fix: convert the stored hex key to bytes before nip44 getConversationKey (#1)

Since 1.0.0 every `window.nostr.nip44.encrypt`/`decrypt` call fails with `expected Uint8Array, got type=string`, which breaks NIP-17 DMs and anything else using NIP-44 on sites that use the extension.

`private_key` is stored as hex, and nostr-tools 2.23 (noble-curves v2) no longer accepts hex strings in `getConversationKey`. `signEvent` and `getPublicKey` already convert with `hexToBytes(sk)`; this does the same in `getSharedSecret`.

Also adds NIP-44 tests (hex key rejected, converted key round-trips with a peer) in place of the note saying NIP-44 was only covered by the build. `vitest run` passes (50 tests), biome is clean, and a `build.js prod firefox` bundle encrypts where the published 1.0.0 throws.

Reviewed-on: #1
Co-authored-by: Chad Curtis <chad@chadwick.site>

extension/background.js

@@ -38,7 +38,7 @@ function getSharedSecret(sk, peer) {
   let key = secretsCache.get(peer)
 
   if (!key) {
-    key = nip44.v2.utils.getConversationKey(sk, peer)
+    key = nip44.v2.utils.getConversationKey(hexToBytes(sk), peer)
     secretsCache.set(peer, key)
   }
 

extension/background.test.js

@@ -70,9 +70,34 @@ describe('background.js crypto operations', () => {
       expect(typeof nip44.v2.decrypt).toBe('function')
     })
 
-    // Note: nip44.v2.utils.getConversationKey expects specific input format
+    // The stored private_key is hex, but getConversationKey only takes bytes
-    // The actual NIP-44 functionality is tested indirectly through the
+    it('should reject a hex private key', async () => {
-    // build process succeeding without errors
+      const nip44 = await import('nostr-tools/nip44')
+      const peerPubkey = getPublicKey(generateSecretKey())
+
+      expect(() =>
+        nip44.v2.utils.getConversationKey(testPrivateKeyHex, peerPubkey)
+      ).toThrow(/expected Uint8Array/)
+    })
+
+    it('should encrypt and decrypt with a converted hex private key', async () => {
+      const nip44 = await import('nostr-tools/nip44')
+      const peerSecret = generateSecretKey()
+      const peerPubkey = getPublicKey(peerSecret)
+      const plaintext = 'Hello, Nostr!'
+
+      const key = nip44.v2.utils.getConversationKey(
+        hexToBytes(testPrivateKeyHex),
+        peerPubkey
+      )
+      const ciphertext = nip44.v2.encrypt(plaintext, key)
+      const peerKey = nip44.v2.utils.getConversationKey(
+        peerSecret,
+        testPublicKey
+      )
+
+      expect(nip44.v2.decrypt(ciphertext, peerKey)).toBe(plaintext)
+    })
   })
 
   describe('nip19 encoding/decoding', async () => {