@nostrify/nostrify 0.47.1 → 0.48.2

package/.turbo/turbo-build.log

@@ -1,19 +1,33 @@
-
-
-> @nostrify/nostrify@0.47.0 build /home/sid/repos/nostrify/packages/nostrify
-> npx tsc -p tsconfig.json && node ../../esbuild.config.js --package ./
-
-npm warn Unknown env config "verify-deps-before-run". This will stop working in the next major version of npm.
-npm warn Unknown env config "_jsr-registry". This will stop working in the next major version of npm.
-⠙Building with esbuild...
-
-  dist/NRelay1.js               8.9kb
-  dist/NSchema.js               5.8kb
-  dist/NPool.js                 5.0kb
-  dist/test/TestRelayServer.js  4.4kb
-  dist/NSet.js                  4.1kb
-  ...and 26 more output files...
-
-⚡ Done in 25ms
-Copying source files...
-Done!
+
+> @nostrify/nostrify@0.48.1 build /home/sid/repos/nostrify/packages/nostrify
+> npx tsc -p tsconfig.json && node ../../esbuild.config.js --package ./
+
+npm warn Unknown env config "verify-deps-before-run". This will stop working in the next major version of npm.
+npm warn Unknown env config "_jsr-registry". This will stop working in the next major version of npm.
+Building with esbuild...
+
+  dist/NRelay1.js                       8.9kb
+  dist/NSchema.js                       5.8kb
+  dist/NPool.js                         5.0kb
+  dist/test/TestRelayServer.js          4.4kb
+  dist/NSet.js                          4.1kb
+  dist/NConnectSigner.js                3.9kb
+  dist/ln/LNURL.js                      3.3kb
+  dist/NIP98.js                         2.7kb
+  dist/NBrowserSigner.js                2.6kb
+  dist/uploaders/BlossomUploader.js     1.9kb
+  dist/uploaders/NostrBuildUploader.js  1.9kb
+  dist/test/MockRelay.js                1.4kb
+  dist/BunkerURI.js                     1.4kb
+  dist/NKinds.js                        1.1kb
+  dist/NIP05.js                         1.1kb
+  dist/NSecSigner.js                    1.1kb
+  dist/utils/Machina.js                 925b 
+  dist/NCache.js                        828b 
+  dist/mod.js                           815b 
+  dist/test/mod.js                      701b 
+  ...and 11 more output files...
+
+⚡ Done in 31ms
+Copying source files...
+Done!

package/.turbo/turbo-typecheck.log

@@ -0,0 +1,6 @@
+
+> @nostrify/nostrify@0.48.1 typecheck /home/sid/repos/nostrify/packages/nostrify
+> npx tsc --noEmit
+
+npm warn Unknown env config "verify-deps-before-run". This will stop working in the next major version of npm.
+npm warn Unknown env config "_jsr-registry". This will stop working in the next major version of npm.

package/CHANGELOG.md

@@ -1,5 +1,25 @@
 # Changelog
 
+## 0.48.2
+
+### Patch Changes
+
+- Implement type checking in CI for all libs.
+- Updated dependencies
+  - @nostrify/types@0.36.8
+
+## 0.48.1
+
+### Patch Changes
+
+- remove happy-dom dependency, fix improper test in NRelay1
+
+## 0.48.0
+
+### Minor Changes
+
+- Remove all JSR imports
+
 ## 0.47.1
 
 ### Patch Changes
@@ -71,7 +91,8 @@
 All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+and this project adheres to
+[Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## 0.46.4 - 2025-07-15
 
@@ -83,7 +104,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Fix fetch calls in browser by binding globalThis (NIP05, LNURL, BlossomUploader).
+- Fix fetch calls in browser by binding globalThis (NIP05, LNURL,
+  BlossomUploader).
 - BlossomUploader: use a browser-supported file hashing method.
 
 ## 0.46.0 - 2025-05-10
@@ -108,7 +130,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- BREAKING: Redesign the `LNURL` module to be a stateful class, more similar to `URL`.
+- BREAKING: Redesign the `LNURL` module to be a stateful class, more similar to
+  `URL`.
 
 ## 0.44.0 - 2025-04-23
 
@@ -120,7 +143,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- Moved `NSeedSigner`, `NPhraseSigner`, and `NCustodial` into a separate `@nostrify/seed` package.
+- Moved `NSeedSigner`, `NPhraseSigner`, and `NCustodial` into a separate
+  `@nostrify/seed` package.
 
