Cargo.toml

[package]
name = "carbonado"
edition = "2021"
version = "2.0.0"
license = "MIT"
description = "An apocalypse-resistant data storage format for the truly paranoid. Fully symmetric AES-256-CTR + HMAC-SHA512 (EtM) container. Callers supply high-entropy master keys; passphrase KDF (e.g. Argon2id) is caller responsibility. SLH-DSA signatures are provided only as sidecars (via `bitcoinpqc`). Clean cryptographic break from ECIES — v1 encrypted archives require external migration."
documentation = "https://docs.rs/carbonado"
homepage = "https://github.com/bitmask-stack/carbonado"
repository = "https://github.com/bitmask-stack/carbonado.git"
readme = "README.md"
keywords = ["archive", "encryption", "erasure-coding", "bao", "backup"]
categories = ["command-line-utilities", "cryptography"]
include = ["src/**/*", "LICENSE", "README.md", "doc/man/*.1", "doc/man/README.md", ".cargo/config.toml.example"]

[dependencies]
# bao kept for Hash re-export (blake3::Hash), pub re-export in lib, and legacy error type bridging.
# All Bao logic now uses the local keyed fork for 4KB chunk groups + format-keyed roots.
bao = "0.13"

# Local keyed fork (SurmountSystems/bao-tree) — default 4KB groups (BlockSize::from_chunk_log(2))
# via BAO_BLOCK_SIZE. Keyed mode makes root = keyed_hash(key_from_format, data) so the
# Bao hash commits to the exact format pipeline chosen (multi-dimensional naming).
# See AGENTS.md and constants::BAO_BLOCK_SIZE.
# Temporary until upstreamed to n0-computer/bao-tree.
# To fetch the fork (for agents):
#   git clone -b 76-keyed-bao git@github.com:SurmountSystems/bao-tree.git ../bao-tree
#   (or: git clone -b 76-keyed-bao https://github.com/SurmountSystems/bao-tree.git ../bao-tree)
# Keyed fork (SurmountSystems/bao-tree branch 76-keyed-bao). Git dep supports `cargo install`
# from crates.io and `cargo install --path .` without a sibling checkout.
# For faster local iteration, copy `.cargo/config.toml.example` → `.cargo/config.toml`
# after `just setup-bao-tree` to patch in `../bao-tree`.
# We set default-features = false because the fork's defaults pull in tokio/fs/etc
# which are not needed (we only use sync keyed) and break some cross/wasm targets.
bao_tree = { package = "bao-tree", git = "https://github.com/SurmountSystems/bao-tree.git", branch = "76-keyed-bao", default-features = false, features = ["validate"] }
futures-lite = { version = "2", optional = true, default-features = false, features = ["std"] }
tokio = { version = "1", features = ["rt"], optional = true }
bitmask-enum = "2.1.0"
log = "0.4.19"
serde = { version = "1.0.164", features = ["derive"] }
zstd = "0.13"
thiserror = "1.0"

# For hybrid paranoia layer: secp256k1 ECDH + ChaCha20-Poly1305 AEAD as inner,
# wrapped in outer AES-CTR + HMAC-EtM.
secp256k1 = { version = "0.29", features = ["global-context", "rand-std"] }
chacha20poly1305 = "0.10"

# For direct BLAKE3 hashing in filepack manifest (directory archival) and binary.
# (blake3 already indirect via bao-tree; explicit for file/dir content hashes.)
blake3 = { version = "1", default-features = false, features = ["std"] }

# Minimal CBOR for filepack manifest (standard is CBOR `manifest.filepack`).
ciborium = "0.2"

# rkyv FilepackManifest v2 (canonical directory catalog payload inside Adamantine 1.0).
rkyv = { version = "0.8.16", features = ["unaligned", "bytecheck"] }

# Segment format heuristic for directory archives (compressible vs incompressible).
infer = "0.19"

# CLI binary (`carbonado`) — optional for library-only consumers.
clap = { version = "4.4", features = ["derive"], optional = true }
bip39 = { version = "2", features = ["rand"], optional = true }
directories = { version = "5", optional = true }
clap_mangen = { version = "0.2", optional = true }

# v2.0 FEC: reed-solomon-erasure (deterministic RS 4/8, ~50% erasure (any 4 shards),
# reproducible for reliable scrub + bao hash match). Preserves 4/8 model + 4 KiB slice/Bao-leaf align.
# Note: upstream notes "looking for new maintainers" (as of 2026); periodically re-eval for archival use (see AGENTS).
reed-solomon-erasure = "5"
positioned-io = { version = "0.3.5", default-features = false }

# New symmetric crypto stack (AES-256-CTR + HMAC-SHA512 EtM)
aes = "0.8"
ctr = "0.9"
hmac = "0.12"
sha2 = "0.10"
getrandom = { version = "0.2", features = ["js"] }
# bitcoinpqc 0.4 (WASM-capable build.rs); SLH-DSA-SHA2-128s sidecars.
# Local mirror lag: `.cargo/config.toml` patches 0.4 until 2026-07-18 (see lift checklist there).
bitcoinpqc = { version = "0.4", optional = true }

# Note: ecies + libsecp256k1-core + nostr + secp256k1 removed (clean break from old ECIES design and Nostr bech32/npub helpers).
# Future quantum-resistant key formats (qpub etc.) will be handled separately.

[features]
default = ["pqc", "ots", "cli", "parallel"]
pqc = ["dep:bitcoinpqc"]
# OpenTimestamps stub stamping (offline/testable; no network calendar in default build).
ots = []
# `carbonado` CLI binary (encode/decode/key). Disable for library-only dependency trees.
cli = ["dep:clap", "dep:bip39", "dep:directories"]
# `gen-carbonado-man` — regenerate roff pages under doc/man/ (`just gen-man`).
man-gen = ["cli", "dep:clap_mangen"]
# Async I/O adapter layer (Phase 2): `stream_decode_async` and pipeline I/O traits.
# `bao_tree/tokio_fsm` is reserved for future async Bao FSM paths — no crate code references it yet.
async = ["dep:futures-lite", "bao_tree/tokio_fsm"]
# Optional Tokio: `stream_decode_async` offloads sync pipeline to `spawn_blocking` (not required for trait defs).
async-tokio = ["async", "dep:tokio"]
# CPU parallelism (Phase 3): fork-join RS parity encode via `std::thread::scope` (std only; on by default).
# Disable with `--no-default-features` for library-only trees that want serial `rs.encode` only.
parallel = []

[dev-dependencies]
anyhow = "1.0.71"
sha2 = "0.10"
serde_json = "1"
pretty_env_logger = "0.5.0"
rand = "0.8.5"
wasm-bindgen-test = "0.3.37"
criterion = { version = "0.5", features = ["html_reports"] }
proptest = "1"
tiny_http = "0.12"
tokio = { version = "1", features = ["rt", "macros"] }

[[bench]]
name = "crypto_bench"
harness = false

[[bench]]
name = "parallel_bench"
harness = false
required-features = ["parallel"]

# Primary CLI: `cargo install carbonado` or `cargo install --path . --bin carbonado`
[[bin]]
name = "carbonado"
path = "src/bin/carbonado/main.rs"
required-features = ["cli"]

# Maintainer tool: `just gen-man` → doc/man/*.1
[[bin]]
name = "gen-carbonado-man"
path = "src/bin/gen-carbonado-man.rs"
required-features = ["man-gen"]