@algorandfoundation/react-native-passkey-autofill 1.0.0-canary.14 → 1.0.0-canary.16

package/.oxlintrc.json

@@ -1,13 +1,6 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": [
-    "eslint",
-    "react",
-    "react-perf",
-    "typescript",
-    "unicorn",
-    "oxc"
-  ],
+  "plugins": ["eslint", "react", "react-perf", "typescript", "unicorn", "oxc"],
   "categories": {
     "correctness": "error"
   },
@@ -18,4 +11,4 @@
   "env": {
     "builtin": true
   }
-}
+}

package/ARCHITECTURE.md

@@ -63,7 +63,13 @@ The following methods are exposed to the JavaScript layer:
 - `getHdRootKeyId()`: Retrieves the current HD root key ID.
 - `configureIntentActions(getPasskeyAction: string, createPasskeyAction: string)`: Configures the intent actions used for Passkey flows.
 - `clearCredentials()`: Clears all stored credentials.
+- `isProviderActive()`: Returns `true` if this app is the user-selected system credential/autofill provider. Uses Android's `Settings.Secure("credential_service"[_primary])` (API 34+) and iOS's `ASCredentialIdentityStore.getState`. Useful both for gating passkey UI at runtime and for E2E tests, which need to confirm that an OS passkey prompt is served by _this_ provider rather than any other installed one.
+- `openProviderSettings()`: Deep-links the user to the OS credential/autofill provider settings so they can enable this app as the active provider. Resolves to `true` if a settings screen could be launched.
 
 ## Security Considerations
 
 As this module handles sensitive information (Passkeys), it is crucial to ensure that keys and secrets are handled securely in the native layers. Master keys should be stored in secure storage (like Android Keystore or iOS Keychain).
+
+## End-to-End Tests
+
+The `e2e/` workspace drives the `example/` app with Appium 2 + WebdriverIO, executed through Jest. The Android job uses the UiAutomator2 driver; the iOS job uses XCUITest. The happy-path spec mirrors the example and exercises passkey registration and assertion against `https://debug.liquidauth.com`. See [`e2e/README.md`](./e2e/README.md) for local usage and the [`E2E` workflow](./.github/workflows/e2e.yml) for CI.

package/CHANGELOG.md

@@ -1,24 +1,39 @@
-# [1.0.0-canary.14](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.13...v1.0.0-canary.14) (2026-04-10)
+# [1.0.0-canary.16](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.15...v1.0.0-canary.16) (2026-05-15)
 
 
 ### Bug Fixes
 
-* switch to maven for local AAR dependency ([f4e52b4](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/f4e52b46d618e6e8a7972e649c5d75d768e32339))
+* align ios autofill root key flow ([1287f57](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/1287f57952b41829032ef368bad826624375e9a3))
 
-# [1.0.0-canary.13](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.12...v1.0.0-canary.13) (2026-04-10)
 
+### Features
+
+* add iOS passkey autofill provider ([9aad8f8](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/9aad8f8ceb2ad54cf53847b60dd6e70d5b2a1f2b))
+
+# [1.0.0-canary.15](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.14...v1.0.0-canary.15) (2026-04-10)
 
 ### Bug Fixes
 
-* bump keystore to 1.0.0-canary.9 ([f093bab](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/f093bab0b74d5cbf93e8f03ecd8d56c77597d3f5))
+- use bouncycastle bcprov-jdk15to18 for android ([cd860b2](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/cd860b2012f2189e854137afa55c7a0c0dc1b94c))
 
-# [1.0.0-canary.12](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.11...v1.0.0-canary.12) (2026-04-10)
+# [1.0.0-canary.14](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.13...v1.0.0-canary.14) (2026-04-10)
+
+### Bug Fixes
+
+- switch to maven for local AAR dependency ([f4e52b4](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/f4e52b46d618e6e8a7972e649c5d75d768e32339))
+
+# [1.0.0-canary.13](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.12...v1.0.0-canary.13) (2026-04-10)
 
+### Bug Fixes
+
+- bump keystore to 1.0.0-canary.9 ([f093bab](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/f093bab0b74d5cbf93e8f03ecd8d56c77597d3f5))
+
+# [1.0.0-canary.12](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.11...v1.0.0-canary.12) (2026-04-10)
 
