@rubytech/create-maxy-code 0.1.51 → 0.1.57

package/payload/platform/plugins/property-data/mcp/package.json

@@ -0,0 +1,21 @@
+{
+  "name": "@maxy/property-data",
+  "version": "0.1.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "scripts": {
+    "build": "tsc",
+    "start": "node dist/index.js",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.12.1",
+    "neo4j-driver": "^5.28.1"
+  },
+  "devDependencies": {
+    "typescript": "^5.7.0",
+    "@types/node": "^22.0.0",
+    "vitest": "^4.1.2"
+  }
+}

package/payload/platform/plugins/property-data/mcp/src/__tests__/key-roundtrip.test.ts

@@ -0,0 +1,107 @@
+/**
+ * Key register / list / deregister round-trip against a mocked Neo4j
+ * session + mocked crypto + mocked fetch (for key validation against
+ * PropertyData's /national-hpi endpoint).
+ */
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("../lib/neo4j.js", () => {
+  let stored: { encryptedKey: string; createdAt: string; updatedAt: string } | null = null;
+  return {
+    getSession: () => ({
+      run: vi.fn(async (cypher: string, params: Record<string, unknown>) => {
+        if (/CREATE INDEX/.test(cypher)) return { records: [] };
+        if (/MERGE \(k:PropertyDataKey/.test(cypher)) {
+          const now = String(params.now ?? new Date().toISOString());
+          stored = {
+            encryptedKey: String(params.encryptedKey),
+            createdAt: stored?.createdAt ?? now,
+            updatedAt: now,
+          };
+          return { records: [] };
+        }
+        if (/MATCH \(k:PropertyDataKey/.test(cypher) && /DELETE/.test(cypher)) {
+          const count = stored ? 1 : 0;
+          stored = null;
+          return {
+            records: [{ get: (k: string) => (k === "deleted" ? { toNumber: () => count } : null) }],
+          };
+        }
+        if (/MATCH \(k:PropertyDataKey/.test(cypher) && /RETURN/.test(cypher)) {
+          return {
+            records: stored
+              ? [
+                  {
+                    get: (k: string) => {
+                      if (k === "encryptedKey") return stored!.encryptedKey;
+                      if (k === "createdAt") return stored!.createdAt;
+                      if (k === "updatedAt") return stored!.updatedAt;
+                      return null;
+                    },
+                  },
+                ]
+              : [],
+          };
+        }
+        return { records: [] };
+      }),
+      close: vi.fn(async () => {}),
+    }),
+    closeDriver: vi.fn(async () => {}),
+  };
+});
+
+vi.mock("../lib/crypto.js", () => ({
+  encrypt: (s: string) => `enc:${s}`,
+  decrypt: (s: string) => s.replace(/^enc:/, ""),
+}));
+
+import { keyRegister } from "../tools/key-register.js";
+import { keyDeregister } from "../tools/key-deregister.js";
+import { keyList } from "../tools/key-list.js";
+
+const originalFetch = globalThis.fetch;
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  vi.restoreAllMocks();
+});
+
+describe("key round-trip", () => {
+  it("rejects an unregistered account on list", async () => {
+    const out = await keyList({ accountId: "acc-empty" });
+    expect(out).toMatch(/No PropertyData API key registered/);
+  });
+
+  it("rejects deregister when no key is stored", async () => {
+    await expect(keyDeregister({ accountId: "acc-empty-2" })).rejects.toThrow(
+      /No PropertyData API key/,
+    );
+  });
+
+  it("rejects registration when PropertyData returns 401", async () => {
+    globalThis.fetch = vi.fn(
+      async () => new Response("unauthorized", { status: 401 }),
+    ) as unknown as typeof fetch;
+    await expect(keyRegister({ apiKey: "bad-key", accountId: "acc-x" })).rejects.toThrow(
+      /rejected the API key/,
+    );
+  });
+
+  it("registers, lists, then deregisters successfully", async () => {
+    globalThis.fetch = vi.fn(
+      async () =>
+        new Response(JSON.stringify({ status: "success", uk_hpi: 100 }), { status: 200 }),
+    ) as unknown as typeof fetch;
+    await keyRegister({ apiKey: "good-key-12345", accountId: "acc-r" });
+
+    const listed = await keyList({ accountId: "acc-r" });
+    expect(listed).toMatch(/PropertyData API key registered/);
+    expect(listed).not.toContain("good-key-12345");
+
+    await keyDeregister({ accountId: "acc-r" });
+    const afterDelete = await keyList({ accountId: "acc-r" });
+    expect(afterDelete).toMatch(/No PropertyData API key/);
+  });
+});

package/payload/platform/plugins/property-data/mcp/src/__tests__/propertydata-api.test.ts

