libp2r2p 0.8.0 → 0.10.0

package/nip04/index.js

@@ -0,0 +1,47 @@
+import { cbc } from '@noble/ciphers/aes.js'
+import { randomBytes } from '@noble/ciphers/utils.js'
+
+import { base16ToBytes } from '../base16/index.js'
+import { base64ToBytes, bytesToBase64 } from '../base64/index.js'
+import { sharedXOnlySecret } from '../ecdh/index.js'
+import { ValidationError } from '../error/index.js'
+
+const encoder = new TextEncoder()
+const decoder = new TextDecoder('utf-8', { fatal: true })
+
+function decodeBase64 (value) {
+  if (typeof value !== 'string' || value.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) {
+    throw new ValidationError('INVALID_BASE64')
+  }
+  const bytes = base64ToBytes(value)
+  if (bytesToBase64(bytes) !== value) throw new ValidationError('NON_CANONICAL_BASE64')
+  return bytes
+}
+
+function conversationKey (secretKey, pubkey) {
+  if (!(secretKey instanceof Uint8Array) || secretKey.length !== 32) throw new ValidationError('INVALID_SECRET_KEY')
+  if (typeof pubkey !== 'string' || !/^[0-9a-f]{64}$/.test(pubkey)) throw new ValidationError('INVALID_PUBLIC_KEY')
+  return sharedXOnlySecret(secretKey, pubkey)
+}
+
+export function encrypt (secretKey, pubkey, plaintext) {
+  if (typeof plaintext !== 'string') throw new ValidationError('PLAINTEXT_SHOULD_BE_A_STRING')
+  const iv = randomBytes(16)
+  const ciphertext = cbc(conversationKey(secretKey, pubkey), iv).encrypt(encoder.encode(plaintext))
+  return `${bytesToBase64(ciphertext)}?iv=${bytesToBase64(iv)}`
+}
+
+export function decrypt (secretKey, pubkey, payload) {
+  if (typeof payload !== 'string') throw new ValidationError('CIPHERTEXT_SHOULD_BE_A_STRING')
+  const parts = payload.split('?iv=')
+  if (parts.length !== 2 || !parts[0] || !parts[1]) throw new ValidationError('INVALID_NIP04_ENVELOPE')
+  const ciphertext = decodeBase64(parts[0])
+  const iv = decodeBase64(parts[1])
+  if (iv.length !== 16 || ciphertext.length === 0 || ciphertext.length % 16 !== 0) throw new ValidationError('INVALID_NIP04_ENVELOPE')
+  try {
+    return decoder.decode(cbc(conversationKey(secretKey, pubkey), iv).decrypt(ciphertext))
+  } catch (cause) {
+    if (cause instanceof ValidationError && cause.code !== 'INVALID_NIP04_CIPHERTEXT') throw cause
+    throw new ValidationError('INVALID_NIP04_CIPHERTEXT', { cause })
+  }
+}

