chore(lint): eliminate ESLint suppressions, adopt high-value rules, clear React Doctor findings

.github/workflows/ci.yml

@@ -43,7 +43,21 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.SOVRAN_CI_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           bun run deps:sovran-latest
-          bun install
+          # --ignore-scripts: the token is needed only to AUTH the
+          # @sovranbitcoin/* registry fetch, not to run lifecycle code, so no
+          # package install script executes while the secret is in scope
+          # (build-pipeline-secret-boundary).
+          bun install --ignore-scripts
+
+      # Run the deferred install scripts with NO secret in scope: trusted
+      # dependency scripts (e.g. @shopify/react-native-skia's install-skia) via
+      # `bun pm trust`, then the first-party postinstall (patch-package, bitchat
+      # patching, local-sibling linking). None of these need the registry token.
+      - name: Run install scripts (no secrets in scope)
+        working-directory: ${{ env.APP_DIR }}
+        run: |
+          bun pm trust --all
+          bun run postinstall
 
       - name: Lint
         working-directory: ${{ env.APP_DIR }}
@@ -61,6 +75,15 @@ jobs:
         working-directory: ${{ env.APP_DIR }}
         run: bun run knip
 
+      # Fails when any component bails out of the React Compiler. The compiler
+      # is the source of truth for memoization (ADR 0006); a bailout means a
+      # component renders unmemoized and a "redundant" manual memo we removed is
+      # now actually missing. The eslint-plugin-react-compiler rule that would
+      # catch this is dead under the repo's zod@4 override, so this is the gate.
+      - name: React Compiler coverage
+        working-directory: ${{ env.APP_DIR }}
+        run: bun run check:react-compiler
+
       - name: Test
         working-directory: ${{ env.APP_DIR }}
         run: bun run test
@@ -99,7 +122,21 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.SOVRAN_CI_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           bun run deps:sovran-latest
-          bun install
+          # --ignore-scripts: the token is needed only to AUTH the
+          # @sovranbitcoin/* registry fetch, not to run lifecycle code, so no
+          # package install script executes while the secret is in scope
+          # (build-pipeline-secret-boundary).
+          bun install --ignore-scripts
+
+      # Run the deferred install scripts with NO secret in scope: trusted
+      # dependency scripts (e.g. @shopify/react-native-skia's install-skia) via
+      # `bun pm trust`, then the first-party postinstall (patch-package, bitchat
+      # patching, local-sibling linking). None of these need the registry token.
+      - name: Run install scripts (no secrets in scope)
+        working-directory: ${{ env.APP_DIR }}
+        run: |
+          bun pm trust --all
+          bun run postinstall
 
       - name: Run analyze-structure
         working-directory: ${{ env.APP_DIR }}

__tests__/dmDecryptNip04.test.ts

@@ -5,7 +5,7 @@
  */
 import { finalizeEvent, generateSecretKey, getPublicKey, nip04 } from 'nostr-tools';
 import { decryptDmEnvelopes } from '@/features/payments/data/dmDecryptPipeline';
-import type { DmEnvelope } from '@/features/payments/data/dmEnvelopeClient';
+import type { DmEnvelope } from '@/features/payments/data/dmEnvelopeTypes';
 
 jest.mock('@react-native-async-storage/async-storage', () =>
   require('@react-native-async-storage/async-storage/jest/async-storage-mock')

__tests__/facadeFeedAdapter.test.ts

@@ -20,7 +20,12 @@ describe('resolvedFeedPageToParseResult', () => {
       tier: 'relay' as const,
       items: [
         { type: 'note' as const, event: event(NOTE, 200, [['q', QUOTED]]) },
-        { type: 'repost' as const, repostEvent: event(REPOST, 150), originalEvent: event(ORIG, 100), originalEventId: ORIG },
+        {
+          type: 'repost' as const,
+          repostEvent: event(REPOST, 150),
+          originalEvent: event(ORIG, 100),
+          originalEventId: ORIG,
+        },
       ],
       stats: { [NOTE]: { likes: 5, reposts: 2, replies: 1, zaps: 3, satsZapped: 2100 } },
       profiles: { [PUB]: { name: 'alice', picture: 'http://x/a.png' } },
@@ -40,7 +45,12 @@ describe('resolvedFeedPageToParseResult', () => {
     expect(repost.type === 'repost' && repost.originalEventId).toBe(ORIG);
     expect(repost.timestamp).toBe(150);
     // stats → NoteMetrics field rename
-    expect(result.metricsMap.get(NOTE)).toEqual({ likeCount: 5, repostCount: 2, replyCount: 1, satsZapped: 2100 });
+    expect(result.metricsMap.get(NOTE)).toEqual({
+      likeCount: 5,
+      repostCount: 2,
+      replyCount: 1,
+      satsZapped: 2100,
+    });
     // profiles + cursor
     expect(result.profilesMap.get(PUB)).toEqual({ name: 'alice', picture: 'http://x/a.png' });
     expect(result.paginationUntil).toBe(100);