@@ -0,0 +1,184 @@
+/**
+ * propertydata-api.ts behaviour with mocked fetch + mocked neo4j store.
+ * Covers:
+ *  - missing-key path throws KeyNotRegisteredError
+ *  - 4xx upstream maps to PropertyDataError with the status preserved
+ *  - 5xx upstream maps to PropertyDataError with the status preserved
+ *  - PropertyData JSON envelope with status=error maps to PropertyDataError
+ *  - non-JSON body maps to BadResponseError
+ *  - successful call returns the payload as a JSON string
+ */
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("../lib/neo4j.js", () => {
+  let stored: { encryptedKey: string } | null = null;
+  return {
+    getSession: () => ({
+      run: vi.fn(async (cypher: string, params: Record<string, unknown>) => {
+        if (/MATCH \(k:PropertyDataKey/.test(cypher) && /RETURN/.test(cypher)) {
+          return {
+            records: stored
+              ? [
+                  {
+                    get: (k: string) => {
+                      if (k === "encryptedKey") return stored!.encryptedKey;
+                      if (k === "createdAt") return "2026-01-01T00:00:00Z";
+                      if (k === "updatedAt") return "2026-01-01T00:00:00Z";
+                      return null;
+                    },
+                  },
+                ]
+              : [],
+          };
+        }
+        if (/MERGE \(k:PropertyDataKey/.test(cypher)) {
+          stored = { encryptedKey: String(params.encryptedKey) };
+          return { records: [] };
+        }
+        if (/DELETE k/.test(cypher)) {
+          const count = stored ? 1 : 0;
+          stored = null;
+          return {
+            records: [{ get: (k: string) => (k === "deleted" ? { toNumber: () => count } : null) }],
+          };
+        }
+        return { records: [] };
+      }),
+      close: vi.fn(async () => {}),
+    }),
+    closeDriver: vi.fn(async () => {}),
+  };
+});
+
+vi.mock("../lib/crypto.js", () => ({
+  encrypt: (s: string) => `enc:${s}`,
+  decrypt: (s: string) => s.replace(/^enc:/, ""),
+}));
+
+import {
+  propertyDataCall,
+  KeyNotRegisteredError,
+  PropertyDataError,
+  BadResponseError,
+} from "../lib/propertydata-api.js";
+import { keyRegister } from "../tools/key-register.js";
+
+const originalFetch = globalThis.fetch;
+
+function mockFetch(impl: (url: string) => Response | Promise<Response>) {
+  globalThis.fetch = vi.fn(async (url: string | URL | Request) =>
+    impl(String(url)),
+  ) as unknown as typeof fetch;
+}
+
+beforeEach(() => {
+  // no-op
+});
+
+afterEach(() => {
+  globalThis.fetch = originalFetch;
+  vi.restoreAllMocks();
+});
+
+async function registerTestKey() {
+  mockFetch(() => new Response(JSON.stringify({ status: "success", uk_hpi: 100 }), { status: 200 }));
+  await keyRegister({ apiKey: "test-key-12345", accountId: "acc-1" });
+}
+
+describe("propertyDataCall", () => {
+  it("throws KeyNotRegisteredError when no key is stored", async () => {
+    await expect(
+      propertyDataCall({
+        endpoint: "demand",
+        toolName: "property-data-demand",
+        accountId: "ghost-account",
+        params: { postcode: "SN7" },
+      }),
+    ).rejects.toBeInstanceOf(KeyNotRegisteredError);
+  });
+
+  it("returns the JSON payload as a string on success", async () => {
+    await registerTestKey();
+    mockFetch(
+      () => new Response(JSON.stringify({ status: "success", point_estimate: 350000 }), { status: 200 }),
+    );
+    const result = await propertyDataCall({
+      endpoint: "valuation-sale",
+      toolName: "property-data-valuation-sale",
+      accountId: "acc-1",
+      params: { postcode: "SN7", type: "detached", bedrooms: 3 },
+    });
+    expect(result).toContain("point_estimate");
+    expect(JSON.parse(result).point_estimate).toBe(350000);
+  });
+
+  it("maps HTTP 4xx to PropertyDataError preserving the status", async () => {
+    await registerTestKey();
+    mockFetch(() => new Response("bad postcode", { status: 400 }));
+    try {
+      await propertyDataCall({
+        endpoint: "demand",
+        toolName: "property-data-demand",
+        accountId: "acc-1",
+        params: { postcode: "INVALID" },
+      });
+      throw new Error("expected PropertyDataError");
+    } catch (err) {
+      expect(err).toBeInstanceOf(PropertyDataError);
+      expect((err as PropertyDataError).status).toBe(400);
+    }
+  });
+
+  it("maps HTTP 5xx to PropertyDataError preserving the status", async () => {
+    await registerTestKey();
+    mockFetch(() => new Response("upstream down", { status: 503 }));
+    try {
+      await propertyDataCall({
+        endpoint: "demand",
+        toolName: "property-data-demand",
+        accountId: "acc-1",
+        params: { postcode: "SN7" },
+      });
+      throw new Error("expected PropertyDataError");
+    } catch (err) {
+      expect(err).toBeInstanceOf(PropertyDataError);
+      expect((err as PropertyDataError).status).toBe(503);
+    }
+  });
+
+  it("maps PropertyData status=error envelope to PropertyDataError", async () => {
+    await registerTestKey();
+    mockFetch(
+      () =>
+        new Response(JSON.stringify({ status: "error", message: "Insufficient comparables" }), {
+          status: 200,
+        }),
+    );
+    try {
+      await propertyDataCall({
+        endpoint: "valuation-sale",
+        toolName: "property-data-valuation-sale",
+        accountId: "acc-1",
+        params: { postcode: "SN7" },
+      });
+      throw new Error("expected PropertyDataError");
+    } catch (err) {
+      expect(err).toBeInstanceOf(PropertyDataError);
+      expect((err as PropertyDataError).upstreamMessage).toMatch(/Insufficient/);
+    }
+  });
+
+  it("maps non-JSON body to BadResponseError", async () => {
+    await registerTestKey();
+    mockFetch(() => new Response("<html>service maintenance</html>", { status: 200 }));
+    await expect(
+      propertyDataCall({
+        endpoint: "demand",
+        toolName: "property-data-demand",
+        accountId: "acc-1",
+        params: { postcode: "SN7" },
+      }),
+    ).rejects.toBeInstanceOf(BadResponseError);
+  });
+});

