libp2r2p 0.7.0 → 0.9.0

package/nip19/index.js

@@ -1,5 +1,6 @@
 import { bech32 } from '@scure/base'
 import { BASE62_ALPHABET, base62ToBytes, bytesToBase62 } from '../base62/index.js'
+import { ValidationError } from '../error/index.js'
 
 const MAX_ENTITY_SIZE = 5000
 const MAX_TLV_VALUE_SIZE = 255
@@ -29,6 +30,10 @@ const channelByPrefix = Object.fromEntries(
   Object.entries(prefixByChannel).map(([channel, prefix]) => [prefix, channel])
 )
 
+function invalid (code, message, cause) {
+  return new ValidationError(code, { message, cause })
+}
+
 function bytesToHex (bytes) {
   let result = ''
   for (const byte of bytes) result += byte.toString(16).padStart(2, '0')
@@ -37,7 +42,7 @@ function bytesToHex (bytes) {
 
 function hexToBytes (hex, fieldName = 'hex value') {
   if (typeof hex !== 'string' || !/^[0-9a-f]+$/i.test(hex) || hex.length % 2 !== 0) {
-    throw new Error(`Invalid ${fieldName}`)
+    throw invalid('INVALID_NIP19_HEX', `Invalid ${fieldName}`)
   }
   const result = new Uint8Array(hex.length / 2)
   for (let index = 0; index < result.length; index++) {
@@ -48,7 +53,7 @@ function hexToBytes (hex, fieldName = 'hex value') {
 
 function fixedHexToBytes (hex, byteLength, fieldName) {
   const bytes = hexToBytes(hex, fieldName)
-  if (bytes.length !== byteLength) throw new Error(`${fieldName} should be ${byteLength} bytes`)
+  if (bytes.length !== byteLength) throw invalid('INVALID_NIP19_FIELD_LENGTH', `${fieldName} should be ${byteLength} bytes`)
   return bytes
 }
 
@@ -63,34 +68,34 @@ function concatBytes (arrays) {
   return result
 }
 
-function encodeText (value, fieldName) {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new Error(`${fieldName} should be a non-empty string`)
+function encodeText (value, fieldName, { allowEmpty = false } = {}) {
+  if (typeof value !== 'string' || (!allowEmpty && value.length === 0)) {
+    throw invalid('INVALID_NIP19_TEXT_FIELD', `${fieldName} should be ${allowEmpty ? 'a string' : 'a non-empty string'}`)
   }
   const bytes = textEncoder.encode(value)
-  if (bytes.length > MAX_TLV_VALUE_SIZE) throw new Error(`${fieldName} is too big`)
+  if (bytes.length > MAX_TLV_VALUE_SIZE) throw invalid('NIP19_FIELD_TOO_LARGE', `${fieldName} is too big`)
   // TextEncoder replaces lone surrogates. Reject them instead of silently changing
   // the signed/canonical entity value.
-  if (fatalTextDecoder.decode(bytes) !== value) throw new Error(`Invalid ${fieldName} UTF-8`)
+  if (fatalTextDecoder.decode(bytes) !== value) throw invalid('INVALID_NIP19_UTF8', `Invalid ${fieldName} UTF-8`)
   return bytes
 }
 
-function decodeText (bytes, fieldName) {
-  if (bytes.length === 0 || bytes.length > MAX_TLV_VALUE_SIZE) {
-    throw new Error(`Invalid ${fieldName} length`)
+function decodeText (bytes, fieldName, { allowEmpty = false } = {}) {
+  if ((!allowEmpty && bytes.length === 0) || bytes.length > MAX_TLV_VALUE_SIZE) {
+    throw invalid('INVALID_NIP19_FIELD_LENGTH', `Invalid ${fieldName} length`)
   }
   try {
     return fatalTextDecoder.decode(bytes)
-  } catch {
-    throw new Error(`Invalid ${fieldName} UTF-8`)
+  } catch (cause) {
+    throw invalid('INVALID_NIP19_UTF8', `Invalid ${fieldName} UTF-8`, cause)
   }
 }
 