__tests__/loggerChild.test.ts

@@ -315,7 +315,7 @@ describe('logger redaction safety (audit 56.json F-001 / F-008 / F-012)', () =>
       dedupWindowMs: 1000,
     });
     log.debug('evt');
-    const firstSnapshot = JSON.parse(JSON.stringify(log.getRecentLogs()));
+    const firstSnapshot = structuredClone(log.getRecentLogs());
     log.debug('evt');
     log.debug('evt');
     log.debug('evt');

__tests__/loggerValueCompact.test.ts

@@ -0,0 +1,78 @@
+import { compactValue, redactKnownSecretSubstrings } from '@/shared/lib/loggerValueCompact';
+
+const OPTS = { maxStringLength: 120, maxArrayItems: 5, maxDepth: 4, maxObjectKeys: 15 };
+
+describe('compactValue — structural compaction', () => {
+  it('passes primitives through untouched', () => {
+    expect(compactValue(42, OPTS)).toBe(42);
+    expect(compactValue(true, OPTS)).toBe(true);
+    expect(compactValue(null, OPTS)).toBe(null);
+    expect(compactValue(undefined, OPTS)).toBe(undefined);
+    expect(compactValue('short', OPTS)).toBe('short');
+  });
+
+  it('truncates long arrays and notes the remainder', () => {
+    const result = compactValue([1, 2, 3, 4, 5, 6, 7], OPTS) as unknown[];
+    expect(result.slice(0, 5)).toEqual([1, 2, 3, 4, 5]);
+    expect(result[5]).toBe('…2 more');
+  });
+
+  it('caps object keys at maxObjectKeys with a _more marker', () => {
+    const obj: Record<string, number> = {};
+    for (let i = 0; i < 20; i++) obj[`k${i}`] = i;
+    const result = compactValue(obj, { ...OPTS, maxObjectKeys: 3 }) as Record<string, unknown>;
+    expect(Object.keys(result)).toEqual(['k0', 'k1', 'k2', '…17_more']);
+  });
+
+  it('summarizes a Uint8Array as a buffer brand (never the bytes)', () => {
+    expect(compactValue(new Uint8Array([1, 2, 3, 4]), OPTS)).toEqual({ _kind: 'buffer', bytes: 4 });
+  });
+
+  it('summarizes Error / Date / Map / Set without leaking structure', () => {
+    expect(compactValue(new Date('2026-01-01T00:00:00.000Z'), OPTS)).toEqual({
+      _kind: 'date',
+      iso: '2026-01-01T00:00:00.000Z',
+    });
+    const err = compactValue(new Error('boom'), OPTS) as { _kind: string; message: string };
+    expect(err._kind).toBe('error');
+    expect(err.message).toBe('boom');
+    expect(compactValue(new Set([1, 2]), OPTS)).toMatchObject({ _kind: 'set', size: 2 });
+    expect(compactValue(new Map([['a', 1]]), OPTS)).toMatchObject({ _kind: 'map', size: 1 });
+  });
+
+  it('collapses objects past maxDepth instead of recursing forever', () => {
+    const deep = { a: { b: { c: { d: { e: 1 } } } } };
+    const result = compactValue(deep, { ...OPTS, maxDepth: 2 });
+    expect(JSON.stringify(result)).toContain('_kind');
+  });
+});
+
+describe('compactValue — field-name driven redaction', () => {
+  it('brands a value under a sensitive field name even when the value looks innocent', () => {
+    expect(compactValue('whatever', OPTS, 0, 'privateKey')).toEqual({
+      _kind: 'private_key',
+      len: 8,
+    });
+    expect(compactValue('seedphrase here', OPTS, 0, 'mnemonic')).toEqual({
+      _kind: 'secret',
+      len: 15,
+    });
+    expect(compactValue('Bearer abc', OPTS, 0, 'authorization')).toEqual({
+      _kind: 'secret',
+      len: 10,
+    });
+  });
+
+  it('prefers a specifically branded secret value over the field-derived kind', () => {
+    const nsec = 'nsec1' + 'q'.repeat(58);
+    expect(compactValue(nsec, OPTS, 0, 'someKey')).toMatchObject({ _kind: 'nsec' });
+  });
+});
+
+describe('redactKnownSecretSubstrings', () => {
+  it('replaces embedded secrets but leaves plain text intact', () => {
+    expect(redactKnownSecretSubstrings('all good here')).toBe('all good here');
+    const out = redactKnownSecretSubstrings(`token=${'eyJabc.eyJdef.sig'}`);
+    expect(out).toContain('<REDACTED:jwt>');
+  });
+});

