Cargo.toml

[package]
name = "dota"
version = "1.1.0"
edition = "2024"
authors = ["zack"]
description = "Defense of the Artifacts - Post-quantum secure secrets manager with v7 TC-HKEM (ML-KEM-768 + X25519) vaults"
license = "MIT"

[features]
default = ["legacy-migration"]
# Read-only support for migrating v1-v5 vaults forward. Disable for builds
# whose vaults are already v6+, dropping the pqcrypto-kyber supply chain.
legacy-migration = ["dep:pqcrypto-kyber", "dep:pqcrypto-traits"]

[dependencies]
# Cryptography - Post-quantum and classical
# Pinned exactly: ml-kem byte layout is part of the v7 on-disk contract.
ml-kem = { version = "=0.3.2", features = ["getrandom", "zeroize"] }
pqcrypto-kyber = { version = "0.8", optional = true }
pqcrypto-traits = { version = "0.3", optional = true }
x25519-dalek = { version = "2.0", features = ["static_secrets"] }
aes-gcm = "0.10"
argon2 = "0.5"
hkdf = "0.12"
hmac = "0.12"
sha2 = "0.10"
zeroize = { version = "1.7", features = ["derive"] }
rand = "0.8"
rand_core = "0.6"

# CLI
clap = { version = "4.5", features = ["derive"] }
rpassword = "7.3"

# Clipboard (OS clipboard for `dota get --copy`; default-features off drops
# the `image` dep and friends -- we only ever set/clear text).
arboard = { version = "3.6", default-features = false }

# Data serialization
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
base64 = "0.22"

# Error handling and utilities
anyhow = "1.0"
thiserror = "2.0"

# Time handling
chrono = { version = "0.4", features = ["serde"] }

# System directories
dirs = "5.0"
tempfile = "3.13"

[target.'cfg(unix)'.dependencies]
libc = "0.2"

[dev-dependencies]

[profile.release]
opt-level = "z"      # Optimize for size
lto = true           # Link-time optimization
codegen-units = 1    # Better optimization
strip = true         # Strip symbols
panic = "abort"      # Fail-fast on panic. harden_process (mlockall + PR_SET_DUMPABLE=0 + RLIMIT_CORE=0) and the Linux page allocator (zero-on-reallocation) already prevent secret recovery from freed pages under our threat model; running drop glue during unwind would also make extern "C" fn signal_handler panic-freedom a load-bearing invariant.