@naylence/runtime 0.3.5-test.923 → 0.3.5-test.925

package/dist/cjs/naylence/fame/factory-manifest.js

@@ -96,6 +96,7 @@ exports.MODULES = [
     "./security/policy/no-security-policy-factory.js",
     "./security/signing/eddsa-envelope-signer-factory.js",
     "./security/signing/eddsa-envelope-verifier-factory.js",
+    "./security/trust-store/noop-trust-store-provider-factory.js",
     "./sentinel/capability-aware-routing-policy-factory.js",
     "./sentinel/composite-routing-policy-factory.js",
     "./sentinel/hybrid-path-routing-policy-factory.js",
@@ -170,6 +171,7 @@ exports.MODULE_LOADERS = {
     "./security/policy/no-security-policy-factory.js": () => Promise.resolve().then(() => __importStar(require("./security/policy/no-security-policy-factory.js"))),
     "./security/signing/eddsa-envelope-signer-factory.js": () => Promise.resolve().then(() => __importStar(require("./security/signing/eddsa-envelope-signer-factory.js"))),
     "./security/signing/eddsa-envelope-verifier-factory.js": () => Promise.resolve().then(() => __importStar(require("./security/signing/eddsa-envelope-verifier-factory.js"))),
+    "./security/trust-store/noop-trust-store-provider-factory.js": () => Promise.resolve().then(() => __importStar(require("./security/trust-store/noop-trust-store-provider-factory.js"))),
     "./sentinel/capability-aware-routing-policy-factory.js": () => Promise.resolve().then(() => __importStar(require("./sentinel/capability-aware-routing-policy-factory.js"))),
     "./sentinel/composite-routing-policy-factory.js": () => Promise.resolve().then(() => __importStar(require("./sentinel/composite-routing-policy-factory.js"))),
     "./sentinel/hybrid-path-routing-policy-factory.js": () => Promise.resolve().then(() => __importStar(require("./sentinel/hybrid-path-routing-policy-factory.js"))),

