libp2r2p 0.8.0 → 0.10.0

package/nip96/index.js

@@ -0,0 +1,285 @@
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import { bytesToBase16 } from '../base16/index.js'
+import { ValidationError } from '../error/index.js'
+import { FILE_SERVER_PREFERENCE } from '../kind/index.js'
+
+const WELL_KNOWN_PATH = '/.well-known/nostr/nip96.json'
+
+function isValidHttpUrl (value) {
+  try {
+    const url = new URL(value)
+    return url.protocol === 'http:' || url.protocol === 'https:'
+  } catch {
+    return false
+  }
+}
+
+function combineSignal (signal, timeoutMs) {
+  if (signal?.aborted) throw signal.reason ?? new DOMException('This operation was aborted', 'AbortError')
+  const controller = new AbortController()
+  const onAbort = () => controller.abort(signal.reason)
+  signal?.addEventListener('abort', onAbort, { once: true })
+  const timeout = Number.isFinite(timeoutMs) && timeoutMs >= 0
+    ? setTimeout(() => controller.abort(new DOMException('NIP-96 request timed out', 'TimeoutError')), timeoutMs)
+    : null
+  return {
+    signal: controller.signal,
+    cleanup () {
+      if (timeout !== null) clearTimeout(timeout)
+      signal?.removeEventListener('abort', onAbort)
+    }
+  }
+}
+
+async function fetchJson (url, options, { fetch: fetchImpl = globalThis.fetch, signal, timeoutMs = 10000 } = {}) {
+  if (typeof fetchImpl !== 'function') throw new Error('FETCH_IS_NOT_AVAILABLE')
+  const combined = combineSignal(signal, timeoutMs)
+  try {
+    const response = await fetchImpl(url, { ...options, signal: combined.signal })
+    if (!response.ok) {
+      const error = new Error(`NIP-96 request failed with status ${response.status}`)
+      error.status = response.status
+      throw error
+    }
+    try {
+      return { response, data: await response.json() }
+    } catch (cause) {
+      throw new ValidationError('INVALID_NIP96_JSON_RESPONSE', { cause })
+    }
+  } finally {
+    combined.cleanup()
+  }
+}
+
+function serverConfigurationError (config) {
+  if (!config || typeof config !== 'object' || Array.isArray(config)) return 'INVALID_NIP96_SERVER_CONFIGURATION'
+  const hasApi = typeof config.api_url === 'string' && config.api_url.length > 0
+  const hasDelegation = typeof config.delegated_to_url === 'string' && config.delegated_to_url.length > 0
+  if (!hasApi && !hasDelegation) return 'NIP96_SERVER_CONFIGURATION_SOURCE_REQUIRED'
+  if (hasApi && hasDelegation) return 'NIP96_SERVER_CONFIGURATION_SOURCE_CONFLICT'
+  if (hasApi && !isValidHttpUrl(config.api_url)) return 'INVALID_NIP96_API_URL'
+  if (hasDelegation && !isValidHttpUrl(config.delegated_to_url)) return 'INVALID_NIP96_DELEGATION_URL'
+  if (config.download_url !== undefined && !isValidHttpUrl(config.download_url)) return 'INVALID_NIP96_DOWNLOAD_URL'
+  return null
+}
+
+export function isValidServerConfiguration (config) {
+  return serverConfigurationError(config) === null
+}
+
