castrum 0.7.0 → 0.9.0

package/src/rust-ffi/packed.ts

@@ -0,0 +1,253 @@
+// src/rust-ffi/packed.ts — Raw packed-wire FFI namespace.
+//
+// `rust.packed.*` is the zero-copy API: callers pass already-packed buffers and
+// receive the raw packed output, plus the batch metadata/count helpers.
+
+import { asNumber } from './options'
+import { resolvePoolNative, type RustClientContext } from './context'
+import type { PasswordHashOptions } from '../native'
+
+/** Raw packed-wire FFI namespace. */
+export interface RustPacked {
+  // ── Sync batch (packed in → packed out) ──
+  crc32BatchPacked(input: Uint8Array): Uint8Array
+  jsonValidBatchPacked(input: Uint8Array): Uint8Array
+  validateEmailBatchPacked(input: Uint8Array): Uint8Array
+  validateUuidBatchPacked(input: Uint8Array): Uint8Array
+  validateIpv4BatchPacked(input: Uint8Array): Uint8Array
+  validateIpv6BatchPacked(input: Uint8Array): Uint8Array
+  jsonSumBatchPacked(input: Uint8Array): Uint8Array
+  queryParseBatchPacked(input: Uint8Array): Uint8Array
+  cookieParseBatchPacked(input: Uint8Array): Uint8Array
+  httpParseRequestBatchPacked(input: Uint8Array): Uint8Array
+  /** Batch RFC 6902 JSON Patch (two packed lists, zipped) → packed results. */
+  jsonPatchBatchPacked(docs: Uint8Array, patches: Uint8Array): Uint8Array
+  /** Packed FNV-1a 64 batch (i64 per item). */
+  fnv1A64BatchPacked(input: Uint8Array): Uint8Array
+  /** Packed ETag batch (10 strong / 12 weak bytes per item). */
+  etagBatchPacked(input: Uint8Array, weak?: boolean | null): Uint8Array
+  urlEncodeBatchPacked(input: Uint8Array): Uint8Array
+  urlDecodeBatchPacked(input: Uint8Array): Uint8Array
+  urlDecodeBytesBatchPacked(input: Uint8Array): Uint8Array
+  mimeFromExtensionBatchPacked(input: Uint8Array): Uint8Array
+  wsAcceptKeyBatchPacked(input: Uint8Array): Uint8Array
+
+  // ── Batch metadata / counts ──
+  jsonValidBatchCountPacked(input: Uint8Array): number
+  validateEmailBatchCountPacked(input: Uint8Array): number
+  validateUuidBatchCountPacked(input: Uint8Array): number
+  validateIpv4BatchCountPacked(input: Uint8Array): number
+  validateIpv6BatchCountPacked(input: Uint8Array): number
+  jsonSumBatchTotalPacked(input: Uint8Array): number
+  queryParseBatchTotalLenPacked(input: Uint8Array): number
+  cookieParseBatchTotalLenPacked(input: Uint8Array): number
+  httpParseRequestBatchTotalLenPacked(input: Uint8Array): number
+
+  // ── Backend-framework features ──
+  passwordHashBatchPacked(
+    input: Uint8Array,
+    salt: Uint8Array,
+    options?: PasswordHashOptions | null,
+  ): Uint8Array
+  /** Packed password-verify batch (two packed lists, zipped) → bitset. */
+  passwordVerifyBatchPacked(passwords: Uint8Array, phcs: Uint8Array): Uint8Array
+  /** Packed URL-resolve batch (two packed lists, zipped) → packed results. */
+  urlResolveBatchPacked(bases: Uint8Array, references: Uint8Array): Uint8Array
+  aeadEncryptBatchPacked(
+    input: Uint8Array,
+    key: Uint8Array,
+    nonce: Uint8Array,
+    algorithm?: string | null,
+  ): Uint8Array
+  aeadDecryptBatchPacked(
+    input: Uint8Array,
+    key: Uint8Array,
+    nonce: Uint8Array,
+    algorithm?: string | null,
+  ): Uint8Array
+  gzipCompressBatchPacked(input: Uint8Array, level?: number | null): Uint8Array
+  gzipDecompressBatchPacked(input: Uint8Array): Uint8Array
+  brotliCompressBatchPacked(input: Uint8Array, quality?: number | null): Uint8Array
+  brotliDecompressBatchPacked(input: Uint8Array): Uint8Array
+  jwtSignBatchPacked(
+    input: Uint8Array,
