The app arrives in movements: real ESM chunks split the bundle (entry 333KB, shared chunks alongside, 61KB of gifts/NWC/hats deferred past first paint into slots that keep their hook seniority), the lazy scripts wear IIFE coats so their names can't collide with the page's — which is what silently broke the remote-signer button — nip98 moves out of the login module so minimal builds stop hauling backup relays, and the smoke test learns the front door's new steps while the regtest stack rises from its IBD nap

Co-Authored-By: Claude Fable 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_019eA8JRq9Wr7z2fRQk99HLi

1 files changed, 15 insertions, 0 deletions

diff --git a/src/nip98.js b/src/nip98.js
new file mode 100644
index 0000000..aa0343e
--- /dev/null
+++ b/src/nip98.js
@@ -0,0 +1,15 @@
+// NIP-98 HTTP Auth header (kind 27235): the signature covers the exact URL,
+// method and body hash, so a captured header is useless anywhere else. Its
+// own module — every build needs it (registrar calls), but only some builds
+// need the login/backup machinery around it in nostr-login.js.
+import { hex } from '@scure/base';
+import { sha256 } from '@noble/hashes/sha256';
+
+export async function nip98Header(signer, url, method, bodyText) {
+  const tags = [['u', url], ['method', method.toUpperCase()]];
+  if (bodyText) tags.push(['payload', hex.encode(sha256(new TextEncoder().encode(bodyText)))]);
+  const evt = await signer.signEvent({
+    kind: 27235, created_at: Math.floor(Date.now() / 1000), tags, content: '',
+  });
+  return 'Nostr ' + btoa(JSON.stringify(evt));
+}