+export function assertValidServerConfiguration (config) {
+  const code = serverConfigurationError(config)
+  if (code) throw new ValidationError(code)
+  return config
+}
+
+export async function readServerConfig ({ serverUrl, fetch, signal, timeoutMs = 10000 }) {
+  if (!isValidHttpUrl(serverUrl)) throw new ValidationError('INVALID_SERVER_URL')
+  const firstUrl = new URL(WELL_KNOWN_PATH, new URL(serverUrl).origin)
+  const first = await fetchJson(firstUrl, { headers: { Accept: 'application/json' } }, { fetch, signal, timeoutMs })
+  assertValidServerConfiguration(first.data)
+  if (!first.data.delegated_to_url) return first.data
+
+  const delegated = await fetchJson(first.data.delegated_to_url, { headers: { Accept: 'application/json' } }, { fetch, signal, timeoutMs })
+  try {
+    assertValidServerConfiguration(delegated.data)
+  } catch (cause) {
+    throw new ValidationError('INVALID_DELEGATED_SERVER_CONFIGURATION', { cause })
+  }
+  if (delegated.data.delegated_to_url) throw new ValidationError('INVALID_DELEGATED_SERVER_CONFIGURATION')
+  return delegated.data
+}
+
+function fileUploadResponseError (response) {
+  if (!response || typeof response !== 'object' || Array.isArray(response)) return 'INVALID_NIP96_FILE_UPLOAD_RESPONSE'
+  if (!['success', 'error', 'processing'].includes(response.status)) return 'INVALID_NIP96_UPLOAD_STATUS'
+  if (typeof response.message !== 'string') return 'INVALID_NIP96_UPLOAD_MESSAGE'
+  if (response.status === 'processing' && !isValidHttpUrl(response.processing_url)) return 'INVALID_NIP96_PROCESSING_URL'
+  if (response.processing_url !== undefined && !isValidHttpUrl(response.processing_url)) return 'INVALID_NIP96_PROCESSING_URL'
+  if (response.status === 'success' && !response.nip94_event) return 'NIP96_FILE_METADATA_REQUIRED'
+  if (response.nip94_event !== undefined) {
+    const { tags } = response.nip94_event
+    if (!Array.isArray(tags) || tags.some(tag => !Array.isArray(tag) || tag.length < 2 || tag.some(value => typeof value !== 'string'))) return 'INVALID_NIP94_TAGS'
+    if (!tags.some(tag => tag[0] === 'url' && isValidHttpUrl(tag[1]))) return 'NIP94_URL_TAG_REQUIRED'
+    if (!tags.some(tag => tag[0] === 'ox' && /^[0-9a-f]{64}$/.test(tag[1]))) return 'NIP94_ORIGINAL_HASH_TAG_REQUIRED'
+  }
+  return null
+}
+
+export function isValidFileUploadResponse (response) {
+  return fileUploadResponseError(response) === null
+}
+
+export function assertValidFileUploadResponse (response) {
+  const code = fileUploadResponseError(response)
+  if (code) throw new ValidationError(code)
+  return response
+}
+
+function uploadError (status) {
+  const messages = {
+    400: 'Bad request! Some fields are missing or invalid!',
+    402: 'Payment required!',
+    403: 'Forbidden! Payload tag does not match the requested file!',
+    413: 'File too large!'
+  }
+  const error = new Error(messages[status] ?? 'Unknown error in uploading file!')