 function encodeTlvEntries (entries) {
   return concatBytes(entries.map(([type, value]) => {
-    if (!Number.isInteger(type) || type < 0 || type > 255) throw new Error('Invalid TLV type')
-    if (!(value instanceof Uint8Array)) throw new TypeError('TLV value should be a Uint8Array')
-    if (value.length > MAX_TLV_VALUE_SIZE) throw new Error('TLV value is too big')
+    if (!Number.isInteger(type) || type < 0 || type > 255) throw invalid('INVALID_TLV_TYPE', 'Invalid TLV type')
+    if (!(value instanceof Uint8Array)) throw invalid('INVALID_TLV_VALUE', 'TLV value should be a Uint8Array')
+    if (value.length > MAX_TLV_VALUE_SIZE) throw invalid('TLV_VALUE_TOO_LARGE', 'TLV value is too big')
     const entry = new Uint8Array(value.length + 2)
     entry[0] = type
     entry[1] = value.length
@@ -103,11 +108,11 @@ function decodeTlvEntries (bytes) {
   const entries = []
   let offset = 0
   while (offset < bytes.length) {
-    if (bytes.length - offset < 2) throw new Error('Truncated TLV header')
+    if (bytes.length - offset < 2) throw invalid('TRUNCATED_TLV_HEADER', 'Truncated TLV header')
     const type = bytes[offset]
     const length = bytes[offset + 1]
     offset += 2
-    if (bytes.length - offset < length) throw new Error(`Truncated TLV value for type ${type}`)
+    if (bytes.length - offset < length) throw invalid('TRUNCATED_TLV_VALUE', `Truncated TLV value for type ${type}`)
     entries.push([type, bytes.slice(offset, offset + length)])
     offset += length
   }
@@ -115,12 +120,65 @@ function decodeTlvEntries (bytes) {
 }
 
 function onlyValue (values, fieldName) {
-  if (values.length > 1) throw new Error(`Duplicate ${fieldName}`)
+  if (values.length > 1) throw invalid('DUPLICATE_NIP19_FIELD', `Duplicate ${fieldName}`)
   return values[0]
 }
 
+function encodeBech32Tlv (prefix, entries) {
+  return bech32.encode(prefix, bech32.toWords(encodeTlvEntries(entries)), MAX_ENTITY_SIZE)
+}
+
+function encodeStandardPointer (prefix, entries) {
+  return encodeBech32Tlv(prefix, entries.slice().sort(([left], [right]) => right - left))
+}
+
+function decodeBech32Bytes (entity, prefix) {
+  if (typeof entity !== 'string' || entity !== entity.toLowerCase() || !entity.startsWith(`${prefix}1`)) {
+    throw invalid('NON_CANONICAL_NIP19_ENTITY', `${prefix} should use canonical lowercase Bech32`)
+  }
+  let decoded
+  try {
+    decoded = bech32.decode(entity, MAX_ENTITY_SIZE)
+  } catch (error) {
+    throw invalid('INVALID_NIP19_ENTITY', `Invalid ${prefix}: ${error.message}`, error)
+  }
+  if (decoded.prefix !== prefix) throw invalid('INVALID_NIP19_PREFIX', `Invalid ${prefix} prefix`)
+  try {
+    return new Uint8Array(bech32.fromWords(decoded.words))
+  } catch (error) {
+    throw invalid('INVALID_NIP19_DATA', `Invalid ${prefix} data: ${error.message}`, error)
+  }
+}
+
+function decodeKnownTlv (entity, prefix, types) {
+  const known = new Map(types.map(type => [type, []]))
+  for (const [type, value] of decodeTlvEntries(decodeBech32Bytes(entity, prefix))) known.get(type)?.push(value)
+  return known
+}
+
+function encodeUint32 (value, fieldName = 'kind') {
+  if (!Number.isInteger(value) || value < 0 || value > 0xffffffff) throw invalid('INVALID_NIP19_UINT32', `Invalid ${fieldName}`)
+  const bytes = new Uint8Array(4)
+  new DataView(bytes.buffer).setUint32(0, value, false)
+  return bytes
+}
+
+function decodeUint32 (bytes, fieldName = 'kind') {
+  if (!bytes || bytes.length !== 4) throw invalid('INVALID_NIP19_UINT32', `${fieldName} should be 4 bytes`)
+  return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0, false)
+}
+
+function relayEntries (relays) {
+  if (!Array.isArray(relays)) throw invalid('INVALID_RELAY_HINTS', 'relays should be an array')
+  return relays.map(relay => [1, encodeText(relay, 'relay hint')])
+}
+
+function decodeRelayHints (values) {
+  return values.map(value => decodeText(value, 'relay hint'))
+}
+
 export function nfileEncode ({ root, relays = [], author, mime, filename }) {
-  if (!Array.isArray(relays)) throw new TypeError('relays should be an array')
+  if (!Array.isArray(relays)) throw invalid('INVALID_RELAY_HINTS', 'relays should be an array')
   const entries = [[0, fixedHexToBytes(root, 32, 'MMR root')]]
   for (const relay of relays) entries.push([1, encodeText(relay, 'relay hint')])
   if (author !== undefined) entries.push([2, fixedHexToBytes(author, 32, 'author hint')])
@@ -133,32 +191,32 @@ export function nfileEncode ({ root, relays = [], author, mime, filename }) {
 
