suaveplan/openspec/archive/2026-04-18-enterprise-crypto-family/tasks.md

Tasks: enterprise-crypto-family

Pre-work

• 1. Archive openspec/changes/enterprise-crypto/ → openspec/archive/2026-04-18-enterprise-crypto/
• 2. Add catalog entries to root package.json: @noble/hashes, @noble/ciphers, @noble/curves, libsodium-wrappers-sumo, @types/libsodium-wrappers-sumo, @scure/bip39
• 3. Delete packages/universal/crypto/ (existing genesis scaffold, will be rebuilt as the new multi-package family)

Wave 1 — @suaveplan/hash (no workspace deps)

• 4. Scaffold packages/universal/hash: package.json (deps: @noble/hashes, @suaveplan/error, tslib, zod), tsconfig.lib.json, vite.config.ts, vitest.config.ts (100/100/100/100 thresholds)
• 5. errors/: HashError, HASH_CODES, hash-error.ts, codes.ts, index.ts
• 6. hash/sha2.ts + test + md: sha256, sha384, sha512, hash(algo, data), HashAlgorithm
• 7. mac/hmac.ts + test + md: hmac(algo, key, data); hasherFor private to package
• 8. kdf/hkdf.ts + test + md: hkdf(algo, ikm, { salt, info, length })
• 9. kdf/pbkdf2.ts + test + md: pbkdf2, PBKDF2_MIN_ITERATIONS, parameter validation
• 10. kdf/argon2id.ts + test + md: argon2id, min constants, per-field validation
• 11. encoding/hex.ts + encoding/base64.ts + tests + mds
• 12. constants/index.ts; barrel src/index.ts; subpath exports in package.json
• 13. tests/no-disallowed.test.ts, tests/tree-shake.test.ts
• 14. fast-check property tests; mitata benchmarks
• 15. README.md
• 16. bunx turbo lint typecheck test:coverage --filter=@suaveplan/hash --force → green at 100%
• 17. bun scripts/publish.ts --package @suaveplan/hash

Wave 2 — @suaveplan/crypto (depends on hash, error, types)

• 18. Scaffold packages/universal/crypto: package.json (deps: @noble/ciphers, @noble/curves, @suaveplan/hash, @suaveplan/error, @suaveplan/types, tslib, zod), configs, 100% thresholds
• 19. errors/: CryptoError, CRYPTO_CODES
• 20. engines/: aead-engine.types.ts, sign-engine.types.ts, agree-engine.types.ts, sealed-box-engine.types.ts, auth-box-engine.types.ts
• 21. primitives/random-bytes.ts + test + md: ByteSource, defaultByteSource, randomBytes; single crypto.getRandomValues callsite
• 22. primitives/constant-time-equal.ts + test + md
• 23. primitives/zeroize.ts + test + md
• 24. aead/noble-aead-engine.ts + aead/aead.ts + test + md: aeadEncrypt, aeadDecrypt, AeadAlgorithm (adds XChaCha20-Poly1305), key/nonce validation
• 25. sign/noble-sign-engine.ts + sign/ed25519.ts + test + md
• 26. sign/ecdsa-p256.ts + test + md (retry loop for key validity)
• 27. agree/noble-agree-engine.ts + agree/x25519.ts + test + md
• 28. sealed-box/noble-sealed-box-engine.ts + sealed-box/sealed-box.ts + test + md
• 29. auth-box/noble-auth-box-engine.ts + auth-box/auth-box.ts + test + md
• 30. constants/index.ts; barrel src/index.ts; subpath exports
• 31. tests/no-disallowed.test.ts, tests/dep-graph.test.ts, tests/tree-shake.test.ts
• 32. fast-check property tests; mitata benchmarks; Zod schemas for all public option types
• 33. README.md
• 34. bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto --force → green at 100%
• 35. bun scripts/publish.ts --package @suaveplan/crypto

Wave 3 — @suaveplan/crypto-sodium and @suaveplan/crypto-browser (parallel, both depend on crypto)

• 36. Scaffold packages/universal/crypto-sodium: package.json (deps: libsodium-wrappers-sumo, @types/libsodium-wrappers-sumo, @suaveplan/crypto, @suaveplan/error, tslib), configs
• 37. init.ts + md: sodiumReady() lazy singleton
• 38. engines/sodium-aead-engine.ts + test + md
• 39. engines/sodium-sign-engine.ts + test + md
• 40. engines/sodium-agree-engine.ts + test + md
• 41. engines/sodium-sealed-box-engine.ts + test + md
• 42. engines/sodium-auth-box-engine.ts + test + md
• 43. primitives/crypto-kdf.ts + test + md
• 44. primitives/crypto-auth.ts + test + md
• 45. primitives/crypto-pwhash.ts + test + md
• 46. primitives/ristretto255.ts + test + md
• 47. barrel + subpath exports + README; bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-sodium --force → 100%
• 48. bun scripts/publish.ts --package @suaveplan/crypto-sodium
• 49. Scaffold packages/universal/crypto-browser: package.json (deps: @suaveplan/crypto, @suaveplan/error, tslib), configs
• 50. engines/webcrypto-aead-engine.ts + test + md
• 51. engines/webcrypto-sign-engine.ts + test + md
• 52. engines/webcrypto-agree-engine.ts + test + md
• 53. rsa/rsa.ts + test + md
• 54. aes-kw/aes-kw.ts + test + md
• 55. ecdsa-p384/ + ecdh-p384/ + tests + mds
• 56. non-extractable-key/non-extractable-key.ts + test + md
• 57. isWebCryptoAvailable + BrowserCryptoError; barrel + subpath exports + README
• 58. bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-browser --force → 100%
• 59. bun scripts/publish.ts --package @suaveplan/crypto-browser

Wave 4 — @suaveplan/crypto-keys (depends on crypto)

• 60. Scaffold packages/universal/crypto-keys: package.json, configs
• 61. keypair/generate.ts + test + md
• 62. keypair/validate.ts + test + md
• 63. keychain/keychain.ts + test + md
• 64. keychain/adapters/memory-adapter.ts + serialized-adapter.ts + tests + mds
• 65. errors/; barrel + subpath exports + README
• 66. bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-keys --force → 100%
• 67. bun scripts/publish.ts --package @suaveplan/crypto-keys

Wave 5 — @suaveplan/crypto-vault (depends on crypto, crypto-keys, hash, events)

• 68. Scaffold packages/universal/crypto-vault: package.json (deps: @suaveplan/crypto, @suaveplan/crypto-keys, @suaveplan/hash, @suaveplan/events, @suaveplan/error, @suaveplan/types, @scure/bip39, tslib, zod), configs
• 69. mnemonic/mnemonic.ts + test + md: generateMnemonic, validateMnemonic, mnemonicToSeed
• 70. (derivation folded into vault.ts — HKDF child key derivation inline)
• 71. vault/vault.types.ts — VaultEvents, VaultOptions
• 72. vault/vault.ts + test + md: unlock, lock, sign, derive, zeroize on lock
• 73. chain-signer/chain-signer.ts + test + md
• 74. errors/; barrel + subpath exports + README
• 75. bunx turbo lint typecheck test:coverage --filter=@suaveplan/crypto-vault --force → 100%
• 76. bun scripts/publish.ts --package @suaveplan/crypto-vault

Close-out

• 77. Update CLAUDE.md package listing for all 6 new packages
• 78. Update PACKAGES.yml / STRUCTURE.yml with new packages and deps
• 79. Archive openspec/changes/enterprise-crypto-family/ → openspec/archive/2026-04-18-enterprise-crypto-family/