 ### Features
 
-* **android:** biometrics single tap and fallback ([a6cbe4c](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/a6cbe4cf51579b15b2a219e1e06e843bb6001ed4))
-* **android:** support DER format ([492034f](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/492034f8b031e795b2575be69da8c3a1adb9096c))
+- **android:** biometrics single tap and fallback ([a6cbe4c](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/a6cbe4cf51579b15b2a219e1e06e843bb6001ed4))
+- **android:** support DER format ([492034f](https://github.com/algorandfoundation/react-native-passkey-autofill/commit/492034f8b031e795b2575be69da8c3a1adb9096c))
 
 # [1.0.0-canary.11](https://github.com/algorandfoundation/react-native-passkey-autofill/compare/v1.0.0-canary.10...v1.0.0-canary.11) (2026-03-31)
 

package/README.md

@@ -45,6 +45,54 @@ If you are using Expo, you can configure the plugin in your `app.json` or `app.c
 - `site`: The URL of your FIDO server (default: `https://debug.liquidauth.com`).
 - `label`: The name of the credential provider as it appears in Android settings (default: `My Credential Provider`).
 
+### Configure for iOS
+
+iOS passkey AutoFill requires a Credential Provider extension, an App Group shared between the app and extension, and an associated domain for Web Credentials. The Expo config plugin can create and wire the extension during prebuild:
+
+```json
+{
+  "expo": {
+    "ios": {
+      "bundleIdentifier": "com.example.wallet",
+      "associatedDomains": ["webcredentials:your-fido-server.com"],
+      "entitlements": {
+        "com.apple.developer.authentication-services.autofill-credential-provider": true
+      }
+    },
+    "plugins": [
+      [
+        "@algorandfoundation/react-native-passkey-autofill",
+        {
+          "site": "https://your-fido-server.com",
+          "label": "My Custom Credential Provider",
+          "appGroup": "group.com.example.wallet.passkey-autofill",
+          "appleTeamId": "YOUR_TEAM_ID"
+        }
+      ]
+    ]
+  }
+}
+```
+
+For iOS integration, make sure that:
+
+- The app and Credential Provider extension both have the AutoFill Credential Provider capability.
+- The app and extension both have the same App Group entitlement.
+- The app has a `webcredentials:<domain>` associated domain, and that domain serves a valid `apple-app-site-association` file for the app identifier.
+- The deployment target is iOS 17 or newer for passkey credential provider support.
+- The generated extension target can link `AuthenticationServices.framework`, `CryptoKit.framework`, `MMKVCore`, and the deterministic P-256 Swift package.
+- `NSFaceIDUsageDescription` is present when biometric authentication is used.
+
+At runtime, the app must provide the native side with the master key, identify the HD root key stored in MMKV, and keep the iOS identity store in sync:
+
+```typescript
+await ReactNativePasskeyAutofill.setMasterKey(masterKeyHex);
+await ReactNativePasskeyAutofill.setHdRootKeyId(hdRootKeyId);
+await ReactNativePasskeyAutofill.refreshCredentialIdentities();
+```
+
+Call `refreshCredentialIdentities()` after creating, importing, deleting, or restoring passkeys so iOS AutoFill sees the current credentials.
+
 ## Usage
 
 ```typescript
@@ -128,7 +176,7 @@ The project includes a GitHub Actions workflow that automatically runs linting,
 
 ### Integration Testing (E2E)
 
-For full end-to-end testing that covers the bridge between JavaScript and Native, we recommend using [Maestro](https://maestro.mobile.dev/). It provides a clean, YAML-based way to automate UI flows and verify the integration of the Passkey Autofill service with the system UI.
+Full end-to-end tests driving the example app with Appium and WebdriverIO are available in the [`e2e/`](./e2e) directory. These tests exercise the entire passkey creation and usage flow on Android emulators and iOS simulators. See the [E2E README](./e2e/README.md) for more details.
 
 ## 📱 Example App
 

package/android/build.gradle

@@ -67,7 +67,7 @@ dependencies {
   implementation "androidx.lifecycle:lifecycle-viewmodel-ktx:2.8.4"
   implementation "androidx.lifecycle:lifecycle-runtime-ktx:2.8.4"
   implementation "io.github.zhongwuzw:mmkv:2.3.0"
-  implementation "org.bouncycastle:bcprov-jdk18on:1.78.1"
+  implementation "org.bouncycastle:bcprov-jdk15to18:1.78.1"
