Function nip44Decrypt

src/utils/nip44.ts:116–150

(payload: string, conversationKey: Buffer)

 * Validates version byte, payload sizes, and MAC before decrypting.
 */
export function nip44Decrypt(payload: string, conversationKey: Buffer): string {
  if (!payload || payload[0] === '#') {
    throw new Error('unknown version')
  }
  if (payload.length < 132 || payload.length > 87472) {
    throw new Error('invalid payload size')
  }

  const data = Buffer.from(payload, 'base64')
  if (data.length < 99 || data.length > 65603) {
    throw new Error('invalid data size')
  }

  const version = data[0]
  if (version !== 2) {
    throw new Error(`unknown version ${version}`)
  }

  const nonce = data.subarray(1, 33)
  const ciphertext = data.subarray(33, data.length - 32)
  const mac = data.subarray(data.length - 32)

  const { chachaKey, chachaNonce, hmacKey } = getMessageKeys(conversationKey, nonce)

  const expectedMac = createHmac('sha256', hmacKey).update(nonce).update(ciphertext).digest()
  if (!timingSafeEqual(expectedMac, mac)) {
    throw new Error('invalid MAC')
  }

  const iv = Buffer.concat([Buffer.alloc(4), chachaNonce])
  const decipher = createDecipheriv('chacha20', chachaKey, iv)
  const padded = Buffer.concat([decipher.update(ciphertext), decipher.final()])

  return unpad(padded)
}

/**
 * Validate the structural format of a NIP-44 v2 payload without decrypting it.