up

src/__Libraries/StellaOps.Cryptography.DependencyInjection/CryptoProviderRegistryOptions.cs

@@ -13,15 +13,38 @@ public sealed class CryptoProviderRegistryOptions
     private readonly Dictionary<string, CryptoProviderProfileOptions> profiles =
         new(StringComparer.OrdinalIgnoreCase);
 
+    /// <summary>
+    /// Registry configuration factory that aligns with the 2025-11-18 sovereign crypto decision.
+    /// </summary>
+    public static CryptoProviderRegistryOptions SovereignDefault()
+    {
+        var options = new CryptoProviderRegistryOptions
+        {
+            ActiveProfile = "ru-offline"
+        };
+
+        options.PreferredProviders.Add("default");
+        options.PreferredProviders.Add("ru.openssl.gost");
+        options.PreferredProviders.Add("ru.pkcs11");
+
+        var ruOffline = new CryptoProviderProfileOptions();
+        ruOffline.PreferredProviders.Add("ru.cryptopro.csp");
+        ruOffline.PreferredProviders.Add("ru.openssl.gost");
+        ruOffline.PreferredProviders.Add("ru.pkcs11");
+        options.Profiles["ru-offline"] = ruOffline;
+
+        return options;
+    }
+
     /// <summary>
     /// Ordered list of preferred provider names. Providers appearing here are consulted first.
     /// </summary>
     public IList<string> PreferredProviders { get; } = new List<string>();
 
     /// <summary>
-    /// Optional active profile name (e.g. "ru-offline") that overrides <see cref="PreferredProviders"/>.
+    /// Active profile name (e.g. "ru-offline") that overrides <see cref="PreferredProviders"/>.
     /// </summary>
-    public string? ActiveProfile { get; set; }
+    public string ActiveProfile { get; set; } = "default";
 
     /// <summary>
     /// Regional or environment-specific provider preference profiles.