suaveplan/openspec/archive/2026-05-03-restore-crypto-keychain-packer-umbrella/specs/crypto-vault/spec.md

Capability Spec Delta: crypto-vault (restore-crypto-keychain-packer)

Package: @suaveplan/crypto-vault Status: PROPOSED

REMOVED Requirements

Requirement: Package exists as a standalone primitive

Reason: @suaveplan/crypto-vault is folded into the new opinionated @suaveplan/crypto package alongside @suaveplan/crypto-keys. The vault, the keychain, the packer, and the signing hierarchy are inseparable — the original design across nx/libs/keys/keys-common.ts and suaveplan/packages/universal/packer/ always treated them as one capability. Splitting them across three packages in genesis was a primitive-layer carve-out that made the missing top-layer easier to overlook.

In particular, the misleadingly-named ChainSigner (a flat Map<string, Keypair> with no chain semantics) is replaced, not folded as-is. Its name implied a hierarchy that the implementation never delivered; the new Authority interface in @suaveplan/crypto finally earns that name by signing under a real root → server hierarchy with revocation and audit-log support.

Migration:

• Vault → @suaveplan/crypto/vault (preserved API; default AEAD switched from AES-GCM to XChaCha20-Poly1305 — see specs/crypto/spec.md)
• VaultEvents, VaultOptions → @suaveplan/crypto/vault
• generateMnemonic, mnemonicToSeed, validateMnemonic, GenerateMnemonicOptions → @suaveplan/crypto/vault/mnemonic
• ChainSigner → REMOVED ENTIRELY, no replacement. Callers must use Authority from @suaveplan/crypto. The migration is non-trivial: ChainSigner.addKey(id, keypair) → InMemoryAuthority.fromKeychain(keychain) plus a hierarchy operation (createServer / rollServer). A codemod is provided at scripts/codemods/chain-signer-to-authority.ts.
• CRYPTO_VAULT_CODES, CryptoVaultError → folded into @suaveplan/crypto's CRYPTO_CODES / CryptoError. Code names are aligned to the new domain prefixes (VAULT.*, AUTHORITY.*).

The package directory packages/crypto/crypto-vault/ is deleted in this change. openspec/specs/crypto-vault/ is deleted at archive time. CLAUDE.md and MANIFEST.md are updated.

This REMOVED Requirements block is the migration record; the consolidated spec lives at specs/crypto/spec.md.