

AtomicFilePublication

Source

Publishes a complete owned file through a single create-if-absent filesystem operation.

Type

KeycloakCanonicalJson

Source

Canonical schema-1 JSON serialization for recipes and trust policies.

Method

Write

2 overloads

byte[] Write(KeycloakSecurityRecipe recipe)

Source

Serializes every recipe field, including every nested operation and material reference.

byte[] Write(KeycloakMaterialTrustPolicy policy)

Source

Serializes the separately owned material trust policy.

Method

ReadRecipe

KeycloakSecurityRecipe ReadRecipe(ReadOnlySpan<byte> utf8Json)

Source

Strictly deserializes a complete recipe and all nested operations.

Method

ReadPolicy

KeycloakMaterialTrustPolicy ReadPolicy(ReadOnlySpan<byte> utf8Json)

Source

Strictly deserializes every trust-policy field.

Method

Read

KeycloakSecurityRecipe Read(ReadOnlySpan<byte> utf8Json)

Source

Compatibility name for the strict recipe reader.

Type

TemporaryDiskBudget

Source

Conservatively bounds cumulative owned output writes across one public invocation.

Remarks

Deleted staging bytes remain charged. Nested phases share the budget; unrelated invocations do not.

Type

KeycloakRecipeValidation

Source

Validates closed recipe and host trust-policy declarations before effects.

Method

Validate

3 overloads

KeycloakSecurityRecipe Validate(KeycloakSecurityRecipe recipe)

Source

Validates schema, required fields, duplicate IDs, empty groups, overlap, and supported operation shapes.

KeycloakCaptureInputs Validate(KeycloakCaptureInputs inputs)

Source

Validates host-local capture bindings separately from recipe identity.

KeycloakMaterialTrustPolicy Validate(KeycloakMaterialTrustPolicy policy)

Source

Validates policy version, owner approval, exact origins, and material digests without network access.

Method

RetryFor

KeycloakRetryMetadata RetryFor(KeycloakEffectState effect, bool transientNetworkOrReadOnlyProbe, bool verifiedCleanedStaging = false, int previousExplicitAttempts = 0)

Source

Returns recommendation metadata only; it never performs a retry.

Type

KeycloakCanonicalization

Source

Canonical HTTPS URI boundary validation.

Method

CanonicalizeHttpsUri

string CanonicalizeHttpsUri(string value)

Source

Canonicalizes HTTPS DNS URIs and rejects userinfo, fragments, IP hosts, encoded separators, and dot segments.

Type

ApprovedMaterial

Source

One exact host-approved material association. URLs do not authorize one another.

Type

AcquiredMaterial

Source

Records an origin authorization for portable plan provenance.

Type

MaterialAcquisitionException

Source

A safe acquisition classification; no untrusted response text or URI reaches the exception.

Type

MaterialAcquisition

Source

Acquires one approved material once, with exact redirect matching and bounded hashing.

Type

CaptureFile

Source

A source binding used only at capture; its local path is excluded from canonical identity.

Type

SnapshotFile

Source

Captured relative identity and metadata, independent of the source workspace.

Type

InvocationLimits

Source

Optional per-invocation resource limits shared by private infrastructure operations.

Type

SnapshotHandle

Source

Owns entry acceptance only. Disposal never deletes committed caller-owned snapshots.

Type

SnapshotStore

Source

Creates and revalidates a focused content-addressed snapshot directory.

Type

SignedRepository

Source

Private bounded verifier for an exact Debian signed repository snapshot.

Method

VerifyRelease

2 overloads

VerificationResult VerifyRelease(Stream boundedCapturedRelease, Stream boundedKeyring, string expectedReleaseSha256, string expectedKeyringSha256, string exactSignerFingerprint, VerificationPolicy policy, IEnumerable<RequestedPackage> requestedPackages, CancellationToken cancellationToken = default)

Source

Verifies canonical text, signer policy, and the exact signed package index records.

VerificationResult VerifyRelease(Stream boundedCapturedRelease, Stream boundedKeyring, string expectedReleaseSha256, string expectedKeyringSha256, string exactSignerFingerprint, VerificationPolicy policy, IEnumerable<RequestedPackage> requestedPackages, IReadOnlyDictionary<string, Stream>? capturedPackageIndexes, CancellationToken cancellationToken = default)

Source

Verifies a snapshot and reads only the captured package indexes named by its signed SHA256 table.

Enum

ProcessStopReason

Source

Identifies the bounded execution stage that stopped a private process.

Enum

KeycloakStagePhase

Source

Bounded public phases emitted by one recipe invocation.

Enum

KeycloakStageOutcome

Source

Outcome of a bounded stage event.

Enum

KeycloakRecipeMode

Source

Recipe operation mode.

Enum

KeycloakSafePhase

Source

Stable stage at which an operation stopped.

Enum

KeycloakEffectState

Source

Known effect state after a failed operation.

Enum

KeycloakRecoveryClass

Source

Recovery class exposed to noninteractive callers.

Enum

KeycloakFailureCode

Source

Stable failure categories; enum names are canonical serialized values.