Initial Commit

openspec/archive/2026-05-03-restore-crypto-cleanup-duplicates/specs/crypto/spec.md

@@ -0,0 +1,27 @@
+# Capability Spec Delta: crypto (restore-crypto-cleanup-duplicates)
+
+**Package:** `@suaveplan/crypto`
+**Status:** PROPOSED
+
+## ADDED Requirements
+
+### Requirement: Primitive-surface symbols sourced from `@suaveplan/crypto-core`
+
+`@suaveplan/crypto` SHALL NOT contain its own implementation of the cryptographic primitives (AEAD, key agreement, signing, sealed-box, auth-box, raw key generation). Every primitive symbol exposed in the package's public surface MUST be a typed re-export from `@suaveplan/crypto-core`. The opinionated modules (`keychain`, `derivation`, `bundles`, `domain-tags`, `authority`) MAY internally import from `@suaveplan/crypto-core` but MUST NOT re-implement primitive operations.
+
+#### Scenario: no primitive impl files remain in `crypto/src/`
+
+- **WHEN** the test scans `crypto/src/` for files under `aead/`, `agree/`, `auth-box/`, `sealed-box/`, `sign/`, `primitives/`, or `engines/`
+- **THEN** zero files are found
+
+#### Scenario: every previously-public primitive symbol is still importable
+
+- **WHEN** a consumer imports any of `aead`, `ed25519`, `x25519`, `sealedBox`, `authBox`, `randomBytes`, `zeroize`, `constantTimeEqual`, etc. from `@suaveplan/crypto`
+- **THEN** the symbol resolves and has the same type signature it had before this change
+
+#### Scenario: barrel diff is byte-identical
+
+- **WHEN** the post-change `dist/index.d.ts` is diffed against the pre-change snapshot at `tests/before.dts.txt`
+- **THEN** the diff is zero lines (the public type surface is unchanged)
+
+**Verified by:** `tests/no-duplicates.test.ts::"no primitive impl files in crypto/src/"` AND `tests/dts-snapshot.test.ts::"public surface byte-identical"` AND existing primitive-surface usage in dependent packages (`bitpacker-crypto`, `slsa`, etc.) compiling green