[package]
name = "chanora_storage"
description = "Chanora storage — non-secret embedded DB (SQLite via rusqlite bundled per DEC-013.1) and platform secure storage (Secret Service preferred + keyutils fallback on Linux per DEC-013.2). Strict SAD-067 separation."
version.workspace = true
edition.workspace = true
rust-version.workspace = true
authors.workspace = true
license.workspace = true
repository.workspace = true
publish.workspace = true

[dependencies]
thiserror.workspace = true
tracing.workspace = true
rusqlite = { version = "0.32", features = ["bundled"] }
chacha20poly1305 = "0.10"
rand = "0.8"
zeroize = "1"
# `base64` is needed to serialise the DEK as a string for the
# keyring API (which is text-only on most platforms).
base64 = "0.22"
serde = { version = "1", features = ["derive"] }
serde_json = "1"

# Platform keyring abstraction: Secret Service / kernel keyutils on
# Linux (DEC-013.2); macOS Keychain; Windows Credential Manager;
# iOS Keychain; on Android the keyring crate falls back to the
# in-memory provider, so we keep a file-on-disk fallback there.
[target.'cfg(any(target_os = "linux", target_os = "macos", target_os = "windows", target_os = "ios"))'.dependencies]
keyring = { version = "3", default-features = false, features = ["sync-secret-service", "linux-native", "apple-native", "windows-native"] }

[dev-dependencies]
tempfile = "3"