[package]
name = "affinidi-crypto"
version = "0.2.4"
description = "Cryptographic primitives and JWK types for Affinidi TDK"
edition.workspace = true
authors.workspace = true
homepage.workspace = true
keywords.workspace = true
publish.workspace = true
license.workspace = true
repository.workspace = true
readme = "README.md"
rust-version.workspace = true

[features]
default = ["p256", "k256", "p384", "p521", "ed25519"]
p256 = ["dep:p256"]
k256 = ["dep:k256"]
p384 = ["dep:p384"]
p521 = ["dep:p521"]
ed25519 = ["dep:ed25519-dalek"]
# Post-quantum cryptography (experimental — W3C di-quantum-safe v0.3).
# `post-quantum` is the umbrella flag; `ml-dsa` and `slh-dsa` can be enabled
# individually. Off by default.
post-quantum = ["ml-dsa", "slh-dsa"]
ml-dsa = ["dep:ml-dsa", "dep:rand_10"]
slh-dsa = ["dep:slh-dsa", "dep:rand_10"]
# JOSE primitives (#327): ECDH-ES / ECDH-1PU Concat KDF, A256KW key wrap,
# A256CBC-HS512 content encryption, EdDSA signing. Pulls in EdDSA via the
# `ed25519` feature. Key agreement (curves) lands separately in a later PR.
jose = ["dep:aes", "dep:cbc", "dep:hmac", "dep:subtle", "ed25519", "p256", "k256", "p384", "p521"]

[dependencies]
# Requires >= 0.1.4: the `bls12381` module imports
# `affinidi_encoding::BLS12381_G2_PUB`, added in 0.1.4 (#346). A loose "0.1"
# resolved against an older lock to a 0.1.x < 0.1.4 and failed to compile (#348).
affinidi-encoding = "0.1.4"

base58 = "0.2"
base64 = "0.22"
multibase = "0.9"
ed25519-dalek = { version = "2", features = ["rand_core"], optional = true }
k256 = { version = "0.13", features = [
  "ecdsa-core",
  "arithmetic",
  "ecdh",
], optional = true }
p256 = { version = "0.13", features = [
  "ecdsa-core",
  "ecdsa",
  "arithmetic",
  "ecdh",
], optional = true }
p384 = { version = "0.13", features = [
  "ecdsa-core",
  "arithmetic",
  "ecdh",
], optional = true }
p521 = { version = "0.13", features = [
  "arithmetic",
  "ecdh",
], optional = true }
# JOSE content-encryption / key-wrap primitives (`jose` feature).
aes = { version = "0.8", optional = true }
cbc = { version = "0.1", features = ["alloc"], optional = true }
hmac = { version = "0.12", optional = true }
subtle = { version = "2", optional = true }
ml-dsa = { version = "0.1.0", features = ["rand_core", "zeroize"], optional = true }
slh-dsa = { version = "=0.2.0-rc.5", features = ["zeroize"], optional = true }
# PQC crates (ml-dsa, slh-dsa) pull rand_core 0.10 transitively via
# `signature` v3. A second copy coexists with the 0.6 one used by other
# primitives; we never import it directly, so no explicit dep is needed.
rand_10 = { package = "rand", version = "0.10", default-features = false, features = ["std", "std_rng", "sys_rng"], optional = true }
rand_core = { version = "0.6", features = ["getrandom"] }
serde = { version = "1", features = ["derive"] }
serde_json = "1"
sha2 = "0.10"
thiserror = "2"
x25519-dalek = { version = "2", features = ["static_secrets"] }
zeroize = "1"

[target.'cfg(target_arch = "wasm32")'.dependencies]
getrandom = { version = "0.2", features = ["js"] }

[lints]
workspace = true
