fix(expo): floor the iOS deployment target instead of pinning it to 16.4

.agents/commands/review.md

@@ -4,20 +4,26 @@ Review all commits on the current branch since diverging from main.
 
 ## Prerequisites
 
-**IMPORTANT**: Before starting the review, check if this is a fresh context/session:
+**IMPORTANT**: A reviewer should not be the same "person" who wrote the code. Before starting, check if this is a fresh context/session:
 
-- If there is prior conversation history in this session (e.g., you helped write the code being reviewed), STOP immediately
-- Inform the user: "Code reviews should be done in a fresh context to avoid bias. Please start a new agent session and run /review there."
-- A reviewer should not be the same "person" who wrote the code
+- **If there is prior conversation history in this session** (e.g., you helped write the code being reviewed), do NOT review it yourself — your context is biased. Instead, spawn a fresh reviewer:
+  - Launch a subagent (synchronously — `run_in_background: false`) with a prompt telling it to perform the full review defined in the **Instructions** section below on the current branch, and to return its findings as: a summary, positives, and a severity-ranked list of issues (each with `file:line`, description, and a proposed action). Paste the Instructions criteria into the prompt so the subagent doesn't need to re-read this file.
+  - Pick the subagent type by what the diff actually touches: `crypto-specialist` for crypto/algorithm changes, `cpp-specialist` for `cpp/`, `typescript-specialist` for TS-only changes, `general-purpose` otherwise. Spawn more than one in parallel when the diff spans domains.
+  - **Scope the prompt to THIS branch's actual changes, not the generic template.** Before spawning, run `git diff --stat origin/main...HEAD` (three dots — see step 3) and put the concrete context into the prompt: what the branch does, which subsystem it touches (this repo spans C++/OpenSSL under `packages/react-native-quick-crypto/cpp`, the TypeScript package under `src/`, the Expo config plugin, the `example/` RN app and its test suites, `docs/`, and CI workflows — name the ones actually changed), and the list of changed files. Tell the subagent to open and review **every** changed file, including non-C++ ones (`.ts`, `.tsx`, podspec, Gradle, `.github/workflows`, `.agents/`), and to validate **each** changed toolchain rather than assuming one check covers the diff.
+  - The subagent starts with a clean context and did NOT write the code, so its review is unbiased.
+  - When it returns, relay its review to the user verbatim, then run the **Follow-up** fix-plan step yourself (the subagent can't interact with the user).
+- **If this is a fresh context** (no prior history — you did not write this code), perform the review directly.
 
 ## Instructions
 
-When activated (in a fresh session), perform a full code review of the commits since branching from main:
+When activated, perform a full code review of the commits since branching from main:
 
-1. **Get the commits**: Run `git log main..HEAD --oneline` to see all commits on this branch
-2. **Get the full diff**: Run `git diff main..HEAD` to see all changes
-3. **For each file changed**, read enough context to understand the changes
-4. **Review for**:
+1. **Sync the base**: Run `git fetch origin` first. Local `main` is often stale (a PR merged upstream but not pulled locally), which silently drags already-merged commits into the review scope and balloons the diff. Use `origin/main` as the base for everything below.
+2. **Get the commits**: Run `git log origin/main..HEAD --oneline` to see all commits on this branch
+3. **Get the full diff**: Run `git diff origin/main...HEAD` to see all changes. **Three dots.** For `diff`, two dots compares the two endpoints, so anything merged into `origin/main` since the branch point shows up as an inverse diff — as if this branch deleted it. Three dots diffs against the merge-base, which is what you want. Note that step 2's `git log` takes **two** dots: the same syntax means different things for `log` and `diff`.
+4. **Also check the working tree**: run `git status --short` and `git diff`. Uncommitted changes are in scope — review them alongside the commits, and say which findings apply to uncommitted work.
+5. **For each file changed**, read enough context to understand the changes
+6. **Review for**:
    - Correctness and logic errors
    - Consistency with existing patterns in the codebase
    - TypeScript best practices
@@ -26,13 +32,13 @@ When activated (in a fresh session), perform a full code review of the commits s
    - Potential bugs or edge cases
    - Missing error handling
    - Code clarity and maintainability
-5. **Provide a structured review** with:
+7. **Provide a structured review** with:
    - Summary of what the branch does
    - Positives (what's done well)
    - Issues & suggestions (ranked by severity)
    - Recommended actions (if any)
 
-Run `bun tsc` to verify the code compiles.
+Verify the toolchains the diff actually touches: `bun tsc` for TypeScript, `bun run test` (in `packages/react-native-quick-crypto` — `run` matters, bare `bun test` is Bun's own runner, not the package's jest) if node-side code changed, `clang-format --dry-run --Werror` for C++. C++ runtime behavior and example-app test suites can only be validated by the user running `bun ios` / `bun android` — flag that rather than claiming it passes.
 
