# restore-crypto-fold-keys-vault — fold `crypto-keys` + `crypto-vault` into `crypto`, delete the originals

**Packages:** `@suaveplan/crypto`, `@suaveplan/crypto-keys` (deleted), `@suaveplan/crypto-vault` (deleted), `@suaveplan/auth` (consumer migration)
**Status:** PROPOSED
**Type:** refactor + package-removal
**Carved from:** `restore-crypto-keychain-packer` umbrella (2026-05-03)
**Depends on:** `restore-crypto-cleanup-duplicates` must land first

## Why

`@suaveplan/crypto-keys` (key shape) and `@suaveplan/crypto-vault` (vault + ChainSigner) were always artificial splits — "key shape", "keychain", and "vault" are one concept that needs one home. Three confusingly-similar package names invite consumers to spread keychain logic across all three; folding them into the new opinionated `@suaveplan/crypto` consolidates the wire formats and removes a class of misimports.

After this slice ships:

- `@suaveplan/crypto/keychain/keypair/` owns key generation, validation, and the `Keypair` type (was `crypto-keys/keypair/`)
- `@suaveplan/crypto/keychain/storage/` owns the `Keychain` adapter shapes (was `crypto-keys/keychain/`)
- `@suaveplan/crypto/vault/mnemonic/` owns BIP39 (was `crypto-vault/mnemonic/`)
- `@suaveplan/crypto/vault/legacy-vault/` owns the existing `Vault` class (was `crypto-vault/vault/`) — this is a temporary home; slice 3 will replace it with the three-regime `Vault` from the umbrella spec
- The misleadingly-named `ChainSigner` is dropped (slice 3 introduces `Authority` to actually earn the name)
- `@suaveplan/auth` migrates to import from `@suaveplan/crypto` instead of `@suaveplan/crypto-keys`

The removed packages have no other in-monorepo consumers (cross-checked against `MANIFEST.md` and `grep -rln`).

## What changes

### Moved into `@suaveplan/crypto/src/`

- `crypto-keys/src/keypair/*` → `crypto/src/keychain/keypair/*` (preserve git history via `git mv`)
- `crypto-keys/src/keychain/*` → `crypto/src/keychain/storage/*`
- `crypto-keys/src/errors/*` → folded into `crypto/src/errors/codes/`
- `crypto-vault/src/mnemonic/*` → `crypto/src/vault/mnemonic/*`
- `crypto-vault/src/vault/*` → `crypto/src/vault/legacy-vault/*` (rename to mark as transitional)
- `crypto-vault/src/errors/*` → folded into `crypto/src/errors/codes/`

### Removed (entire packages)

- `packages/crypto/crypto-keys/` — `git rm -r`
- `packages/crypto/crypto-vault/` — `git rm -r`

### Removed (specifically not folded)

- `crypto-vault/src/chain-signer/*` — DROPPED. The class is replaced by `Authority` in slice 3; nothing in genesis imports `ChainSigner` outside `crypto-vault`'s own tests.

### Modified consumers

- `@suaveplan/auth` — `package.json` removes `@suaveplan/crypto-keys` dep, adds `@suaveplan/crypto`; imports updated via codemod
- Any other consumer surfaced by `grep -rln "@suaveplan/crypto-keys\|@suaveplan/crypto-vault" packages/` — codemod-migrated to `@suaveplan/crypto`

### `CLAUDE.md` + `MANIFEST.md`

- Remove `crypto-keys` and `crypto-vault` from the package list
- `bun scripts/folder-reorg/generate-manifest.ts` regenerates `MANIFEST.md`

## Out of scope

- Building `Authority`, the three-regime `Vault`, `Packer`, `ChunkedPacker`, `RevocationList`, `AuditLog`, `RootIdentity`, `ServerIdentity` — slice 3.
- The import-allowlist conformance gate, `crypto-cli`, `slsa` migration — slice 4.
- Renaming `crypto/src/vault/legacy-vault/` to its final home — slice 3 (where the three-regime `Vault` replaces it).

## Source mapping

| Requirement | Source | Notes |
|---|---|---|
| Fold `crypto-keys` content into `crypto/keychain` | `restore-crypto-keychain-packer` umbrella, "Removed (folded into new crypto)" | Above-baseline genesis slice plan |
| Fold `crypto-vault` content into `crypto/vault` (legacy) | Same | Same |
| Delete `crypto-keys`, `crypto-vault` packages | Same | Same |
| Drop `ChainSigner` | Umbrella, "Removed (folded into new crypto)" | Replaced by `Authority` in slice 3 |
| Migrate `auth/auth` consumer | Umbrella, "Migration impact" table | One consumer; codemod-driven |

## Verification approach

- `bunx turbo lint typecheck test --filter=@suaveplan/crypto` green after the move; the previously-passing tests in `crypto-keys` + `crypto-vault` are now run from `crypto/`
- `bunx turbo test:coverage --filter=@suaveplan/crypto` 100/100/100/100 over folded modules
- `bunx turbo test --filter=@suaveplan/auth` green after consumer codemod
- `grep -rln "@suaveplan/crypto-keys\|@suaveplan/crypto-vault" packages/` returns zero (excluding archives)
- `MANIFEST.md` regenerated; package list in `CLAUDE.md` updated

## Migration impact

Consumers that import from `@suaveplan/crypto-keys` or `@suaveplan/crypto-vault` MUST switch to `@suaveplan/crypto`. The codemod handles the in-monorepo cases:

| Consumer today | Tomorrow |
|---|---|
| `@suaveplan/auth` | `@suaveplan/crypto` |
| (no others in monorepo) | — |

External consumers (none today; genesis is pre-1.0) would need the same trivial rename.