suaveplan/openspec/archive/2026-05-03-restore-crypto-cleanup-duplicates/specs/crypto/spec.md

Capability Spec Delta: crypto (restore-crypto-cleanup-duplicates)

Package: @suaveplan/crypto Status: PROPOSED

ADDED Requirements

Requirement: Primitive-surface symbols sourced from @suaveplan/crypto-core

@suaveplan/crypto SHALL NOT contain its own implementation of the cryptographic primitives (AEAD, key agreement, signing, sealed-box, auth-box, raw key generation). Every primitive symbol exposed in the package's public surface MUST be a typed re-export from @suaveplan/crypto-core. The opinionated modules (keychain, derivation, bundles, domain-tags, authority) MAY internally import from @suaveplan/crypto-core but MUST NOT re-implement primitive operations.

Scenario: no primitive impl files remain in crypto/src/

• WHEN the test scans crypto/src/ for files under aead/, agree/, auth-box/, sealed-box/, sign/, primitives/, or engines/
• THEN zero files are found

Scenario: every previously-public primitive symbol is still importable

• WHEN a consumer imports any of aead, ed25519, x25519, sealedBox, authBox, randomBytes, zeroize, constantTimeEqual, etc. from @suaveplan/crypto
• THEN the symbol resolves and has the same type signature it had before this change

Scenario: barrel diff is byte-identical

• WHEN the post-change dist/index.d.ts is diffed against the pre-change snapshot at tests/before.dts.txt
• THEN the diff is zero lines (the public type surface is unchanged)

Verified by: tests/no-duplicates.test.ts::"no primitive impl files in crypto/src/" AND tests/dts-snapshot.test.ts::"public surface byte-identical" AND existing primitive-surface usage in dependent packages (bitpacker-crypto, slsa, etc.) compiling green