+  error.status = status
+  return error
+}
+
+function makeFormData (file, optionalFormDataFields) {
+  const formData = new FormData()
+  for (const [key, value] of Object.entries(optionalFormDataFields ?? {})) {
+    if (value !== undefined) formData.append(key, value)
+  }
+  formData.append('file', file)
+  return formData
+}
+
+function emitProgress (onProgress, event) {
+  if (typeof onProgress !== 'function') return
+  try { onProgress(event) } catch (error) { console.error('NIP-96 progress callback failed:', error) }
+}
+
+function uploadWithXhr ({ file, serverApiUrl, nip98AuthorizationHeader, optionalFormDataFields, onProgress, signal, timeoutMs, xhrFactory }) {
+  return new Promise((resolve, reject) => {
+    const xhr = xhrFactory ? xhrFactory() : new XMLHttpRequest()
+    const onAbort = () => xhr.abort()
+    const settle = callback => value => {
+      signal?.removeEventListener('abort', onAbort)
+      callback(value)
+    }
+    const resolveUpload = settle(resolve)
+    const rejectUpload = settle(reject)
+    xhr.open('POST', serverApiUrl, true)
+    if (nip98AuthorizationHeader) xhr.setRequestHeader('Authorization', nip98AuthorizationHeader)
+    if (Number.isFinite(timeoutMs) && timeoutMs >= 0) xhr.timeout = timeoutMs
+    xhr.upload.addEventListener('progress', event => emitProgress(onProgress, event))
+    xhr.addEventListener('abort', () => rejectUpload(signal?.reason ?? new DOMException('This operation was aborted', 'AbortError')))
+    xhr.addEventListener('timeout', () => rejectUpload(new DOMException('NIP-96 request timed out', 'TimeoutError')))
+    xhr.addEventListener('error', () => rejectUpload(new Error('NIP-96 upload failed')))
+    xhr.addEventListener('load', () => {
+      if (xhr.status < 200 || xhr.status >= 300) return rejectUpload(uploadError(xhr.status))
+      let data
+      try { data = JSON.parse(xhr.responseText) } catch (cause) {
+        return rejectUpload(new ValidationError('INVALID_UPLOAD_RESPONSE_JSON', { cause }))
+      }
+      try {
+        resolveUpload(assertValidFileUploadResponse(data))
+      } catch (error) {
+        rejectUpload(error)
+      }
+    })
+    if (signal?.aborted) return rejectUpload(signal.reason ?? new DOMException('This operation was aborted', 'AbortError'))
+    signal?.addEventListener('abort', onAbort, { once: true })
+    xhr.send(makeFormData(file, optionalFormDataFields))
+  })
+}
+
+export async function uploadFile ({
+  file,
+  serverApiUrl,
+  nip98AuthorizationHeader,
+  optionalFormDataFields = {},
+  onProgress,
+  signal,
+  timeoutMs = 30000,
+  fetch: fetchImpl,
+  xhrFactory
+}) {
+  if (!file || !isValidHttpUrl(serverApiUrl)) throw new ValidationError('INVALID_UPLOAD_ARGUMENTS')
+  if (!fetchImpl && (xhrFactory || typeof XMLHttpRequest === 'function') && typeof onProgress === 'function') {
+    return uploadWithXhr({ file, serverApiUrl, nip98AuthorizationHeader, optionalFormDataFields, onProgress, signal, timeoutMs, xhrFactory })
+  }
+
+  const total = Number.isFinite(file.size) ? file.size : 0
+  emitProgress(onProgress, { lengthComputable: Number.isFinite(file.size), loaded: 0, total })
+  let result
+  try {
+    result = await fetchJson(serverApiUrl, {
+      method: 'POST',
+      headers: nip98AuthorizationHeader ? { Authorization: nip98AuthorizationHeader } : {},
+      body: makeFormData(file, optionalFormDataFields)