package/nip05/index.js

@@ -0,0 +1,61 @@
+import { normalizeRelayUrl } from '../url/index.js'
+
+const PUBKEY = /^[0-9a-f]{64}$/
+const LOCAL_PART = /^[a-z0-9._-]+$/
+
+export async function queryProfile (identifier, {
+  fetch: fetchImpl = globalThis.fetch,
+  signal,
+  timeoutMs = 5000
+} = {}) {
+  if (typeof identifier !== 'string' || typeof fetchImpl !== 'function') return null
+  const normalized = identifier.trim().toLowerCase()
+  const separator = normalized.lastIndexOf('@')
+  if (separator <= 0 || separator === normalized.length - 1) return null
+  const name = normalized.slice(0, separator)
+  const domain = normalized.slice(separator + 1)
+  if (!LOCAL_PART.test(name) || /[/?#@]/.test(domain)) return null
+
+  let url
+  try {
+    url = new URL(`https://${domain}/.well-known/nostr.json`)
+    if (url.hostname !== domain.split(':')[0] || url.username || url.password) return null
+    url.searchParams.set('name', name)
+  } catch {
+    return null
+  }
+
+  const controller = new AbortController()
+  const onAbort = () => controller.abort(signal.reason)
+  if (signal?.aborted) throw signal.reason ?? new DOMException('This operation was aborted', 'AbortError')
+  signal?.addEventListener('abort', onAbort, { once: true })
+  const timeout = Number.isFinite(timeoutMs) && timeoutMs >= 0
+    ? setTimeout(() => controller.abort(new DOMException('NIP-05 request timed out', 'TimeoutError')), timeoutMs)
+    : null
+
+  try {
+    const response = await fetchImpl(url, {
+      headers: { Accept: 'application/json' },
+      redirect: 'error',
+      signal: controller.signal
+    })
+    if (!response.ok) return null
+    const data = await response.json()
+    const pubkey = data?.names?.[name]
+    if (!PUBKEY.test(pubkey)) return null
+    const relays = []
+    for (const relay of data?.relays?.[pubkey] ?? []) {
+      try {
+        const normalizedRelay = normalizeRelayUrl(relay)
+        if (!relays.includes(normalizedRelay)) relays.push(normalizedRelay)
+      } catch {}
+    }
+    return { pubkey, relays }
+  } catch (error) {
+    if (signal?.aborted) throw signal.reason ?? error
+    return null
+  } finally {
+    if (timeout !== null) clearTimeout(timeout)
+    signal?.removeEventListener('abort', onAbort)
+  }
+}

package/nip19/index.js

@@ -1,5 +1,6 @@
 import { bech32 } from '@scure/base'
 import { BASE62_ALPHABET, base62ToBytes, bytesToBase62 } from '../base62/index.js'
+import { ValidationError } from '../error/index.js'
 
 const MAX_ENTITY_SIZE = 5000
 const MAX_TLV_VALUE_SIZE = 255
@@ -29,6 +30,10 @@ const channelByPrefix = Object.fromEntries(
   Object.entries(prefixByChannel).map(([channel, prefix]) => [prefix, channel])
 )
 
+function invalid (code, message, cause) {
+  return new ValidationError(code, { message, cause })
+}
+
 function bytesToHex (bytes) {
   let result = ''
   for (const byte of bytes) result += byte.toString(16).padStart(2, '0')
@@ -37,7 +42,7 @@ function bytesToHex (bytes) {
 
 function hexToBytes (hex, fieldName = 'hex value') {
   if (typeof hex !== 'string' || !/^[0-9a-f]+$/i.test(hex) || hex.length % 2 !== 0) {
-    throw new Error(`Invalid ${fieldName}`)
+    throw invalid('INVALID_NIP19_HEX', `Invalid ${fieldName}`)
   }
   const result = new Uint8Array(hex.length / 2)
   for (let index = 0; index < result.length; index++) {
@@ -48,7 +53,7 @@ function hexToBytes (hex, fieldName = 'hex value') {
 
 function fixedHexToBytes (hex, byteLength, fieldName) {
   const bytes = hexToBytes(hex, fieldName)
-  if (bytes.length !== byteLength) throw new Error(`${fieldName} should be ${byteLength} bytes`)
+  if (bytes.length !== byteLength) throw invalid('INVALID_NIP19_FIELD_LENGTH', `${fieldName} should be ${byteLength} bytes`)
   return bytes
 }
 
@@ -63,34 +68,34 @@ function concatBytes (arrays) {
   return result
 }
 
-function encodeText (value, fieldName) {
-  if (typeof value !== 'string' || value.length === 0) {
-    throw new Error(`${fieldName} should be a non-empty string`)
+function encodeText (value, fieldName, { allowEmpty = false } = {}) {
+  if (typeof value !== 'string' || (!allowEmpty && value.length === 0)) {
+    throw invalid('INVALID_NIP19_TEXT_FIELD', `${fieldName} should be ${allowEmpty ? 'a string' : 'a non-empty string'}`)
   }
   const bytes = textEncoder.encode(value)
-  if (bytes.length > MAX_TLV_VALUE_SIZE) throw new Error(`${fieldName} is too big`)
+  if (bytes.length > MAX_TLV_VALUE_SIZE) throw invalid('NIP19_FIELD_TOO_LARGE', `${fieldName} is too big`)
   // TextEncoder replaces lone surrogates. Reject them instead of silently changing
   // the signed/canonical entity value.
-  if (fatalTextDecoder.decode(bytes) !== value) throw new Error(`Invalid ${fieldName} UTF-8`)
+  if (fatalTextDecoder.decode(bytes) !== value) throw invalid('INVALID_NIP19_UTF8', `Invalid ${fieldName} UTF-8`)
   return bytes
 }
 