package/dist/cjs/naylence/fame/security/default-security-manager-factory.js

@@ -15,6 +15,7 @@ const envelope_verifier_js_1 = require("./signing/envelope-verifier.js");
 const default_security_manager_js_1 = require("./default-security-manager.js");
 const security_manager_factory_js_1 = require("./security-manager-factory.js");
 const logging_js_1 = require("../util/logging.js");
+const trust_store_provider_factory_js_1 = require("./trust-store/trust-store-provider-factory.js");
 const logger = (0, logging_js_1.getLogger)('naylence.fame.security.default_security_manager_factory');
 function normalizeDefaultSecurityManagerConfig(config) {
     if (!config) {
@@ -47,6 +48,7 @@ function normalizeDefaultSecurityManagerConfig(config) {
     ensureAlias('keyValidator', 'key_validator');
     ensureAlias('eventListeners', 'event_listeners');
     ensureAlias('cryptoProvider', 'crypto_provider');
+    ensureAlias('trustStoreProvider', 'trust_store_provider');
     return normalized;
 }
 exports.FACTORY_META = {
@@ -95,6 +97,7 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
         const certificateManager = DefaultSecurityManagerFactory.extractInstance(config, 'certificateManager', 'certificate_manager');
         const secureChannelManager = DefaultSecurityManagerFactory.extractInstance(config, 'secureChannelManager', 'secure_channel_manager');
         const cryptoProvider = DefaultSecurityManagerFactory.extractInstance(config, 'cryptoProvider', 'crypto_provider');
+        const trustStoreProvider = DefaultSecurityManagerFactory.extractInstance(config, 'trustStoreProvider', 'trust_store_provider');
         const listenersSource = overrides?.eventListeners ??
             config.eventListeners ??
             config.event_listeners;
@@ -114,10 +117,11 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
             secureChannelManager,
             eventListeners,
             cryptoProvider: cryptoProvider ?? null,
+            trustStoreProvider: trustStoreProvider ?? null,
         };
     }
     static async buildSecurityManager(options) {
-        let { config, createOptions, policy, envelopeSigner, envelopeVerifier, encryptionManager, keyStore, keyManager, keyValidator, authorizer, certificateManager, secureChannelManager, eventListeners, cryptoProvider, } = options;
+        let { config, createOptions, policy, envelopeSigner, envelopeVerifier, encryptionManager, keyStore, keyManager, keyValidator, authorizer, certificateManager, secureChannelManager, eventListeners, cryptoProvider, trustStoreProvider, } = options;
         if (!keyStore) {
             keyStore = await DefaultSecurityManagerFactory.getOrCreateKeyStore(config, createOptions ?? null);
         }
@@ -130,6 +134,10 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
         if (!policy) {
             throw new Error('DefaultSecurityManagerFactory could not resolve a SecurityPolicy');
         }
+        if (!trustStoreProvider) {
+            trustStoreProvider =
+                await trust_store_provider_factory_js_1.TrustStoreProviderFactory.createTrustStoreProvider();
+        }
         if (!keyManager) {
             keyManager =
                 await DefaultSecurityManagerFactory.createKeyManagerFromConfig(config, policy, keyStore, createOptions ?? null);
@@ -140,7 +148,7 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
         }
         if (!envelopeVerifier) {
             envelopeVerifier =
-                await DefaultSecurityManagerFactory.createEnvelopeVerifierFromConfig(config, policy, keyManager);
+                await DefaultSecurityManagerFactory.createEnvelopeVerifierFromConfig(config, policy, keyManager, trustStoreProvider);
         }
         if (!encryptionManager || !secureChannelManager) {
             const encryptionResult = await DefaultSecurityManagerFactory.createEncryptionManagerFromConfig(config, policy, keyManager, secureChannelManager, cryptoProvider ?? null);
@@ -160,7 +168,7 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
         }
         if (!certificateManager) {
             certificateManager =
-                await DefaultSecurityManagerFactory.createCertificateManagerFromConfig(config, policy);
+                await DefaultSecurityManagerFactory.createCertificateManagerFromConfig(config, policy, trustStoreProvider);
         }
         return new default_security_manager_js_1.DefaultSecurityManager(policy, envelopeSigner, envelopeVerifier, encryptionManager, keyManager, authorizer, certificateManager, secureChannelManager, keyValidator ?? null);
     }
@@ -240,7 +248,7 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
             throw error instanceof Error ? error : new Error(String(error));
         }
     }
-    static async createEnvelopeVerifierFromConfig(config, policy, keyManager) {
+    static async createEnvelopeVerifierFromConfig(config, policy, keyManager, trustStoreProvider) {
         const verifierConfig = config.envelope_verifier ?? config.envelopeVerifier ?? null;
         if (verifierConfig &&
             DefaultSecurityManagerFactory.isConfigLike(verifierConfig)) {
@@ -264,7 +272,7 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
             }
             const signing = policy.signing ?? null;
             return await envelope_verifier_js_1.EnvelopeVerifierFactory.createEnvelopeVerifier(null, {
-                factoryArgs: [keyManager, signing ?? null],
+                factoryArgs: [keyManager, signing ?? null, { trustStoreProvider }],
             });
         }
         catch (error) {
@@ -416,7 +424,7 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
             throw error instanceof Error ? error : new Error(String(error));
         }
     }
-    static async createCertificateManagerFromConfig(config, policy) {
+    static async createCertificateManagerFromConfig(config, policy, trustStoreProvider) {
         const certificateConfig = config.certificate_manager ?? null;
         if (certificateConfig &&
             DefaultSecurityManagerFactory.isConfigLike(certificateConfig)) {
@@ -429,8 +437,12 @@ class DefaultSecurityManagerFactory extends security_manager_factory_js_1.Securi
                 return null;
             }
             const signing = policy.signing ?? null;
+            const trustStorePem = trustStoreProvider
+                ? async () => await trustStoreProvider.getTrustStorePem()
+                : null;
             return await certificate_manager_factory_js_1.CertificateManagerFactory.createCertificateManager(null, {
                 signing: signing ?? null,
+                factoryArgs: trustStorePem ? [trustStorePem] : [],
             });
         }
         catch (error) {

