[package]
name = "engram-crypto"
version = "0.1.0"
edition = "2021"
description = "Quantum-secure encryption at rest for Engram — AES-256-GCM with PQ upgrade path"
license = "MIT"

[dependencies]
serde = { version = "1", features = ["derive"] }
serde_json = "1"
uuid = { version = "1", features = ["v4", "serde"] }
thiserror = "1"
# AES-256-GCM symmetric encryption (quantum-resistant at 256-bit key length)
aes-gcm = "0.10"
# BLAKE3 for key derivation (fast, cryptographically strong)
blake3 = "1"
# Random number generation
rand = "0.8"
# Base64 encoding for serialization (used in EncryptedContent serialization)
base64 = "0.22"

# TODO: Upgrade to post-quantum KEM/signature once crates stabilize.
# Target: ml-kem (CRYSTALS-Kyber / NIST ML-KEM) and ml-dsa (CRYSTALS-Dilithium / NIST ML-DSA).
# As of 2025, the `ml-kem` and `ml-dsa` crates are available on crates.io but not yet
# production-stable for all platforms. The algorithm registry structure below is designed
# so that the upgrade is a drop-in: add the PQ crate, implement the KemAlgorithm variant,
# and new writes use the new algorithm while old records continue to decrypt via the registry.
#
# Uncomment when ready:
# ml-kem = "0.2"     # CRYSTALS-Kyber (NIST ML-KEM 768/1024)
# ml-dsa = "0.1"     # CRYSTALS-Dilithium (NIST ML-DSA)

[dev-dependencies]
tempfile = "3"