up

src/StellaOps.Cryptography/CryptoProvider.cs

@@ -29,6 +29,32 @@ public interface ICryptoProvider
     bool Supports(CryptoCapability capability, string algorithmId);
 
     IPasswordHasher GetPasswordHasher(string algorithmId);
+
+    /// <summary>
+    /// Retrieves a signer for the supplied algorithm and key reference.
+    /// </summary>
+    /// <param name="algorithmId">Signing algorithm identifier (e.g., ES256).</param>
+    /// <param name="keyReference">Key reference.</param>
+    /// <returns>Signer instance.</returns>
+    ICryptoSigner GetSigner(string algorithmId, CryptoKeyReference keyReference);
+
+    /// <summary>
+    /// Adds or replaces signing key material managed by this provider.
+    /// </summary>
+    /// <param name="signingKey">Key material descriptor.</param>
+    void UpsertSigningKey(CryptoSigningKey signingKey);
+
+    /// <summary>
+    /// Removes signing key material by key identifier.
+    /// </summary>
+    /// <param name="keyId">Identifier to remove.</param>
+    /// <returns><c>true</c> if the key was removed.</returns>
+    bool RemoveSigningKey(string keyId);
+
+    /// <summary>
+    /// Lists signing key descriptors managed by this provider.
+    /// </summary>
+    IReadOnlyCollection<CryptoSigningKey> GetSigningKeys();
 }
 
 /// <summary>
@@ -41,4 +67,18 @@ public interface ICryptoProviderRegistry
     bool TryResolve(string preferredProvider, out ICryptoProvider provider);
 
     ICryptoProvider ResolveOrThrow(CryptoCapability capability, string algorithmId);
+
+    /// <summary>
+    /// Resolves a signer for the supplied algorithm and key reference using registry policy.
+    /// </summary>
+    /// <param name="capability">Capability required (typically <see cref="CryptoCapability.Signing"/>).</param>
+    /// <param name="algorithmId">Algorithm identifier.</param>
+    /// <param name="keyReference">Key reference.</param>
+    /// <param name="preferredProvider">Optional provider hint.</param>
+    /// <returns>Resolved signer.</returns>
+    ICryptoSigner ResolveSigner(
+        CryptoCapability capability,
+        string algorithmId,
+        CryptoKeyReference keyReference,
+        string? preferredProvider = null);
 }