package/dist/cjs/naylence/fame/security/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PROFILE_NAME_OPEN = exports.PROFILE_NAME_GATED_CALLBACK = exports.PROFILE_NAME_GATED = exports.PROFILE_NAME_OVERLAY_CALLBACK = exports.PROFILE_NAME_OVERLAY = exports.PROFILE_NAME_STRICT_OVERLAY = exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.ENV_VAR_HMAC_SECRET = exports.ENV_VAR_DEFAULT_ENCRYPTION_LEVEL = exports.ENV_VAR_JWKS_URL = exports.ENV_VAR_JWT_AUDIENCE = exports.ENV_VAR_JWT_ALGORITHM = exports.ENV_VAR_JWT_TRUSTED_ISSUER = exports.CREDENTIAL_PROVIDER_FACTORY_BASE_TYPE = exports.EdDSAEnvelopeSigner = exports.encodeUtf8 = exports.immutableHeaders = exports.frameDigest = exports.decodeBase64Url = exports.canonicalJson = exports.SigningConfigClass = exports.SECURITY_MANAGER_FACTORY_BASE_TYPE = exports.SECURITY_POLICY_FACTORY_BASE_TYPE = exports.KEY_STORE_FACTORY_BASE_TYPE = exports.ATTACHMENT_KEY_VALIDATOR_FACTORY_BASE_TYPE = exports.KEY_MANAGER_FACTORY_BASE_TYPE = exports.SecureChannelManagerFactory = exports.SECURE_CHANNEL_MANAGER_FACTORY_BASE_TYPE = exports.ENCRYPTION_MANAGER_FACTORY_BASE_TYPE = exports.CertificateManagerFactory = exports.CERTIFICATE_MANAGER_FACTORY_BASE_TYPE = exports.TokenProviderFactory = exports.TOKEN_PROVIDER_FACTORY_BASE_TYPE = exports.TokenVerifierFactory = exports.TOKEN_VERIFIER_FACTORY_BASE_TYPE = exports.TokenIssuerFactory = exports.TOKEN_ISSUER_FACTORY_BASE_TYPE = exports.AuthInjectionStrategyFactory = exports.AUTH_INJECTION_STRATEGY_FACTORY_BASE_TYPE = exports.AuthorizerFactory = exports.AUTHORIZER_FACTORY_BASE_TYPE = void 0;
+exports.PROFILE_NAME_OPEN = exports.PROFILE_NAME_GATED_CALLBACK = exports.PROFILE_NAME_GATED = exports.PROFILE_NAME_OVERLAY_CALLBACK = exports.PROFILE_NAME_OVERLAY = exports.PROFILE_NAME_STRICT_OVERLAY = exports.ENV_VAR_JWT_REVERSE_AUTH_AUDIENCE = exports.ENV_VAR_JWT_REVERSE_AUTH_TRUSTED_ISSUER = exports.ENV_VAR_HMAC_SECRET = exports.ENV_VAR_DEFAULT_ENCRYPTION_LEVEL = exports.ENV_VAR_JWKS_URL = exports.ENV_VAR_JWT_AUDIENCE = exports.ENV_VAR_JWT_ALGORITHM = exports.ENV_VAR_JWT_TRUSTED_ISSUER = exports.CREDENTIAL_PROVIDER_FACTORY_BASE_TYPE = exports.EdDSAEnvelopeSigner = exports.encodeUtf8 = exports.immutableHeaders = exports.frameDigest = exports.decodeBase64Url = exports.canonicalJson = exports.SigningConfigClass = exports.SECURITY_MANAGER_FACTORY_BASE_TYPE = exports.SECURITY_POLICY_FACTORY_BASE_TYPE = exports.KEY_STORE_FACTORY_BASE_TYPE = exports.ATTACHMENT_KEY_VALIDATOR_FACTORY_BASE_TYPE = exports.KEY_MANAGER_FACTORY_BASE_TYPE = exports.SecureChannelManagerFactory = exports.SECURE_CHANNEL_MANAGER_FACTORY_BASE_TYPE = exports.ENCRYPTION_MANAGER_FACTORY_BASE_TYPE = exports.NoopTrustStoreProvider = exports.TrustStoreProviderFactory = exports.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE = exports.CertificateManagerFactory = exports.CERTIFICATE_MANAGER_FACTORY_BASE_TYPE = exports.TokenProviderFactory = exports.TOKEN_PROVIDER_FACTORY_BASE_TYPE = exports.TokenVerifierFactory = exports.TOKEN_VERIFIER_FACTORY_BASE_TYPE = exports.TokenIssuerFactory = exports.TOKEN_ISSUER_FACTORY_BASE_TYPE = exports.AuthInjectionStrategyFactory = exports.AUTH_INJECTION_STRATEGY_FACTORY_BASE_TYPE = exports.AuthorizerFactory = exports.AUTHORIZER_FACTORY_BASE_TYPE = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./auth/authorizer.js"), exports);
 var authorizer_factory_js_1 = require("./auth/authorizer-factory.js");
@@ -28,6 +28,11 @@ tslib_1.__exportStar(require("./cert/certificate-manager.js"), exports);
 var certificate_manager_factory_js_1 = require("./cert/certificate-manager-factory.js");
 Object.defineProperty(exports, "CERTIFICATE_MANAGER_FACTORY_BASE_TYPE", { enumerable: true, get: function () { return certificate_manager_factory_js_1.CERTIFICATE_MANAGER_FACTORY_BASE_TYPE; } });
 Object.defineProperty(exports, "CertificateManagerFactory", { enumerable: true, get: function () { return certificate_manager_factory_js_1.CertificateManagerFactory; } });
+tslib_1.__exportStar(require("./trust-store/trust-store-provider.js"), exports);
+var trust_store_provider_factory_js_1 = require("./trust-store/trust-store-provider-factory.js");
+Object.defineProperty(exports, "TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE", { enumerable: true, get: function () { return trust_store_provider_factory_js_1.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE; } });
+Object.defineProperty(exports, "TrustStoreProviderFactory", { enumerable: true, get: function () { return trust_store_provider_factory_js_1.TrustStoreProviderFactory; } });
+Object.defineProperty(exports, "NoopTrustStoreProvider", { enumerable: true, get: function () { return trust_store_provider_factory_js_1.NoopTrustStoreProvider; } });
 tslib_1.__exportStar(require("./encryption/encryption-manager.js"), exports);
 var encryption_manager_factory_js_1 = require("./encryption/encryption-manager-factory.js");
 Object.defineProperty(exports, "ENCRYPTION_MANAGER_FACTORY_BASE_TYPE", { enumerable: true, get: function () { return encryption_manager_factory_js_1.ENCRYPTION_MANAGER_FACTORY_BASE_TYPE; } });

