class

Cri::Auth::Broker

Host-only authentication broker. Extensions receive CredentialRef values at most; the secret remains inside the host and its provider adapter.

Constructors

new(store : CredentialStore = CredentialStore.default)

existing(provider_id : String, flow_id : String) : CredentialRef | Nil

import_api_token(provider_id : String, flow_id : String, token : String) : CredentialRef

import_env(provider_id : String, flow_id : String, env_name : String) : CredentialRef | Nil

import_opaque(provider_id : String, flow_id : String, value : String) : CredentialRef

logout(provider_id : String, flow_id : String)

provider(id : String) : Provider

providers

remove(ref : CredentialRef)

secret(ref : CredentialRef) : String

This is intentionally a host-side operation. Do not pass Broker or Credential objects through extension/WASM input.

store