package/payload/platform/plugins/property-data/mcp/src/__tests__/schema-parity.test.ts

@@ -0,0 +1,48 @@
+/**
+ * Schema parity: every tool declared in PLUGIN.md frontmatter must have a
+ * handler registered in index.ts, and every handler in index.ts must be
+ * declared in PLUGIN.md. Blocks silent drift between the manifest the
+ * platform reads and the tool surface the server exposes.
+ */
+
+import { describe, expect, it } from "vitest";
+import { readFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const PLUGIN_ROOT = resolve(here, "../../..");
+
+function readPluginMdTools(): string[] {
+  const md = readFileSync(resolve(PLUGIN_ROOT, "PLUGIN.md"), "utf-8");
+  const fmMatch = md.match(/^---\n([\s\S]*?)\n---/);
+  if (!fmMatch) throw new Error("PLUGIN.md frontmatter not found");
+  const tools: string[] = [];
+  for (const line of fmMatch[1].split("\n")) {
+    const m = line.match(/^\s+-\s+name:\s+(\S+)/);
+    if (m) tools.push(m[1]);
+  }
+  return tools;
+}
+
+function readIndexTools(): string[] {
+  const src = readFileSync(resolve(PLUGIN_ROOT, "mcp/src/index.ts"), "utf-8");
+  const matches = src.matchAll(/server\.tool\(\s*"([^"]+)"/g);
+  return Array.from(matches, (m) => m[1]);
+}
+
+describe("schema parity", () => {
+  it("PLUGIN.md frontmatter and index.ts register the same tool set", () => {
+    const declared = readPluginMdTools().sort();
+    const registered = readIndexTools().sort();
+    expect(registered).toEqual(declared);
+  });
+
+  it("declares all 12 tools (3 key-mgmt + 9 endpoints)", () => {
+    const declared = readPluginMdTools();
+    expect(declared).toHaveLength(12);
+    expect(declared).toContain("property-data-key-register");
+    expect(declared).toContain("property-data-valuation-sale");
+    expect(declared).toContain("property-data-national-hpi");
+  });
+});

