# Capability Spec Delta: crypto (restore-crypto-cleanup-duplicates)

**Package:** `@suaveplan/crypto`
**Status:** PROPOSED

## ADDED Requirements

### Requirement: Primitive-surface symbols sourced from `@suaveplan/crypto-core`

`@suaveplan/crypto` SHALL NOT contain its own implementation of the cryptographic primitives (AEAD, key agreement, signing, sealed-box, auth-box, raw key generation). Every primitive symbol exposed in the package's public surface MUST be a typed re-export from `@suaveplan/crypto-core`. The opinionated modules (`keychain`, `derivation`, `bundles`, `domain-tags`, `authority`) MAY internally import from `@suaveplan/crypto-core` but MUST NOT re-implement primitive operations.

#### Scenario: no primitive impl files remain in `crypto/src/`

- **WHEN** the test scans `crypto/src/` for files under `aead/`, `agree/`, `auth-box/`, `sealed-box/`, `sign/`, `primitives/`, or `engines/`
- **THEN** zero files are found

#### Scenario: every previously-public primitive symbol is still importable

- **WHEN** a consumer imports any of `aead`, `ed25519`, `x25519`, `sealedBox`, `authBox`, `randomBytes`, `zeroize`, `constantTimeEqual`, etc. from `@suaveplan/crypto`
- **THEN** the symbol resolves and has the same type signature it had before this change

#### Scenario: barrel diff is byte-identical

- **WHEN** the post-change `dist/index.d.ts` is diffed against the pre-change snapshot at `tests/before.dts.txt`
- **THEN** the diff is zero lines (the public type surface is unchanged)

**Verified by:** `tests/no-duplicates.test.ts::"no primitive impl files in crypto/src/"` AND `tests/dts-snapshot.test.ts::"public surface byte-identical"` AND existing primitive-surface usage in dependent packages (`bitpacker-crypto`, `slsa`, etc.) compiling green