suaveplan/openspec/archive/2026-04-19-crypto-primitive-replaceability/specs/crypto/spec.md

MODIFIED Requirements

Requirement: Primitive source

@suaveplan/crypto SHALL source every curve and cipher primitive from @suaveplan/crypto-curve and @suaveplan/crypto-cipher respectively, not from @noble/* directly. Every hash primitive is sourced from @suaveplan/crypto-hash. Every byte / encoding / random utility is sourced from @suaveplan/crypto-utils.

Scenario: No @noble/* imports in @suaveplan/crypto source

• WHEN packages/universal/crypto/src/**/*.ts is grepped
• THEN no occurrence of the string @noble/ remains

Scenario: No @noble/* in @suaveplan/crypto direct dependencies

• WHEN packages/universal/crypto/package.json is inspected
• THEN none of @noble/hashes, @noble/curves, @noble/ciphers appear under dependencies or peerDependencies
• AND @suaveplan/crypto-hash, @suaveplan/crypto-curve, @suaveplan/crypto-cipher, @suaveplan/crypto-utils appear under dependencies with workspace:^

Requirement: Public API surface unchanged

@suaveplan/crypto SHALL preserve its existing public API across the primitive-rewiring. All subpath exports declared in package.json at the start of this change remain available with identical signatures.

Scenario: Subpath exports preserved

• WHEN a consumer imports @suaveplan/crypto/aead, @suaveplan/crypto/sign, @suaveplan/crypto/agree, @suaveplan/crypto/sealed-box, @suaveplan/crypto/auth-box, @suaveplan/crypto/engines, @suaveplan/crypto/primitives/random-bytes, @suaveplan/crypto/primitives/constant-time-equal, @suaveplan/crypto/primitives/zeroize, or @suaveplan/crypto/errors
• THEN the exported functions have identical signatures and behaviour as before this change
• AND all existing @suaveplan/crypto tests pass unchanged