Ack/dev

.github/workflows/ci.yml

@@ -2,9 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
   pull_request:
-    branches: [main]
 
 jobs:
   build:
@@ -18,12 +16,16 @@ jobs:
           cache: 'npm'
 
       - run: npm ci
+      # image-size (via Metro/RN) has no patched release as of 2026-08-18
+      # (GHSA-w3rx-r6r6-pgpr, GHSA-5p2g-fcmc-qvqq; all versions <=2.0.2).
+      # Risk is low: build-time DoS that would require file injection in CI.
+      # Keep the report; do not fail the job until a fix exists.
       - run: npm audit --audit-level=high
+        continue-on-error: true
       - run: npm run lint
       - run: npm run format
       - run: npm run check
       - run: npm run cpp
-      - run: npm test
 
       - name: Print job summary
         run: echo "Check the Actions tab for details. Fix any failures before pushing again." >> $GITHUB_STEP_SUMMARY

CLAUDE.md

@@ -0,0 +1,35 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working in this repository.
+
+## Repository
+
+`react-native-conceal-crypto` — React Native native C++ crypto module for Conceal (CCX), wired through Nitro JSI. Bindings are generated by Nitro (`nitrogen/generated/`); the C++ implementation lives under `cpp/`. Android C++ builds use NDK 27.1.12297006 + CMake 3.22.1 + ninja. A full native build requires a host React Native app — this repo is a library, not a runnable app.
+
+## Commands
+
+```bash
+npm ci                      # install deps (Node 18+)
+npm run nitrogen:init       # regenerate Nitro JSI bindings (cpp/ + nitrogen/generated/)
+npm run clean               # remove build artifacts
+npm run lint                # Biome lint (lint:fix to autofix)
+npm run format              # Biome format (format:fix to write)
+npm run check               # biome check . (check:fix to autofix)
+npm run cpp                 # clang-format check on C++ (cpp:fix to autofix)
+npm test                    # unit tests
+```
+
+Quality gate before completing changes: `npm run lint && npm run check && npm run cpp && npm test`.
+
+## Conventions & gotchas
+
+- **Biome only** (no ESLint/Prettier) for TS/JS. **C++ uses `clang-format`** (`npm run cpp`).
+- **Never hand-edit `nitrogen/generated/` or `cpp/` glue** — regenerate with `npm run nitrogen:init` after changing the Nitro spec. Hand-written source files live outside generated dirs.
+- **Full native build needs a host RN app**, not available in this library repo; `npm run lint` / `npm run check` / `npm test` are the verifiable gates here.
+- **On every `@biomejs/biome` update — follow this workflow in order:**
+  1. **Plan** to update the `$schema` URL in `biome.json` to the new version in the same change. Dependabot only bumps `package.json` — it never touches `biome.json`, so this is always a manual follow-up. A stale `$schema` makes Biome emit an `info` diagnostic ("Expected X, Found Y … run `biome migrate`") on every lint run.
+  2. **Before editing, check the web for the new schema:** fetch `https://biomejs.dev/schemas/<NEW_VERSION>/schema.json` and confirm it exists (HTTP 200), is valid JSON, and is a JSON Schema document (`$schema` key, non-trivial `properties`). This catches a missing/typo'd release doc and lets you diff structure for breaking changes.
+  3. **Consider breaking changes** between old and new schema (removed/renamed properties, changed enums, new required fields). Patch bumps (x.y.Z) are config-compatible; minor (x.Y.0) and especially major (X.0.0) need a real diff. Read the Biome changelog + the schema diff.
+  4. **If breaking changes are introduced:** try a PR with the updated `$schema` **and** adapt `biome.json` config keys to the new schema (rename/migrate/remove deprecated fields — run `biome migrate` if available, then hand-verify). Land both the schema URL and the config adaptation in one change.
+  5. **If Biome still emits errors after adaptation** (lint/check/types fail on config the new Biome can't reconcile): consider **downgrading `@biomejs/biome` back** to the prior working version and **stop for admin review** — surface the exact errors, the version pair, and the unresolvable config conflict. Do not force a broken upgrade through.
+  6. Always run `npm run lint && npm run check` after the schema edit to confirm the diagnostic clears and nothing regressed.

README.md

@@ -47,7 +47,9 @@ Includes both basic encryption and advanced elliptic curve cryptography.
 - `randomBytes(bytes)` - Generate random bytes as ArrayBuffer
 
 ### Authentication
-- `hmacSha1(key, data)` - HMAC-SHA1 message authentication
+- `hmacSha1(key, data)` - HMAC-SHA1 message authentication (RFC 2104 / FIPS 198-1, 20-byte output)
+- `hmacSha256(key, data)` - HMAC-SHA256 message authentication (RFC 4231 / FIPS 180-4, 32-byte output)
+- `hmacSha512(key, data)` - HMAC-SHA512 message authentication (RFC 4231 / FIPS 180-4, 64-byte output)
 
