# Capability Spec Delta: crypto (crypto) **Package**: `@suaveplan/crypto` **Status**: PROPOSED > Every requirement below carries a `**Verified by:**` line at authoring time. No exceptions. ## MODIFIED Requirements ### Requirement: Top-level barrel forwards canonical Rng `@suaveplan/crypto/src/index.ts` SHALL re-export `Rng` from `@suaveplan/crypto-core` — which in turn forwards the canonical `Rng` from `@suaveplan/types`. The legacy `defaultRng` re-export SHALL be dropped; consumers use `defaultByteSource` (preserved under its real name) when they need the default callable byte producer. The `ByteSource` re-export SHALL remain unchanged — every existing consumer of `import { ByteSource } from "@suaveplan/crypto"` continues to work. **Verified by:** `packages/crypto/crypto/src/index.ts` (presence of `Rng` re-export; absence of `defaultRng` re-export; presence of `ByteSource`, `defaultByteSource`, `randomBytes`, `RandomBytesOptions` re-exports) AND `bunx turbo typecheck test --filter=@suaveplan/crypto` (green with zero assertion edits) AND repo-internal grep `grep -rn "defaultRng\b" packages/crypto/crypto/src/ --include="*.ts"` returns zero results. #### Scenario: Rng re-export forwards canonical - **WHEN** a consumer writes `import type { Rng } from "@suaveplan/crypto"` - **THEN** the imported type is structurally identical to `import type { Rng } from "@suaveplan/types"` #### Scenario: defaultRng re-export is removed - **WHEN** a consumer writes `import { defaultRng } from "@suaveplan/crypto"` - **THEN** `tsc` rejects with "has no exported member `defaultRng`" #### Scenario: defaultByteSource remains available - **WHEN** a consumer writes `import { defaultByteSource } from "@suaveplan/crypto"` - **THEN** `tsc` accepts AND `defaultByteSource(32).length === 32`