 export function nfileDecode (entity) {
   if (typeof entity !== 'string' || entity !== entity.toLowerCase()) {
-    throw new Error('nfile should use canonical lowercase Bech32')
+    throw invalid('NON_CANONICAL_NFILE', 'nfile should use canonical lowercase Bech32')
   }
   let decoded
   try {
     decoded = bech32.decode(entity, MAX_ENTITY_SIZE)
   } catch (error) {
-    throw new Error(`Invalid nfile: ${error.message}`)
+    throw invalid('INVALID_NFILE', `Invalid nfile: ${error.message}`, error)
   }
-  if (decoded.prefix !== 'nfile') throw new Error('Invalid nfile prefix')
+  if (decoded.prefix !== 'nfile') throw invalid('INVALID_NFILE_PREFIX', 'Invalid nfile prefix')
 
   let bytes
   try {
     bytes = new Uint8Array(bech32.fromWords(decoded.words))
   } catch (error) {
-    throw new Error(`Invalid nfile data: ${error.message}`)
+    throw invalid('INVALID_NFILE_DATA', `Invalid nfile data: ${error.message}`, error)
   }
 
   const known = new Map([[0, []], [1, []], [2, []], [3, []], [4, []]])
   for (const [type, value] of decodeTlvEntries(bytes)) known.get(type)?.push(value)
 
   const rootBytes = onlyValue(known.get(0), 'MMR root')
-  if (!rootBytes) throw new Error('Missing MMR root')
-  if (rootBytes.length !== 32) throw new Error('MMR root should be 32 bytes')
+  if (!rootBytes) throw invalid('MISSING_NFILE_ROOT', 'Missing MMR root')
+  if (rootBytes.length !== 32) throw invalid('INVALID_NFILE_ROOT', 'MMR root should be 32 bytes')
 
   const authorBytes = onlyValue(known.get(2), 'author hint')
-  if (authorBytes && authorBytes.length !== 32) throw new Error('Author hint should be 32 bytes')
+  if (authorBytes && authorBytes.length !== 32) throw invalid('INVALID_NFILE_AUTHOR', 'Author hint should be 32 bytes')
   const mimeBytes = onlyValue(known.get(3), 'MIME')
   const filenameBytes = onlyValue(known.get(4), 'filename')
 