+    }, { fetch: fetchImpl, signal, timeoutMs })
+  } catch (error) {
+    if (error.status) throw uploadError(error.status)
+    throw error
+  }
+  assertValidFileUploadResponse(result.data)
+  emitProgress(onProgress, { lengthComputable: Number.isFinite(file.size), loaded: total, total })
+  return result.data
+}
+
+export function generateDownloadUrl ({ fileHash, serverDownloadUrl, fileExtension = '' }) {
+  if (typeof fileHash !== 'string' || !isValidHttpUrl(serverDownloadUrl) || typeof fileExtension !== 'string') {
+    throw new ValidationError('INVALID_DOWNLOAD_ARGUMENTS')
+  }
+  return `${serverDownloadUrl.replace(/\/$/, '')}/${fileHash}${fileExtension}`
+}
+
+export async function deleteFile ({ fileHash, serverApiUrl, nip98AuthorizationHeader, fetch, signal, timeoutMs = 10000 }) {
+  const url = generateDownloadUrl({ fileHash, serverDownloadUrl: serverApiUrl })
+  const result = await fetchJson(url, {
+    method: 'DELETE',
+    headers: nip98AuthorizationHeader ? { Authorization: nip98AuthorizationHeader } : {}
+  }, { fetch, signal, timeoutMs })
+  return result.data
+}
+
+function delayedProcessingResponseError (response) {
+  if (!response || typeof response !== 'object' || Array.isArray(response)) return 'INVALID_NIP96_DELAYED_RESPONSE'
+  if (!['processing', 'error'].includes(response.status)) return 'INVALID_NIP96_DELAYED_STATUS'
+  if (typeof response.message !== 'string') return 'INVALID_NIP96_DELAYED_MESSAGE'
+  if (typeof response.percentage !== 'number' || !Number.isFinite(response.percentage) ||
+      response.percentage < 0 || response.percentage > 100) return 'INVALID_NIP96_DELAYED_PERCENTAGE'
+  return null
+}
+
+export function isValidDelayedProcessingResponse (response) {
+  return delayedProcessingResponseError(response) === null
+}
+
+export function assertValidDelayedProcessingResponse (response) {
+  const code = delayedProcessingResponseError(response)
+  if (code) throw new ValidationError(code)
+  return response
+}
+
+export async function checkFileProcessingStatus ({ processingUrl, fetch, signal, timeoutMs = 10000 }) {
+  if (!isValidHttpUrl(processingUrl)) throw new ValidationError('INVALID_PROCESSING_URL')
+  const { response, data } = await fetchJson(processingUrl, {}, { fetch, signal, timeoutMs })
+  if (response.status === 201) return assertValidFileUploadResponse(data)
+  if (response.status === 200) return assertValidDelayedProcessingResponse(data)
+  throw new ValidationError('INVALID_PROCESSING_RESPONSE')
+}
+
+export function generateFSPEventTemplate ({ serverUrls, createdAt = Math.floor(Date.now() / 1000) }) {
+  if (!Array.isArray(serverUrls)) throw new ValidationError('SERVER_URLS_SHOULD_BE_AN_ARRAY')
+  return {
+    kind: FILE_SERVER_PREFERENCE,
+    content: '',
+    tags: serverUrls.filter(isValidHttpUrl).map(serverUrl => ['server', serverUrl]),
+    created_at: createdAt
+  }
+}
+
+export async function calculateFileHash (file) {
+  if (!file || typeof file.stream !== 'function') {
+    if (!file || typeof file.arrayBuffer !== 'function') throw new ValidationError('FILE_SHOULD_BE_A_BLOB')
+    return bytesToBase16(sha256(new Uint8Array(await file.arrayBuffer())))
+  }
+  const hash = sha256.create()
+  const reader = file.stream().getReader()
+  try {
+    while (true) {
+      const { done, value } = await reader.read()
+      if (done) break
