@qntx/nostr 0.0.1

package/dist/nips/nip98.mjs

@@ -0,0 +1,91 @@
+import { c as utf8Decoder, l as utf8Encoder, r as bytesToHex } from "../util-6tfLQ9JF.mjs";
+import { a as NostrError } from "../error-DZEs5OuZ.mjs";
+import { t as Kind } from "../kind-BLl4cLOc.mjs";
+import { p as validateSignedEvent } from "../event-CzoQEFMF.mjs";
+import { s as verifyEvent } from "../key-Dn-aX4x4.mjs";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { base64 } from "@scure/base";
+//#region src/nips/nip98.ts
+/**
+* NIP-98: HTTP Auth (kind 27235).
+* Token is standard base64 of the signed event JSON, not base64url.
+*
+* @see https://github.com/nostr-protocol/nips/blob/master/98.md
+*/
+const AUTHORIZATION_SCHEME = "Nostr ";
+const DEFAULT_MAX_SKEW_SEC = 60;
+var Nip98Error = class extends NostrError {};
+/** SHA-256 of the request body: raw bytes for string/Uint8Array, else JSON.stringify. */
+function hashPayload(payload) {
+	const bytes = typeof payload === "string" ? utf8Encoder.encode(payload) : payload instanceof Uint8Array ? payload : utf8Encoder.encode(JSON.stringify(payload));
+	return bytesToHex(sha256(bytes));
+}
+/** RFC 4648 standard base64; accept missing `=` (NIP-98 spec example is unpadded). */
+function decodeStandardBase64(encoded) {
+	const rem = encoded.length % 4;
+	const padded = rem === 0 ? encoded : encoded + "=".repeat(4 - rem);
+	return base64.decode(padded);
+}
+function stripAuthorizationScheme(token) {
+	const prefix = /^nostr\s+/i.exec(token);
+	return prefix ? token.slice(prefix[0].length) : token;
+}
+/**
+* Sign a kind 27235 auth event and encode it as a NIP-98 token.
+* Uses standard base64 (`@scure/base`), not base64url.
+*/
+async function getToken(url, method, sign, opts) {
+	const tags = [["u", url], ["method", method]];
+	if (opts?.payload !== void 0) tags.push(["payload", hashPayload(opts.payload)]);
+	const signed = await sign({
+		kind: Kind.HttpAuth,
+		created_at: opts?.now ?? Math.floor(Date.now() / 1e3),
+		tags,
+		content: opts?.content ?? ""
+	});
+	const encoded = base64.encode(utf8Encoder.encode(JSON.stringify(signed)));
+	return opts?.includeAuthorizationScheme ? AUTHORIZATION_SCHEME + encoded : encoded;
+}
+/** Decode a NIP-98 token (with or without the `Nostr ` scheme) into an event. */
+function unpackEventFromToken(token) {
+	if (!token) throw new Nip98Error("missing token");
+	const encoded = stripAuthorizationScheme(token);
+	let json;
+	try {
+		json = utf8Decoder.decode(decodeStandardBase64(encoded));
+	} catch (cause) {
+		throw new Nip98Error("invalid token encoding", { cause });
+	}
+	if (!json.startsWith("{")) throw new Nip98Error("invalid token");
+	let parsed;
+	try {
+		parsed = JSON.parse(json);
+	} catch (cause) {
+		throw new Nip98Error("invalid token JSON", { cause });
+	}
+	if (!validateSignedEvent(parsed)) throw new Nip98Error("token is not a signed event");
+	return parsed;
+}
+/**
+* True when `event` is a valid NIP-98 auth event for `url` + `method`.
+* Verifies signature, kind 27235, timestamp window, `u`, `method`,
+* and optional `payload` tag.
+*/
+function validateAuthEvent(event, url, method, opts) {
+	if (!verifyEvent(event)) return false;
+	if (event.kind !== Kind.HttpAuth) return false;
+	const maxSkewSec = opts?.maxSkewSec ?? DEFAULT_MAX_SKEW_SEC;
+	const now = Math.floor(Date.now() / 1e3);
+	if (Math.abs(now - event.created_at) > maxSkewSec) return false;
+	if (event.tags.find((t) => t[0] === "u")?.[1] !== url) return false;
+	const m = event.tags.find((t) => t[0] === "method")?.[1];
+	if (m === void 0 || m.toLowerCase() !== method.toLowerCase()) return false;
+	if (opts?.payload !== void 0) {
+		if (event.tags.find((t) => t[0] === "payload")?.[1] !== hashPayload(opts.payload)) return false;
+	}
+	return true;
+}
+//#endregion
+export { Nip98Error, getToken, unpackEventFromToken, validateAuthEvent };
+
+//# sourceMappingURL=nip98.mjs.map