 ## 0.42.1 - 2025-04-10
 
@@ -155,7 +179,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- NRelay1: batch ids-only filters and filters for replaceable events by author/kind within the same event loop.
+- NRelay1: batch ids-only filters and filters for replaceable events by
+  author/kind within the same event loop.
 
 ## 0.40.0 - 2025-03-26
 
@@ -254,7 +279,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- NRelay1: added `idleTimeout` option to automatically close inactive connections.
+- NRelay1: added `idleTimeout` option to automatically close inactive
+  connections.
 - NRelay1: support `await using` syntax.
 
 ## 0.31.0 - 2024-09-09
@@ -262,11 +288,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 
 - Added ReplyBotPolicy to block replies from bots in the same second.
-- Added AuthorPolicy to reject events from authors without a kind 0, or with a particular kind 0.
+- Added AuthorPolicy to reject events from authors without a kind 0, or with a
+  particular kind 0.
 
 ### Changed
 
-- BREAKING: Moved moderation policies to the `@nostrify/policies` package. Replace `@nostrify/nostrify/policies` with `@nostrify/policies` in your project.
+- BREAKING: Moved moderation policies to the `@nostrify/policies` package.
+  Replace `@nostrify/nostrify/policies` with `@nostrify/policies` in your
+  project.
 
 ### Fixed
 
@@ -306,7 +335,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- BREAKING: NDatabase: add kind, pubkey, and created_at columns to nostr_tags table. These columns are non-nullable, so the old database will need to be deleted or manually migrated.
+- BREAKING: NDatabase: add kind, pubkey, and created_at columns to nostr_tags
+  table. These columns are non-nullable, so the old database will need to be
+  deleted or manually migrated.
 
 ## [0.26.3] - 2024-07-18
 
@@ -330,7 +361,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- BREAKING: NPool: remove `reqRelays` option, add `reqRouter`. Rename `eventRelays` to `eventRouter`.
+- BREAKING: NPool: remove `reqRelays` option, add `reqRouter`. Rename
+  `eventRelays` to `eventRouter`.
 
 ## [0.25.0] - 2024-06-29
 
@@ -348,7 +380,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- NDatabase: add intrinsic limits to filters when applicable, skip 0 limit filters.
+- NDatabase: add intrinsic limits to filters when applicable, skip 0 limit
+  filters.
 
 ## [0.23.2] - 2024-06-13
 
@@ -391,7 +424,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- NostrMetadata: added `website` field so `NSchema.metadata()` returns the correct type.
+- NostrMetadata: added `website` field so `NSchema.metadata()` returns the
+  correct type.
 
 ### Changed
 
@@ -416,7 +450,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- `NUploader` interface and two uploader classes under `@nostrify/nostrify/uploaders`.
+- `NUploader` interface and two uploader classes under
+  `@nostrify/nostrify/uploaders`.
 - Blossom uploader (`BlossomUploader`) to upload files to Blossom servers.
 - nostr.build uploader (`NostrBuildUploader`) to upload files to nostr.build.
 - `NIP98` module to verify NIP-98 Requests.
@@ -431,11 +466,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
-- NConnectSigner: NIP-44 encryption support by setting `{ encryption: 'nip44' }` in the constructor.
+- NConnectSigner: NIP-44 encryption support by setting `{ encryption: 'nip44' }`
+  in the constructor.
 
 ### Fixed
 
-- NDatabase: Postgres FTS now correctly uses the `searchText` option to create the search index.
+- NDatabase: Postgres FTS now correctly uses the `searchText` option to create
+  the search index.
 
 ## [0.20.0] - 2024-05-16
 
@@ -445,7 +482,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
-- BREAKING: NDatabase `fts5` option has been renamed to `fts`, and now accepts a string of either `'sqlite'` or `'postgres'`.
+- BREAKING: NDatabase `fts5` option has been renamed to `fts`, and now accepts a
+  string of either `'sqlite'` or `'postgres'`.
 
 ## [0.19.2] - 2024-05-16
 
@@ -457,14 +495,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- NDatabase: fix deleting everything for the author when they delete a single event.
+- NDatabase: fix deleting everything for the author when they delete a single
+  event.
 