+      hash.update(value)
+    }
+    return bytesToBase16(hash.digest())
+  } finally {
+    reader.releaseLock()
+  }
+}

package/nip98/index.js

@@ -0,0 +1,56 @@
+import { sha256 } from '@noble/hashes/sha2.js'
+
+import { bytesToBase16 } from '../base16/index.js'
+import { bytesToBase64 } from '../base64/index.js'
+import { ValidationError } from '../error/index.js'
+import { isValidEvent } from '../event/index.js'
+import { HTTP_AUTH } from '../kind/index.js'
+
+const encoder = new TextEncoder()
+const PAYLOAD_HASH = /^[0-9a-f]{64}$/
+
+async function payloadBytes (payload) {
+  if (typeof payload === 'string') return encoder.encode(payload)
+  if (payload instanceof Uint8Array) return payload
+  if (payload instanceof ArrayBuffer) return new Uint8Array(payload)
+  if (ArrayBuffer.isView(payload)) return new Uint8Array(payload.buffer, payload.byteOffset, payload.byteLength)
+  if (typeof Blob === 'function' && payload instanceof Blob) return new Uint8Array(await payload.arrayBuffer())
+  throw new ValidationError('INVALID_PAYLOAD')
+}
+
+export async function getToken ({
+  loginUrl,
+  httpMethod,
+  signEvent,
+  includeAuthorizationScheme = false,
+  payload,
+  payloadHash
+}) {
+  if (typeof loginUrl !== 'string' || loginUrl.length === 0) throw new ValidationError('INVALID_LOGIN_URL')
+  try { new URL(loginUrl) } catch (cause) { throw new ValidationError('INVALID_LOGIN_URL', { cause }) }
+  if (typeof httpMethod !== 'string' || httpMethod.trim().length === 0) throw new ValidationError('INVALID_HTTP_METHOD')
+  if (typeof signEvent !== 'function') throw new ValidationError('SIGN_EVENT_SHOULD_BE_A_FUNCTION')
+  if (payload !== undefined && payloadHash !== undefined) throw new ValidationError('PAYLOAD_AND_HASH_ARE_MUTUALLY_EXCLUSIVE')
+
+  let hash = payloadHash
+  if (payload !== undefined) hash = bytesToBase16(sha256(await payloadBytes(payload)))
+  if (hash !== undefined && !PAYLOAD_HASH.test(hash)) throw new ValidationError('INVALID_PAYLOAD_HASH')
+
+  const method = httpMethod.trim().toUpperCase()
+  const tags = [['u', loginUrl], ['method', method]]
+  if (hash !== undefined) tags.push(['payload', hash])
+  const event = await signEvent({
+    kind: HTTP_AUTH,
+    created_at: Math.floor(Date.now() / 1000),
+    tags,
+    content: ''
+  })
+  if (!isValidEvent(event) || event.kind !== HTTP_AUTH) throw new ValidationError('INVALID_SIGNED_HTTP_AUTH_EVENT')
+  if (!event.tags.some(tag => tag[0] === 'u' && tag[1] === loginUrl) ||
+      !event.tags.some(tag => tag[0] === 'method' && tag[1] === method) ||
+      (hash !== undefined && !event.tags.some(tag => tag[0] === 'payload' && tag[1] === hash))) {
+    throw new ValidationError('SIGNED_HTTP_AUTH_EVENT_WAS_CHANGED')
+  }
+  const token = bytesToBase64(encoder.encode(JSON.stringify(event)))
+  return includeAuthorizationScheme ? `Nostr ${token}` : token
+}

package/nwt/index.js

@@ -0,0 +1,241 @@
+import { base64UrlToBytes, bytesToBase64Url } from '../base64/index.js'
+import { ValidationError } from '../error/index.js'
+import { isValidEvent } from '../event/index.js'
+import { NWT } from '../kind/index.js'
+
+const textDecoder = new TextDecoder('utf-8', { fatal: true })
+const textEncoder = new TextEncoder()
+const BASE64URL = /^[A-Za-z0-9_-]+$/
+const REGISTERED_CLAIMS = new Set(['iss', 'sub', 'aud', 'iat', 'exp', 'nbf'])
+const SINGLE_CLAIMS = new Set(['iss', 'sub', 'iat', 'exp', 'nbf'])
