// NIP-98 HTTP Auth header (kind 27235): the signature covers the exact URL,
// method and body hash, so a captured header is useless anywhere else. Its
// own module — every build needs it (registrar calls), but only some builds
// need the login/backup machinery around it in nostr-login.js.
import { hex } from '@scure/base';
import { sha256 } from '@noble/hashes/sha256';
export async function nip98Header(signer, url, method, bodyText) {
const tags = [['u', url], ['method', method.toUpperCase()]];
if (bodyText) tags.push(['payload', hex.encode(sha256(new TextEncoder().encode(bodyText)))]);
const evt = await signer.signEvent({
kind: 27235, created_at: Math.floor(Date.now() / 1000), tags, content: '',
});
return 'Nostr ' + btoa(JSON.stringify(evt));
}
e='85f5e1c26472176dfd846bbd410e6796598e240f'/>