import { createHmac } from "node:crypto";
// ── Telegram Verification ────────────────────────────────────────────────────
export function verifyTelegramInitData(initData, botToken) {
    if (!botToken || !initData)
        return false;
    try {
        const params = new URLSearchParams(initData);
        const hash = params.get("hash");
        if (!hash)
            return false;
        params.delete("hash");
        const dataCheckString = [...params.entries()]
            .sort(([a], [b]) => a.localeCompare(b))
            .map(([k, v]) => `${k}=${v}`)
            .join("\n");
        const secretKey = createHmac("sha256", "WebAppData").update(botToken).digest();
        const checkHash = createHmac("sha256", secretKey).update(dataCheckString).digest("hex");
        return checkHash === hash;
    }
    catch {
        return false;
    }
}
//# sourceMappingURL=telegram-auth.js.map