Add NIP-04 support for drop-in NIP-07 parity

signEvent() already handles any event kind and NIP-44 was already
implemented, but window.nostr.nip04 (and the equivalent element-scoped
nip04Encrypt/nip04Decrypt) didn't exist anywhere -- every real NIP-07
extension exposes it, and sites with legacy DM code paths still expect
it. A site whose own code called window.nostr.nip04.encrypt(...) while
BitLogin was the active signer got a bare "Cannot read properties of
undefined" instead of a working call.

- packages/core/src/crypto/nip04.ts: AES-256-CBC + secp256k1 ECDH
  shared secret (raw X coordinate, no HKDF -- this is legacy NIP-04,
  not NIP-44), "<ciphertext>?iv=<iv>" payload shape, cross-checked
  against the NIP-04 spec's algorithm description
- NostrSigner.nip04Encrypt/nip04Decrypt, mirroring the existing
  nip44Encrypt/nip44Decrypt methods
- crypto worker: new nip04Encrypt/nip04Decrypt actions and protocol
  payload types
- <bitlogin-auth>.nip04Encrypt/nip04Decrypt (element-scoped, like the
  existing nip44 methods) and window.nostr.nip04.encrypt/decrypt

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01DY9UMTuF43Ekc2U4E1eDwX

packages/widget/src/worker/cryptoWorker.ts

@@ -34,6 +34,8 @@ import type {
   SignEventPayload,
   Nip44EncryptPayload,
   Nip44DecryptPayload,
+  Nip04EncryptPayload,
+  Nip04DecryptPayload,
   PreviewImportKeyPayload
 } from "./protocol.js";
 
@@ -259,6 +261,18 @@ async function handle(action: string, payload: unknown): Promise<unknown> {
       return { plaintext: signer.nip44Decrypt(p.peerPublicKey, p.payload) };
     }
 
+    case "nip04Encrypt": {
+      const { signer } = requireUnlocked();
+      const p = payload as Nip04EncryptPayload;
+      return { ciphertext: signer.nip04Encrypt(p.peerPublicKey, p.plaintext) };
+    }
+
+    case "nip04Decrypt": {
+      const { signer } = requireUnlocked();
+      const p = payload as Nip04DecryptPayload;
+      return { plaintext: signer.nip04Decrypt(p.peerPublicKey, p.payload) };
+    }
+
     case "exportIdentity": {
       const { everydayPrivateKey, signer } = requireUnlocked();
       return { nsec: encodeNsec(everydayPrivateKey), npub: encodeNpub(signer.getPublicKey()) };

packages/widget/src/worker/protocol.ts

@@ -132,6 +132,15 @@ export interface Nip44DecryptPayload {
   payload: string;
 }
 
+export interface Nip04EncryptPayload {
+  peerPublicKey: string;
+  plaintext: string;
+}
+export interface Nip04DecryptPayload {
+  peerPublicKey: string;
+  payload: string;
+}
+
 export interface ExportIdentityResult {
   nsec: string;
   npub: string;
@@ -161,6 +170,8 @@ export type WorkerActionMap = {
   signEvent: [SignEventPayload, NostrEvent];
   nip44Encrypt: [Nip44EncryptPayload, { ciphertext: string }];
   nip44Decrypt: [Nip44DecryptPayload, { plaintext: string }];
+  nip04Encrypt: [Nip04EncryptPayload, { ciphertext: string }];
+  nip04Decrypt: [Nip04DecryptPayload, { plaintext: string }];
   exportIdentity: [Record<string, never>, ExportIdentityResult];
   buildRecoveryExport: [Record<string, never>, unknown];
   repairReplicas: [Record<string, never>, RepairReplicasResult];

packages/widget/src/worker/workerClient.ts

@@ -14,7 +14,9 @@ import type {
   PublishProfilePayload,
   SignEventPayload,
   Nip44EncryptPayload,
-  Nip44DecryptPayload
+  Nip44DecryptPayload,
+  Nip04EncryptPayload,
+  Nip04DecryptPayload
 } from "./protocol.js";
 
 export class WorkerClient {
@@ -92,6 +94,12 @@ export class WorkerClient {
   nip44Decrypt(payload: Nip44DecryptPayload) {
     return this.call("nip44Decrypt", payload);
   }
+  nip04Encrypt(payload: Nip04EncryptPayload) {
+    return this.call("nip04Encrypt", payload);
+  }
+  nip04Decrypt(payload: Nip04DecryptPayload) {
+    return this.call("nip04Decrypt", payload);
+  }
   exportIdentity() {
     return this.call("exportIdentity", {});
   }