@@ -172,14 +230,93 @@ export function nfileDecode (entity) {
   return result
 }
 
+export function noteEncode (eventId) {
+  return bech32.encode('note', bech32.toWords(fixedHexToBytes(eventId, 32, 'event ID')), MAX_ENTITY_SIZE)
+}
+
+export function noteDecode (entity) {
+  const bytes = decodeBech32Bytes(entity, 'note')
+  if (bytes.length !== 32) throw invalid('INVALID_NOTE_EVENT_ID', 'event ID should be 32 bytes')
+  return bytesToHex(bytes)
+}
+
+export function nprofileEncode ({ pubkey, relays = [] }) {
+  return encodeStandardPointer('nprofile', [
+    [0, fixedHexToBytes(pubkey, 32, 'profile pubkey')],
+    ...relayEntries(relays)
+  ])
+}
+
+export function nprofileDecode (entity) {
+  const known = decodeKnownTlv(entity, 'nprofile', [0, 1])
+  const pubkey = onlyValue(known.get(0), 'profile pubkey')
+  if (!pubkey || pubkey.length !== 32) throw invalid('INVALID_NPROFILE_PUBKEY', 'profile pubkey should be 32 bytes')
+  return { pubkey: bytesToHex(pubkey), relays: decodeRelayHints(known.get(1)) }
+}
+
+export function neventEncode ({ id, relays = [], author, kind }) {
+  const entries = [[0, fixedHexToBytes(id, 32, 'event ID')], ...relayEntries(relays)]
+  if (author !== undefined) entries.push([2, fixedHexToBytes(author, 32, 'event author')])
+  if (kind !== undefined) entries.push([3, encodeUint32(kind)])
+  return encodeStandardPointer('nevent', entries)
+}
+
+export function neventDecode (entity) {
+  const known = decodeKnownTlv(entity, 'nevent', [0, 1, 2, 3])
+  const id = onlyValue(known.get(0), 'event ID')
+  const author = onlyValue(known.get(2), 'event author')
+  const kind = onlyValue(known.get(3), 'event kind')
+  if (!id || id.length !== 32) throw invalid('INVALID_NEVENT_ID', 'event ID should be 32 bytes')
+  if (author && author.length !== 32) throw invalid('INVALID_NEVENT_AUTHOR', 'event author should be 32 bytes')
+  const result = { id: bytesToHex(id), relays: decodeRelayHints(known.get(1)) }
+  if (author) result.author = bytesToHex(author)
+  if (kind) result.kind = decodeUint32(kind, 'event kind')
+  return result
+}
+
+export function naddrEncode ({ identifier, pubkey, kind, relays = [] }) {
+  return encodeStandardPointer('naddr', [
+    [0, encodeText(identifier, 'identifier', { allowEmpty: true })],
+    ...relayEntries(relays),
+    [2, fixedHexToBytes(pubkey, 32, 'address author')],
+    [3, encodeUint32(kind)]
+  ])
+}
+
+export function naddrDecode (entity) {
+  const known = decodeKnownTlv(entity, 'naddr', [0, 1, 2, 3])
+  const identifier = onlyValue(known.get(0), 'identifier')
+  const pubkey = onlyValue(known.get(2), 'address author')
+  const kind = onlyValue(known.get(3), 'address kind')
+  if (!identifier) throw invalid('MISSING_NADDR_IDENTIFIER', 'Missing identifier')
+  if (!pubkey || pubkey.length !== 32) throw invalid('INVALID_NADDR_AUTHOR', 'address author should be 32 bytes')
+  return {
+    identifier: decodeText(identifier, 'identifier', { allowEmpty: true }),
+    pubkey: bytesToHex(pubkey),
+    kind: decodeUint32(kind, 'address kind'),
+    relays: decodeRelayHints(known.get(1))
+  }
+}
+
+export function nrelayEncode (relay) {
+  return encodeStandardPointer('nrelay', [[0, encodeText(relay, 'relay URL')]])
+}
+
+export function nrelayDecode (entity) {
+  const known = decodeKnownTlv(entity, 'nrelay', [0])
+  const relay = onlyValue(known.get(0), 'relay URL')
+  if (!relay) throw invalid('MISSING_NRELAY_URL', 'Missing relay URL')
+  return decodeText(relay, 'relay URL')
+}
+
 function isNostrAppDTagSafe (value) {
   return typeof value === 'string' && value.length <= NOSTR_APP_D_TAG_MAX_LENGTH
 }
 
 export function appEncode (ref) {
-  if (!isNostrAppDTagSafe(ref.dTag)) throw new Error('Invalid deduplication tag')
+  if (!isNostrAppDTagSafe(ref?.dTag)) throw invalid('INVALID_APP_D_TAG', 'Invalid deduplication tag')
   const channel = ref.channel ? (prefixByChannel[ref.channel] && ref.channel) : channelByKind[ref.kind]
-  if (!channel) throw new Error('Wrong channel')
+  if (!channel) throw invalid('INVALID_APP_CHANNEL', 'Wrong channel')
 
   // Keep the established app-entity byte ordering exactly for compatibility.
   const groups = [
@@ -195,15 +332,15 @@ export function appEncode (ref) {
       for (const value of values) entries.push([type, value])
     })
   const entity = `${prefixByChannel[channel]}${bytesToBase62(encodeTlvEntries(entries))}`
-  if (entity.length > MAX_ENTITY_SIZE) throw new Error('App entity is too big')
+  if (entity.length > MAX_ENTITY_SIZE) throw invalid('APP_ENTITY_TOO_LARGE', 'App entity is too big')
   return entity
 }
 
 export function appDecode (entity) {
-  if (typeof entity !== 'string' || entity.length > MAX_ENTITY_SIZE) throw new Error('Invalid app entity')
+  if (typeof entity !== 'string' || entity.length > MAX_ENTITY_SIZE) throw invalid('INVALID_APP_ENTITY', 'Invalid app entity')
   const prefix = entity.match(/^\+*/)?.[0]
   const channel = channelByPrefix[prefix]
-  if (!channel) throw new Error('Invalid channel')
+  if (!channel) throw invalid('INVALID_APP_CHANNEL', 'Invalid channel')
 
   const values = new Map()
   for (const [type, value] of decodeTlvEntries(base62ToBytes(entity.slice(prefix.length)))) {
@@ -213,11 +350,11 @@ export function appDecode (entity) {
   }
   const dTagBytes = values.get(0)?.[0]
   const pubkeyBytes = values.get(2)?.[0]
-  if (!dTagBytes) throw new Error('Missing deduplication tag')
-  if (!pubkeyBytes) throw new Error('Missing author pubkey')
-  if (pubkeyBytes.length !== 32) throw new Error('Author pubkey should be 32 bytes')
+  if (!dTagBytes) throw invalid('MISSING_APP_D_TAG', 'Missing deduplication tag')
+  if (!pubkeyBytes) throw invalid('MISSING_APP_AUTHOR', 'Missing author pubkey')
+  if (pubkeyBytes.length !== 32) throw invalid('INVALID_APP_AUTHOR', 'Author pubkey should be 32 bytes')
   const dTag = textDecoder.decode(dTagBytes)
-  if (!isNostrAppDTagSafe(dTag)) throw new Error('Invalid deduplication tag')
+  if (!isNostrAppDTagSafe(dTag)) throw invalid('INVALID_APP_D_TAG', 'Invalid deduplication tag')
 