package/dist/cjs/naylence/fame/security/trust-store/noop-trust-store-provider-factory.js

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoopTrustStoreProviderFactory = exports.FACTORY_META = void 0;
+const trust_store_provider_factory_js_1 = require("./trust-store-provider-factory.js");
+exports.FACTORY_META = {
+    base: trust_store_provider_factory_js_1.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE,
+    key: "NoopTrustStoreProvider",
+    isDefault: true,
+    priority: 10,
+};
+class NoopTrustStoreProviderFactory extends trust_store_provider_factory_js_1.TrustStoreProviderFactory {
+    constructor() {
+        super(...arguments);
+        this.type = "NoopTrustStoreProvider";
+        this.isDefault = true;
+        this.priority = 10;
+    }
+    async create(_config, ..._factoryArgs) {
+        return new trust_store_provider_factory_js_1.NoopTrustStoreProvider();
+    }
+}
+exports.NoopTrustStoreProviderFactory = NoopTrustStoreProviderFactory;
+exports.default = NoopTrustStoreProviderFactory;

package/dist/cjs/naylence/fame/security/trust-store/trust-store-provider-factory.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NoopTrustStoreProvider = exports.TrustStoreProviderFactory = exports.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE = void 0;
+const factory_1 = require("@naylence/factory");
+const DEFAULT_UNCONFIGURED_MESSAGE = "Trust store is not configured. Set FAME_CA_CERTS to a PEM value, a file path, a data URI, or an HTTPS bundle URL.";
+exports.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE = "TrustStoreProviderFactory";
+class TrustStoreProviderFactory extends factory_1.AbstractResourceFactory {
+    createUnconfiguredProvider(reason) {
+        return new NoopTrustStoreProvider(reason ?? DEFAULT_UNCONFIGURED_MESSAGE);
+    }
+    static async createTrustStoreProvider(config, options = {}) {
+        const { dependencies, factoryArgs, ...restOptions } = options;
+        const mergedFactoryArgs = [
+            ...(dependencies ? [dependencies] : []),
+            ...(factoryArgs ?? []),
+        ];
+        const creationOptions = {
+            ...restOptions,
+            factoryArgs: mergedFactoryArgs,
+        };
+        if (config) {
+            const instance = await (0, factory_1.createResource)(exports.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE, config, creationOptions);
+            return instance ?? new NoopTrustStoreProvider();
+        }
+        const instance = await (0, factory_1.createDefaultResource)(exports.TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE, null, creationOptions);
+        return instance ?? new NoopTrustStoreProvider();
+    }
+}
+exports.TrustStoreProviderFactory = TrustStoreProviderFactory;
+class NoopTrustStoreProvider {
+    constructor(reason = DEFAULT_UNCONFIGURED_MESSAGE) {
+        this.reason = reason;
+    }
+    async getTrustStorePem() {
+        throw new Error(this.reason);
+    }
+    async getRoots() {
+        return [];
+    }
+    async initialize() {
+        // No-op for the placeholder provider.
+    }
+}
+exports.NoopTrustStoreProvider = NoopTrustStoreProvider;

