feat: schema projections, command transactions, quantum-secure encryption

engram/crates/engram-crypto/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "engram-crypto"
+version = "0.1.0"
+edition = "2021"
+description = "Quantum-secure encryption at rest for Engram — AES-256-GCM with PQ upgrade path"
+license = "MIT"
+
+[dependencies]
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+uuid = { version = "1", features = ["v4", "serde"] }
+thiserror = "1"
+# AES-256-GCM symmetric encryption (quantum-resistant at 256-bit key length)
+aes-gcm = "0.10"
+# BLAKE3 for key derivation (fast, cryptographically strong)
+blake3 = "1"
+# Random number generation
+rand = "0.8"
+# Base64 encoding for serialization (used in EncryptedContent serialization)
+base64 = "0.22"
+
+# TODO: Upgrade to post-quantum KEM/signature once crates stabilize.
+# Target: ml-kem (CRYSTALS-Kyber / NIST ML-KEM) and ml-dsa (CRYSTALS-Dilithium / NIST ML-DSA).
+# As of 2025, the `ml-kem` and `ml-dsa` crates are available on crates.io but not yet
+# production-stable for all platforms. The algorithm registry structure below is designed
+# so that the upgrade is a drop-in: add the PQ crate, implement the KemAlgorithm variant,
+# and new writes use the new algorithm while old records continue to decrypt via the registry.
+#
+# Uncomment when ready:
+# ml-kem = "0.2"     # CRYSTALS-Kyber (NIST ML-KEM 768/1024)
+# ml-dsa = "0.1"     # CRYSTALS-Dilithium (NIST ML-DSA)
+
+[dev-dependencies]
+tempfile = "3"