-function decodeText (bytes, fieldName) {
-  if (bytes.length === 0 || bytes.length > MAX_TLV_VALUE_SIZE) {
-    throw new Error(`Invalid ${fieldName} length`)
+function decodeText (bytes, fieldName, { allowEmpty = false } = {}) {
+  if ((!allowEmpty && bytes.length === 0) || bytes.length > MAX_TLV_VALUE_SIZE) {
+    throw invalid('INVALID_NIP19_FIELD_LENGTH', `Invalid ${fieldName} length`)
   }
   try {
     return fatalTextDecoder.decode(bytes)
-  } catch {
-    throw new Error(`Invalid ${fieldName} UTF-8`)
+  } catch (cause) {
+    throw invalid('INVALID_NIP19_UTF8', `Invalid ${fieldName} UTF-8`, cause)
   }
 }
 
 function encodeTlvEntries (entries) {
   return concatBytes(entries.map(([type, value]) => {
-    if (!Number.isInteger(type) || type < 0 || type > 255) throw new Error('Invalid TLV type')
-    if (!(value instanceof Uint8Array)) throw new TypeError('TLV value should be a Uint8Array')
-    if (value.length > MAX_TLV_VALUE_SIZE) throw new Error('TLV value is too big')
+    if (!Number.isInteger(type) || type < 0 || type > 255) throw invalid('INVALID_TLV_TYPE', 'Invalid TLV type')
+    if (!(value instanceof Uint8Array)) throw invalid('INVALID_TLV_VALUE', 'TLV value should be a Uint8Array')
+    if (value.length > MAX_TLV_VALUE_SIZE) throw invalid('TLV_VALUE_TOO_LARGE', 'TLV value is too big')
     const entry = new Uint8Array(value.length + 2)
     entry[0] = type
     entry[1] = value.length
@@ -103,11 +108,11 @@ function decodeTlvEntries (bytes) {
   const entries = []
   let offset = 0
   while (offset < bytes.length) {
-    if (bytes.length - offset < 2) throw new Error('Truncated TLV header')
+    if (bytes.length - offset < 2) throw invalid('TRUNCATED_TLV_HEADER', 'Truncated TLV header')
     const type = bytes[offset]
     const length = bytes[offset + 1]
     offset += 2
-    if (bytes.length - offset < length) throw new Error(`Truncated TLV value for type ${type}`)
+    if (bytes.length - offset < length) throw invalid('TRUNCATED_TLV_VALUE', `Truncated TLV value for type ${type}`)
     entries.push([type, bytes.slice(offset, offset + length)])
     offset += length
   }
@@ -115,12 +120,65 @@ function decodeTlvEntries (bytes) {
 }
 
 function onlyValue (values, fieldName) {
-  if (values.length > 1) throw new Error(`Duplicate ${fieldName}`)
+  if (values.length > 1) throw invalid('DUPLICATE_NIP19_FIELD', `Duplicate ${fieldName}`)
   return values[0]
 }
 
