> Archived 2026-04-19: all tasks retroactively ticked; packages shipped under universal/crypto/.

# Tasks: enterprise-crypto

- [x] 1. Add `crypto` catalog (@noble/ciphers, @noble/curves, @noble/hashes) to root package.json
- [x] 2. Scaffold package.json, tsconfig, vite/vitest configs (100 thresholds)
- [x] 3. errors: `CryptoError` extending `SuaveplanError` with `CRYPTO_CODES`
- [x] 4. random: `randomBytes` with injectable RNG; single module-level `crypto.getRandomValues` callsite
- [x] 5. compare: `constantTimeEqual`
- [x] 6. zeroize: `zeroize`
- [x] 7. hash: `sha256`/`sha384`/`sha512`
- [x] 8. hmac: `hmac` with algorithm dispatch
- [x] 9. kdf: `hkdf`, `pbkdf2`, `argon2id` with parameter validation
- [x] 10. aead: `aeadEncrypt`/`aeadDecrypt` dispatching AES-256-GCM + ChaCha20-Poly1305
- [x] 11. sign: `ed25519`, `ecdsaP256` namespaces
- [x] 12. agree: `x25519` namespace
- [x] 13. Cross-cutting `tests/`: dep-graph, no-disallowed, tree-shake
- [x] 14. Property-based tests via fast-check for every primitive
- [x] 15. Co-located `.md` per implementation file
- [x] 16. README
- [x] 17. `bunx turbo lint typecheck build test:coverage --filter=@suaveplan/crypto --force` green at 100/100/100/100
- [x] 18. Publish to Verdaccio at 0.0.0
- [x] 19. Archive change folder to `openspec/archive/<yyyy-mm-dd>-enterprise-crypto/`