+    secret: Uint8Array,
+    ttlSeconds: number | null,
+    nowSeconds: number,
+  ): Uint8Array
+  jwtVerifyBatchPacked(input: Uint8Array, secret: Uint8Array, nowSeconds: number): Uint8Array
+  /** Batch HMAC-SHA256 sign (packed in → hex-signature byte results). */
+  hmacSha256BatchPacked(input: Uint8Array, key: Uint8Array): Uint8Array
+  /** Batch HMAC-SHA256 verify (two packed lists: data + hex sigs, zipped) → bitset. */
+  hmacSha256VerifyBatchPacked(input: Uint8Array, sigs: Uint8Array, key: Uint8Array): Uint8Array
+  multipartParseBatchPacked(input: Uint8Array, boundary: Uint8Array): Uint8Array
+  templateRenderBatchPacked(input: Uint8Array, source: string): Uint8Array
+  sseEncodeBatchPacked(
+    input: Uint8Array,
+    event: string | null,
+    id: string | null,
+    retry: number | null,
+  ): Uint8Array
+  wsFrameEncodeBatchPacked(
+    input: Uint8Array,
+    opcode: number,
+    mask: boolean,
+    fin: boolean,
+  ): Uint8Array
+  wsFrameDecodeBatchPacked(input: Uint8Array): Uint8Array
+}
+
+/** Build the `packed` namespace for a client context. */
+export function buildPacked(ctx: RustClientContext): RustPacked {
+  // Packed ops are rayon-backed NAPI calls (no C ABI). Resolve each native fn
+  // on first use — ensuring the process-wide pool initializes at that point so
+  // `rust.configure({ rayonThreads })` still takes effect — and cache it via
+  // `resolvePoolNative` (shared with `resolveNative`/batch, context.ts). This
+  // removes BOTH the lazy-addon Proxy `get` and the old `withPoolInit`
+  // per-access Proxy from the packed hot path. The object keeps the
+  // `NativeAddon` type so the method bodies below typecheck unchanged.
+  const addon = new Proxy(ctx.addon, {
+    get: (_target, name) => resolvePoolNative(ctx, String(name)),
+  }) as typeof ctx.addon
+
+  return {
+    crc32BatchPacked(input) {
+      return addon.crc32BatchPacked(input)
+    },
+    jsonValidBatchPacked(input) {
+      return addon.jsonValidBatchPacked(input)
+    },
+    validateEmailBatchPacked(input) {
+      return addon.validateEmailBatchPacked(input)
+    },
+    validateUuidBatchPacked(input) {
+      return addon.validateUuidBatchPacked(input)
+    },
+    validateIpv4BatchPacked(input) {
+      return addon.validateIpv4BatchPacked(input)
+    },
+    validateIpv6BatchPacked(input) {
+      return addon.validateIpv6BatchPacked(input)
+    },
+    jsonSumBatchPacked(input) {
+      return addon.jsonSumBatchPacked(input)
+    },
+    queryParseBatchPacked(input) {
+      return addon.queryParseBatchPacked(input)
+    },
+    cookieParseBatchPacked(input) {
+      return addon.cookieParseBatchPacked(input)
+    },
+    httpParseRequestBatchPacked(input) {
+      return addon.httpParseRequestBatchPacked(input)
+    },
+    jsonPatchBatchPacked(docs, patches) {
+      return addon.jsonPatchBatchPacked(docs, patches)
+    },
+    fnv1A64BatchPacked(input) {
+      return addon.fnv1A64BatchPacked(input)
+    },
+    etagBatchPacked(input, weak) {
+      return addon.etagBatchPacked(input, weak ?? null)
+    },
+    urlEncodeBatchPacked(input) {
+      return addon.urlEncodeBatchPacked(input)
+    },
+    urlDecodeBatchPacked(input) {
+      return addon.urlDecodeBatchPacked(input)
+    },
+    urlDecodeBytesBatchPacked(input) {
+      return addon.urlDecodeBytesBatchPacked(input)
+    },
+    mimeFromExtensionBatchPacked(input) {
+      return addon.mimeFromExtensionBatchPacked(input)
+    },
+    wsAcceptKeyBatchPacked(input) {
+      return addon.wsAcceptKeyBatchPacked(input)