+function encodeBech32Tlv (prefix, entries) {
+  return bech32.encode(prefix, bech32.toWords(encodeTlvEntries(entries)), MAX_ENTITY_SIZE)
+}
+
+function encodeStandardPointer (prefix, entries) {
+  return encodeBech32Tlv(prefix, entries.slice().sort(([left], [right]) => right - left))
+}
+
+function decodeBech32Bytes (entity, prefix) {
+  if (typeof entity !== 'string' || entity !== entity.toLowerCase() || !entity.startsWith(`${prefix}1`)) {
+    throw invalid('NON_CANONICAL_NIP19_ENTITY', `${prefix} should use canonical lowercase Bech32`)
+  }
+  let decoded
+  try {
+    decoded = bech32.decode(entity, MAX_ENTITY_SIZE)
+  } catch (error) {
+    throw invalid('INVALID_NIP19_ENTITY', `Invalid ${prefix}: ${error.message}`, error)
+  }
+  if (decoded.prefix !== prefix) throw invalid('INVALID_NIP19_PREFIX', `Invalid ${prefix} prefix`)
+  try {
+    return new Uint8Array(bech32.fromWords(decoded.words))
+  } catch (error) {
+    throw invalid('INVALID_NIP19_DATA', `Invalid ${prefix} data: ${error.message}`, error)
+  }
+}
+
+function decodeKnownTlv (entity, prefix, types) {
+  const known = new Map(types.map(type => [type, []]))
+  for (const [type, value] of decodeTlvEntries(decodeBech32Bytes(entity, prefix))) known.get(type)?.push(value)
+  return known
+}
+
+function encodeUint32 (value, fieldName = 'kind') {
+  if (!Number.isInteger(value) || value < 0 || value > 0xffffffff) throw invalid('INVALID_NIP19_UINT32', `Invalid ${fieldName}`)
+  const bytes = new Uint8Array(4)
+  new DataView(bytes.buffer).setUint32(0, value, false)
+  return bytes
+}
+
+function decodeUint32 (bytes, fieldName = 'kind') {
+  if (!bytes || bytes.length !== 4) throw invalid('INVALID_NIP19_UINT32', `${fieldName} should be 4 bytes`)
+  return new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength).getUint32(0, false)
+}
+
+function relayEntries (relays) {
+  if (!Array.isArray(relays)) throw invalid('INVALID_RELAY_HINTS', 'relays should be an array')
+  return relays.map(relay => [1, encodeText(relay, 'relay hint')])
+}
+
+function decodeRelayHints (values) {
+  return values.map(value => decodeText(value, 'relay hint'))
+}
+
 export function nfileEncode ({ root, relays = [], author, mime, filename }) {
-  if (!Array.isArray(relays)) throw new TypeError('relays should be an array')
+  if (!Array.isArray(relays)) throw invalid('INVALID_RELAY_HINTS', 'relays should be an array')
   const entries = [[0, fixedHexToBytes(root, 32, 'MMR root')]]
   for (const relay of relays) entries.push([1, encodeText(relay, 'relay hint')])
   if (author !== undefined) entries.push([2, fixedHexToBytes(author, 32, 'author hint')])
@@ -133,32 +191,32 @@ export function nfileEncode ({ root, relays = [], author, mime, filename }) {
 
 export function nfileDecode (entity) {
   if (typeof entity !== 'string' || entity !== entity.toLowerCase()) {
-    throw new Error('nfile should use canonical lowercase Bech32')
+    throw invalid('NON_CANONICAL_NFILE', 'nfile should use canonical lowercase Bech32')
   }
   let decoded
   try {
     decoded = bech32.decode(entity, MAX_ENTITY_SIZE)
   } catch (error) {
-    throw new Error(`Invalid nfile: ${error.message}`)
+    throw invalid('INVALID_NFILE', `Invalid nfile: ${error.message}`, error)
   }
-  if (decoded.prefix !== 'nfile') throw new Error('Invalid nfile prefix')
+  if (decoded.prefix !== 'nfile') throw invalid('INVALID_NFILE_PREFIX', 'Invalid nfile prefix')
 
   let bytes
   try {
     bytes = new Uint8Array(bech32.fromWords(decoded.words))
   } catch (error) {
-    throw new Error(`Invalid nfile data: ${error.message}`)
+    throw invalid('INVALID_NFILE_DATA', `Invalid nfile data: ${error.message}`, error)
   }
 
   const known = new Map([[0, []], [1, []], [2, []], [3, []], [4, []]])
   for (const [type, value] of decodeTlvEntries(bytes)) known.get(type)?.push(value)
 