   return {
     dTag,
@@ -245,16 +382,12 @@ export function nsecDecode (entity) {
 }
 
 function decodeSimpleEntity (entity, prefix, fieldName) {
-  if (typeof entity !== 'string' || !entity.startsWith(`${prefix}1`)) {
-    throw new Error(`Invalid ${prefix} format`)
-  }
   try {
-    const decoded = bech32.decode(entity)
-    if (decoded.prefix !== prefix) throw new Error(`Invalid ${prefix} prefix`)
-    const bytes = new Uint8Array(bech32.fromWords(decoded.words))
-    if (bytes.length !== 32) throw new Error(`Invalid ${fieldName} length`)
+    const bytes = decodeBech32Bytes(entity, prefix)
+    if (bytes.length !== 32) throw invalid('INVALID_NIP19_FIELD_LENGTH', `Invalid ${fieldName} length`)
     return bytesToHex(bytes)
   } catch (error) {
-    throw new Error(`Failed to decode ${prefix}: ${error.message}`)
+    if (error instanceof ValidationError && error.code === 'INVALID_NIP19_FIELD_LENGTH') throw error
+    throw invalid('INVALID_NIP19_ENTITY', `Failed to decode ${prefix}: ${error.message}`, error)
   }
 }

package/nip44/helpers.js

@@ -0,0 +1,95 @@
+import { chacha20 } from '@noble/ciphers/chacha.js'
+import { equalBytes, randomBytes } from '@noble/ciphers/utils.js'
+import { expand, extract } from '@noble/hashes/hkdf.js'
+import { hmac } from '@noble/hashes/hmac.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import { base64ToBytes, bytesToBase64 } from '../base64/index.js'
+import { ValidationError } from '../error/index.js'
+
+const encoder = new TextEncoder()
+const decoder = new TextDecoder('utf-8', { fatal: true })
+const minPlaintextSize = 1
+const maxPlaintextSize = 0xffffffff
+const maxRawPayloadSize = 1 + 32 + 6 + 0x100000000 + 32
+const maxEncodedPayloadSize = Math.ceil(maxRawPayloadSize / 3) * 4
+
+function concatBytes (...arrays) {
+  const output = new Uint8Array(arrays.reduce((total, value) => total + value.length, 0))
+  let offset = 0
+  for (const value of arrays) {
+    output.set(value, offset)
+    offset += value.length
+  }
+  return output
+}
+
+export function getMessageKeys (conversationKey, nonce) {
+  if (!(conversationKey instanceof Uint8Array) || conversationKey.length !== 32) throw new ValidationError('INVALID_CONVERSATION_KEY')
+  if (!(nonce instanceof Uint8Array) || nonce.length !== 32) throw new ValidationError('INVALID_NONCE')
+  const keys = expand(sha256, conversationKey, nonce, 76)
+  return { key: keys.subarray(0, 32), nonce: keys.subarray(32, 44), hmacKey: keys.subarray(44) }
+}
+
+export function calcPaddedLen (length) {
+  if (!Number.isSafeInteger(length) || length < minPlaintextSize || length > maxPlaintextSize) throw new ValidationError('INVALID_PLAINTEXT_SIZE')
+  if (length <= 32) return 32
+  const nextPower = 2 ** (Math.floor(Math.log2(length - 1)) + 1)
+  const chunk = nextPower <= 256 ? 32 : nextPower / 8
+  return chunk * (Math.floor((length - 1) / chunk) + 1)
+}
+
+export function pad (plaintext) {
+  if (typeof plaintext !== 'string') throw new ValidationError('PLAINTEXT_SHOULD_BE_A_STRING')
+  const bytes = encoder.encode(plaintext)
+  const length = bytes.length
+  calcPaddedLen(length)
+  const prefixLength = length < 0x10000 ? 2 : 6
+  const prefix = new Uint8Array(prefixLength)
+  const view = new DataView(prefix.buffer)
+  if (prefixLength === 2) view.setUint16(0, length, false)
+  else view.setUint32(2, length, false)
+  return concatBytes(prefix, bytes, new Uint8Array(calcPaddedLen(length) - length))
+}
+
+export function unpad (padded) {
+  if (!(padded instanceof Uint8Array) || padded.length < 2) throw new ValidationError('INVALID_PADDING')
+  const view = new DataView(padded.buffer, padded.byteOffset, padded.byteLength)
