add package: pyproject + src

EnvelopeCrypto: hybrid envelope encryption for dict records — a random
AES-256-GCM data key (DEK) encrypts the data, wrapped per-system via
RSA-OAEP (SHA-256) for distribution. config-free (DEK + key paths
injected), storage-agnostic, object-only. covers bootstrap/self_test,
authorize/deauthorize, rotate + reencrypt, and record-level decrypt.
src/ layout, hatchling build, cryptography backend.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: disqualifier <dev@disqualifier.me>

README.md

@@ -37,10 +37,10 @@ openssl rsa -in local_priv.pem -pubout -out local_pub.pem
 from envelope_crypto import EnvelopeCrypto
 
 # generate the DEK and wrap it for this system in one call
-crypto, fingerprint, wrapped = EnvelopeCrypto.bootstrap(cfg.local_pub)
+crypto, fingerprint, wrapped = EnvelopeCrypto.bootstrap("public_key.pem")
 
 # verify the keypair actually round-trips BEFORE storing anything
-crypto.self_test(cfg.local_pub, cfg.local_priv)        # raises if keys don't pair
+crypto.self_test("public_key.pem", "private_key.pem")        # raises if keys don't pair
 
 # store the wrapped key — this is now the ONLY record of the DEK
 await db.create_document("keys", {"_id": fingerprint, "key": wrapped})
@@ -53,11 +53,11 @@ re-derived each boot by unwrapping. **Never persist the plaintext key.**
 
 ```python
 crypto = EnvelopeCrypto()
-fingerprint = crypto.get_rsa_key_fingerprint(cfg.local_pub)
+fingerprint = crypto.get_rsa_key_fingerprint("public_key.pem")
 record = await db.get_document("keys", {"_id": fingerprint})
 if not record:
     raise RuntimeError("this system is not authorized")
-crypto.initialize(crypto.decrypt_aes_key_with_rsa(record["key"], cfg.local_priv))
+crypto.initialize(crypto.decrypt_aes_key_with_rsa(record["key"], "private_key.pem"))
 bot.crypto = crypto
 ```
 

src/envelope_crypto/envelope_crypto.py

@@ -17,15 +17,15 @@ envelope-encryption pattern used by KMS-style systems.
 first-time setup: generate the DEK and wrap it for the first system in one call,
 then verify the pipeline before storing anything:
 
-    crypto, fingerprint, wrapped = EnvelopeCrypto.bootstrap(cfg.local_pub)
-    crypto.self_test(cfg.local_pub, cfg.local_priv)    # raises if anything is wrong
+    crypto, fingerprint, wrapped = EnvelopeCrypto.bootstrap("public_key.pem")
+    crypto.self_test("public_key.pem", "private_key.pem")    # raises if anything is wrong
     caller_store({"_id": fingerprint, "key": wrapped}) # the only record of the DEK
 
 boot (already set up): fingerprint own pubkey, fetch the wrapped DEK, unwrap:
 
-    fp = crypto.get_rsa_key_fingerprint(cfg.local_pub)
+    fp = crypto.get_rsa_key_fingerprint("public_key.pem")
     record = caller_lookup(fp)
-    crypto.initialize(crypto.decrypt_aes_key_with_rsa(record["key"], cfg.local_priv))
+    crypto.initialize(crypto.decrypt_aes_key_with_rsa(record["key"], "private_key.pem"))
 
 authorize another system (this instance must already hold the DEK):