   const rootBytes = onlyValue(known.get(0), 'MMR root')
-  if (!rootBytes) throw new Error('Missing MMR root')
-  if (rootBytes.length !== 32) throw new Error('MMR root should be 32 bytes')
+  if (!rootBytes) throw invalid('MISSING_NFILE_ROOT', 'Missing MMR root')
+  if (rootBytes.length !== 32) throw invalid('INVALID_NFILE_ROOT', 'MMR root should be 32 bytes')
 
   const authorBytes = onlyValue(known.get(2), 'author hint')
-  if (authorBytes && authorBytes.length !== 32) throw new Error('Author hint should be 32 bytes')
+  if (authorBytes && authorBytes.length !== 32) throw invalid('INVALID_NFILE_AUTHOR', 'Author hint should be 32 bytes')
   const mimeBytes = onlyValue(known.get(3), 'MIME')
   const filenameBytes = onlyValue(known.get(4), 'filename')
 
@@ -172,14 +230,93 @@ export function nfileDecode (entity) {
   return result
 }
 
+export function noteEncode (eventId) {
+  return bech32.encode('note', bech32.toWords(fixedHexToBytes(eventId, 32, 'event ID')), MAX_ENTITY_SIZE)
+}
+
+export function noteDecode (entity) {
+  const bytes = decodeBech32Bytes(entity, 'note')
+  if (bytes.length !== 32) throw invalid('INVALID_NOTE_EVENT_ID', 'event ID should be 32 bytes')
+  return bytesToHex(bytes)
+}
+
+export function nprofileEncode ({ pubkey, relays = [] }) {
+  return encodeStandardPointer('nprofile', [
+    [0, fixedHexToBytes(pubkey, 32, 'profile pubkey')],
+    ...relayEntries(relays)
+  ])
+}
+
+export function nprofileDecode (entity) {
+  const known = decodeKnownTlv(entity, 'nprofile', [0, 1])
+  const pubkey = onlyValue(known.get(0), 'profile pubkey')
+  if (!pubkey || pubkey.length !== 32) throw invalid('INVALID_NPROFILE_PUBKEY', 'profile pubkey should be 32 bytes')
+  return { pubkey: bytesToHex(pubkey), relays: decodeRelayHints(known.get(1)) }
+}
+
+export function neventEncode ({ id, relays = [], author, kind }) {
+  const entries = [[0, fixedHexToBytes(id, 32, 'event ID')], ...relayEntries(relays)]
+  if (author !== undefined) entries.push([2, fixedHexToBytes(author, 32, 'event author')])
+  if (kind !== undefined) entries.push([3, encodeUint32(kind)])
+  return encodeStandardPointer('nevent', entries)
+}
+
+export function neventDecode (entity) {
+  const known = decodeKnownTlv(entity, 'nevent', [0, 1, 2, 3])
+  const id = onlyValue(known.get(0), 'event ID')
+  const author = onlyValue(known.get(2), 'event author')
+  const kind = onlyValue(known.get(3), 'event kind')
+  if (!id || id.length !== 32) throw invalid('INVALID_NEVENT_ID', 'event ID should be 32 bytes')
+  if (author && author.length !== 32) throw invalid('INVALID_NEVENT_AUTHOR', 'event author should be 32 bytes')
+  const result = { id: bytesToHex(id), relays: decodeRelayHints(known.get(1)) }
+  if (author) result.author = bytesToHex(author)
+  if (kind) result.kind = decodeUint32(kind, 'event kind')
+  return result
+}
+
+export function naddrEncode ({ identifier, pubkey, kind, relays = [] }) {
+  return encodeStandardPointer('naddr', [
+    [0, encodeText(identifier, 'identifier', { allowEmpty: true })],
+    ...relayEntries(relays),
+    [2, fixedHexToBytes(pubkey, 32, 'address author')],
+    [3, encodeUint32(kind)]
+  ])
+}
+
+export function naddrDecode (entity) {
+  const known = decodeKnownTlv(entity, 'naddr', [0, 1, 2, 3])
+  const identifier = onlyValue(known.get(0), 'identifier')
+  const pubkey = onlyValue(known.get(2), 'address author')
+  const kind = onlyValue(known.get(3), 'address kind')
+  if (!identifier) throw invalid('MISSING_NADDR_IDENTIFIER', 'Missing identifier')
+  if (!pubkey || pubkey.length !== 32) throw invalid('INVALID_NADDR_AUTHOR', 'address author should be 32 bytes')
+  return {
+    identifier: decodeText(identifier, 'identifier', { allowEmpty: true }),
+    pubkey: bytesToHex(pubkey),
+    kind: decodeUint32(kind, 'address kind'),
+    relays: decodeRelayHints(known.get(1))
+  }
+}
+
+export function nrelayEncode (relay) {
+  return encodeStandardPointer('nrelay', [[0, encodeText(relay, 'relay URL')]])
+}
+
+export function nrelayDecode (entity) {
+  const known = decodeKnownTlv(entity, 'nrelay', [0])
+  const relay = onlyValue(known.get(0), 'relay URL')
+  if (!relay) throw invalid('MISSING_NRELAY_URL', 'Missing relay URL')
+  return decodeText(relay, 'relay URL')
+}
+
 function isNostrAppDTagSafe (value) {
   return typeof value === 'string' && value.length <= NOSTR_APP_D_TAG_MAX_LENGTH
 }
 