__tests__/mintInfoScreenSource.test.ts

@@ -23,9 +23,7 @@ describe('mint info screen source', () => {
   });
 
   it('uses Nostr profile data to pretty-display the first Nostr contact', () => {
-    expect(source).toContain(
-      'const contactRows = useMemo(() => getSortedMintInfoContacts(contact), [contact]);'
-    );
+    expect(source).toContain('const contactRows = getSortedMintInfoContacts(contact);');
     expect(source).toContain('useNostrProfile(');
     expect(source).toContain('getMintInfoNostrDisplayName(rowProfile, fallbackNpub ?? c.info)');
     expect(source).toContain('picture={rowPicture}');

__tests__/naggFeedClient.test.ts

@@ -170,7 +170,13 @@ describe('createNaggFeedClient (app-view REST)', () => {
     mockFetch.mockResolvedValueOnce(
       restResponse({
         notifications: {
-          nodes: [{ event: note({ id: 'n1', pubkey: 'carol' }), reason: 'mention', actorVertexScore: 0.5 }],
+          nodes: [
+            {
+              event: note({ id: 'n1', pubkey: 'carol' }),
+              reason: 'mention',
+              actorVertexScore: 0.5,
+            },
+          ],
           pageInfo: { hasNextPage: false, endCursor: null },
         },
         metrics: { n1: emptyStats },
@@ -253,7 +259,11 @@ describe('createNaggFeedClient (app-view REST)', () => {
       })
     );
 
-    await loadClient().getFeed({ spec: JSON.stringify({ id: 'feed' }), userPubkey: 'viewer', limit: 5 });
+    await loadClient().getFeed({
+      spec: JSON.stringify({ id: 'feed' }),
+      userPubkey: 'viewer',
+      limit: 5,
+    });
 
     for (const call of mockFetch.mock.calls) {
       expect(String(call[0])).not.toContain('/graphql');