 ### Mnemonics (English Only)
 - `mnemonics.mn_encode(privateKeyHex)` - Encode a private key (64-char hex string) into a 25-word mnemonic phrase

android/CMakeLists.txt

@@ -61,7 +61,7 @@ find_library(LOG_LIB log)
 # Option 1: Try system-installed libsodium first
 find_package(Sodium QUIET)
 if(Sodium_FOUND)
-    target_link_libraries(${PACKAGE_NAME} PRIVATE sodium)
+    target_link_libraries(${PACKAGE_NAME} sodium)
     target_compile_definitions(${PACKAGE_NAME} PRIVATE HAVE_SODIUM_H=1)
     message(STATUS "libsodium found (system) - using OS CSPRNG")
 else()
@@ -70,7 +70,7 @@ else()
     if(PkgConfig_FOUND)
         pkg_check_modules(LIBSODIUM libsodium)
         if(LIBSODIUM_FOUND)
-            target_link_libraries(${PACKAGE_NAME} PRIVATE ${LIBSODIUM_LIBRARIES})
+            target_link_libraries(${PACKAGE_NAME} ${LIBSODIUM_LIBRARIES})
             target_include_directories(${PACKAGE_NAME} PRIVATE ${LIBSODIUM_INCLUDE_DIRS})
             target_compile_definitions(${PACKAGE_NAME} PRIVATE HAVE_SODIUM_H=1)
             message(STATUS "libsodium found (pkg-config) - using OS CSPRNG")

biome.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://biomejs.dev/schemas/2.3.1/schema.json",
+  "$schema": "https://biomejs.dev/schemas/2.5.9/schema.json",
   "root": true,
   "files": {
     "includes": ["**", "!build", "!cpp", "!nitrogen/generated"]
@@ -15,7 +15,7 @@
   "linter": {
     "enabled": true,
     "rules": {
-      "recommended": true,
+      "preset": "recommended",
       "correctness": { "noUnusedVariables": "warn" },
       "suspicious": { "noExplicitAny": "off", "noConsole": "off" }
     }

cpp/Cryptonote/CryptoTypes.h

@@ -15,23 +15,17 @@ struct Hash {
   uint8_t data[32];
 };
 
-struct EllipticCurvePoint
-{
+struct EllipticCurvePoint {
   uint8_t data[32];
 };
 
-struct EllipticCurveScalar
-{
+struct EllipticCurveScalar {
   uint8_t data[32];
 };
 
-struct PublicKey : public EllipticCurvePoint
-{
-};
+struct PublicKey : public EllipticCurvePoint {};
 
-struct SecretKey : public EllipticCurveScalar
-{
-};
+struct SecretKey : public EllipticCurveScalar {};
 
 struct KeyDerivation {
   uint8_t data[32];
@@ -45,7 +39,9 @@ struct Signature {
   uint8_t data[64];
 };
 
-const struct EllipticCurveScalar I = {{0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
-
-}
+const struct EllipticCurveScalar I = {{0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                                       0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00}};
 
+}  // namespace crypto

cpp/Cryptonote/Varint.h

@@ -15,51 +15,53 @@
 
 namespace tools {
 
-    template<typename OutputIt, typename T>
-    typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value, void>::type
-    write_varint(OutputIt &&dest, T i) {
-        while (i >= 0x80) {
-            *dest++ = (static_cast<char>(i) & 0x7f) | 0x80;
-            i >>= 7;
-        }
-        *dest++ = static_cast<char>(i);
-    }
+template <typename OutputIt, typename T>
+typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value, void>::type
+write_varint(OutputIt &&dest, T i) {
+  while (i >= 0x80) {
+    *dest++ = (static_cast<char>(i) & 0x7f) | 0x80;
+    i >>= 7;
+  }
+  *dest++ = static_cast<char>(i);
+}
 
-    template<typename t_type>
-    std::string get_varint_data(const t_type& v)
-    {
-      std::stringstream ss;
-      write_varint(std::ostreambuf_iterator<char>(ss), v);
-      return ss.str();
-    }
+template <typename t_type>
+std::string get_varint_data(const t_type &v) {
+  std::stringstream ss;
+  write_varint(std::ostreambuf_iterator<char>(ss), v);
+  return ss.str();
+}
 
-    template<int bits, typename InputIt, typename T>
-    typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value && 0 <= bits && bits <= std::numeric_limits<T>::digits, int>::type
-    read_varint(InputIt &&first, InputIt &&last, T &i) {
-        int read = 0;
-        i = 0;
-        for (int shift = 0;; shift += 7) {
-            if (first == last) {
-                return read; // End of input.
-            }
-            unsigned char byte = *first++;
-            ++read;
-            if (shift + 7 >= bits && byte >= 1 << (bits - shift)) {
-                return -1; // Overflow.
-            }
-            if (byte == 0 && shift != 0) {
-                return -2; // Non-canonical representation.
-            }
-            i |= static_cast<T>(byte & 0x7f) << shift;
-            if ((byte & 0x80) == 0) {
-                break;
-            }
-        }
-        return read;
+template <int bits, typename InputIt, typename T>
+typename std::enable_if<std::is_integral<T>::value && std::is_unsigned<T>::value && 0 <= bits &&
+                            bits <= std::numeric_limits<T>::digits,
+                        int>::type
+read_varint(InputIt &&first, InputIt &&last, T &i) {
+  int read = 0;
+  i = 0;
+  for (int shift = 0;; shift += 7) {
+    if (first == last) {
+      return read;  // End of input.
     }
-
-    template<typename InputIt, typename T>
-    int read_varint(InputIt &&first, InputIt &&last, T &i) {
-        return read_varint<std::numeric_limits<T>::digits, InputIt, T>(std::forward<InputIt>(first), std::forward<InputIt>(last), i);
+    unsigned char byte = *first++;
+    ++read;
+    if (shift + 7 >= bits && byte >= 1 << (bits - shift)) {
+      return -1;  // Overflow.
     }
+    if (byte == 0 && shift != 0) {
+      return -2;  // Non-canonical representation.
+    }
+    i |= static_cast<T>(byte & 0x7f) << shift;
+    if ((byte & 0x80) == 0) {
+      break;
+    }
+  }
+  return read;
+}
+
+template <typename InputIt, typename T>
+int read_varint(InputIt &&first, InputIt &&last, T &i) {
+  return read_varint<std::numeric_limits<T>::digits, InputIt, T>(std::forward<InputIt>(first),
+                                                                 std::forward<InputIt>(last), i);
 }
+}  // namespace tools