# Native-only crate. On wasm32 it compiles to nothing (aws-lc does not build there, and the
# browser's TLS is the browser's), so the workspace's wasm lines need no exclude for it.
[package]
name = "flowrs-tls"
version.workspace = true
edition.workspace = true
publish.workspace = true
rust-version.workspace = true
authors.workspace = true
license = "MIT OR Apache-2.0"
description = "The one TLS configuration every flowRS client and server uses: rustls on aws-lc-rs, X25519MLKEM768 (FIPS 203 ML-KEM-768 with X25519) offered first."

[lib]
crate-type = ["rlib"]

[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
# aws-lc-rs is the provider with ML-KEM; ring's has none. Already in the lock through
# reqwest. `prefer-post-quantum` is named so that every rustls user unified into the same
# build (reqwest's default provider included) offers the hybrid first too; this crate's own
# provider does not rely on it and lists its groups in order. 0.23.46 is the floor: it
# fixes RUSTSEC-2026-0349, where one forged ServerHello made later connections classical.
rustls = { version = "0.23.46", default-features = false, features = [
    "aws_lc_rs",
    "prefer-post-quantum",
    "std",
    "tls12",
] }

[features]
default = []
# A loopback TLS server that agrees to X25519MLKEM768 and nothing else, and an in-memory
# handshake driver: what other crates' tests use to show their clients offer the hybrid
# first. Enabled from dev-dependencies only.
testing = []