feat: upgrade to nostr-crypto-utils v0.5.1, use finalizeEvent and getPublicKeySync

Switch crypto utils wrapper to use finalizeEvent() (one-step event
creation + signing) and getPublicKeySync() (sync pubkey derivation).
Simplifies generateChallenge() from a 3-step manual pattern to a
single call. Also fixes loadConfig() to derive pubkey from the actual
SERVER_PRIVATE_KEY instead of a random keypair.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: vveerrgg

package-lock.json

@@ -82,7 +82,7 @@
     "express-rate-limit": "^7.5.1",
     "helmet": "^8.1.0",
     "jsonwebtoken": "^9.0.3",
-    "nostr-crypto-utils": "^0.4.10",
+    "nostr-crypto-utils": "^0.5.1",
     "tslib": "^2.8.1",
     "winston": "^3.19.0"
   },

package.json

@@ -5,7 +5,7 @@
  */
 
 import { createLogger } from '../utils/logger.js';
-import { generateKeyPair } from '../utils/crypto.utils.js';
+import { generateKeyPair, getPublicKey } from '../utils/crypto.utils.js';
 import { createClient } from '@supabase/supabase-js';
 import dotenv from 'dotenv';
 import { NostrConfig } from '../types/index.js';
@@ -132,9 +132,8 @@ export async function loadConfig(envPath?: string): Promise<NostrConfig> {
   // SECURITY: Prefer loading server keys from environment variables (SERVER_PRIVATE_KEY).
   // This avoids storing private keys as plaintext in Supabase.
   if (process.env.SERVER_PRIVATE_KEY) {
-    const keyPair = await generateKeyPair();
     loadedConfig.privateKey = process.env.SERVER_PRIVATE_KEY;
-    loadedConfig.publicKey = keyPair.publicKey.toString();
+    loadedConfig.publicKey = getPublicKey(process.env.SERVER_PRIVATE_KEY);
     logger.info('Loaded server keys from environment (recommended for production)');
     return loadedConfig;
   }

src/config/index.ts

@@ -1,7 +1,10 @@
 declare module 'nostr-crypto-utils' {
-  export function generateKeyPair(): { privateKey: string; publicKey: string };
-  export function getPublicKey(privateKey: string): Promise<string>;
+  export function generateKeyPair(): Promise<{ privateKey: string; publicKey: string }>;
+  export function getPublicKey(privateKey: string): Promise<{ hex: string; bytes: Uint8Array }>;
+  export function getPublicKeySync(privateKey: string): string;
   export function calculateEventId(event: any): string;
+  export function createEvent(event: Partial<any>): any;
   export function signEvent(event: any, privateKey: string): Promise<any>;
+  export function finalizeEvent(event: Partial<any>, privateKey: string): Promise<any>;
   export function verifySignature(event: any): Promise<boolean>;
 }

src/types/nostr-crypto-utils.d.ts

@@ -4,11 +4,11 @@
  * @module crypto-utils
  */
 
-import { 
+import {
   generateKeyPair as genKeyPair,
-  getPublicKey as getNostrPublicKey,
+  getPublicKeySync,
   calculateEventId as getEventHash,
-  signEvent as signNostrEvent,
+  finalizeEvent,
   verifySignature as verifyNostrSignature
 } from 'nostr-crypto-utils';
 import { NostrEvent } from '../types.js';
@@ -22,13 +22,12 @@ export function generateKeyPair() {
 }
 
 /**
- * Derives a public key from a private key
+ * Derives a public key from a private key (synchronous)
  * @param {string} privateKey - The private key in hex format
- * @returns {Promise<string>} The derived public key in hex format
+ * @returns {string} The derived public key in hex format
  */
-export async function getPublicKey(privateKey: string): Promise<string> {
-  const publicKeyDetails = await getNostrPublicKey(privateKey);
-  return publicKeyDetails.toString();
+export function getPublicKey(privateKey: string): string {
+  return getPublicKeySync(privateKey);
 }
 
 /**
@@ -50,34 +49,29 @@ export function generateEventHash(event: Partial<NostrEvent>): string {
 }
 
 /**
- * Signs a Nostr event with a private key
+ * Signs a Nostr event with a private key using finalizeEvent
  * @param {NostrEvent} event - The event to sign
  * @param {string} privateKey - The private key to sign with
- * @returns {Promise<NostrEvent>} The signed event
+ * @returns {Promise<NostrEvent>} The signed event with id, pubkey, and sig
  */
 export async function signEvent(event: NostrEvent, privateKey: string): Promise<NostrEvent> {
-  return signNostrEvent(event, privateKey);
+  const signed = await finalizeEvent(event, privateKey);
+  return signed as unknown as NostrEvent;
 }
 
 /**
  * Generates a challenge event for authentication
- * @param {string} pubkey - The public key to generate the challenge for
- * @returns {Promise<NostrEvent>} The generated challenge event
+ * @param {string} privateKey - The server's private key to sign the challenge with
+ * @param {string} challengePubkey - The public key to generate the challenge for
+ * @returns {Promise<NostrEvent>} The generated and signed challenge event
  */
-export async function generateChallenge(pubkey: string): Promise<NostrEvent> {
-  const now = Math.floor(Date.now() / 1000);
-  const event: NostrEvent = {
+export async function generateChallenge(privateKey: string, challengePubkey?: string): Promise<NostrEvent> {
+  const pubkey = challengePubkey ?? getPublicKeySync(privateKey);
+  const signed = await finalizeEvent({
     kind: 22242,
-    created_at: now,
     tags: [['challenge', pubkey]],
-    content: 'Authentication request',
-    pubkey: pubkey,
-    id: '',
-    sig: ''
-  };
+    content: 'Authentication request'
+  }, privateKey);
 
-  event.id = getEventHash(event);
-  event.sig = await signNostrEvent(event, pubkey);
-
-  return event;
+  return signed as unknown as NostrEvent;
 }