package/dist/nips/nip98.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"nip98.mjs","names":[],"sources":["../../src/nips/nip98.ts"],"sourcesContent":["/**\n * NIP-98: HTTP Auth (kind 27235).\n * Token is standard base64 of the signed event JSON, not base64url.\n *\n * @see https://github.com/nostr-protocol/nips/blob/master/98.md\n */\nimport { sha256 } from \"@noble/hashes/sha2.js\";\nimport { base64 } from \"@scure/base\";\nimport type { Event, EventTemplate } from \"../core/event.ts\";\nimport { validateSignedEvent } from \"../core/event.ts\";\nimport { NostrError } from \"../core/error.ts\";\nimport { verifyEvent } from \"../core/key.ts\";\nimport { Kind } from \"../core/kind.ts\";\nimport type { Tag } from \"../core/tag.ts\";\nimport { bytesToHex, utf8Decoder, utf8Encoder } from \"../core/util.ts\";\n\nconst AUTHORIZATION_SCHEME = \"Nostr \";\nconst DEFAULT_MAX_SKEW_SEC = 60;\n\nexport class Nip98Error extends NostrError {}\n\n/** SHA-256 of the request body: raw bytes for string/Uint8Array, else JSON.stringify. */\nfunction hashPayload(payload: unknown): string {\n  const bytes =\n    typeof payload === \"string\"\n      ? utf8Encoder.encode(payload)\n      : payload instanceof Uint8Array\n        ? payload\n        : utf8Encoder.encode(JSON.stringify(payload));\n  return bytesToHex(sha256(bytes));\n}\n\n/** RFC 4648 standard base64; accept missing `=` (NIP-98 spec example is unpadded). */\nfunction decodeStandardBase64(encoded: string): Uint8Array {\n  const rem = encoded.length % 4;\n  const padded = rem === 0 ? encoded : encoded + \"=\".repeat(4 - rem);\n  return base64.decode(padded);\n}\n\nfunction stripAuthorizationScheme(token: string): string {\n  const prefix = /^nostr\\s+/i.exec(token);\n  return prefix ? token.slice(prefix[0].length) : token;\n}\n\n/**\n * Sign a kind 27235 auth event and encode it as a NIP-98 token.\n * Uses standard base64 (`@scure/base`), not base64url.\n */\nexport async function getToken(\n  url: string,\n  method: string,\n  sign: (template: EventTemplate) => Promise<Event> | Event,\n  opts?: {\n    includeAuthorizationScheme?: boolean;\n    content?: string;\n    payload?: unknown;\n    now?: number;\n  },\n): Promise<string> {\n  const tags: Tag[] = [\n    [\"u\", url],\n    [\"method\", method],\n  ];\n  if (opts?.payload !== undefined) {\n    tags.push([\"payload\", hashPayload(opts.payload)]);\n  }\n\n  const signed = await sign({\n    kind: Kind.HttpAuth,\n    created_at: opts?.now ?? Math.floor(Date.now() / 1000),\n    tags,\n    content: opts?.content ?? \"\",\n  });\n\n  const encoded = base64.encode(utf8Encoder.encode(JSON.stringify(signed)));\n  return opts?.includeAuthorizationScheme ? AUTHORIZATION_SCHEME + encoded : encoded;\n}\n\n/** Decode a NIP-98 token (with or without the `Nostr ` scheme) into an event. */\nexport function unpackEventFromToken(token: string): Event {\n  if (!token) {\n    throw new Nip98Error(\"missing token\");\n  }\n\n  const encoded = stripAuthorizationScheme(token);\n\n  let json: string;\n  try {\n    json = utf8Decoder.decode(decodeStandardBase64(encoded));\n  } catch (cause) {\n    throw new Nip98Error(\"invalid token encoding\", { cause });\n  }\n  if (!json.startsWith(\"{\")) {\n    throw new Nip98Error(\"invalid token\");\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(json);\n  } catch (cause) {\n    throw new Nip98Error(\"invalid token JSON\", { cause });\n  }\n  if (!validateSignedEvent(parsed)) {\n    throw new Nip98Error(\"token is not a signed event\");\n  }\n  return parsed;\n}\n\n/**\n * True when `event` is a valid NIP-98 auth event for `url` + `method`.