chore: lint test/, accept string algorithms in subtle types, unblock CI

.github/workflows/e2e-android-test.yml

@@ -80,7 +80,7 @@ jobs:
           sudo apt-get install -y libssl-dev pkg-config
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Install Dependencies
         run: bun install
@@ -164,7 +164,7 @@ jobs:
 
     steps:
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Enable KVM
         run: |
@@ -230,7 +230,7 @@ jobs:
           mkdir -p $HOME/.maestro/tests/
 
       - name: Setup Android SDK
-        uses: android-actions/setup-android@v3
+        uses: android-actions/setup-android@v4
 
       - name: Restore node_modules cache
         uses: actions/cache/restore@v5

.github/workflows/validate-js.yml

@@ -38,7 +38,8 @@ env:
   # https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'
 
-# Minimum scopes — reviewdog posts tsc errors as review comments on PRs.
+# Minimum scopes — reviewdog posts tsc errors as review comments on PRs and as
+# check annotations on main, where github-pr-review has no PR to report against.
 permissions:
   contents: read
   checks: write
@@ -63,7 +64,7 @@ jobs:
       - name: Run TypeScript # Reviewdog tsc errorformat: %f:%l:%c - error TS%n: %m
         run: |
           set -o pipefail
-          bun tsc 2>&1 | sed 's/^[^ ]* typescript: //' | reviewdog -name="tsc" -efm="%f(%l,%c): error TS%n: %m" -reporter="github-pr-review" -filter-mode="nofilter" -fail-on-error -tee
+          bun tsc 2>&1 | sed 's/^[^ ]* typescript: //' | reviewdog -name="tsc" -efm="%f(%l,%c): error TS%n: %m" -reporter="${{ github.event_name == 'pull_request' && 'github-pr-review' || 'github-check' }}" -filter-mode="nofilter" -fail-on-error -tee
         env:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -92,11 +93,12 @@ jobs:
       #
       # `bun audit` resolves peers from the registry regardless of what is installed, so
       # neither `--omit=peer` nor `[install] peer = false` keeps react-native's own tree
-      # out of the graph — only `--ignore` does. These two are metro (react-native's
+      # out of the graph — only `--ignore` does. These are metro (react-native's
       # bundler, dev-time only) reached via the react-native peer of
       # react-native-quick-base64; they are not in a consumer's runtime bundle. Ignores
       # are per-advisory, so anything new still fails this job. Drop them once
-      # react-native ships a metro with image-size >= 2.0.3.
+      # react-native ships a metro with image-size >= 2.0.3 and a patched braces
+      # (GHSA-vfj7-8cjw-p6xm, via micromatch; no fixed release yet).
       - name: Audit runtime dependencies
         run: |
           mkdir -p /tmp/rnqc-runtime-audit
@@ -106,7 +108,8 @@ jobs:
           bun install --no-summary
           bun audit --audit-level=high \
             --ignore=GHSA-w3rx-r6r6-pgpr \
-            --ignore=GHSA-5p2g-fcmc-qvqq
+            --ignore=GHSA-5p2g-fcmc-qvqq \
+            --ignore=GHSA-vfj7-8cjw-p6xm
 
   lint_js:
     name: JS Lint (eslint, prettier)

packages/react-native-quick-crypto/eslint.config.mjs

@@ -66,11 +66,11 @@ export default [
   // Ignore patterns
   {
     ignores: [
-      '.prettierrc.js', 
-      '*.config.*js', 
-      '*.plugin.js', 
+      '.prettierrc.js',
+      '*.config.*js',
+      '*.plugin.js',
       '**/lib/**',
       '**/build/**',
-      '**/test/**'],
+    ],
   },
 ];

packages/react-native-quick-crypto/src/subtle.ts

@@ -3541,7 +3541,7 @@ export class Subtle {
   }
 
   async decrypt(
-    algorithm: EncryptDecryptParams,
+    algorithm: EncryptDecryptParams | AnyAlgorithm,
     key: CryptoKey,
     data: BufferLike,
   ): Promise<ArrayBuffer> {
@@ -3577,7 +3577,7 @@ export class Subtle {
   }
 
   async deriveBits(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     baseKey: CryptoKey,
     length: number | null = null,
   ): Promise<ArrayBuffer> {
@@ -3633,9 +3633,9 @@ export class Subtle {
   }
 