+  const shortLength = view.getUint16(0, false)
+  const prefixLength = shortLength === 0 ? 6 : 2
+  if (padded.length < prefixLength) throw new ValidationError('INVALID_PADDING')
+  const length = shortLength === 0 ? view.getUint32(2, false) : shortLength
+  if (shortLength === 0 && length < 0x10000) throw new ValidationError('INVALID_PADDING')
+  let expected
+  try { expected = prefixLength + calcPaddedLen(length) } catch (cause) { throw new ValidationError('INVALID_PADDING', { cause }) }
+  if (padded.length !== expected || prefixLength + length > padded.length) throw new ValidationError('INVALID_PADDING')
+  try { return decoder.decode(padded.subarray(prefixLength, prefixLength + length)) } catch (cause) { throw new ValidationError('INVALID_UTF8', { cause }) }
+}
+
+export function encodePayload (conversationKey, plaintext, nonce = randomBytes(32)) {
+  const messageKeys = getMessageKeys(conversationKey, nonce)
+  const ciphertext = chacha20(messageKeys.key, messageKeys.nonce, pad(plaintext))
+  const mac = hmac(sha256, messageKeys.hmacKey, concatBytes(nonce, ciphertext))
+  return bytesToBase64(concatBytes(new Uint8Array([2]), nonce, ciphertext, mac))
+}
+
+export function decodePayload (conversationKey, payload) {
+  if (typeof payload !== 'string' || payload.length < 132 || payload.length > maxEncodedPayloadSize || payload[0] === '#') throw new ValidationError('INVALID_NIP44_PAYLOAD')
+  if (payload.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(payload)) throw new ValidationError('INVALID_BASE64')
+  const data = base64ToBytes(payload)
+  if (bytesToBase64(data) !== payload || data.length < 99 || data[0] !== 2) throw new ValidationError('INVALID_NIP44_PAYLOAD')
+  const nonce = data.subarray(1, 33)
+  const ciphertext = data.subarray(33, -32)
+  const mac = data.subarray(-32)
+  const messageKeys = getMessageKeys(conversationKey, nonce)
+  const calculated = hmac(sha256, messageKeys.hmacKey, concatBytes(nonce, ciphertext))
+  if (!equalBytes(mac, calculated)) throw new ValidationError('INVALID_MAC')
+  return unpad(chacha20(messageKeys.key, messageKeys.nonce, ciphertext))
+}
+
+export function extractConversationKey (sharedSecret, salt = 'nip44-v2') {
+  if (typeof salt !== 'string') throw new ValidationError('SALT_SHOULD_BE_A_STRING')
+  const saltBytes = encoder.encode(salt)
+  if (saltBytes.length === 0 || saltBytes.length > 32) throw new ValidationError('INVALID_SALT')
+  return extract(sha256, sharedSecret, saltBytes)
+}

package/nip44/index.js

@@ -0,0 +1,14 @@
+import { sharedXOnlySecret } from '../ecdh/index.js'
+import { decodePayload, encodePayload, extractConversationKey } from './helpers.js'
+
+export function getConversationKey (secretKey, pubkey, { salt = 'nip44-v2' } = {}) {
+  return extractConversationKey(sharedXOnlySecret(secretKey, pubkey), salt)
+}
+
+export function encrypt (plaintext, conversationKey, nonce) {
+  return encodePayload(conversationKey, plaintext, nonce)
+}
+
+export function decrypt (ciphertext, conversationKey) {
+  return decodePayload(conversationKey, ciphertext)
+}

package/nip44-v3/index.js

@@ -5,6 +5,7 @@ import { concatBytes, utf8ToBytes } from '@noble/hashes/utils.js'
 import { chacha20 } from '@noble/ciphers/chacha.js'
 import { bytesToBase64, base64ToBytes } from '../base64/index.js'
 import { sharedXOnlySecret } from '../ecdh/index.js'
+import { ValidationError } from '../error/index.js'
 
 // NIP-44 v3 — local implementation (spec.nostr.land/nip44v3)
 // Copied from the bunker testbench and verified against the vendored
@@ -34,7 +35,7 @@ function readU32be (b, off) {
   return new DataView(b.buffer, b.byteOffset, b.byteLength).getUint32(off, false)
 }
 