+    },
+
+    jsonValidBatchCountPacked(input) {
+      return asNumber(addon.jsonValidBatchCountPacked(input))
+    },
+    validateEmailBatchCountPacked(input) {
+      return asNumber(addon.validateEmailBatchCountPacked(input))
+    },
+    validateUuidBatchCountPacked(input) {
+      return asNumber(addon.validateUuidBatchCountPacked(input))
+    },
+    validateIpv4BatchCountPacked(input) {
+      return asNumber(addon.validateIpv4BatchCountPacked(input))
+    },
+    validateIpv6BatchCountPacked(input) {
+      return asNumber(addon.validateIpv6BatchCountPacked(input))
+    },
+    jsonSumBatchTotalPacked(input) {
+      return asNumber(addon.jsonSumBatchTotalPacked(input))
+    },
+    queryParseBatchTotalLenPacked(input) {
+      return asNumber(addon.queryParseBatchTotalLenPacked(input))
+    },
+    cookieParseBatchTotalLenPacked(input) {
+      return asNumber(addon.cookieParseBatchTotalLenPacked(input))
+    },
+    httpParseRequestBatchTotalLenPacked(input) {
+      return asNumber(addon.httpParseRequestBatchTotalLenPacked(input))
+    },
+
+    // ── Backend-framework features ──
+    passwordHashBatchPacked(input, salt, options) {
+      return addon.passwordHashBatchPacked(input, salt, options ?? null)
+    },
+    passwordVerifyBatchPacked(passwords, phcs) {
+      return addon.passwordVerifyBatchPacked(passwords, phcs)
+    },
+    urlResolveBatchPacked(bases, references) {
+      return addon.urlResolveBatchPacked(bases, references)
+    },
+    aeadEncryptBatchPacked(input, key, nonce, algorithm) {
+      return addon.aeadEncryptBatchPacked(input, key, nonce, algorithm ?? null)
+    },
+    aeadDecryptBatchPacked(input, key, nonce, algorithm) {
+      return addon.aeadDecryptBatchPacked(input, key, nonce, algorithm ?? null)
+    },
+    gzipCompressBatchPacked(input, level) {
+      return addon.gzipCompressBatchPacked(input, level ?? null)
+    },
+    gzipDecompressBatchPacked(input) {
+      return addon.gzipDecompressBatchPacked(input)
+    },
+    brotliCompressBatchPacked(input, quality) {
+      return addon.brotliCompressBatchPacked(input, quality ?? null)
+    },
+    brotliDecompressBatchPacked(input) {
+      return addon.brotliDecompressBatchPacked(input)
+    },
+    jwtSignBatchPacked(input, secret, ttlSeconds, nowSeconds) {
+      return addon.jwtSignBatchPacked(input, secret, ttlSeconds ?? null, nowSeconds)
+    },
+    jwtVerifyBatchPacked(input, secret, nowSeconds) {
+      return addon.jwtVerifyBatchPacked(input, secret, nowSeconds)
+    },
+    hmacSha256BatchPacked(input, key) {
+      return addon.hmacSha256BatchPacked(input, key)
+    },
+    hmacSha256VerifyBatchPacked(input, sigs, key) {
+      return addon.hmacSha256VerifyBatchPacked(input, sigs, key)
+    },
+    multipartParseBatchPacked(input, boundary) {
+      return addon.multipartParseBatchPacked(input, boundary)
+    },
+    templateRenderBatchPacked(input, source) {
+      return addon.templateRenderBatchPacked(input, source)
+    },
+    sseEncodeBatchPacked(input, event, id, retry) {
+      return addon.sseEncodeBatchPacked(input, event ?? null, id ?? null, retry ?? null)
+    },
+    wsFrameEncodeBatchPacked(input, opcode, mask, fin) {
+      return addon.wsFrameEncodeBatchPacked(input, opcode, mask, fin)
+    },
+    wsFrameDecodeBatchPacked(input) {
+      return addon.wsFrameDecodeBatchPacked(input)
+    },
+  }
+}

package/src/rust-ffi/proven.ts

@@ -0,0 +1,42 @@
+// src/rust-ffi/proven.ts — The performance-annotated export surface.