 export function appEncode (ref) {
-  if (!isNostrAppDTagSafe(ref.dTag)) throw new Error('Invalid deduplication tag')
+  if (!isNostrAppDTagSafe(ref?.dTag)) throw invalid('INVALID_APP_D_TAG', 'Invalid deduplication tag')
   const channel = ref.channel ? (prefixByChannel[ref.channel] && ref.channel) : channelByKind[ref.kind]
-  if (!channel) throw new Error('Wrong channel')
+  if (!channel) throw invalid('INVALID_APP_CHANNEL', 'Wrong channel')
 
   // Keep the established app-entity byte ordering exactly for compatibility.
   const groups = [
@@ -195,15 +332,15 @@ export function appEncode (ref) {
       for (const value of values) entries.push([type, value])
     })
   const entity = `${prefixByChannel[channel]}${bytesToBase62(encodeTlvEntries(entries))}`
-  if (entity.length > MAX_ENTITY_SIZE) throw new Error('App entity is too big')
+  if (entity.length > MAX_ENTITY_SIZE) throw invalid('APP_ENTITY_TOO_LARGE', 'App entity is too big')
   return entity
 }
 
 export function appDecode (entity) {
-  if (typeof entity !== 'string' || entity.length > MAX_ENTITY_SIZE) throw new Error('Invalid app entity')
+  if (typeof entity !== 'string' || entity.length > MAX_ENTITY_SIZE) throw invalid('INVALID_APP_ENTITY', 'Invalid app entity')
   const prefix = entity.match(/^\+*/)?.[0]
   const channel = channelByPrefix[prefix]
-  if (!channel) throw new Error('Invalid channel')
+  if (!channel) throw invalid('INVALID_APP_CHANNEL', 'Invalid channel')
 
   const values = new Map()
   for (const [type, value] of decodeTlvEntries(base62ToBytes(entity.slice(prefix.length)))) {
@@ -213,11 +350,11 @@ export function appDecode (entity) {
   }
   const dTagBytes = values.get(0)?.[0]
   const pubkeyBytes = values.get(2)?.[0]
-  if (!dTagBytes) throw new Error('Missing deduplication tag')
-  if (!pubkeyBytes) throw new Error('Missing author pubkey')
-  if (pubkeyBytes.length !== 32) throw new Error('Author pubkey should be 32 bytes')
+  if (!dTagBytes) throw invalid('MISSING_APP_D_TAG', 'Missing deduplication tag')
+  if (!pubkeyBytes) throw invalid('MISSING_APP_AUTHOR', 'Missing author pubkey')
+  if (pubkeyBytes.length !== 32) throw invalid('INVALID_APP_AUTHOR', 'Author pubkey should be 32 bytes')
   const dTag = textDecoder.decode(dTagBytes)
-  if (!isNostrAppDTagSafe(dTag)) throw new Error('Invalid deduplication tag')
+  if (!isNostrAppDTagSafe(dTag)) throw invalid('INVALID_APP_D_TAG', 'Invalid deduplication tag')
 