   async deriveKey(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     baseKey: CryptoKey,
-    derivedKeyAlgorithm: SubtleAlgorithm,
+    derivedKeyAlgorithm: SubtleAlgorithm | AnyAlgorithm,
     extractable: boolean,
     keyUsages: KeyUsage[],
   ): Promise<CryptoKey> {
@@ -3723,7 +3723,7 @@ export class Subtle {
   }
 
   async encrypt(
-    algorithm: EncryptDecryptParams,
+    algorithm: EncryptDecryptParams | AnyAlgorithm,
     key: CryptoKey,
     data: BufferLike,
   ): Promise<ArrayBuffer> {
@@ -3800,7 +3800,7 @@ export class Subtle {
     format: ImportFormat,
     key: CryptoKey,
     wrappingKey: CryptoKey,
-    wrapAlgorithm: EncryptDecryptParams,
+    wrapAlgorithm: EncryptDecryptParams | AnyAlgorithm,
   ): Promise<ArrayBuffer> {
     requireArgs(arguments.length, 4, 'wrapKey');
     // Mirrors Node webcrypto.js:923-927: prefer the 'wrapKey' op (only
@@ -3868,7 +3868,7 @@ export class Subtle {
     format: ImportFormat,
     wrappedKey: BufferLike,
     unwrappingKey: CryptoKey,
-    unwrapAlgorithm: EncryptDecryptParams,
+    unwrapAlgorithm: EncryptDecryptParams | AnyAlgorithm,
     unwrappedKeyAlgorithm: SubtleAlgorithm | AnyAlgorithm,
     extractable: boolean,
     keyUsages: KeyUsage[],
@@ -3941,7 +3941,7 @@ export class Subtle {
   }
 
   async generateKey(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     extractable: boolean,
     keyUsages: KeyUsage[],
   ): Promise<CryptoKey | CryptoKeyPair> {
@@ -4289,7 +4289,7 @@ export class Subtle {
   }
 
   async sign(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
     data: BufferLike,
   ): Promise<ArrayBuffer> {
@@ -4302,7 +4302,7 @@ export class Subtle {
   }
 
   async verify(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
     signature: BufferLike,
     data: BufferLike,
@@ -4317,7 +4317,7 @@ export class Subtle {
   }
 
   private _encapsulateCore(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
   ): EncapsulateResult {
     const normalizedAlgorithm = normalizeAlgorithm(
@@ -4346,7 +4346,7 @@ export class Subtle {
   }
 
   private _decapsulateCore(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
     ciphertext: BufferLike,
   ): ArrayBuffer {
@@ -4376,7 +4376,7 @@ export class Subtle {
   }
 
   async encapsulateBits(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
   ): Promise<EncapsulateResult> {
     requireArgs(arguments.length, 2, 'encapsulateBits');
@@ -4391,7 +4391,7 @@ export class Subtle {
   }
 
   async encapsulateKey(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
     sharedKeyAlgorithm: SubtleAlgorithm | AnyAlgorithm,
     extractable: boolean,
@@ -4420,7 +4420,7 @@ export class Subtle {
   }
 
   async decapsulateBits(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
     ciphertext: BufferLike,
   ): Promise<ArrayBuffer> {
@@ -4436,7 +4436,7 @@ export class Subtle {
   }
 
   async decapsulateKey(
-    algorithm: SubtleAlgorithm,
+    algorithm: SubtleAlgorithm | AnyAlgorithm,
     key: CryptoKey,
     ciphertext: BufferLike,
     sharedKeyAlgorithm: SubtleAlgorithm | AnyAlgorithm,

packages/react-native-quick-crypto/test/jestMock.test.ts

@@ -1,6 +1,6 @@
 // `virtual` because the package can't resolve its own name inside this repo;
 // apps use the same call without it.
-jest.mock('react-native-quick-crypto', () => require('../jest'), {
+jest.mock('react-native-quick-crypto', () => jest.requireActual('../jest'), {
   virtual: true,
 });
 

packages/react-native-quick-crypto/test/tsconfig.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "composite": false,
+    "rootDir": "..",
+    "noEmit": true,
+    "types": ["jest", "node"]
+  },
+  "include": ["."]
+}