package/payload/platform/plugins/property-data/mcp/src/index.ts

@@ -0,0 +1,249 @@
+import { initStderrTee } from "../../../../../../platform/lib/mcp-stderr-tee/dist/index.js";
+initStderrTee("property-data");
+
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { keyRegister } from "./tools/key-register.js";
+import { keyDeregister } from "./tools/key-deregister.js";
+import { keyList } from "./tools/key-list.js";
+import {
+  valuationSale,
+  valuationRent,
+  prices,
+  pricesRent,
+  soldPrices,
+  demand,
+  yields,
+  growth,
+  nationalHpi,
+} from "./tools/endpoints.js";
+import { closeDriver } from "./lib/neo4j.js";
+import {
+  KeyNotRegisteredError,
+  PropertyDataError,
+  BadResponseError,
+} from "./lib/propertydata-api.js";
+
+const accountId = process.env.ACCOUNT_ID;
+if (!accountId) {
+  throw new Error("ACCOUNT_ID environment variable is required");
+}
+
+const server = new McpServer({
+  name: "maxy-property-data",
+  version: "0.1.0",
+});
+
+console.error(`[property-data] server started, account=${accountId}`);
+
+function errorEnvelope(err: unknown): { content: { type: "text"; text: string }[]; isError: true } {
+  let text: string;
+  if (err instanceof KeyNotRegisteredError) {
+    text =
+      "Error: key-not-registered. Register a PropertyData API key with property-data-key-register before calling this tool.";
+  } else if (err instanceof PropertyDataError) {
+    text = `Error: http-${err.status} from PropertyData. ${err.upstreamMessage}`;
+  } else if (err instanceof BadResponseError) {
+    text = `Error: bad-response from PropertyData (non-JSON, length=${err.length}).`;
+  } else {
+    text = `Error: ${err instanceof Error ? err.message : String(err)}`;
+  }
+  return { content: [{ type: "text" as const, text }], isError: true };
+}
+
+function endpointHandler<P extends Record<string, unknown>>(
+  fn: (args: P & { accountId: string }) => Promise<string>,
+) {
+  return async (params: P) => {
+    try {
+      const text = await fn({ ...params, accountId: accountId as string });
+      return { content: [{ type: "text" as const, text }] };
+    } catch (err) {
+      return errorEnvelope(err);
+    }
+  };
+}
+
+// ─────────────────────────────────────────────────────────────────
+// Key Management
+// ─────────────────────────────────────────────────────────────────
+
+server.tool(
+  "property-data-key-register",
+  "Register the account's PropertyData API key. Validates the key against PropertyData's /national-hpi endpoint, encrypts it with AES-256-GCM, and stores it in Neo4j. One key per account; re-registering overwrites the existing key.",
+  {
+    apiKey: z.string().min(8).describe("PropertyData API key from propertydata.co.uk dashboard"),
+  },
+  async ({ apiKey }) => {
+    try {
+      await keyRegister({ apiKey, accountId: accountId as string });
+      return {
+        content: [
+          {
+            type: "text" as const,
+            text: "PropertyData API key registered successfully.",
+          },
+        ],
+      };
+    } catch (err) {
+      return errorEnvelope(err);
+    }
+  },
+);
+
+server.tool(
+  "property-data-key-deregister",
+  "Remove the account's PropertyData API key. The encrypted key is permanently deleted from Neo4j.",
+  {},
+  async () => {
+    try {
+      await keyDeregister({ accountId: accountId as string });
+      return {
+        content: [{ type: "text" as const, text: "PropertyData API key deregistered." }],
+      };
+    } catch (err) {
+      return errorEnvelope(err);
+    }
+  },
+);
+
+server.tool(
+  "property-data-key-list",
+  "Show whether a PropertyData API key is registered for this account. Never reveals the key value.",
+  {},
+  async () => {
+    try {
+      const text = await keyList({ accountId: accountId as string });
+      return { content: [{ type: "text" as const, text }] };
+    } catch (err) {
+      return errorEnvelope(err);
+    }
+  },
+);
+
+// ─────────────────────────────────────────────────────────────────
+// Valuation endpoints
+// ─────────────────────────────────────────────────────────────────
+
+const valuationSchema = {
+  postcode: z.string().min(2).describe("UK postcode (outcode or full)"),