package/dist/cjs/naylence/fame/security/trust-store/trust-store-provider.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/version.js

@@ -1,10 +1,10 @@
 "use strict";
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.5-test.923
+// Generated from package.json version: 0.3.5-test.925
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VERSION = void 0;
 /**
  * The package version, injected at build time.
  * @internal
  */
-exports.VERSION = '0.3.5-test.923';
+exports.VERSION = '0.3.5-test.925';

package/dist/esm/naylence/fame/factory-manifest.js

@@ -60,6 +60,7 @@ export const MODULES = [
     "./security/policy/no-security-policy-factory.js",
     "./security/signing/eddsa-envelope-signer-factory.js",
     "./security/signing/eddsa-envelope-verifier-factory.js",
+    "./security/trust-store/noop-trust-store-provider-factory.js",
     "./sentinel/capability-aware-routing-policy-factory.js",
     "./sentinel/composite-routing-policy-factory.js",
     "./sentinel/hybrid-path-routing-policy-factory.js",
@@ -134,6 +135,7 @@ export const MODULE_LOADERS = {
     "./security/policy/no-security-policy-factory.js": () => import("./security/policy/no-security-policy-factory.js"),
     "./security/signing/eddsa-envelope-signer-factory.js": () => import("./security/signing/eddsa-envelope-signer-factory.js"),
     "./security/signing/eddsa-envelope-verifier-factory.js": () => import("./security/signing/eddsa-envelope-verifier-factory.js"),
+    "./security/trust-store/noop-trust-store-provider-factory.js": () => import("./security/trust-store/noop-trust-store-provider-factory.js"),
     "./sentinel/capability-aware-routing-policy-factory.js": () => import("./sentinel/capability-aware-routing-policy-factory.js"),
     "./sentinel/composite-routing-policy-factory.js": () => import("./sentinel/composite-routing-policy-factory.js"),
     "./sentinel/hybrid-path-routing-policy-factory.js": () => import("./sentinel/hybrid-path-routing-policy-factory.js"),