\n * Verifies signature, kind 27235, timestamp window, `u`, `method`,\n * and optional `payload` tag.\n */\nexport function validateAuthEvent(\n  event: Event,\n  url: string,\n  method: string,\n  opts?: { payload?: unknown; maxSkewSec?: number },\n): boolean {\n  if (!verifyEvent(event)) return false;\n  if (event.kind !== Kind.HttpAuth) return false;\n\n  const maxSkewSec = opts?.maxSkewSec ?? DEFAULT_MAX_SKEW_SEC;\n  const now = Math.floor(Date.now() / 1000);\n  if (Math.abs(now - event.created_at) > maxSkewSec) return false;\n\n  const u = event.tags.find((t) => t[0] === \"u\")?.[1];\n  if (u !== url) return false;\n\n  const m = event.tags.find((t) => t[0] === \"method\")?.[1];\n  if (m === undefined || m.toLowerCase() !== method.toLowerCase()) return false;\n\n  if (opts?.payload !== undefined) {\n    const payloadTag = event.tags.find((t) => t[0] === \"payload\")?.[1];\n    if (payloadTag !== hashPayload(opts.payload)) return false;\n  }\n\n  return true;\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAE7B,IAAa,aAAb,cAAgC,WAAW,CAAC;;AAG5C,SAAS,YAAY,SAA0B;CAC7C,MAAM,QACJ,OAAO,YAAY,WACf,YAAY,OAAO,OAAO,IAC1B,mBAAmB,aACjB,UACA,YAAY,OAAO,KAAK,UAAU,OAAO,CAAC;CAClD,OAAO,WAAW,OAAO,KAAK,CAAC;AACjC;;AAGA,SAAS,qBAAqB,SAA6B;CACzD,MAAM,MAAM,QAAQ,SAAS;CAC7B,MAAM,SAAS,QAAQ,IAAI,UAAU,UAAU,IAAI,OAAO,IAAI,GAAG;CACjE,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAS,yBAAyB,OAAuB;CACvD,MAAM,SAAS,aAAa,KAAK,KAAK;CACtC,OAAO,SAAS,MAAM,MAAM,OAAO,EAAE,CAAC,MAAM,IAAI;AAClD;;;;;AAMA,eAAsB,SACpB,KACA,QACA,MACA,MAMiB;CACjB,MAAM,OAAc,CAClB,CAAC,KAAK,GAAG,GACT,CAAC,UAAU,MAAM,CACnB;CACA,IAAI,MAAM,YAAY,KAAA,GACpB,KAAK,KAAK,CAAC,WAAW,YAAY,KAAK,OAAO,CAAC,CAAC;CAGlD,MAAM,SAAS,MAAM,KAAK;EACxB,MAAM,KAAK;EACX,YAAY,MAAM,OAAO,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACrD;EACA,SAAS,MAAM,WAAW;CAC5B,CAAC;CAED,MAAM,UAAU,OAAO,OAAO,YAAY,OAAO,KAAK,UAAU,MAAM,CAAC,CAAC;CACxE,OAAO,MAAM,6BAA6B,uBAAuB,UAAU;AAC7E;;AAGA,SAAgB,qBAAqB,OAAsB;CACzD,IAAI,CAAC,OACH,MAAM,IAAI,WAAW,eAAe;CAGtC,MAAM,UAAU,yBAAyB,KAAK;CAE9C,IAAI;CACJ,IAAI;EACF,OAAO,YAAY,OAAO,qBAAqB,OAAO,CAAC;CACzD,SAAS,OAAO;EACd,MAAM,IAAI,WAAW,0BAA0B,EAAE,MAAM,CAAC;CAC1D;CACA,IAAI,CAAC,KAAK,WAAW,GAAG,GACtB,MAAM,IAAI,WAAW,eAAe;CAGtC,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,IAAI;CAC1B,SAAS,OAAO;EACd,MAAM,IAAI,WAAW,sBAAsB,EAAE,MAAM,CAAC;CACtD;CACA,IAAI,CAAC,oBAAoB,MAAM,GAC7B,MAAM,IAAI,WAAW,6BAA6B;CAEpD,OAAO;AACT;;;;;;AAOA,SAAgB,kBACd,OACA,KACA,QACA,MACS;CACT,IAAI,CAAC,YAAY,KAAK,GAAG,OAAO;CAChC,IAAI,MAAM,SAAS,KAAK,UAAU,OAAO;CAEzC,MAAM,aAAa,MAAM,cAAc;CACvC,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CACxC,IAAI,KAAK,IAAI,MAAM,MAAM,UAAU,IAAI,YAAY,OAAO;CAG1D,IADU,MAAM,KAAK,MAAM,MAAM,EAAE,OAAO,GAAG,CAAC,GAAG,OACvC,KAAK,OAAO;CAEtB,MAAM,IAAI,MAAM,KAAK,MAAM,MAAM,EAAE,OAAO,QAAQ,CAAC,GAAG;CACtD,IAAI,MAAM,KAAA,KAAa,EAAE,YAAY,MAAM,OAAO,YAAY,GAAG,OAAO;CAExE,IAAI,MAAM,YAAY,KAAA,GACD;MAAA,MAAM,KAAK,MAAM,MAAM,EAAE,OAAO,SAAS,CAAC,GAAG,OAC7C,YAAY,KAAK,OAAO,GAAG,OAAO;CAAA;CAGvD,OAAO;AACT"}

package/dist/nostr_crypto_wasm_bg-hi5aXi5P.mjs

@@ -0,0 +1,4 @@
+//#region \0wasm-url:/Users/xu/Desktop/qntx/nostr.js/src/wasm/nostr_crypto_wasm_bg.wasm
+var nostr_crypto_wasm_bg_default = new URL("nostr_crypto_wasm_bg.wasm", import.meta.url).href;
+//#endregion
+export { nostr_crypto_wasm_bg_default as default };