 ## Follow-up
 
@@ -46,4 +52,8 @@ After presenting the review, present a **fix plan table** for the user to approv
 - **Skip**: Not worth changing (explain why)
 - **Ask**: Ambiguous, needs user input on approach
 
-**Wait for the user to approve the plan** (they may want to skip or modify items). Then apply only the approved fixes. Run `bun tsc` after all fixes are applied to verify everything is clean.
+**Wait for the user to approve the plan** (they may want to skip or modify items). They may reply with "approve" / "approve all" to accept everything, override individual rows ("skip #3", "fix #5 differently"), or ask clarifying questions.
+
+Once approved, apply only the approved fixes, then re-run the same toolchain checks to verify everything is clean.
+
+Then commit the approved fixes (via `/commit`) — don't leave review changes sitting in the working tree. Commit only; pushing and opening PRs still need explicit permission.

.github/workflows/validate-js.yml

@@ -8,6 +8,7 @@ on:
       - '.github/workflows/validate-js.yml'
       - 'bun.lock'
       - 'packages/react-native-quick-crypto/src/**'
+      - 'packages/react-native-quick-crypto/test/**'
       - 'packages/react-native-quick-crypto/*.json'
       - 'packages/react-native-quick-crypto/*.*s'
       - 'packages/react-native-quick-crypto/bun.lock'
@@ -21,6 +22,7 @@ on:
       - '.github/workflows/validate-js.yml'
       - 'bun.lock'
       - 'packages/react-native-quick-crypto/src/**'
+      - 'packages/react-native-quick-crypto/test/**'
       - 'packages/react-native-quick-crypto/*.json'
       - 'packages/react-native-quick-crypto/*.*s'
       - 'packages/react-native-quick-crypto/bun.lock'
@@ -70,6 +72,11 @@ jobs:
           cd packages/react-native-quick-crypto
           bun circular
 
+      - name: Run tests
+        run: |
+          cd packages/react-native-quick-crypto
+          bun run test
+
   audit_runtime_deps:
     name: Audit runtime deps (bun audit)
     runs-on: ubuntu-latest
@@ -82,14 +89,24 @@ jobs:
       # workspace's dev/peer tooling. Workspace-level `bun audit` walks through optional
       # peers (expo, react-native, etc.) which surface ~70 advisories that never reach a
       # consumer's runtime bundle. Phase 5.1 baseline: zero advisories in the runtime tree.
+      #
+      # `bun audit` resolves peers from the registry regardless of what is installed, so
+      # neither `--omit=peer` nor `[install] peer = false` keeps react-native's own tree
+      # out of the graph — only `--ignore` does. These two are metro (react-native's
+      # bundler, dev-time only) reached via the react-native peer of
+      # react-native-quick-base64; they are not in a consumer's runtime bundle. Ignores
+      # are per-advisory, so anything new still fails this job. Drop them once
+      # react-native ships a metro with image-size >= 2.0.3.
       - name: Audit runtime dependencies
         run: |
           mkdir -p /tmp/rnqc-runtime-audit
           cd /tmp/rnqc-runtime-audit
           bun -e "const pkg=require('$GITHUB_WORKSPACE/packages/react-native-quick-crypto/package.json'); require('fs').writeFileSync('package.json', JSON.stringify({name:'rnqc-runtime-audit',version:'0.0.0',dependencies:pkg.dependencies},null,2));"
           cat package.json
           bun install --no-summary
-          bun audit --audit-level=high
+          bun audit --audit-level=high \
+            --ignore=GHSA-w3rx-r6r6-pgpr \
+            --ignore=GHSA-5p2g-fcmc-qvqq
 
   lint_js:
     name: JS Lint (eslint, prettier)

packages/react-native-quick-crypto/package.json

@@ -114,14 +114,14 @@
     "util": "0.12.5"
   },
   "devDependencies": {
+    "@babel/runtime": "7.28.4",
     "@types/jest": "29.5.11",
     "@types/node": "24.3.0",
     "@types/react": "18.3.3",
     "@types/readable-stream": "4.0.23",
     "del-cli": "7.0.0",
     "dpdm": "^4.0.1",
     "expo": "^54.0.25",
-    "expo-build-properties": "^1.0.0",
     "jest": "29.7.0",
     "nitrogen": "0.33.2",
     "react-native-builder-bob": "0.40.15",
@@ -132,15 +132,11 @@
     "react-native": "*",
     "react-native-nitro-modules": ">=0.31.2",
     "react-native-quick-base64": ">=3.0.0",
-    "expo": ">=48.0.0",
-    "expo-build-properties": "*"
+    "expo": ">=48.0.0"
   },
   "peerDependenciesMeta": {
     "expo": {
       "optional": true
-    },
-    "expo-build-properties": {
-      "optional": true
     }
   },
   "release-it": {