+//
+// `proven` exposes the FULL `rust.*` surface. Each exported function's JSDoc
+// carries its measured performance vs the native JS baseline, annotated from
+// the CPU benchmark report by `scripts/annotate-performance.ts` (run via
+// `bun run check:annotate`). Functions that are SLOWER than the JS baseline
+// (e.g. `jsonParse` vs Bun's JSON.parse, or schema validation vs ajv) are
+// marked `@deprecated`.
+//
+// The registry (`src/shared/proven.ts`) is the single source of truth for the
+// annotations; `bun run check:proven` audits it against the latest benchmark
+// report (with `--fail` to gate CI).
+
+import { rust, type RustClient } from './client'
+
+/**
+ * The performance-annotated client: the full {@link RustClient} surface.
+ * Each exported function's JSDoc notes its measured performance vs the JS
+ * baseline; functions slower than the baseline carry `@deprecated`.
+ */
+export type ProvenClient = RustClient
+
+/**
+ * The full `rust.*` surface with benchmark-annotated JSDoc. Identical to
+ * `rust` — the annotations and `@deprecated` markers are what communicate
+ * performance now, not a curated subset.
+ */
+export const proven: ProvenClient = rust
+
+// Re-export the registry + helpers so consumers can audit the surface.
+export {
+  PROVEN_SURFACE,
+  provenStatus,
+  isProven,
+  provenSurface,
+  provenSummary,
+} from '../shared/proven'
+export type {
+  PerformanceStatus,
+  ProvenEntry,
+  ProvenKey,
+} from '../shared/proven'

package/src/rust-ffi/scalar/crypto.ts

@@ -0,0 +1,265 @@
+// src/rust-ffi/scalar/crypto.ts — Auth / crypto scalar methods.
+//
+// Mirrors rust/crypto/*: base64/hex codecs, signed cookies, CSRF, random
+// tokens, JWT, password hashing and AEAD.
+
+import type { PasswordHashOptions } from '../../native'
+import { getBunFFI } from '../../native/ffi'
+import { isBun } from '../../shared/runtime'
+import type { RustClientContext } from '../context'
+
+const encoder = new TextEncoder()
+const decoder = new TextDecoder()
+
+/** Auth / crypto scalar methods (`Pick<RustScalar, ...>`). */
+export function buildCrypto(ctx: RustClientContext) {
+  const { addon } = ctx
+
+  return {
+    randomToken(byteLen: number): Uint8Array {
+      // Optimal by default under Bun: `crypto.getRandomValues` + native hex
+      // beats the rust+FFI crossing for token-sized draws (decision matrix).
+      // Preserves the native 16 MiB allocation guard and the hex format
+      // (2n bytes). Node keeps the addon.
+      if (isBun()) {
+        if (byteLen > 16 * 1024 * 1024) {
+          throw new RangeError('randomToken: byteLen exceeds 16 MiB limit')
+        }
+        return encoder.encode(
+          Buffer.from(crypto.getRandomValues(new Uint8Array(byteLen))).toString('hex'),
+        )
+      }
+      const ffi = getBunFFI()
+      if (ffi) return ffi.randomToken(byteLen)
+      return addon.randomToken(byteLen)
+    },
+    base64Encode(input: Uint8Array, urlSafe?: boolean, padding?: boolean): Uint8Array {
+      // Bun's Buffer base64 (SIMD) beats the rust+FFI crossing (~2x, measured)
+      // for the standard (url-safe=false, padded) case; byte-parity pinned by
+      // test/unit/features/encoding.test.ts. url-safe/unpadded falls through to
+      // the native path (Buffer can't express base64url without string surgery).