+  type: z
+    .enum(["detached", "semi-detached", "terraced", "flat"])
+    .describe("Property type"),
+  bedrooms: z.number().int().min(0).describe("Bedroom count"),
+  bathrooms: z.number().int().min(0).optional().describe("Bathroom count"),
+  internal_area: z.number().optional().describe("Internal area (sq ft)"),
+  construction_date: z.string().optional().describe("Construction date band (e.g. 'pre1900', '1900-1929')"),
+  finish_quality: z
+    .enum(["luxury", "above_average", "average", "below_average", "needs_modernisation"])
+    .optional()
+    .describe("Finish quality"),
+};
+
+server.tool(
+  "property-data-valuation-sale",
+  "Point sale-price estimate for a property given postcode + attributes. Returns point estimate plus comparables.",
+  valuationSchema,
+  endpointHandler(valuationSale),
+);
+
+server.tool(
+  "property-data-valuation-rent",
+  "Point rent estimate (PCM) for a property given postcode + attributes. Returns point estimate plus comparables.",
+  valuationSchema,
+  endpointHandler(valuationRent),
+);
+
+// ─────────────────────────────────────────────────────────────────
+// Asking-price distributions
+// ─────────────────────────────────────────────────────────────────
+
+const pricesSchema = {
+  postcode: z.string().min(2).describe("UK postcode (outcode or full)"),
+  type: z
+    .enum(["detached", "semi-detached", "terraced", "flat"])
+    .optional()
+    .describe("Filter by property type"),
+  bedrooms: z.number().int().min(0).optional().describe("Filter by bedroom count"),
+};
+
+server.tool(
+  "property-data-prices",
+  "Asking-price distribution for sale listings in a postcode — mean, median, 80th percentile.",
+  pricesSchema,
+  endpointHandler(prices),
+);
+
+server.tool(
+  "property-data-prices-rent",
+  "Asking-price distribution for rental listings in a postcode — mean, median, 80th percentile (PCM).",
+  pricesSchema,
+  endpointHandler(pricesRent),
+);
+
+// ─────────────────────────────────────────────────────────────────
+// Sold prices (Land Registry)
+// ─────────────────────────────────────────────────────────────────
+
+server.tool(
+  "property-data-sold-prices",
+  "Land Registry sold transactions for a postcode, optionally filtered by age, type, and bedrooms.",
+  {
+    postcode: z.string().min(2).describe("UK postcode (outcode or full)"),
+    max_age: z.number().int().min(1).optional().describe("Max transaction age in months"),
+    type: z
+      .enum(["detached", "semi-detached", "terraced", "flat"])
+      .optional()
+      .describe("Filter by property type"),
+    bedrooms: z.number().int().min(0).optional().describe("Filter by bedroom count"),
+  },
+  endpointHandler(soldPrices),
+);
+
+// ─────────────────────────────────────────────────────────────────
+// Demand / yields / growth / national HPI
+// ─────────────────────────────────────────────────────────────────
+
+server.tool(
+  "property-data-demand",
+  "Demand signals for a postcode — count of properties for sale and average days to sell-STC.",
+  { postcode: z.string().min(2).describe("UK postcode (outcode or full)") },
+  endpointHandler(demand),
+);
+
+server.tool(
+  "property-data-yields",
+  "Gross rental yield for a postcode and bedroom count.",
+  {
+    postcode: z.string().min(2).describe("UK postcode (outcode or full)"),
+    bedrooms: z.number().int().min(0).describe("Bedroom count"),
+  },
+  endpointHandler(yields),
+);
+
+server.tool(
+  "property-data-growth",
+  "Short-term and long-term price growth signals for a postcode.",
+  { postcode: z.string().min(2).describe("UK postcode (outcode or full)") },
+  endpointHandler(growth),
+);
+
+server.tool(
+  "property-data-national-hpi",
+  "UK national house-price index series. No postcode required.",
+  {},
+  endpointHandler(nationalHpi),
+);
+
+// ─────────────────────────────────────────────────────────────────
+// Lifecycle
+// ─────────────────────────────────────────────────────────────────
+
+process.on("SIGINT", async () => {
+  await closeDriver();
+  process.exit(0);
+});
+
+const transport = new StdioServerTransport();
+await server.connect(transport);