   return {
     dTag,
@@ -245,16 +382,12 @@ export function nsecDecode (entity) {
 }
 
 function decodeSimpleEntity (entity, prefix, fieldName) {
-  if (typeof entity !== 'string' || !entity.startsWith(`${prefix}1`)) {
-    throw new Error(`Invalid ${prefix} format`)
-  }
   try {
-    const decoded = bech32.decode(entity)
-    if (decoded.prefix !== prefix) throw new Error(`Invalid ${prefix} prefix`)
-    const bytes = new Uint8Array(bech32.fromWords(decoded.words))
-    if (bytes.length !== 32) throw new Error(`Invalid ${fieldName} length`)
+    const bytes = decodeBech32Bytes(entity, prefix)
+    if (bytes.length !== 32) throw invalid('INVALID_NIP19_FIELD_LENGTH', `Invalid ${fieldName} length`)
     return bytesToHex(bytes)
   } catch (error) {
-    throw new Error(`Failed to decode ${prefix}: ${error.message}`)
+    if (error instanceof ValidationError && error.code === 'INVALID_NIP19_FIELD_LENGTH') throw error
+    throw invalid('INVALID_NIP19_ENTITY', `Failed to decode ${prefix}: ${error.message}`, error)
   }
 }

package/nip44/helpers.js

@@ -0,0 +1,95 @@
+import { chacha20 } from '@noble/ciphers/chacha.js'
+import { equalBytes, randomBytes } from '@noble/ciphers/utils.js'
+import { expand, extract } from '@noble/hashes/hkdf.js'
+import { hmac } from '@noble/hashes/hmac.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import { base64ToBytes, bytesToBase64 } from '../base64/index.js'
+import { ValidationError } from '../error/index.js'
+
+const encoder = new TextEncoder()
+const decoder = new TextDecoder('utf-8', { fatal: true })
+const minPlaintextSize = 1
+const maxPlaintextSize = 0xffffffff
+const maxRawPayloadSize = 1 + 32 + 6 + 0x100000000 + 32
+const maxEncodedPayloadSize = Math.ceil(maxRawPayloadSize / 3) * 4
+
+function concatBytes (...arrays) {
+  const output = new Uint8Array(arrays.reduce((total, value) => total + value.length, 0))
+  let offset = 0
+  for (const value of arrays) {
+    output.set(value, offset)
+    offset += value.length
+  }
+  return output
+}
+
+export function getMessageKeys (conversationKey, nonce) {
+  if (!(conversationKey instanceof Uint8Array) || conversationKey.length !== 32) throw new ValidationError('INVALID_CONVERSATION_KEY')
+  if (!(nonce instanceof Uint8Array) || nonce.length !== 32) throw new ValidationError('INVALID_NONCE')
+  const keys = expand(sha256, conversationKey, nonce, 76)
+  return { key: keys.subarray(0, 32), nonce: keys.subarray(32, 44), hmacKey: keys.subarray(44) }
+}
+
+export function calcPaddedLen (length) {
+  if (!Number.isSafeInteger(length) || length < minPlaintextSize || length > maxPlaintextSize) throw new ValidationError('INVALID_PLAINTEXT_SIZE')
+  if (length <= 32) return 32
+  const nextPower = 2 ** (Math.floor(Math.log2(length - 1)) + 1)
+  const chunk = nextPower <= 256 ? 32 : nextPower / 8
+  return chunk * (Math.floor((length - 1) / chunk) + 1)
+}
+
+export function pad (plaintext) {
+  if (typeof plaintext !== 'string') throw new ValidationError('PLAINTEXT_SHOULD_BE_A_STRING')
+  const bytes = encoder.encode(plaintext)
+  const length = bytes.length
+  calcPaddedLen(length)
+  const prefixLength = length < 0x10000 ? 2 : 6
+  const prefix = new Uint8Array(prefixLength)
+  const view = new DataView(prefix.buffer)
+  if (prefixLength === 2) view.setUint16(0, length, false)
+  else view.setUint32(2, length, false)