-function equalBytes (a, b) {
+function areBytesEqual (a, b) {
   if (a.length !== b.length) return false
   let diff = 0
   for (let i = 0; i < a.length; i++) diff |= a[i] ^ b[i]
@@ -47,7 +48,15 @@ function randomBytes32 () {
   return bytes
 }
 
+function assertBytes (value, code, length) {
+  if (!(value instanceof Uint8Array) || (length !== undefined && value.length !== length)) {
+    throw new ValidationError(code)
+  }
+  return value
+}
+
 export function deriveKeys (seckey, pubkey, nonce) {
+  assertBytes(nonce, 'INVALID_NONCE', 32)
   const shared = sharedXOnlySecret(seckey, pubkey)
   const salt = concatBytes(utf8ToBytes('nip44-v3\x00'), nonce)
   const prk = hkdfExtract(sha256, shared, salt)
@@ -71,6 +80,8 @@ export function payloadByteLength (plaintextByteLength, scopeByteLength = 0) {
 }
 
 export function deriveKeysFromConversationKey (conversationKey, nonce) {
+  assertBytes(conversationKey, 'INVALID_CONVERSATION_KEY', 32)
+  assertBytes(nonce, 'INVALID_NONCE', 32)
   const salt = concatBytes(utf8ToBytes('nip44-v3\x00'), nonce)
   const prk = hkdfExtract(sha256, conversationKey, salt)
   return {
@@ -87,6 +98,11 @@ export function encryptBytes (seckey, pubkey, kind, scope, plaintext, nonce) {
 
 export function encryptWithConversationKeyBytes (conversationKey, kind, scope, plaintext, nonce) {
   nonce ??= randomBytes32()
+  assertBytes(conversationKey, 'INVALID_CONVERSATION_KEY', 32)
+  kind = normalizeKind(kind)
+  assertBytes(scope, 'INVALID_SCOPE')
+  assertBytes(plaintext, 'INVALID_PLAINTEXT')
+  assertBytes(nonce, 'INVALID_NONCE', 32)
   const { encryption_key: encryptionKey, mac_key: macKey } = deriveKeysFromConversationKey(conversationKey, nonce)
   const prefixed = concatBytes(u32be(plaintext.length), plaintext)
   const padded = new Uint8Array(targetSize(prefixed.length))
@@ -102,34 +118,37 @@ export function decryptBytes (seckey, pubkey, expectedKind, expectedScope, ciphe
 }
 
