1 files changed, 15 insertions, 0 deletions
diff --git a/src/nip98.js b/src/nip98.js
new file mode 100644
index 0000000..aa0343e
--- /dev/null
+++ b/src/nip98.js
@@ -0,0 +1,15 @@
+// NIP-98 HTTP Auth header (kind 27235): the signature covers the exact URL,
+// method and body hash, so a captured header is useless anywhere else. Its
+// own module — every build needs it (registrar calls), but only some builds
+// need the login/backup machinery around it in nostr-login.js.
+import { hex } from '@scure/base';
+import { sha256 } from '@noble/hashes/sha256';
+
+export async function nip98Header(signer, url, method, bodyText) {
+  const tags = [['u', url], ['method', method.toUpperCase()]];
+  if (bodyText) tags.push(['payload', hex.encode(sha256(new TextEncoder().encode(bodyText)))]);
+  const evt = await signer.signEvent({
+    kind: 27235, created_at: Math.floor(Date.now() / 1000), tags, content: '',
+  });
+  return 'Nostr ' + btoa(JSON.stringify(evt));
+}