   implementation "androidx.datastore:datastore-preferences:1.1.1"
   implementation "co.algorand:dP256Android:1.0.0"
   implementation fileTree(dir: 'libs', include: ['*.jar'])

package/android/src/main/java/co/algorand/passkeyautofill/CreatePasskeyActivity.kt

@@ -53,6 +53,7 @@ class CreatePasskeyActivity : AppCompatActivity() {
     private var request: ProviderCreateCredentialRequest? = null
     private var biometricPromptResult: Any? = null
     private var systemUnlockedCipher: javax.crypto.Cipher? = null
+    private var isHandling: Boolean = false
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
@@ -127,6 +128,13 @@ class CreatePasskeyActivity : AppCompatActivity() {
             return
         }
 
+        // Auto-trigger creation flow
+        handleCreation()
+    }
+
+    private fun setupUI() {
+        if (isFinishing || isDestroyed) return
+        
         // Improved UI
         val layout = LinearLayout(this).apply {
             val padding = (32 * resources.displayMetrics.density).toInt()
@@ -226,6 +234,11 @@ class CreatePasskeyActivity : AppCompatActivity() {
         
         val confirmButton = Button(this).apply {
             text = "Create Passkey"
+            // Stable accessibility id for E2E tests (`~create-passkey-confirm`).
+            // The Create Passkey activity intermittently appears on top of the
+            // system biometric prompt, so tests drive this explicit id rather
+            // than depending on localised button text.
+            contentDescription = "create-passkey-confirm"
             setOnClickListener {
                 handleCreation()
             }
@@ -240,6 +253,7 @@ class CreatePasskeyActivity : AppCompatActivity() {
 
         val cancelButton = Button(this, null, android.R.attr.borderlessButtonStyle).apply {
             text = "Cancel"
+            contentDescription = "create-passkey-cancel"
             setOnClickListener {
                 setResult(RESULT_CANCELED)
                 finish()
@@ -261,6 +275,8 @@ class CreatePasskeyActivity : AppCompatActivity() {
 
     @SuppressLint("RestrictedApi")
     private fun handleCreation() {
+        if (isHandling) return
+        isHandling = true
         Log.d(TAG, "handleCreation started, userVerification=$userVerification")
         lifecycleScope.launch {
             val cipherToUse = systemUnlockedCipher ?: run {
@@ -285,7 +301,8 @@ class CreatePasskeyActivity : AppCompatActivity() {
                     Log.d(TAG, "Manual biometrics result: $result")
                     if (result == null) {
                         Log.w(TAG, "Biometrics failed or was canceled")
-                        finish()
+                        setupUI() // Show UI as fallback
+                        isHandling = false
                         return@launch
                     }
                     result.cryptoObject?.cipher
@@ -420,14 +437,14 @@ class CreatePasskeyActivity : AppCompatActivity() {
             ReactNativePasskeyAutofillModule.instance?.sendEvent("onPasskeyAdded", Bundle().apply {
                 putBoolean("success", true)
             })
+            finish()
         } catch (e: Exception) {
             Log.e(TAG, "Error during passkey creation", e)
-            setResult(Activity.RESULT_CANCELED)
+            setupUI() // Show UI on error
+            isHandling = false
         }
-        finish()
     }
-}
-
+    }
 
     private suspend fun biometrics(needsCipher: Boolean): BiometricPrompt.AuthenticationResult? {
         return suspendCoroutine { continuation ->

package/android/src/main/java/co/algorand/passkeyautofill/GetPasskeyActivity.kt

@@ -54,6 +54,7 @@ class GetPasskeyActivity : AppCompatActivity() {
     private var request: ProviderGetCredentialRequest? = null
     private var biometricPromptResult: Any? = null
     private var systemUnlockedCipher: javax.crypto.Cipher? = null
+    private var isHandling: Boolean = false
 
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
@@ -124,6 +125,13 @@ class GetPasskeyActivity : AppCompatActivity() {
             return
         }
 
+        // Auto-trigger assertion flow
+        handleAssertion()
+    }
+
+    private fun setupUI() {
+        if (isFinishing || isDestroyed) return
+        
         // Improved UI
         val layout = LinearLayout(this).apply {
