# Capability Spec Delta: crypto-vault (restore-crypto-keychain-packer)

**Package**: `@suaveplan/crypto-vault`
**Status**: PROPOSED

## REMOVED Requirements

### Requirement: Package exists as a standalone primitive

**Reason:** `@suaveplan/crypto-vault` is folded into the new opinionated `@suaveplan/crypto` package alongside `@suaveplan/crypto-keys`. The vault, the keychain, the packer, and the signing hierarchy are inseparable — the original design across `nx/libs/keys/keys-common.ts` and `suaveplan/packages/universal/packer/` always treated them as one capability. Splitting them across three packages in genesis was a primitive-layer carve-out that made the missing top-layer easier to overlook.

In particular, the misleadingly-named `ChainSigner` (a flat `Map<string, Keypair>` with no chain semantics) is *replaced*, not folded as-is. Its name implied a hierarchy that the implementation never delivered; the new `Authority` interface in `@suaveplan/crypto` finally earns that name by signing under a real root → server hierarchy with revocation and audit-log support.

**Migration:**

- `Vault` → `@suaveplan/crypto/vault` (preserved API; default AEAD switched from AES-GCM to XChaCha20-Poly1305 — see `specs/crypto/spec.md`)
- `VaultEvents`, `VaultOptions` → `@suaveplan/crypto/vault`
- `generateMnemonic`, `mnemonicToSeed`, `validateMnemonic`, `GenerateMnemonicOptions` → `@suaveplan/crypto/vault/mnemonic`
- `ChainSigner` → **REMOVED ENTIRELY**, no replacement. Callers must use `Authority` from `@suaveplan/crypto`. The migration is non-trivial: `ChainSigner.addKey(id, keypair)` → `InMemoryAuthority.fromKeychain(keychain)` plus a hierarchy operation (`createServer` / `rollServer`). A codemod is provided at `scripts/codemods/chain-signer-to-authority.ts`.
- `CRYPTO_VAULT_CODES`, `CryptoVaultError` → folded into `@suaveplan/crypto`'s `CRYPTO_CODES` / `CryptoError`. Code names are aligned to the new domain prefixes (`VAULT.*`, `AUTHORITY.*`).

The package directory `packages/crypto/crypto-vault/` is deleted in this change. `openspec/specs/crypto-vault/` is deleted at archive time. `CLAUDE.md` and `MANIFEST.md` are updated.

This `REMOVED Requirements` block is the migration record; the consolidated spec lives at `specs/crypto/spec.md`.