+const TIMESTAMP_CLAIMS = new Set(['iat', 'exp', 'nbf'])
+const MAX_CLAIMS = 512
+
+function fail (code, { message = code, cause } = {}) {
+  throw new ValidationError(code, { message, cause })
+}
+
+function cloneTags (tags) {
+  return tags.map(tag => tag.slice())
+}
+
+function areTagsEqual (left, right) {
+  return left.length === right.length && left.every((tag, index) => {
+    const other = right[index]
+    return tag.length === other.length && tag.every((value, valueIndex) => value === other[valueIndex])
+  })
+}
+
+function normalizeTimestamp (value, code) {
+  if (!Number.isSafeInteger(value) || value < 0) fail(code)
+  return value
+}
+
+function parseTimestamp (value, code) {
+  if (!/^(?:0|[1-9][0-9]*)$/.test(value)) fail(code)
+  return normalizeTimestamp(Number(value), code)
+}
+
+function normalizeStringClaim (value, code) {
+  if (typeof value !== 'string' || value.length === 0) fail(code)
+  return value
+}
+
+function normalizeAudience (audience, { required = false } = {}) {
+  if (audience === undefined) {
+    if (required) fail('INVALID_AUDIENCE')
+    return []
+  }
+  const values = typeof audience === 'string' ? [audience] : audience
+  if (!Array.isArray(values) || (required && values.length === 0)) fail('INVALID_AUDIENCE')
+  return values.map(value => normalizeStringClaim(value, 'INVALID_AUDIENCE'))
+}
+
+function normalizeExtraClaims (claims) {
+  if (claims === undefined) return []
+  if (!Array.isArray(claims)) fail('INVALID_CLAIMS')
+  return claims.map(tag => {
+    if (!Array.isArray(tag) || tag.length < 2 || tag.some(value => typeof value !== 'string')) fail('INVALID_CLAIM')
+    if (tag[0].length === 0 || REGISTERED_CLAIMS.has(tag[0])) fail('INVALID_CUSTOM_CLAIM')
+    return tag.slice()
+  })
+}
+
+function parseClaims (event) {
+  if (event.tags.length > MAX_CLAIMS) fail('TOO_MANY_CLAIMS')
+
+  const single = new Map()
+  const audience = []
+  const claims = []
+
+  for (const tag of event.tags) {
+    if (tag.length < 2 || tag[0].length === 0) fail('INVALID_CLAIM')
+    const name = tag[0]
+
+    if (!REGISTERED_CLAIMS.has(name)) {
+      claims.push(tag.slice())
+      continue
+    }
+    if (tag.length !== 2 || tag[1].length === 0) fail('INVALID_REGISTERED_CLAIM')
+    if (name === 'aud') {
+      audience.push(tag[1])
+      continue
+    }
+    if (SINGLE_CLAIMS.has(name) && single.has(name)) fail('DUPLICATE_SINGLE_CLAIM')
+    single.set(name, TIMESTAMP_CLAIMS.has(name)
+      ? parseTimestamp(tag[1], `INVALID_${name.toUpperCase()}_CLAIM`)
+      : tag[1])
+  }
+
+  const expiration = single.get('exp') ?? null
+  const notBefore = single.get('nbf') ?? null
+  if (expiration !== null && notBefore !== null && notBefore > expiration) fail('INVALID_TIME_WINDOW')
+
+  return {
+    event,
+    id: event.id,
+    signer: event.pubkey,
+    issuer: single.get('iss') ?? event.pubkey,
+    subject: single.get('sub') ?? event.pubkey,
+    audience,
+    issuedAt: single.get('iat') ?? event.created_at,
+    expiration,
+    notBefore,
+    claims,
+    content: event.content
+  }
+}
+
+function parseVerifiedEvent (event) {
+  if (!isValidEvent(event)) fail('INVALID_NWT_EVENT')
+  if (event.kind !== NWT) fail('INVALID_NWT_KIND')
+  return parseClaims(event)
+}
+
+function wireEvent (event) {
+  return {
+    id: event.id,
+    pubkey: event.pubkey,