+      if (isBun() && !urlSafe && padding !== false) {
+        return encoder.encode(Buffer.from(input).toString('base64'))
+      }
+      const ffi = getBunFFI()
+      if (ffi) return ffi.base64Encode(input, urlSafe, padding)
+      return addon.base64Encode(input, urlSafe ?? undefined, padding ?? undefined)
+    },
+    base64EncodeInto(
+      input: Uint8Array,
+      output: Uint8Array,
+      urlSafe?: boolean,
+      padding?: boolean,
+    ): number {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.base64EncodeInto(input, output, urlSafe, padding)
+      return addon.base64EncodeInto(input, output, urlSafe ?? undefined, padding ?? undefined)
+    },
+    base64Decode(input: Uint8Array, urlSafe?: boolean, padding?: boolean): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.base64Decode(input, urlSafe, padding)
+      return addon.base64Decode(input, urlSafe ?? undefined, padding ?? undefined)
+    },
+    base64DecodeInto(
+      input: Uint8Array,
+      output: Uint8Array,
+      urlSafe?: boolean,
+      padding?: boolean,
+    ): number {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.base64DecodeInto(input, output, urlSafe, padding)
+      return addon.base64DecodeInto(input, output, urlSafe ?? undefined, padding ?? undefined)
+    },
+    base64UrlEncode(input: Uint8Array): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.base64Encode(input, true, false)
+      return addon.base64UrlEncode(input)
+    },
+    base64UrlDecode(input: Uint8Array): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.base64Decode(input, true, false)
+      return addon.base64UrlDecode(input)
+    },
+    hexEncode(input: Uint8Array): Uint8Array {
+      // Bun fast path writes straight into a fresh buffer — no napi Buffer
+      // alloc + copy (~13x cheaper crossing for small inputs).
+      const ffi = getBunFFI()
+      if (ffi) return ffi.hexEncode(input)
+      return addon.hexEncode(input)
+    },
+    hexEncodeInto(input: Uint8Array, output: Uint8Array): number {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.hexEncodeInto(input, output)
+      return addon.hexEncodeInto(input, output)
+    },
+    hexDecode(input: Uint8Array): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.hexDecode(input)
+      return addon.hexDecode(input)
+    },
+    hexDecodeInto(input: Uint8Array, output: Uint8Array): number {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.hexDecodeInto(input, output)
+      return addon.hexDecodeInto(input, output)
+    },
+    signCookie(value: Uint8Array, secret: Uint8Array): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.signCookie(value, secret)
+      return addon.signCookie(value, secret)
+    },
+    signCookieInto(value: Uint8Array, secret: Uint8Array, output: Uint8Array): number {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.signCookieInto(value, secret, output)
+      const bytes = addon.signCookie(value, secret)
+      if (output.length < bytes.length) throw new Error('sign cookie: output buffer too small')
+      output.set(bytes)
+      return bytes.length
+    },
+    verifyCookie(signed: Uint8Array, secret: Uint8Array): Uint8Array | null {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.verifyCookie(signed, secret)
+      return addon.verifyCookie(signed, secret)
+    },
+    csrfToken(secret: Uint8Array): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.csrfToken(secret)
+      return addon.csrfToken(secret)
+    },
+    csrfVerify(token: Uint8Array, secret: Uint8Array): boolean {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.csrfVerify(token, secret)
+      return addon.csrfVerify(token, secret)
+    },
+    jwtSign(
+      claims: Record<string, unknown>,
+      secret: Uint8Array,
+      ttlSeconds?: number | null,
+      nowSeconds?: number,
+    ): Uint8Array {
+      return addon.jwtSign(
+        claims,
+        secret,
+        ttlSeconds ?? null,
+        nowSeconds ?? Math.floor(Date.now() / 1000),
+      )
+    },
+    jwtSignBytes(
+      claimsJson: Uint8Array,
+      secret: Uint8Array,
+      ttlSeconds?: number | null,
+      nowSeconds?: number,
+    ): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) {
+        // The C-ABI `ttl <= 0` sentinel matches napi's Option<i64> (inject only
+        // when positive), and nowSeconds defaults identically.