+  return concatBytes(prefix, bytes, new Uint8Array(calcPaddedLen(length) - length))
+}
+
+export function unpad (padded) {
+  if (!(padded instanceof Uint8Array) || padded.length < 2) throw new ValidationError('INVALID_PADDING')
+  const view = new DataView(padded.buffer, padded.byteOffset, padded.byteLength)
+  const shortLength = view.getUint16(0, false)
+  const prefixLength = shortLength === 0 ? 6 : 2
+  if (padded.length < prefixLength) throw new ValidationError('INVALID_PADDING')
+  const length = shortLength === 0 ? view.getUint32(2, false) : shortLength
+  if (shortLength === 0 && length < 0x10000) throw new ValidationError('INVALID_PADDING')
+  let expected
+  try { expected = prefixLength + calcPaddedLen(length) } catch (cause) { throw new ValidationError('INVALID_PADDING', { cause }) }
+  if (padded.length !== expected || prefixLength + length > padded.length) throw new ValidationError('INVALID_PADDING')
+  try { return decoder.decode(padded.subarray(prefixLength, prefixLength + length)) } catch (cause) { throw new ValidationError('INVALID_UTF8', { cause }) }
+}
+
+export function encodePayload (conversationKey, plaintext, nonce = randomBytes(32)) {
+  const messageKeys = getMessageKeys(conversationKey, nonce)
+  const ciphertext = chacha20(messageKeys.key, messageKeys.nonce, pad(plaintext))
+  const mac = hmac(sha256, messageKeys.hmacKey, concatBytes(nonce, ciphertext))
+  return bytesToBase64(concatBytes(new Uint8Array([2]), nonce, ciphertext, mac))
+}
+
+export function decodePayload (conversationKey, payload) {
+  if (typeof payload !== 'string' || payload.length < 132 || payload.length > maxEncodedPayloadSize || payload[0] === '#') throw new ValidationError('INVALID_NIP44_PAYLOAD')
+  if (payload.length % 4 !== 0 || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(payload)) throw new ValidationError('INVALID_BASE64')
+  const data = base64ToBytes(payload)
+  if (bytesToBase64(data) !== payload || data.length < 99 || data[0] !== 2) throw new ValidationError('INVALID_NIP44_PAYLOAD')
+  const nonce = data.subarray(1, 33)
+  const ciphertext = data.subarray(33, -32)
+  const mac = data.subarray(-32)
+  const messageKeys = getMessageKeys(conversationKey, nonce)
+  const calculated = hmac(sha256, messageKeys.hmacKey, concatBytes(nonce, ciphertext))
+  if (!equalBytes(mac, calculated)) throw new ValidationError('INVALID_MAC')
+  return unpad(chacha20(messageKeys.key, messageKeys.nonce, ciphertext))
+}
+
+export function extractConversationKey (sharedSecret, salt = 'nip44-v2') {
+  if (typeof salt !== 'string') throw new ValidationError('SALT_SHOULD_BE_A_STRING')
+  const saltBytes = encoder.encode(salt)
+  if (saltBytes.length === 0 || saltBytes.length > 32) throw new ValidationError('INVALID_SALT')
+  return extract(sha256, sharedSecret, saltBytes)
+}

package/nip44/index.js

@@ -0,0 +1,14 @@
+import { sharedXOnlySecret } from '../ecdh/index.js'
+import { decodePayload, encodePayload, extractConversationKey } from './helpers.js'
+
+export function getConversationKey (secretKey, pubkey, { salt = 'nip44-v2' } = {}) {
+  return extractConversationKey(sharedXOnlySecret(secretKey, pubkey), salt)
+}
+
+export function encrypt (plaintext, conversationKey, nonce) {
+  return encodePayload(conversationKey, plaintext, nonce)
+}
+
+export function decrypt (ciphertext, conversationKey) {
+  return decodePayload(conversationKey, ciphertext)
+}