 ## [0.19.0] - 2024-05-13
 
 ### Fixed
 
 - Improved performance of NDatabase when querying replaceable events by author.
-- NConnect.signEvent now throws if the connect message was rejected by the relay.
+- NConnect.signEvent now throws if the connect message was rejected by the
+  relay.
 
 ## [0.18.0] - 2024-05-04
 
@@ -474,13 +514,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [0.17.1] - 2024-04-29
 
-Redeploy to JSR (to hopefully fix [npm compatibility](https://github.com/jsr-io/jsr/issues/446)).
+Redeploy to JSR (to hopefully fix
+[npm compatibility](https://github.com/jsr-io/jsr/issues/446)).
 
 ## [0.17.0] - 2024-04-28
 
 ### Changed
 
-- BREAKING: change `NRelay.req` return type from an AsyncGenerator to an AsyncIterable.
+- BREAKING: change `NRelay.req` return type from an AsyncGenerator to an
+  AsyncIterable.
 
 ## [0.16.0] - 2024-04-25
 
@@ -504,7 +546,8 @@ Redeploy to JSR (to hopefully fix [npm compatibility](https://github.com/jsr-io/
 
 ### Fixed
 
-- `NConnectSigner` - fixed race condition between sending messages and receiving responses.
+- `NConnectSigner` - fixed race condition between sending messages and receiving
+  responses.
 
 ## [0.14.1] - 2024-04-24
 
@@ -516,7 +559,8 @@ Redeploy to JSR (to hopefully fix [npm compatibility](https://github.com/jsr-io/
 
 ### Fixed
 
-- BREAKING: fixed `NConnectSigner.connect` method signature (it doesn't need to accept a pubkey).
+- BREAKING: fixed `NConnectSigner.connect` method signature (it doesn't need to
+  accept a pubkey).
 
 ## [0.13.0] - 2024-04-24
 
@@ -534,7 +578,8 @@ Redeploy to JSR (to hopefully fix [npm compatibility](https://github.com/jsr-io/
 
 ### Added
 
-- Added `AnyPolicy` policy, a pipeline policy which rejects only if all policies reject.
+- Added `AnyPolicy` policy, a pipeline policy which rejects only if all policies
+  reject.
 
 ### Changed
 
@@ -544,7 +589,8 @@ Redeploy to JSR (to hopefully fix [npm compatibility](https://github.com/jsr-io/
 
 ### Added
 
-- Added moderation policies. Including the `NPolicy` interface and several policies.
+- Added moderation policies. Including the `NPolicy` interface and several
+  policies.
 
 ## [0.10.2] - 2024-04-21
 

package/NIP98.test.ts

@@ -1,8 +1,6 @@
 import { test } from "node:test";
 import { deepStrictEqual, rejects } from "node:assert";
 import { generateSecretKey } from "nostr-tools";
-import { ZodError } from "zod";
-
 import { NIP98 } from "./NIP98.ts";
 import { NSecSigner } from "./NSecSigner.ts";
 import { N64 } from "./utils/mod.ts";
@@ -78,7 +76,7 @@ await test("NIP98.verify fails with invalid token", async () => {
 
   await rejects(
     () => NIP98.verify(request),
-    ZodError,
+    (e) => e instanceof Error && e.message === "Invalid token",
   );
 });
 

package/NIP98.ts

@@ -1,8 +1,8 @@
-import type { NostrEvent } from '@nostrify/types';
-import { encodeHex } from '@std/encoding/hex';
-import { verifyEvent as _verifyEvent } from 'nostr-tools';
+import type { NostrEvent } from "@nostrify/types";
+import { toHex } from "@smithy/util-hex-encoding";
+import { verifyEvent as _verifyEvent } from "nostr-tools";
 
-import { N64 } from './utils/N64.ts';
+import { N64 } from "./utils/N64.ts";
 
