fix: migrate to nostr ^2.0.0 for pointycastle v4 compatibility

The nostr v2.0.0 package widens its pointycastle constraint to
>=3.7.3 <5.0.0, unblocking pointycastle v4. Beyond the documented
Keychain→Keys and privkey:→secretKey: renames, v2 also changed
Keys.private→Keys.secret, dropped the Nip19.encodePrivkey/decodePrivkey
helpers (replaced by Nip19.encode/decode and the Keys.nsec getter),
and changed Event.toJson() to return String while adding Event.toMap()
for callers that need Map<String,dynamic>.

Author: wpfleger96

mobile/lib/features/channels/agent_activity/observer_subscription.dart

@@ -271,7 +271,7 @@ class ObserverRelayNotifier extends Notifier<ObserverRelayState> {
 
   static String _decodePrivkey(String nsec) {
     try {
-      final privHex = nostr.Nip19.decodePrivkey(nsec);
+      final privHex = nostr.Nip19.decode(payload: nsec).data;
       if (privHex.isEmpty) {
         throw const FormatException('empty private key');
       }
@@ -283,7 +283,7 @@ class ObserverRelayNotifier extends Notifier<ObserverRelayState> {
 
   static String _derivePubkey(String privHex) {
     try {
-      return nostr.Keychain(privHex).public;
+      return nostr.Keys(privHex).public;
     } catch (_) {
       throw const FormatException('failed to derive pubkey');
     }

mobile/lib/features/channels/compose_bar.dart

@@ -593,7 +593,7 @@ void _sendTypingIndicator(
     final nsec = config.nsec;
     if (nsec == null || nsec.isEmpty) return;
 
-    final privkeyHex = nostr.Nip19.decodePrivkey(nsec);
+    final privkeyHex = nostr.Nip19.decode(payload: nsec).data;
     if (privkeyHex.isEmpty) return;
 
     final tags = <List<String>>[
@@ -609,13 +609,13 @@ void _sendTypingIndicator(
       kind: EventKind.typingIndicator,
       content: '',
       tags: tags,
-      privkey: privkeyHex,
+      secretKey: privkeyHex,
       verify: false,
     );
 
     // Send directly over WebSocket — fire-and-forget, matching desktop.
     final session = ref.read(relaySessionProvider.notifier);
-    session.sendRaw(['EVENT', event.toJson()]);
+    session.sendRaw(['EVENT', event.toMap()]);
   } catch (_) {
     // Fire-and-forget — typing indicator failure is non-fatal.
   }

mobile/lib/features/channels/read_state/read_state_manager.dart

@@ -22,7 +22,7 @@ class ReadStateCrypto {
     required String pubkey,
   }) {
     try {
-      final privkeyHex = nostr.Nip19.decodePrivkey(nsec);
+      final privkeyHex = nostr.Nip19.decode(payload: nsec).data;
       if (privkeyHex.isEmpty || pubkey.isEmpty) {
         return null;
       }

mobile/lib/features/pairing/pairing_provider.dart

@@ -154,8 +154,8 @@ class PairingNotifier extends Notifier<PairingState> {
       final relayWsUrl = qr.relays.first;
 
       // 2. Generate ephemeral keypair.
-      final keychain = nostr.Keychain.generate();
-      _ephemeralPrivkey = keychain.private;
+      final keychain = nostr.Keys.generate();
+      _ephemeralPrivkey = keychain.secret;
       _ephemeralPubkey = keychain.public;
 
       // 3. Derive session ID and SAS immediately (we know source pubkey from QR).
@@ -302,7 +302,7 @@ class PairingNotifier extends Notifier<PairingState> {
       // NIP-AB §Event Validation: verify event signature (NIP-01).
       // The nostr package's Event.fromJson verifies id + sig on construction.
       try {
-        final event = nostr.Event.fromJson(eventJson);
+        final event = nostr.Event.fromJson(jsonEncode(eventJson));
         if (event.id != eventId) return; // id mismatch
       } catch (_) {
         return; // invalid signature or malformed event
@@ -507,11 +507,11 @@ class PairingNotifier extends Notifier<PairingState> {
       kind: kind,
       content: content,
       tags: tags,
-      privkey: _ephemeralPrivkey!,
+      secretKey: _ephemeralPrivkey!,
       createdAt: createdAt,
     );
 
-    _socket?.publishEvent(event.toJson());
+    _socket?.publishEvent(event.toMap());
   }
 
   void _handleDisconnected(Object? error) {

mobile/lib/features/pairing/pairing_socket.dart

@@ -166,12 +166,12 @@ class PairingSocket {
         kind: EventKind.auth,
         content: '',
         tags: tags,
-        privkey: _ephemeralPrivkey,
+        secretKey: _ephemeralPrivkey,
         createdAt: DateTime.now().millisecondsSinceEpoch ~/ 1000,
       );
 
