fix: support @noble/curves v2 API in signature verification

- Convert hex strings to Uint8Array for schnorr.verify() which now
  requires Uint8Array for signature parameter in @noble/curves v2
- Update @noble/curves from ^1.6.0 to ^2.0.0
- Update @noble/hashes from ^1.5.0 to ^2.0.0
- Update all import paths for v2 module structure:
  - @noble/hashes/sha256 -> @noble/hashes/sha2.js
  - @noble/hashes/utils -> @noble/hashes/utils.js
  - @noble/curves/secp256k1 -> @noble/curves/secp256k1.js
- Bump version to 3.0.3

This fixes silent signature verification failures when apps have
@noble/curves v2 installed (e.g. from @cashu/cashu-ts), which caused
all events to be silently dropped.

Author: Execution Coordinator

bun.lock

@@ -1,6 +1,6 @@
 {
   "name": "@nostr-dev-kit/ndk",
-  "version": "3.0.2",
+  "version": "3.0.3",
   "description": "NDK - Nostr Development Kit. Includes AI Guardrails to catch common mistakes during development.",
   "homepage": "https://ndk.fyi",
   "documentation": "https://nostr-dev-kit.github.io/ndk",
@@ -87,8 +87,8 @@
   },
   "dependencies": {
     "@codesandbox/sandpack-client": "^2.19.8",
-    "@noble/curves": "^1.6.0",
-    "@noble/hashes": "^1.5.0",
+    "@noble/curves": "^2.0.0",
+    "@noble/hashes": "^2.0.0",
     "@noble/secp256k1": "^2.1.0",
     "@scure/base": "^1.1.9",
     "debug": "^4.3.7",

collabstr-01-login.png

@@ -1,6 +1,6 @@
-import { schnorr } from "@noble/curves/secp256k1";
-import { sha256 } from "@noble/hashes/sha256";
-import { bytesToHex } from "@noble/hashes/utils";
+import { schnorr } from "@noble/curves/secp256k1.js";
+import { sha256 } from "@noble/hashes/sha2.js";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
 import { LRUCache } from "typescript-lru-cache";
 import type { NDKEvent, NostrEvent } from ".";
 import { verifySignatureAsync } from "./signature";
@@ -83,7 +83,9 @@ export function verifySignature(this: NDKEvent, persist: boolean): boolean | und
                 });
         } else {
             const hash = sha256(new TextEncoder().encode(this.serialize()));
-            const res = schnorr.verify(this.sig as string, hash, this.pubkey);
+            const sigBytes = hexToBytes(this.sig as string);
+            const pubkeyBytes = hexToBytes(this.pubkey);
+            const res = schnorr.verify(sigBytes, hash, pubkeyBytes);
             if (res) verifiedSignatures.set(this.id, this.sig!);
             else verifiedSignatures.set(this.id, false);
             this.signatureVerified = res;

collabstr-02-connecting-stuck.png

@@ -1,4 +1,4 @@
-import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
 import { describe, expect, it } from "vitest";
 import { decrypt, encrypt } from "./index.js";
 

core/package.json

@@ -1,4 +1,4 @@
-import { hexToBytes } from "@noble/hashes/utils";
+import { hexToBytes } from "@noble/hashes/utils.js";
 import type { NDKEvent } from "../../../events/index.js";
 import type { NDK } from "../../../ndk/index.js";
 import type { NDKUser } from "../../../user/index.js";

core/src/events/validation.ts

@@ -1,4 +1,4 @@
-import { bytesToHex } from "@noble/hashes/utils";
+import { bytesToHex } from "@noble/hashes/utils.js";
 import { nip19 } from "nostr-tools";
 import { NDKEvent, type NostrEvent } from "../../index.js";
 import { NDKPrivateKeySigner } from "./index";

core/src/nip49/index.test.ts

@@ -1,4 +1,4 @@
-import { bytesToHex, hexToBytes } from "@noble/hashes/utils";
+import { bytesToHex, hexToBytes } from "@noble/hashes/utils.js";
 import type { UnsignedEvent } from "nostr-tools";
 import { finalizeEvent, generateSecretKey, getPublicKey, nip04, nip19, nip44 } from "nostr-tools";
 import * as nip49 from "nostr-tools/nip49";

core/src/signers/nip46/backend/index.ts

@@ -1,5 +1,5 @@
-import { schnorr } from "@noble/curves/secp256k1";
-import { sha256 } from "@noble/hashes/sha256";
+import { schnorr } from "@noble/curves/secp256k1.js";
+import { sha256 } from "@noble/hashes/sha2.js";
 
 // Protocol version for signature verification worker
 // Format: [major, minor, patch] matching @nostr-dev-kit/ndk package version
@@ -26,7 +26,9 @@ globalThis.onmessage = (msg: MessageEvent) => {
             return;
         }
 
-        const result = schnorr.verify(sig as string, idHash, pubkey);
+        const sigBytes = hexToBytes(sig);
+        const pubkeyBytes = hexToBytes(pubkey);
+        const result = schnorr.verify(sigBytes, idHash, pubkeyBytes);
         postMessage([id, result]);
     });
 };