/// Engram Crypto — quantum-secure encryption at rest.
///
/// # Current Implementation
///
/// Uses AES-256-GCM for symmetric encryption with BLAKE3 for key derivation.
/// AES-256 is already quantum-resistant (Grover's algorithm halves the key space
/// from 2^256 to 2^128, which remains computationally infeasible).
///
/// # Post-Quantum Upgrade Path
///
/// The `AlgorithmRegistry` stores an `algorithm_id` alongside every ciphertext.
/// When ML-KEM (CRYSTALS-Kyber) and ML-DSA (CRYSTALS-Dilithium) crates stabilize,
/// the upgrade is:
/// 1. Add `KemAlgorithm::MlKem768` / `MlKem1024` variants
/// 2. Implement `CryptoEngine::encrypt()` for the new algorithm
/// 3. Set it as the active algorithm in the registry
/// 4. Old records continue to decrypt via their stored `algorithm_id`
/// 5. Background re-encryption rotates old records to the new algorithm
///
/// No data migration required — the registry handles version negotiation.
///
/// # Usage
///
/// ```rust,no_run
/// use engram_crypto::{CryptoEngine, AlgorithmRegistry};
///
/// let key = b"an-example-32-byte-key!!12345678";
/// let engine = CryptoEngine::from_key(key).unwrap();
///
/// let plaintext = b"sensitive memory content";
/// let encrypted = engine.encrypt(plaintext).unwrap();
/// let decrypted = engine.decrypt(&encrypted).unwrap();
/// assert_eq!(plaintext, decrypted.as_slice());
/// ```
pub mod algorithm;
pub mod engine;
pub mod error;
pub mod registry;

pub use algorithm::{AlgorithmVersion, KemAlgorithm, SigAlgorithm};
pub use engine::{CryptoEngine, EncryptedContent};
pub use error::CryptoError;
pub use registry::AlgorithmRegistry;