package/dist/esm/naylence/fame/security/default-security-manager-factory.js

@@ -12,6 +12,7 @@ import { EnvelopeVerifierFactory } from './signing/envelope-verifier.js';
 import { DefaultSecurityManager } from './default-security-manager.js';
 import { SecurityManagerFactory, SECURITY_MANAGER_FACTORY_BASE_TYPE, } from './security-manager-factory.js';
 import { getLogger } from '../util/logging.js';
+import { TrustStoreProviderFactory } from './trust-store/trust-store-provider-factory.js';
 const logger = getLogger('naylence.fame.security.default_security_manager_factory');
 function normalizeDefaultSecurityManagerConfig(config) {
     if (!config) {
@@ -44,6 +45,7 @@ function normalizeDefaultSecurityManagerConfig(config) {
     ensureAlias('keyValidator', 'key_validator');
     ensureAlias('eventListeners', 'event_listeners');
     ensureAlias('cryptoProvider', 'crypto_provider');
+    ensureAlias('trustStoreProvider', 'trust_store_provider');
     return normalized;
 }
 export const FACTORY_META = {
@@ -92,6 +94,7 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
         const certificateManager = DefaultSecurityManagerFactory.extractInstance(config, 'certificateManager', 'certificate_manager');
         const secureChannelManager = DefaultSecurityManagerFactory.extractInstance(config, 'secureChannelManager', 'secure_channel_manager');
         const cryptoProvider = DefaultSecurityManagerFactory.extractInstance(config, 'cryptoProvider', 'crypto_provider');
+        const trustStoreProvider = DefaultSecurityManagerFactory.extractInstance(config, 'trustStoreProvider', 'trust_store_provider');
         const listenersSource = overrides?.eventListeners ??
             config.eventListeners ??
             config.event_listeners;
@@ -111,10 +114,11 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
             secureChannelManager,
             eventListeners,
             cryptoProvider: cryptoProvider ?? null,
+            trustStoreProvider: trustStoreProvider ?? null,
         };
     }
     static async buildSecurityManager(options) {
-        let { config, createOptions, policy, envelopeSigner, envelopeVerifier, encryptionManager, keyStore, keyManager, keyValidator, authorizer, certificateManager, secureChannelManager, eventListeners, cryptoProvider, } = options;
+        let { config, createOptions, policy, envelopeSigner, envelopeVerifier, encryptionManager, keyStore, keyManager, keyValidator, authorizer, certificateManager, secureChannelManager, eventListeners, cryptoProvider, trustStoreProvider, } = options;
         if (!keyStore) {
             keyStore = await DefaultSecurityManagerFactory.getOrCreateKeyStore(config, createOptions ?? null);
         }
@@ -127,6 +131,10 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
         if (!policy) {
             throw new Error('DefaultSecurityManagerFactory could not resolve a SecurityPolicy');
         }
+        if (!trustStoreProvider) {
+            trustStoreProvider =
+                await TrustStoreProviderFactory.createTrustStoreProvider();
+        }
         if (!keyManager) {
             keyManager =
                 await DefaultSecurityManagerFactory.createKeyManagerFromConfig(config, policy, keyStore, createOptions ?? null);
@@ -137,7 +145,7 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
         }
         if (!envelopeVerifier) {
             envelopeVerifier =
-                await DefaultSecurityManagerFactory.createEnvelopeVerifierFromConfig(config, policy, keyManager);
+                await DefaultSecurityManagerFactory.createEnvelopeVerifierFromConfig(config, policy, keyManager, trustStoreProvider);
         }
         if (!encryptionManager || !secureChannelManager) {
             const encryptionResult = await DefaultSecurityManagerFactory.createEncryptionManagerFromConfig(config, policy, keyManager, secureChannelManager, cryptoProvider ?? null);
@@ -157,7 +165,7 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
         }
         if (!certificateManager) {
             certificateManager =
-                await DefaultSecurityManagerFactory.createCertificateManagerFromConfig(config, policy);
+                await DefaultSecurityManagerFactory.createCertificateManagerFromConfig(config, policy, trustStoreProvider);
         }
         return new DefaultSecurityManager(policy, envelopeSigner, envelopeVerifier, encryptionManager, keyManager, authorizer, certificateManager, secureChannelManager, keyValidator ?? null);
     }
@@ -237,7 +245,7 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
             throw error instanceof Error ? error : new Error(String(error));
         }
     }
-    static async createEnvelopeVerifierFromConfig(config, policy, keyManager) {
+    static async createEnvelopeVerifierFromConfig(config, policy, keyManager, trustStoreProvider) {
         const verifierConfig = config.envelope_verifier ?? config.envelopeVerifier ?? null;
         if (verifierConfig &&
             DefaultSecurityManagerFactory.isConfigLike(verifierConfig)) {
@@ -261,7 +269,7 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
             }
             const signing = policy.signing ?? null;
             return await EnvelopeVerifierFactory.createEnvelopeVerifier(null, {
-                factoryArgs: [keyManager, signing ?? null],
+                factoryArgs: [keyManager, signing ?? null, { trustStoreProvider }],
             });
         }
         catch (error) {
@@ -413,7 +421,7 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
             throw error instanceof Error ? error : new Error(String(error));
         }
     }
-    static async createCertificateManagerFromConfig(config, policy) {
+    static async createCertificateManagerFromConfig(config, policy, trustStoreProvider) {
         const certificateConfig = config.certificate_manager ?? null;
         if (certificateConfig &&
             DefaultSecurityManagerFactory.isConfigLike(certificateConfig)) {
@@ -426,8 +434,12 @@ export class DefaultSecurityManagerFactory extends SecurityManagerFactory {
                 return null;
             }
             const signing = policy.signing ?? null;
+            const trustStorePem = trustStoreProvider
+                ? async () => await trustStoreProvider.getTrustStorePem()
+                : null;
             return await CertificateManagerFactory.createCertificateManager(null, {
                 signing: signing ?? null,
+                factoryArgs: trustStorePem ? [trustStorePem] : [],
             });
         }
         catch (error) {

