suaveplan/openspec/archive/2026-05-03-restore-crypto-keychain-packer-umbrella/specs/crypto-keys/spec.md

Capability Spec Delta: crypto-keys (restore-crypto-keychain-packer)

Package: @suaveplan/crypto-keys Status: PROPOSED

REMOVED Requirements

Requirement: Package exists as a standalone primitive

Reason: @suaveplan/crypto-keys is folded into the new opinionated @suaveplan/crypto package. The split between "key shape" (Keypair, Keychain adapter) and "keychain semantics" (multi-slot, versioned, signed-hierarchy) was an artificial primitive-layer carve-out — they are one concept and belong together. Maintaining them as separate packages is itself a sediment risk: callers reach for primitive Keypair to bypass the opinionated layer, exactly the failure mode this change is designed to prevent.

Migration:

• Keypair, SignAlgorithm, AgreeAlgorithm, ValidationResult types → @suaveplan/crypto/keychain (re-exported under the same names)
• generateKeypair, validateKeypair, assertValidKeypair → @suaveplan/crypto/keychain
• Keychain (the adapter), MemoryKeychainAdapter, SerializedKeychainAdapter, ReadWriter → @suaveplan/crypto/keychain (renamed where the new Keychain type from specs/crypto/spec.md would collide; the adapter becomes KeychainStore to disambiguate)
• CRYPTO_KEYS_CODES, CryptoKeysError → folded into @suaveplan/crypto's CRYPTO_CODES / CryptoError. Old codes are renamed where the new domain prefix differs (e.g., KEYPAIR.INVALID → KEYCHAIN.SLOT_INVALID).

The folded code preserves every public behaviour of @suaveplan/crypto-keys. The only consumer in genesis today is @suaveplan/crypto-vault, which is itself folded; no other package imports @suaveplan/crypto-keys. Net consumer impact: zero.

The package directory packages/crypto/crypto-keys/ is deleted in this change. openspec/specs/crypto-keys/ is deleted at archive time. CLAUDE.md and MANIFEST.md are updated.

This REMOVED Requirements block is the migration record; the consolidated spec lives at specs/crypto/spec.md.