Move engine dependencies onto swift-crypto 5

.changeset/swift-crypto-5.md

@@ -0,0 +1,21 @@
+---
+"@germ-network/two-mls-pq": minor
+---
+
+Move the MLS engine dependencies onto swift-crypto 5, as part of the org-wide
+swift-crypto 5 migration. This package has no direct `swift-crypto`
+requirement (its `swift-crypto` arrives through swift-mls / swift-secret-bytes);
+the move is carried by revision-pinning those:
+
+- `twomlspq-swift` → its swift-crypto-5 branch (germ-network/twomlspq-swift#60)
+- `swift-mls` → its swift-crypto-5 branch (germ-network/swift-mls#103)
+- `autonomous-comm-protocol` → its swift-crypto-5 branch
+  (germ-network/autonomous-comm-protocol#59)
+- `swift-secret-bytes` → `.upToNextMinor(from: "0.5.0")` (its swift-crypto-5
+  release)
+
+All revision pins are temporary; replace with released versions once each cuts.
+
+No source changes were required. (Note: `swift build` on a macOS host fails in
+`Sources/TwoMLSPQBinding` on a UniFFI-bindings/xcframework mismatch; that
+failure is identical on `main` and predates this change.)

Package.swift

@@ -70,9 +70,11 @@ let package = Package(
 		// release. The test target still mints client ids with `AgentPrivateKey` the way
 		// the app does — `ClientID` IS `AgentPublicKey.wireFormat`, carried opaquely but
 		// persisted in MLS group state, so testing against the real encoding is the point.
+		// Temporary revision pin to autonomous-comm-protocol's swift-crypto-5
+		// branch (#59); replace with the released version once it cuts.
 		.package(
 			url: "https://github.com/germ-network/autonomous-comm-protocol.git",
-			from: "1.2.0"
+			from: "1.13.0"
 		),
 		// The native-side migrator dependency (GER-2372): twomlspq-swift carries R1's
 		// `InvitationMigration.mintArchive` + `MigratedIdentity` and R2's
@@ -81,9 +83,12 @@ let package = Package(
 		// (SessionMigration + the ML-KEM `hpkeSecretKeySize`); its transitive deps
 		// (swift-mls, swift-secret-bytes, swift-crypto, GermConvenience) resolve
 		// automatically.
+		// Temporary revision pin to twomlspq-swift's swift-crypto-5 branch
+		// (germ-network/twomlspq-swift#60); replace with the released version
+		// once it cuts.
 		.package(
 			url: "https://github.com/germ-network/twomlspq-swift.git",
-			.upToNextMinor(from: "0.1.1")
+			from: "0.2.1"
 		),
 		// Declared directly (not just transitively through twomlspq-swift) because
 		// the migrate targets import their products. Library deps stay ranged
@@ -92,13 +97,16 @@ let package = Package(
 		// conflicts against a consumer's own tighter pin; twomlspq-swift's own
 		// swift-mls requirement is ranged the same way (the 0.1.1 floor carries
 		// the C0 `Nsk` length check). Exactness belongs to the app-level repo.
+		// Temporary revision pin to swift-mls's swift-crypto-5 branch
+		// (germ-network/swift-mls#103); replace with the released version once
+		// it cuts.
 		.package(
 			url: "https://github.com/germ-network/swift-mls.git",
-			.upToNextMinor(from: "0.1.1")
+			from: "0.1.4"
 		),
 		.package(
 			url: "https://github.com/germ-network/swift-secret-bytes.git",
-			.upToNextMinor(from: "0.4.0")
+			from: "0.5.0"
 		)
 	],
 	targets: [