Description

Relates to issue: ZEUS-0000

Supersedes #4605. Dependabot's bump of @nostr-dev-kit/ndk to 3.0.3 cannot merge on its own: NDK 3 changes two defaults that between them break Cashu mint discovery entirely. This PR carries the same bump plus the two-line behavioral opt-outs needed to keep the old behavior, with before/after measurements on device.

Full analysis is in #4605 (comment). Summary:

1. NDKPool.connect() never resolves without a timeout argument. 3.x races "every relay reported CONNECTED" against a timeout promise that is new Promise(() => {}) when no timeout is passed:

const timeoutPromise = typeof timeoutMs === "number"
    ? new Promise((resolve) => setTimeout(resolve, timeoutMs))
    : new Promise(() => {});          // never resolves
await Promise.race([allConnectedPromise, timeoutPromise]);

2.13.0-rc2 instead awaited the per-relay connect promises, each of which resolves as soon as the socket is created. DEFAULT_NOSTR_RELAYS is never fully connected in practice (only 4 to 5 of 8 reach CONNECTED, wss://nostr.land sits in AUTH_REQUIRED, wss://nostr.wine and wss://relay.8333.space are usually down), so await this.ndk.connect() never returns. Discover Mints and the trusted-mints list spin forever with no error, because the 10s safety timeout in subscribeAndCollectEvents is never even reached.

2. The outbox model flipped from opt-in to on by default. 2.13 had if (opts.enableOutboxModel); 3.0.3 has if (!(opts.enableOutboxModel === false)). Mint discovery from follows subscribes with the followed author set (613 pubkeys for the ZEUS npub), and outbox tracking resolves each author's relay list and reconnects the subscription as those lists arrive. Measured effect: the relay pool grew from 8 to 43 relays and the JS thread was starved badly enough that a setTimeout(resolve, 10000) fired after 94 seconds. Even with fix 1 alone, trusted mints took ~122s instead of ~10s.

Both opt-outs are scoped to the three new NDK(...) sites in stores/CashuStore.ts, which are the only NDK usage in the app.

Measurements

Same device, same checkout, live relays, calling the real store methods:

Top recommended mints come back identical and in the same order before and after (mint.cashu.chat(7), mint.minibits.cash/Bitcoin(5), mint.coinos.io(3) for Discover Mints).

Note that CI is blind to all of this: tsc passes against 3.0.3, and stores/CashuStore.test.ts does jest.mock('@nostr-dev-kit/ndk', () => ({})).

This pull request is categorized as a:

• New feature
• Bug fix
• Code refactor
• Configuration change
• Locales update
• Quality assurance
• Other

Checklist

• I’ve run yarn run tsc and made sure my code compiles correctly
• I’ve run yarn run lint and made sure my code didn’t contain any problematic patterns
• I’ve run yarn run prettier and made sure my code is formatted correctly
• I’ve run yarn run test and made sure all of the tests pass

Testing

If you modified or added a utility file, did you add new unit tests?

• No, I’m a fool
• Yes
• N/A

No utility file was modified. stores/CashuStore.test.ts mocks NDK out entirely, so a unit test cannot cover this; verification was done against live relays on device, as tabulated above.

I have tested this PR on the following platforms (please specify OS version and phone model/VM):

• Android
• iOS (iPhone 17 Pro simulator, iOS 26.5)

Android run still owed.

I have tested this PR with the following types of nodes (please specify node version and API version where appropriate):

On-device

• LDK Node
• Embedded LND

Remote

• LND (REST)
• LND (Lightning Node Connect)
• Core Lightning (CLNRest)
• Nostr Wallet Connect
• LndHub

The affected code path is Cashu mint discovery over nostr relays, which does not talk to the Lightning backend, so no backend-specific behavior is exercised here.

Locales

• I’ve added new locale text that requires translations
• I’m aware that new translations should be made on the ZEUS Transfix page and not directly to this repo

Third Party Dependencies and Packages

• Contributors will need to run yarn after this PR is merged in
• 3rd party dependencies have been modified:
  • verify that package.json and yarn.lock have been properly updated
  • verify that dependencies are installed for both iOS and Android platforms

yarn.lock also picks up shiki and sandpack, which NDK 3 declares as runtime dependencies (a docs-tooling leak upstream). Its dist never imports them, so this is node_modules bloat only and they stay out of the bundle; confirmed by bundling for iOS.

Other:

• Changes were made that require an update to the README
• Changes were made that require an update to onboarding