Initial Commit

openspec/changes/complete-rng-unification/specs/crypto/spec.md

@@ -0,0 +1,31 @@
+<!-- markdownlint-disable MD024 -->
+
+# Capability Spec Delta: crypto (crypto)
+
+**Package**: `@suaveplan/crypto`
+**Status**: PROPOSED
+
+> Every requirement below carries a `**Verified by:**` line at authoring time. No exceptions.
+
+## MODIFIED Requirements
+
+### Requirement: Top-level barrel forwards canonical Rng
+
+`@suaveplan/crypto/src/index.ts` SHALL re-export `Rng` from `@suaveplan/crypto-core` — which in turn forwards the canonical `Rng` from `@suaveplan/types`. The legacy `defaultRng` re-export SHALL be dropped; consumers use `defaultByteSource` (preserved under its real name) when they need the default callable byte producer. The `ByteSource` re-export SHALL remain unchanged — every existing consumer of `import { ByteSource } from "@suaveplan/crypto"` continues to work.
+
+**Verified by:** `packages/crypto/crypto/src/index.ts` (presence of `Rng` re-export; absence of `defaultRng` re-export; presence of `ByteSource`, `defaultByteSource`, `randomBytes`, `RandomBytesOptions` re-exports) AND `bunx turbo typecheck test --filter=@suaveplan/crypto` (green with zero assertion edits) AND repo-internal grep `grep -rn "defaultRng\b" packages/crypto/crypto/src/ --include="*.ts"` returns zero results.
+
+#### Scenario: Rng re-export forwards canonical
+
+- **WHEN** a consumer writes `import type { Rng } from "@suaveplan/crypto"`
+- **THEN** the imported type is structurally identical to `import type { Rng } from "@suaveplan/types"`
+
+#### Scenario: defaultRng re-export is removed
+
+- **WHEN** a consumer writes `import { defaultRng } from "@suaveplan/crypto"`
+- **THEN** `tsc` rejects with "has no exported member `defaultRng`"
+
+#### Scenario: defaultByteSource remains available
+
+- **WHEN** a consumer writes `import { defaultByteSource } from "@suaveplan/crypto"`
+- **THEN** `tsc` accepts AND `defaultByteSource(32).length === 32`