 export function decryptWithConversationKeyBytes (conversationKey, expectedKind, expectedScope, ciphertext) {
-  if (!ciphertext || ciphertext.length === 0) throw new Error('empty ciphertext')
-  if (ciphertext[0] === '#') throw new Error('unsupported future version')
+  assertBytes(conversationKey, 'INVALID_CONVERSATION_KEY', 32)
+  expectedKind = normalizeKind(expectedKind)
+  assertBytes(expectedScope, 'INVALID_SCOPE')
+  if (typeof ciphertext !== 'string' || ciphertext.length === 0) throw new ValidationError('EMPTY_CIPHERTEXT', { message: 'empty ciphertext' })
+  if (ciphertext[0] === '#') throw new ValidationError('UNSUPPORTED_NIP44_VERSION', { message: 'unsupported future version' })
   let decoded
-  try { decoded = base64ToBytes(ciphertext) } catch { throw new Error('invalid base64') }
-  if (decoded.length < 77) throw new Error('ciphertext too short')
-  if (decoded[0] !== VERSION) throw new Error(`unsupported version ${decoded[0]}`)
+  try { decoded = base64ToBytes(ciphertext) } catch (cause) { throw new ValidationError('INVALID_BASE64', { message: 'invalid base64', cause }) }
+  if (decoded.length < 77) throw new ValidationError('NIP44_CIPHERTEXT_TOO_SHORT', { message: 'ciphertext too short' })
+  if (decoded[0] !== VERSION) throw new ValidationError('UNSUPPORTED_NIP44_VERSION', { message: `unsupported version ${decoded[0]}` })
   const nonce = decoded.subarray(1, 33)
   const mac = decoded.subarray(33, 65)
   const kind = readU32be(decoded, 65)
   const scopeLength = readU32be(decoded, 69)
-  if (scopeLength > decoded.length - 73) throw new Error('invalid scope length')
+  if (scopeLength > decoded.length - 73) throw new ValidationError('INVALID_NIP44_SCOPE_LENGTH', { message: 'invalid scope length' })
   const scope = decoded.subarray(73, 73 + scopeLength)
-  try { fatalTextDecoder.decode(scope) } catch { throw new Error('scope is not valid UTF-8') }
+  try { fatalTextDecoder.decode(scope) } catch (cause) { throw new ValidationError('INVALID_NIP44_SCOPE_UTF8', { message: 'scope is not valid UTF-8', cause }) }
   const ct = decoded.subarray(73 + scopeLength)
-  if (ct.length < 4) throw new Error('ciphertext too short')
-  if (kind !== expectedKind) throw new Error(`kind mismatch: got ${kind}, expected ${expectedKind}`)
-  if (!equalBytes(scope, expectedScope)) throw new Error('scope mismatch')
+  if (ct.length < 4) throw new ValidationError('NIP44_CIPHERTEXT_TOO_SHORT', { message: 'ciphertext too short' })
+  if (kind !== expectedKind) throw new ValidationError('NIP44_KIND_MISMATCH', { message: `kind mismatch: got ${kind}, expected ${expectedKind}` })
+  if (!areBytesEqual(scope, expectedScope)) throw new ValidationError('NIP44_SCOPE_MISMATCH', { message: 'scope mismatch' })
   const { encryption_key: encryptionKey, mac_key: macKey } = deriveKeysFromConversationKey(conversationKey, nonce)
   const authData = concatBytes(nonce, u32be(kind), u32be(scope.length), scope, ct)
-  if (!equalBytes(mac, hmac(sha256, macKey, authData))) throw new Error('invalid MAC')
+  if (!areBytesEqual(mac, hmac(sha256, macKey, authData))) throw new ValidationError('INVALID_MAC', { message: 'invalid MAC' })
   const padded = chacha(encryptionKey, ct)
   const plaintextLength = readU32be(padded, 0)
-  if (plaintextLength + 4 > padded.length) throw new Error('invalid plaintext length')
-  if (plaintextLength > 2 ** 31 - 1) throw new Error('plaintext too long')
+  if (plaintextLength + 4 > padded.length) throw new ValidationError('INVALID_PLAINTEXT_LENGTH', { message: 'invalid plaintext length' })
+  if (plaintextLength > 2 ** 31 - 1) throw new ValidationError('PLAINTEXT_TOO_LONG', { message: 'plaintext too long' })
   // Only verify the padding is all-zeroes. Per spec, implementations MUST NOT do any
   // other check on the padding length — non-standard zero-padding must decrypt.
   const padding = padded.subarray(4 + plaintextLength)
-  if (!equalBytes(padding, new Uint8Array(padding.length))) throw new Error('invalid padding')
+  if (!areBytesEqual(padding, new Uint8Array(padding.length))) throw new ValidationError('INVALID_PADDING', { message: 'invalid padding' })
   return padded.subarray(4, 4 + plaintextLength)
 }
 
@@ -139,7 +158,7 @@ function deriveSharedConversationKey (seckey, pubkey) {
 
 export function normalizeKind (kind) {
   const n = typeof kind === 'string' && kind.trim() !== '' ? Number(kind) : kind
-  if (!Number.isInteger(n) || n < 0 || n > 0xffffffff) throw new Error('INVALID_KIND')
+  if (!Number.isInteger(n) || n < 0 || n > 0xffffffff) throw new ValidationError('INVALID_KIND')
   return n
 }
 

package/nip46/helpers/frame.js

@@ -1,10 +1,10 @@
-import { finalizeEvent, verifyEvent } from 'nostr-tools'
-import { decrypt, encrypt, getConversationKey } from 'nostr-tools/nip44'
+import { finalizeEvent, isValidEvent } from '../../event/index.js'
+import { decrypt, encrypt, getConversationKey } from '../../nip44/index.js'
 import { NIP46_KIND } from '../constants/index.js'
 
 const PUBKEY = /^[0-9a-f]{64}$/
 
-export function validPubkey (value) {
+export function isValidPubkey (value) {
   return typeof value === 'string' && PUBKEY.test(value)
 }
 
@@ -14,9 +14,9 @@ export function hasPTag (event, pubkey) {
 
 export function isNip46EventFor (event, pubkey) {
   return event?.kind === NIP46_KIND &&
-    validPubkey(event.pubkey) &&
+    isValidPubkey(event.pubkey) &&
     hasPTag(event, pubkey) &&
-    verifyEvent(event)
+    isValidEvent(event)
 }
 
 export function decodeNip46Frame (event, secretKey) {
@@ -38,7 +38,7 @@ export function createNip46Event ({ secretKey, recipientPubkey, payload }) {
   }, secretKey)
 }
 
-export function validRequestFrame (frame) {
+export function isValidRequestFrame (frame) {
   return typeof frame?.id === 'string' && frame.id &&
     typeof frame.method === 'string' && frame.method &&
     Array.isArray(frame.params) && frame.params.every(param => typeof param === 'string')