+        return ffi.jwtSignBytes(
+          claimsJson,
+          secret,
+          ttlSeconds ?? 0,
+          nowSeconds ?? Math.floor(Date.now() / 1000),
+        )
+      }
+      return addon.jwtSignBytes(
+        claimsJson,
+        secret,
+        ttlSeconds ?? null,
+        nowSeconds ?? Math.floor(Date.now() / 1000),
+      )
+    },
+    jwtVerify(token: Uint8Array, secret: Uint8Array, nowSeconds?: number): unknown {
+      return addon.jwtVerify(token, secret, nowSeconds ?? Math.floor(Date.now() / 1000))
+    },
+    passwordHash(
+      password: Uint8Array,
+      salt: Uint8Array,
+      options?: PasswordHashOptions | null,
+    ): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) {
+        // Resolve the napi defaults (rust/crypto/argon2.rs resolve_opts).
+        const o = options ?? {}
+        return ffi.passwordHash(
+          password,
+          salt,
+          o.mCost ?? 19456,
+          o.tCost ?? 2,
+          o.pCost ?? 1,
+          o.outLen ?? 32,
+        )
+      }
+      return addon.passwordHash(password, salt, options ?? null)
+    },
+    passwordVerify(password: Uint8Array, phc: Uint8Array): boolean {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.passwordVerify(password, phc)
+      return addon.passwordVerify(password, phc)
+    },
+    passwordHashBcrypt(password: Uint8Array, cost: number): string {
+      const ffi = getBunFFI()
+      if (ffi) return decoder.decode(ffi.passwordHashBcrypt(password, cost))
+      return addon.passwordHashBcrypt(password, cost)
+    },
+    passwordVerifyBcrypt(password: Uint8Array, hash: string): boolean {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.passwordVerifyBcrypt(password, encoder.encode(hash))
+      return addon.passwordVerifyBcrypt(password, hash)
+    },
+    pbkdf2Sha256(
+      password: Uint8Array,
+      salt: Uint8Array,
+      rounds: number,
+      dkLen: number,
+    ): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) return ffi.pbkdf2Sha256(password, salt, rounds, dkLen)
+      return addon.pbkdf2Sha256(password, salt, rounds, dkLen)
+    },
+    aeadEncrypt(
+      key: Uint8Array,
+      nonce: Uint8Array,
+      plaintext: Uint8Array,
+      algorithm?: string | null,
+    ): Uint8Array {
+      const ffi = getBunFFI()
+      if (ffi) {
+        return ffi.aeadEncrypt(key, nonce, plaintext, algorithm === 'chacha20-poly1305' ? 1 : 0)
+      }
+      return addon.aeadEncrypt(key, nonce, plaintext, algorithm ?? null)
+    },
+    aeadEncryptInto(
+      key: Uint8Array,
+      nonce: Uint8Array,
+      plaintext: Uint8Array,
+      output: Uint8Array,
+      algorithm?: string | null,
+    ): number {
+      const ffi = getBunFFI()
+      if (ffi) {
+        return ffi.aeadEncryptInto(
+          key,
+          nonce,
+          plaintext,
+          output,
+          algorithm === 'chacha20-poly1305' ? 1 : 0,
+        )
+      }
+      const bytes = addon.aeadEncrypt(key, nonce, plaintext, algorithm ?? null)
+      if (output.length < bytes.length) throw new Error('aead encrypt: output buffer too small')
+      output.set(bytes)
+      return bytes.length
+    },
+    aeadDecrypt(
+      key: Uint8Array,
+      nonce: Uint8Array,
+      ciphertext: Uint8Array,
+      algorithm?: string | null,
+    ): Uint8Array | null {
+      const ffi = getBunFFI()
+      if (ffi) {
+        return ffi.aeadDecrypt(key, nonce, ciphertext, algorithm === 'chacha20-poly1305' ? 1 : 0)
+      }
+      return addon.aeadDecrypt(key, nonce, ciphertext, algorithm ?? null)
+    },
+  }
+}