package/dist/esm/naylence/fame/security/index.js

@@ -12,6 +12,8 @@ export { TOKEN_PROVIDER_FACTORY_BASE_TYPE, TokenProviderFactory, } from './auth/
 export * from './auth/token.js';
 export * from './cert/certificate-manager.js';
 export { CERTIFICATE_MANAGER_FACTORY_BASE_TYPE, CertificateManagerFactory, } from './cert/certificate-manager-factory.js';
+export * from './trust-store/trust-store-provider.js';
+export { TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE, TrustStoreProviderFactory, NoopTrustStoreProvider, } from './trust-store/trust-store-provider-factory.js';
 export * from './encryption/encryption-manager.js';
 export { ENCRYPTION_MANAGER_FACTORY_BASE_TYPE } from './encryption/encryption-manager-factory.js';
 export * from './encryption/encryption-manager-factory.js';

package/dist/esm/naylence/fame/security/trust-store/noop-trust-store-provider-factory.js

@@ -0,0 +1,19 @@
+import { NoopTrustStoreProvider, TrustStoreProviderFactory, TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE, } from "./trust-store-provider-factory.js";
+export const FACTORY_META = {
+    base: TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE,
+    key: "NoopTrustStoreProvider",
+    isDefault: true,
+    priority: 10,
+};
+export class NoopTrustStoreProviderFactory extends TrustStoreProviderFactory {
+    constructor() {
+        super(...arguments);
+        this.type = "NoopTrustStoreProvider";
+        this.isDefault = true;
+        this.priority = 10;
+    }
+    async create(_config, ..._factoryArgs) {
+        return new NoopTrustStoreProvider();
+    }
+}
+export default NoopTrustStoreProviderFactory;

package/dist/esm/naylence/fame/security/trust-store/trust-store-provider-factory.js

@@ -0,0 +1,39 @@
+import { AbstractResourceFactory, createDefaultResource, createResource, } from "@naylence/factory";
+const DEFAULT_UNCONFIGURED_MESSAGE = "Trust store is not configured. Set FAME_CA_CERTS to a PEM value, a file path, a data URI, or an HTTPS bundle URL.";
+export const TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE = "TrustStoreProviderFactory";
+export class TrustStoreProviderFactory extends AbstractResourceFactory {
+    createUnconfiguredProvider(reason) {
+        return new NoopTrustStoreProvider(reason ?? DEFAULT_UNCONFIGURED_MESSAGE);
+    }
+    static async createTrustStoreProvider(config, options = {}) {
+        const { dependencies, factoryArgs, ...restOptions } = options;
+        const mergedFactoryArgs = [
+            ...(dependencies ? [dependencies] : []),
+            ...(factoryArgs ?? []),
+        ];
+        const creationOptions = {
+            ...restOptions,
+            factoryArgs: mergedFactoryArgs,
+        };
+        if (config) {
+            const instance = await createResource(TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE, config, creationOptions);
+            return instance ?? new NoopTrustStoreProvider();
+        }
+        const instance = await createDefaultResource(TRUST_STORE_PROVIDER_FACTORY_BASE_TYPE, null, creationOptions);
+        return instance ?? new NoopTrustStoreProvider();
+    }
+}
+export class NoopTrustStoreProvider {
+    constructor(reason = DEFAULT_UNCONFIGURED_MESSAGE) {
+        this.reason = reason;
+    }
+    async getTrustStorePem() {
+        throw new Error(this.reason);
+    }
+    async getRoots() {
+        return [];
+    }
+    async initialize() {
+        // No-op for the placeholder provider.
+    }
+}

package/dist/esm/naylence/fame/security/trust-store/trust-store-provider.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/version.js

@@ -1,7 +1,7 @@
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.5-test.923
+// Generated from package.json version: 0.3.5-test.925
 /**
  * The package version, injected at build time.
  * @internal
  */
-export const VERSION = '0.3.5-test.923';
+export const VERSION = '0.3.5-test.925';