__tests__/rebalanceRouting.test.ts

@@ -0,0 +1,115 @@
+/**
+ * @jest-environment node
+ */
+import type { GetInfoResponse } from '@cashu/cashu-ts';
+
+import { computeRouteSuggestion } from '@/features/mint/lib/rebalanceRouting';
+import type { AuditMintResponse } from '@/shared/lib/apiClient';
+import type { MiddlemanRoutingSettings } from '@/shared/stores/global/settingsStore';
+
+const mockBuildSwapGraph = jest.fn();
+const mockAddLocalHistoryEdges = jest.fn();
+const mockGetLocalCandidates = jest.fn((..._args: unknown[]) => [] as string[]);
+const mockPickIntermediaryPath = jest.fn();
+
+jest.mock('@/features/mint/components/rebalance', () => ({
+  buildSwapGraph: (...args: unknown[]) => mockBuildSwapGraph(...args),
+  addLocalHistoryEdges: (...args: unknown[]) => mockAddLocalHistoryEdges(...args),
+  getLocalCandidatesForDestination: (...args: unknown[]) => mockGetLocalCandidates(...args),
+  pickIntermediaryPath: (...args: unknown[]) => mockPickIntermediaryPath(...args),
+}));
+
+// Variable-based casts (the repo bans object-literal type assertions).
+function fakeAudit(url: string): AuditMintResponse {
+  const audit = { mintUrl: url };
+  return audit as unknown as AuditMintResponse;
+}
+function mintInfo(name: string): GetInfoResponse {
+  const info = { name };
+  return info as unknown as GetInfoResponse;
+}
+const emptyRouting = (() => {
+  const r = {};
+  return r as unknown as MiddlemanRoutingSettings;
+})();
+const emptyMintInfo: Record<string, GetInfoResponse | null> = {};
+
+const baseInput = () => ({
+  fromMintUrl: 'https://a.mint',
+  toMintUrl: 'https://b.mint',
+  planMintUrls: ['https://a.mint', 'https://b.mint'],
+  trustedMintUrls: ['https://t.mint'],
+  mintInfoMap: emptyMintInfo,
+  middlemanRouting: emptyRouting,
+  groups: [],
+  fetchAudit: jest.fn(async (url: string) => fakeAudit(url)),
+});
+
+describe('computeRouteSuggestion', () => {
+  beforeEach(() => {
+    mockBuildSwapGraph.mockReset().mockReturnValue({});
+    mockAddLocalHistoryEdges.mockReset();
+    mockGetLocalCandidates.mockReset().mockReturnValue([]);
+    mockPickIntermediaryPath.mockReset();
+  });
+
+  it('returns null when no intermediary path is found', async () => {
+    mockPickIntermediaryPath.mockReturnValue({ path: null });
+    const result = await computeRouteSuggestion(baseInput());
+    expect(result).toBeNull();
+  });
+
+  it('maps a found path to display names, falling back to the url', async () => {
+    mockPickIntermediaryPath.mockReturnValue({ path: ['https://a.mint', 'https://x.mint'] });
+    const result = await computeRouteSuggestion({
+      ...baseInput(),
+      mintInfoMap: { 'https://a.mint': mintInfo('Alpha') },
+    });
+    expect(result).toEqual({
+      path: ['https://a.mint', 'https://x.mint'],
+      pathNames: ['Alpha', 'https://x.mint'],
+    });
+  });
+
+  it('dedupes candidates and audits each via the injected port', async () => {
+    mockGetLocalCandidates.mockReturnValue(['https://local.mint', 'https://a.mint']);
+    mockPickIntermediaryPath.mockReturnValue({ path: null });
+    const input = baseInput();
+    await computeRouteSuggestion(input);
+    const auditedUrls = input.fetchAudit.mock.calls.map((c) => c[0]);
+    // 'a' appears in both plan and local candidates — must be audited once.
+    expect(new Set(auditedUrls).size).toBe(auditedUrls.length);
+    expect(auditedUrls).toEqual(
+      expect.arrayContaining([
+        'https://a.mint',
+        'https://b.mint',
+        'https://t.mint',
+        'https://local.mint',
+      ])
+    );
+  });
+
+  it('passes only successful audits to the graph builder', async () => {
+    mockPickIntermediaryPath.mockReturnValue({ path: null });
+    const input = {
+      ...baseInput(),
+      fetchAudit: jest.fn(async (url: string) =>
+        url === 'https://b.mint' ? null : fakeAudit(url)
+      ),
+    };
+    await computeRouteSuggestion(input);
+    const audits = mockBuildSwapGraph.mock.calls[0][0] as { mintUrl: string }[];
+    expect(audits.some((a) => a.mintUrl === 'https://b.mint')).toBe(false);
+    expect(audits.length).toBeGreaterThan(0);
+  });
+
+  it('caps the candidate set at 12 audits', async () => {
+    mockGetLocalCandidates.mockReturnValue(
+      Array.from({ length: 30 }, (_, i) => `https://m${i}.mint`)
+    );
+    mockPickIntermediaryPath.mockReturnValue({ path: null });
+    const input = baseInput();
+    await computeRouteSuggestion(input);
+    expect(input.fetchAudit.mock.calls.length).toBeLessThanOrEqual(12);
+  });
+});

__tests__/sovranPaymentConfig.profile.test.ts

@@ -4,10 +4,8 @@
 
 import type { PaymentMachine } from '@sovranbitcoin/colada';
 import type { Manager } from '@cashu/coco-core';
-import {
-  createSovranHandlers,
-  createSovranNotifications,
-} from '@/features/send/lib/sovranPaymentConfig';
+import { createSovranHandlers } from '@/features/send/lib/sovranHandlers';
+import { createSovranNotifications } from '@/features/send/lib/sovranNotifications';
 import { sendMemoPopup } from '@/shared/lib/popup';
 import { getEncodedToken } from '@cashu/cashu-ts';
 import { sendBLEPrivateMessageWhole } from '@/features/bitchat/lib/blePrivateDelivery';

__tests__/threadItems.test.ts

@@ -177,10 +177,16 @@ describe('thread item builders', () => {
   it('initial fetch keeps the seeded reply order as a stable prefix (no reshuffle)', () => {
     const root = note({ id: 'root', content: 'root', tags: [], createdAt: 100 });
     const seededReply = note({
-      id: 'seeded-reply', content: 'seeded', tags: [['e', 'root', '', 'reply']], createdAt: 101,
+      id: 'seeded-reply',
+      content: 'seeded',
+      tags: [['e', 'root', '', 'reply']],
+      createdAt: 101,
     });
     const rankedFirst = note({
-      id: 'ranked-first', content: 'ranked higher by the server', tags: [['e', 'root', '', 'reply']], createdAt: 102,
+      id: 'ranked-first',
+      content: 'ranked higher by the server',
+      tags: [['e', 'root', '', 'reply']],
+      createdAt: 102,
     });
     const result: ThreadResult = {
       allEvents: mapEvents([root, seededReply, rankedFirst]),