package/payload/platform/plugins/property-data/mcp/src/lib/crypto.ts

@@ -0,0 +1,79 @@
+import { randomBytes, createCipheriv, createDecipheriv } from "node:crypto";
+import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { resolve } from "node:path";
+import { homedir } from "node:os";
+
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const AUTH_TAG_LENGTH = 16;
+const KEY_FILE_NAME = ".property-data-encryption-key";
+
+function resolveConfigDir(): string {
+  try {
+    const platformRoot = process.env.PLATFORM_ROOT;
+    if (platformRoot) {
+      const brandPath = resolve(platformRoot, "config/brand.json");
+      const brand = JSON.parse(readFileSync(brandPath, "utf-8"));
+      if (brand.configDir) return brand.configDir;
+    }
+  } catch {
+    // Fall back to default
+  }
+  return ".maxy";
+}
+
+function keyFilePath(): string {
+  return resolve(homedir(), resolveConfigDir(), KEY_FILE_NAME);
+}
+
+function loadOrGenerateKey(): Buffer {
+  const path = keyFilePath();
+  if (existsSync(path)) {
+    const hex = readFileSync(path, "utf-8").trim();
+    const buf = Buffer.from(hex, "hex");
+    if (buf.length !== KEY_LENGTH) {
+      throw new Error(
+        `Encryption key at ${path} is ${buf.length} bytes, expected ${KEY_LENGTH}. ` +
+          `Delete the file and re-register the PropertyData API key.`,
+      );
+    }
+    return buf;
+  }
+  const key = randomBytes(KEY_LENGTH);
+  writeFileSync(path, key.toString("hex"), { mode: 0o600 });
+  console.error(`[property-data] encryption key generated at ${path}`);
+  return key;
+}
+
+export function encrypt(plaintext: string): string {
+  const key = loadOrGenerateKey();
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  let encrypted = cipher.update(plaintext, "utf-8", "hex");
+  encrypted += cipher.final("hex");
+  const authTag = cipher.getAuthTag().toString("hex");
+  return `${iv.toString("hex")}:${encrypted}:${authTag}`;
+}
+
+export function decrypt(encryptedValue: string): string {
+  const parts = encryptedValue.split(":");
+  if (parts.length !== 3) {
+    throw new Error("Malformed encrypted value — expected iv:ciphertext:authTag");
+  }
+  const [ivHex, ciphertextHex, authTagHex] = parts;
+  const path = keyFilePath();
+  if (!existsSync(path)) {
+    throw new Error(
+      `Encryption key not found at ${path}. The stored PropertyData API key is unrecoverable. Re-register.`,
+    );
+  }
+  const key = loadOrGenerateKey();
+  const iv = Buffer.from(ivHex, "hex");
+  const authTag = Buffer.from(authTagHex, "hex");
+  const decipher = createDecipheriv(ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(ciphertextHex, "hex", "utf-8");
+  decrypted += decipher.final("utf-8");
+  return decrypted;
+}