 /** [NIP-98](https://github.com/nostr-protocol/nips/blob/master/98.md) HTTP auth. */
 export class NIP98 {
@@ -10,27 +10,27 @@ export class NIP98 {
   static async template(
     request: Request,
     opts?: { validatePayload?: boolean },
-  ): Promise<Omit<NostrEvent, 'id' | 'pubkey' | 'sig'>> {
+  ): Promise<Omit<NostrEvent, "id" | "pubkey" | "sig">> {
     const {
-      validatePayload = ['POST', 'PUT', 'PATCH'].includes(request.method),
+      validatePayload = ["POST", "PUT", "PATCH"].includes(request.method),
     } = opts ?? {};
     const { method, url } = request;
 
     const tags = [
-      ['method', method],
-      ['u', url],
+      ["method", method],
+      ["u", url],
     ];
 
     if (validatePayload) {
       const buffer = await request.clone().arrayBuffer();
-      const digest = await crypto.subtle.digest('SHA-256', buffer);
+      const digest = await crypto.subtle.digest("SHA-256", buffer);
 
-      tags.push(['payload', encodeHex(digest)]);
+      tags.push(["payload", toHex(new Uint8Array(digest))]);
     }
 
     return {
       kind: 27235,
-      content: '',
+      content: "",
       tags,
       created_at: Math.floor(Date.now() / 1000),
     };
@@ -47,48 +47,62 @@ export class NIP98 {
   ): Promise<NostrEvent> {
     const {
       maxAge = 60_000,
-      validatePayload = ['POST', 'PUT', 'PATCH'].includes(request.method),
+      validatePayload = ["POST", "PUT", "PATCH"].includes(request.method),
       verifyEvent = _verifyEvent,
     } = opts ?? {};
 
-    const header = request.headers.get('authorization');
+    const header = request.headers.get("authorization");
     if (!header) {
-      throw new Error('Missing Nostr authorization header');
+      throw new Error("Missing Nostr authorization header");
     }
 
     const token = header.match(/^Nostr (.+)$/)?.[1];
     if (!token) {
-      throw new Error('Missing Nostr authorization token');
+      throw new Error("Missing Nostr authorization token");
+    }
+
+    let event: NostrEvent;
+    try {
+      event = N64.decodeEvent(token);
+    } catch (e) {
+      if (
+        e instanceof TypeError &&
+        e.message.includes("Incorrect padding on base64")
+      ) {
+        throw new Error("Invalid token");
+      } else {
+        throw e;
+      }
     }
 
-    const event = N64.decodeEvent(token);
     if (!verifyEvent(event)) {
-      throw new Error('Event signature is invalid');
+      throw new Error("Event signature is invalid");
     }
 
     const age = Date.now() - (event.created_at * 1_000);
-    const u = event.tags.find(([name]) => name === 'u')?.[1];
-    const method = event.tags.find(([name]) => name === 'method')?.[1];
-    const payload = event.tags.find(([name]) => name === 'payload')?.[1];
+    const u = event.tags.find(([name]) => name === "u")?.[1];
+    const method = event.tags.find(([name]) => name === "method")?.[1];
+    const payload = event.tags.find(([name]) => name === "payload")?.[1];
 
     if (event.kind !== 27235) {
-      throw new Error('Event must be kind 27235');
+      throw new Error("Event must be kind 27235");
     }
     if (u !== request.url) {
-      throw new Error('Event URL does not match request URL');
+      throw new Error("Event URL does not match request URL");
     }
     if (method !== request.method) {
-      throw new Error('Event method does not match HTTP request method');
+      throw new Error("Event method does not match HTTP request method");
     }
     if (age >= maxAge) {
-      throw new Error('Event expired');
+      throw new Error("Event expired");
     }
     if (validatePayload && payload !== undefined) {
       const buffer = await request.clone().arrayBuffer();
-      const digest = await crypto.subtle.digest('SHA-256', buffer);
+      const digest = await crypto.subtle.digest("SHA-256", buffer);
+      const hexed = toHex(new Uint8Array(digest));
 
-      if (encodeHex(digest) !== payload) {
-        throw new Error('Event payload does not match request body');
+      if (hexed !== payload) {
+        throw new Error("Event payload does not match request body");
       }
     }
 

package/NRelay1.test.ts

@@ -157,9 +157,12 @@ await test("NRelay1 idleTimeout", async () => {
   await using relay = new NRelay1(server.url, { idleTimeout: 100 });
 
   await it("websocket opens", async () => {
-    await new Promise((resolve) => setTimeout(resolve, 20));
+    await new Promise((resolve) =>
+      relay.socket.addEventListener(WebsocketEvent.open, resolve, {
+        once: true,
+      })
+    );
     deepStrictEqual(relay.socket.readyState, WebSocket.OPEN);
-    await new Promise((resolve) => setTimeout(resolve, 20));
   });
 
