Some spec declarations in the crypto module show serious confusion. For example, the code of "The New API" reads as follows:
[Apologies for the ugly format, but it's the one used in the file.]
It cannot possibly be that Cipher is declared as cipher_no_iv() in the first function which then calls the second function which expects a cipher_iv() where these two types have nothing in common.
The same problem exists in the specs of crypto_one_time.
Also, in various places in the specs, FlagOrOptions reads crypto_opts() | boolean(), i.e., as above, but then again the code defines:
Obviously, boolean() should appear in either the type declaration or in the |, not in both.
Finally, I recommend taking out | descriptive_error() (an alias for no_return()) from the return type of these functions. They will never really return this.