+    created_at: event.created_at,
+    kind: event.kind,
+    tags: cloneTags(event.tags),
+    content: event.content,
+    sig: event.sig
+  }
+}
+
+export async function createToken ({
+  signEvent,
+  issuer,
+  subject,
+  audience,
+  issuedAt,
+  expiration,
+  notBefore,
+  claims,
+  content = '',
+  createdAt = Math.floor(Date.now() / 1000)
+} = {}) {
+  if (typeof signEvent !== 'function') fail('SIGN_EVENT_SHOULD_BE_A_FUNCTION')
+  if (typeof content !== 'string') fail('INVALID_CONTENT')
+
+  const tags = []
+  if (issuer !== undefined) tags.push(['iss', normalizeStringClaim(issuer, 'INVALID_ISSUER')])
+  if (subject !== undefined) tags.push(['sub', normalizeStringClaim(subject, 'INVALID_SUBJECT')])
+  for (const value of normalizeAudience(audience)) tags.push(['aud', value])
+  if (issuedAt !== undefined) tags.push(['iat', String(normalizeTimestamp(issuedAt, 'INVALID_ISSUED_AT'))])
+  if (expiration !== undefined) tags.push(['exp', String(normalizeTimestamp(expiration, 'INVALID_EXPIRATION'))])
+  if (notBefore !== undefined) tags.push(['nbf', String(normalizeTimestamp(notBefore, 'INVALID_NOT_BEFORE'))])
+  tags.push(...normalizeExtraClaims(claims))
+  if (tags.length > MAX_CLAIMS) fail('TOO_MANY_CLAIMS')
+
+  const expected = {
+    kind: NWT,
+    created_at: normalizeTimestamp(createdAt, 'INVALID_CREATED_AT'),
+    tags,
+    content
+  }
+  if (expiration !== undefined && notBefore !== undefined && notBefore > expiration) fail('INVALID_TIME_WINDOW')
+
+  const event = await signEvent({ ...expected, tags: cloneTags(expected.tags) })
+  parseVerifiedEvent(event)
+  if (
+    event.kind !== expected.kind ||
+    event.created_at !== expected.created_at ||
+    event.content !== expected.content ||
+    !areTagsEqual(event.tags, expected.tags)
+  ) fail('SIGNED_NWT_EVENT_WAS_CHANGED')
+  return event
+}
+
+export function encodeToken (event, { includeAuthorizationScheme = false } = {}) {
+  parseVerifiedEvent(event)
+  const token = bytesToBase64Url(textEncoder.encode(JSON.stringify(wireEvent(event))))
+  return includeAuthorizationScheme ? `Nostr ${token}` : token
+}
+
+export function decodeToken (value) {
+  if (typeof value !== 'string' || value.length === 0) fail('INVALID_NWT_TOKEN')
+  let token = value
+  if (value.startsWith('Nostr ')) token = value.slice(6)
+  else if (/\s/.test(value)) fail('INVALID_AUTHORIZATION_HEADER')
+  if (!BASE64URL.test(token) || token.length % 4 === 1) fail('INVALID_NWT_ENCODING')
+
+  let bytes
+  try {
+    bytes = base64UrlToBytes(token)
+    if (bytesToBase64Url(bytes) !== token) fail('INVALID_NWT_ENCODING')
+  } catch (cause) {
+    fail('INVALID_NWT_ENCODING', { cause })
+  }
+
+  try {
+    const event = JSON.parse(textDecoder.decode(bytes))
+    if (!event || typeof event !== 'object' || Array.isArray(event)) fail('INVALID_NWT_EVENT_JSON')
+    return event
+  } catch (error) {
+    if (error instanceof ValidationError && error.code === 'INVALID_NWT_EVENT_JSON') throw error
+    fail('INVALID_NWT_EVENT_JSON', { cause: error })
+  }
+}
+
+export function validateToken (value, {
+  audience,
+  signer,
+  issuer,
+  subject,
+  now = Math.floor(Date.now() / 1000),
+  clockSkewSeconds = 60,
+  requireAudience = false,
+  requireExpiration = false
+} = {}) {
+  const event = typeof value === 'string' ? decodeToken(value) : value
+  const token = parseVerifiedEvent(event)