   await it("websocket closes after idleTimeout", async () => {

package/dist/NIP98.d.ts

@@ -1,10 +1,10 @@
-import type { NostrEvent } from '@nostrify/types';
+import type { NostrEvent } from "@nostrify/types";
 /** [NIP-98](https://github.com/nostr-protocol/nips/blob/master/98.md) HTTP auth. */
 export declare class NIP98 {
     /** Generate an auth event template from a Request. */
     static template(request: Request, opts?: {
         validatePayload?: boolean;
-    }): Promise<Omit<NostrEvent, 'id' | 'pubkey' | 'sig'>>;
+    }): Promise<Omit<NostrEvent, "id" | "pubkey" | "sig">>;
     /** Compare the auth event with the request, throwing a human-readable error if validation fails. */
     static verify(request: Request, opts?: {
         maxAge?: number;

package/dist/NIP98.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"NIP98.d.ts","sourceRoot":"","sources":["../NIP98.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAMlD,oFAAoF;AACpF,qBAAa,KAAK;IAChB,sDAAsD;WACzC,QAAQ,CACnB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC;IA0BrD,oGAAoG;WACvF,MAAM,CACjB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC;KAC9C,GACA,OAAO,CAAC,UAAU,CAAC;CAkDvB"}
+{"version":3,"file":"NIP98.d.ts","sourceRoot":"","sources":["../NIP98.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAMlD,oFAAoF;AACpF,qBAAa,KAAK;IAChB,sDAAsD;WACzC,QAAQ,CACnB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,OAAO,CAAA;KAAE,GACnC,OAAO,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,GAAG,QAAQ,GAAG,KAAK,CAAC,CAAC;IA0BrD,oGAAoG;WACvF,MAAM,CACjB,OAAO,EAAE,OAAO,EAChB,IAAI,CAAC,EAAE;QACL,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,OAAO,CAAC;QAC1B,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC;KAC9C,GACA,OAAO,CAAC,UAAU,CAAC;CAgEvB"}

package/dist/NIP98.js

@@ -1,4 +1,4 @@
-import { encodeHex } from "@std/encoding/hex";
+import { toHex } from "@smithy/util-hex-encoding";
 import { verifyEvent as _verifyEvent } from "nostr-tools";
 import { N64 } from "./utils/N64.js";
 class NIP98 {
@@ -15,7 +15,7 @@ class NIP98 {
     if (validatePayload) {
       const buffer = await request.clone().arrayBuffer();
       const digest = await crypto.subtle.digest("SHA-256", buffer);
-      tags.push(["payload", encodeHex(digest)]);
+      tags.push(["payload", toHex(new Uint8Array(digest))]);
     }
     return {
       kind: 27235,
@@ -39,7 +39,16 @@ class NIP98 {
     if (!token) {
       throw new Error("Missing Nostr authorization token");
     }
-    const event = N64.decodeEvent(token);
+    let event;
+    try {
+      event = N64.decodeEvent(token);
+    } catch (e) {
+      if (e instanceof TypeError && e.message.includes("Incorrect padding on base64")) {
+        throw new Error("Invalid token");
+      } else {
+        throw e;
+      }
+    }
     if (!verifyEvent(event)) {
       throw new Error("Event signature is invalid");
     }
@@ -62,7 +71,8 @@ class NIP98 {
     if (validatePayload && payload !== void 0) {
       const buffer = await request.clone().arrayBuffer();
       const digest = await crypto.subtle.digest("SHA-256", buffer);
-      if (encodeHex(digest) !== payload) {
+      const hexed = toHex(new Uint8Array(digest));
+      if (hexed !== payload) {
         throw new Error("Event payload does not match request body");
       }
     }

package/dist/NIP98.ts

@@ -1,8 +1,8 @@
-import type { NostrEvent } from '@nostrify/types';
-import { encodeHex } from '@std/encoding/hex';
-import { verifyEvent as _verifyEvent } from 'nostr-tools';
+import type { NostrEvent } from "@nostrify/types";
+import { toHex } from "@smithy/util-hex-encoding";
+import { verifyEvent as _verifyEvent } from "nostr-tools";
 
