# Capability Spec Delta: crypto-keys (restore-crypto-keychain-packer)

**Package**: `@suaveplan/crypto-keys`
**Status**: PROPOSED

## REMOVED Requirements

### Requirement: Package exists as a standalone primitive

**Reason:** `@suaveplan/crypto-keys` is folded into the new opinionated `@suaveplan/crypto` package. The split between "key shape" (`Keypair`, `Keychain` adapter) and "keychain semantics" (multi-slot, versioned, signed-hierarchy) was an artificial primitive-layer carve-out — they are one concept and belong together. Maintaining them as separate packages is itself a sediment risk: callers reach for primitive `Keypair` to bypass the opinionated layer, exactly the failure mode this change is designed to prevent.

**Migration:**

- `Keypair`, `SignAlgorithm`, `AgreeAlgorithm`, `ValidationResult` types → `@suaveplan/crypto/keychain` (re-exported under the same names)
- `generateKeypair`, `validateKeypair`, `assertValidKeypair` → `@suaveplan/crypto/keychain`
- `Keychain` (the adapter), `MemoryKeychainAdapter`, `SerializedKeychainAdapter`, `ReadWriter` → `@suaveplan/crypto/keychain` (renamed where the new `Keychain` type from `specs/crypto/spec.md` would collide; the adapter becomes `KeychainStore` to disambiguate)
- `CRYPTO_KEYS_CODES`, `CryptoKeysError` → folded into `@suaveplan/crypto`'s `CRYPTO_CODES` / `CryptoError`. Old codes are renamed where the new domain prefix differs (e.g., `KEYPAIR.INVALID` → `KEYCHAIN.SLOT_INVALID`).

The folded code preserves every public behaviour of `@suaveplan/crypto-keys`. The only consumer in genesis today is `@suaveplan/crypto-vault`, which is itself folded; no other package imports `@suaveplan/crypto-keys`. Net consumer impact: zero.

The package directory `packages/crypto/crypto-keys/` is deleted in this change. `openspec/specs/crypto-keys/` is deleted at archive time. `CLAUDE.md` and `MANIFEST.md` are updated.

This `REMOVED Requirements` block is the migration record; the consolidated spec lives at `specs/crypto/spec.md`.