       _pendingAuthEventId = event.id;
-      send(['AUTH', event.toJson()]);
+      send(['AUTH', event.toMap()]);
     } catch (e) {
       _failAuth(e);
     }

mobile/lib/features/profile/user_status_provider.dart

@@ -25,8 +25,8 @@ class UserStatusNotifier extends AsyncNotifier<UserStatus?> {
 
     String pubkey;
     try {
-      final privkeyHex = nostr.Nip19.decodePrivkey(nsec);
-      final keyPair = nostr.Keychain(privkeyHex);
+      final privkeyHex = nostr.Nip19.decode(payload: nsec).data;
+      final keyPair = nostr.Keys(privkeyHex);
       pubkey = keyPair.public.toLowerCase();
     } catch (_) {
       return null;
@@ -74,18 +74,18 @@ class UserStatusNotifier extends AsyncNotifier<UserStatus?> {
       tags.add(['emoji', emoji]);
     }
 
-    final privkeyHex = nostr.Nip19.decodePrivkey(nsec);
+    final privkeyHex = nostr.Nip19.decode(payload: nsec).data;
     final event = nostr.Event.from(
       kind: EventKind.userStatus,
       content: trimmed,
       tags: tags,
-      privkey: privkeyHex,
+      secretKey: privkeyHex,
       verify: false,
     );
 
     final session = ref.read(relaySessionProvider.notifier);
     await session.publish(
-      NostrEvent.fromJson(Map<String, dynamic>.from(event.toJson())),
+      NostrEvent.fromJson(event.toMap()),
     );
 
     // Optimistic update: update own state immediately.
@@ -99,7 +99,7 @@ class UserStatusNotifier extends AsyncNotifier<UserStatus?> {
     state = AsyncValue.data(newStatus);
 
     // Also update the shared cache so other UI reads stay consistent.
-    final keyPair = nostr.Keychain(privkeyHex);
+    final keyPair = nostr.Keys(privkeyHex);
     final pubkey = keyPair.public.toLowerCase();
     ref.read(userStatusCacheProvider.notifier).updateStatus(pubkey, newStatus);
   }

mobile/lib/features/settings/settings_page.dart

@@ -57,9 +57,9 @@ class SettingsPage extends HookConsumerWidget {
             const SizedBox(height: Grid.xxs),
             Builder(
               builder: (context) {
-                final privHex = nostr.Nip19.decodePrivkey(config.nsec!);
+                final privHex = nostr.Nip19.decode(payload: config.nsec!).data;
                 final pubkey = privHex.isNotEmpty
-                    ? nostr.Keychain(privHex).public
+                    ? nostr.Keys(privHex).public
                     : 'unknown';
                 return ListTile(
                   leading: const Icon(LucideIcons.key),

mobile/lib/shared/relay/media_upload.dart

@@ -270,7 +270,7 @@ class MediaUploadService {
 
   String _buildUploadAuthHeader(String sha256) {
     final authEvent = _buildUploadAuthEvent(sha256);
-    final authJson = jsonEncode(authEvent.toJson());
+    final authJson = authEvent.toJson();
     final encoded = base64Url.encode(utf8.encode(authJson)).replaceAll('=', '');
     return 'Nostr $encoded';
   }
@@ -281,7 +281,7 @@ class MediaUploadService {
       throw Exception('Cannot upload media: no signing key available');
     }
 
-    final privkeyHex = nostr.Nip19.decodePrivkey(nsec);
+    final privkeyHex = nostr.Nip19.decode(payload: nsec).data;
     if (privkeyHex.isEmpty) {
       throw Exception('Invalid nsec');
     }
@@ -300,7 +300,7 @@ class MediaUploadService {
       kind: _uploadAuthKind,
       content: 'Upload sprout-media',
       tags: tags,
-      privkey: privkeyHex,
+      secretKey: privkeyHex,
       verify: false,
     );
   }

mobile/lib/shared/relay/relay_provider.dart

@@ -66,9 +66,9 @@ final relayConfigProvider = NotifierProvider<RelayConfigNotifier, RelayConfig>(
 String? pubkeyFromNsec(String? nsec) {
   if (nsec == null || nsec.isEmpty) return null;
   try {
-    final privkeyHex = nostr.Nip19.decodePrivkey(nsec);
+    final privkeyHex = nostr.Nip19.decode(payload: nsec).data;
     if (privkeyHex.isEmpty) return null;
-    return nostr.Keychain(privkeyHex).public;
+    return nostr.Keys(privkeyHex).public;
   } catch (_) {
     return null;
   }

mobile/lib/shared/relay/relay_socket.dart

@@ -178,7 +178,7 @@ class RelaySocket {
 
     try {
       // Decode bech32 nsec to hex private key.
-      final privkeyHex = nostr.Nip19.decodePrivkey(_nsec);
+      final privkeyHex = nostr.Nip19.decode(payload: _nsec).data;
       if (privkeyHex.isEmpty) {
         _failAuth(Exception('Invalid nsec'));
         return;
@@ -195,11 +195,11 @@ class RelaySocket {
         kind: EventKind.auth,
         content: '',
         tags: tags,
-        privkey: privkeyHex,
+        secretKey: privkeyHex,
       );
 
       _pendingAuthEventId = event.id;
-      send(['AUTH', event.toJson()]);
+      send(['AUTH', event.toMap()]);
     } catch (e) {
       _failAuth(e);
     }