+  normalizeTimestamp(now, 'INVALID_NOW')
+  normalizeTimestamp(clockSkewSeconds, 'INVALID_CLOCK_SKEW')
+  if (!Number.isSafeInteger(now + clockSkewSeconds) || !Number.isSafeInteger(now - clockSkewSeconds)) {
+    fail('INVALID_CLOCK_SKEW')
+  }
+
+  if (token.notBefore !== null && now + clockSkewSeconds < token.notBefore) fail('NWT_NOT_YET_VALID')
+  if (token.expiration !== null && now - clockSkewSeconds >= token.expiration) fail('NWT_EXPIRED')
+  if (requireExpiration && token.expiration === null) fail('NWT_EXPIRATION_REQUIRED')
+
+  if (token.audience.length === 0) {
+    if (requireAudience) fail('NWT_AUDIENCE_REQUIRED')
+  } else {
+    if (audience === undefined) fail('NWT_AUDIENCE_REQUIRED')
+    const expectedAudience = normalizeAudience(audience, { required: true })
+    if (!expectedAudience.some(value => token.audience.includes(value))) fail('NWT_AUDIENCE_MISMATCH')
+  }
+
+  for (const [expected, actual, code] of [
+    [signer, token.signer, 'NWT_SIGNER_MISMATCH'],
+    [issuer, token.issuer, 'NWT_ISSUER_MISMATCH'],
+    [subject, token.subject, 'NWT_SUBJECT_MISMATCH']
+  ]) {
+    if (expected !== undefined && normalizeStringClaim(expected, code) !== actual) fail(code)
+  }
+
+  return token
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libp2r2p",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Peer-to-relay-to-peer",
   "keywords": [
     "p2r2p",
@@ -20,20 +20,29 @@
     "content-key",
     "double-dh",
     "ecdh",
+    "error",
+    "event",
     "idb",
     "idb-queue",
-    "i18n",
     "index.js",
     "key",
+    "kind",
     "network",
+    "nip04",
+    "nip05",
     "nip19",
+    "nip44",
     "nip44-v3",
     "nip46",
+    "nip96",
+    "nip98",
+    "nwt",
     "private-channel",
     "private-message",
     "private-messenger",
     "relay",
     "temporary-storage",
+    "url",
     "web-storage-queue"
   ],
   "scripts": {
@@ -51,28 +60,36 @@
     "./content-key/event": "./content-key/event/index.js",
     "./double-dh": "./double-dh/index.js",
     "./ecdh": "./ecdh/index.js",
+    "./error": "./error/index.js",
+    "./event": "./event/index.js",
     "./idb": "./idb/index.js",
     "./idb-queue": "./idb-queue/index.js",
-    "./i18n": "./i18n/index.js",
     "./key": "./key/index.js",
+    "./kind": "./kind/index.js",
     "./network": "./network/index.js",
+    "./nip04": "./nip04/index.js",
+    "./nip05": "./nip05/index.js",
     "./nip19": "./nip19/index.js",
+    "./nip44": "./nip44/index.js",
     "./nip44-v3": "./nip44-v3/index.js",
     "./nip46": "./nip46/index.js",
+    "./nip96": "./nip96/index.js",
+    "./nip98": "./nip98/index.js",
+    "./nwt": "./nwt/index.js",
     "./private-channel": "./private-channel/index.js",
     "./private-message": "./private-message/index.js",
     "./private-messenger": "./private-messenger/index.js",
     "./private-messenger/recovery": "./private-messenger/recovery/index.js",
     "./relay": "./relay/index.js",
     "./temporary-storage": "./temporary-storage/index.js",
+    "./url": "./url/index.js",
     "./web-storage-queue": "./web-storage-queue/index.js"
   },
   "dependencies": {
     "@noble/ciphers": "2.2.0",
     "@noble/curves": "2.2.0",
     "@noble/hashes": "2.2.0",
-    "@scure/base": "2.0.0",
-    "nostr-tools": "2.23.5"
+    "@scure/base": "2.0.0"
   },
   "devDependencies": {
     "fake-indexeddb": "6.2.5"