-import { N64 } from './utils/N64.ts';
+import { N64 } from "./utils/N64.ts";
 
 /** [NIP-98](https://github.com/nostr-protocol/nips/blob/master/98.md) HTTP auth. */
 export class NIP98 {
@@ -10,27 +10,27 @@ export class NIP98 {
   static async template(
     request: Request,
     opts?: { validatePayload?: boolean },
-  ): Promise<Omit<NostrEvent, 'id' | 'pubkey' | 'sig'>> {
+  ): Promise<Omit<NostrEvent, "id" | "pubkey" | "sig">> {
     const {
-      validatePayload = ['POST', 'PUT', 'PATCH'].includes(request.method),
+      validatePayload = ["POST", "PUT", "PATCH"].includes(request.method),
     } = opts ?? {};
     const { method, url } = request;
 
     const tags = [
-      ['method', method],
-      ['u', url],
+      ["method", method],
+      ["u", url],
     ];
 
     if (validatePayload) {
       const buffer = await request.clone().arrayBuffer();
-      const digest = await crypto.subtle.digest('SHA-256', buffer);
+      const digest = await crypto.subtle.digest("SHA-256", buffer);
 
-      tags.push(['payload', encodeHex(digest)]);
+      tags.push(["payload", toHex(new Uint8Array(digest))]);
     }
 
     return {
       kind: 27235,
-      content: '',
+      content: "",
       tags,
       created_at: Math.floor(Date.now() / 1000),
     };
@@ -47,48 +47,62 @@ export class NIP98 {
   ): Promise<NostrEvent> {
     const {
       maxAge = 60_000,
-      validatePayload = ['POST', 'PUT', 'PATCH'].includes(request.method),
+      validatePayload = ["POST", "PUT", "PATCH"].includes(request.method),
       verifyEvent = _verifyEvent,
     } = opts ?? {};
 
-    const header = request.headers.get('authorization');
+    const header = request.headers.get("authorization");
     if (!header) {
-      throw new Error('Missing Nostr authorization header');
+      throw new Error("Missing Nostr authorization header");
     }
 
     const token = header.match(/^Nostr (.+)$/)?.[1];
     if (!token) {
-      throw new Error('Missing Nostr authorization token');
+      throw new Error("Missing Nostr authorization token");
+    }
+
+    let event: NostrEvent;
+    try {
+      event = N64.decodeEvent(token);
+    } catch (e) {
+      if (
+        e instanceof TypeError &&
+        e.message.includes("Incorrect padding on base64")
+      ) {
+        throw new Error("Invalid token");
+      } else {
+        throw e;
+      }
     }
 
-    const event = N64.decodeEvent(token);
     if (!verifyEvent(event)) {
-      throw new Error('Event signature is invalid');
+      throw new Error("Event signature is invalid");
     }
 
     const age = Date.now() - (event.created_at * 1_000);
-    const u = event.tags.find(([name]) => name === 'u')?.[1];
-    const method = event.tags.find(([name]) => name === 'method')?.[1];
-    const payload = event.tags.find(([name]) => name === 'payload')?.[1];
+    const u = event.tags.find(([name]) => name === "u")?.[1];
+    const method = event.tags.find(([name]) => name === "method")?.[1];
+    const payload = event.tags.find(([name]) => name === "payload")?.[1];
 
     if (event.kind !== 27235) {
-      throw new Error('Event must be kind 27235');
+      throw new Error("Event must be kind 27235");
     }
     if (u !== request.url) {
-      throw new Error('Event URL does not match request URL');
+      throw new Error("Event URL does not match request URL");
     }
     if (method !== request.method) {
-      throw new Error('Event method does not match HTTP request method');
+      throw new Error("Event method does not match HTTP request method");
     }
     if (age >= maxAge) {
-      throw new Error('Event expired');
+      throw new Error("Event expired");
     }
     if (validatePayload && payload !== undefined) {
       const buffer = await request.clone().arrayBuffer();
-      const digest = await crypto.subtle.digest('SHA-256', buffer);
+      const digest = await crypto.subtle.digest("SHA-256", buffer);
+      const hexed = toHex(new Uint8Array(digest));
 
-      if (encodeHex(digest) !== payload) {
-        throw new Error('Event payload does not match request body');
+      if (hexed !== payload) {
+        throw new Error("Event payload does not match request body");
       }
     }