             val padding = (32 * resources.displayMetrics.density).toInt()
@@ -214,6 +222,8 @@ class GetPasskeyActivity : AppCompatActivity() {
 
         val confirmButton = Button(this).apply {
             text = "Sign In"
+            // Stable accessibility id for E2E tests (`~get-passkey-confirm`).
+            contentDescription = "get-passkey-confirm"
             setOnClickListener {
                 handleAssertion()
             }
@@ -228,6 +238,7 @@ class GetPasskeyActivity : AppCompatActivity() {
 
         val cancelButton = Button(this, null, android.R.attr.borderlessButtonStyle).apply {
             text = "Cancel"
+            contentDescription = "get-passkey-cancel"
             setOnClickListener {
                 setResult(RESULT_CANCELED)
                 finish()
@@ -249,6 +260,8 @@ class GetPasskeyActivity : AppCompatActivity() {
 
     @SuppressLint("RestrictedApi")
     private fun handleAssertion() {
+        if (isHandling) return
+        isHandling = true
         Log.d(TAG, "handleAssertion started, userVerification=$userVerification")
         lifecycleScope.launch {
             val credentialData = intent.getBundleExtra("CREDENTIAL_DATA")
@@ -281,7 +294,8 @@ class GetPasskeyActivity : AppCompatActivity() {
                     Log.d(TAG, "Manual biometrics result: $result")
                     if (result == null) {
                         Log.w(TAG, "Biometrics failed or was canceled")
-                        finish()
+                        setupUI() // Show UI as fallback
+                        isHandling = false
                         return@launch
                     }
                     result.cryptoObject?.cipher
@@ -458,14 +472,14 @@ class GetPasskeyActivity : AppCompatActivity() {
             ReactNativePasskeyAutofillModule.instance?.sendEvent("onPasskeyAuthenticated", Bundle().apply {
                 putBoolean("success", true)
             })
+            finish()
         } catch (e: Exception) {
             Log.e(TAG, "Error during passkey assertion", e)
-            setResult(Activity.RESULT_CANCELED)
+            setupUI() // Show UI on error
+            isHandling = false
         }
-        finish()
     }
-}
-
+    }
 
     private suspend fun biometrics(iv: String?): BiometricPrompt.AuthenticationResult? {
         return suspendCoroutine { continuation ->

package/android/src/main/java/co/algorand/passkeyautofill/ReactNativePasskeyAutofillModule.kt

@@ -3,8 +3,14 @@ package co.algorand.passkeyautofill
 import expo.modules.kotlin.modules.Module
 import expo.modules.kotlin.modules.ModuleDefinition
 import co.algorand.passkeyautofill.credentials.CredentialRepository
+import co.algorand.passkeyautofill.service.PasskeyAutofillCredentialProviderService
+import co.algorand.passkeyautofill.service.PasskeyAutofillCredentialProviderService.Companion.KEY_LAST_INVOKED_AT_MS
 import com.tencent.mmkv.MMKV
+import android.content.ComponentName
 import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import android.provider.Settings
 import android.util.Log
 import org.bouncycastle.jce.provider.BouncyCastleProvider
 import java.security.Security
@@ -74,11 +80,102 @@ class ReactNativePasskeyAutofillModule : Module() {
       credentialRepository.clearCredentials(context)
     }
 
+    AsyncFunction("deleteCredential") { credentialId: String ->
+      val context = (appContext.reactContext ?: appContext.hostingRuntimeContext) as? Context
+        ?: return@AsyncFunction Unit
+      credentialRepository.deleteCredential(context, credentialId)
+    }
+
     AsyncFunction("configureIntentActions") { getPasskeyAction: String, createPasskeyAction: String ->
       val context = (appContext.reactContext ?: appContext.hostingRuntimeContext) as? Context
       if (context != null) {
         credentialRepository.configureIntentActions(context, getPasskeyAction, createPasskeyAction)
       }
     }
+
+    AsyncFunction("isProviderActive") {
+      val context = (appContext.reactContext ?: appContext.hostingRuntimeContext) as? Context
+        ?: return@AsyncFunction false
+      isProviderEnabled(context)
+    }
+
+    AsyncFunction("openProviderSettings") {
+      val context = (appContext.reactContext ?: appContext.hostingRuntimeContext) as? Context
+        ?: return@AsyncFunction false
+      openCredentialProviderSettings(context)
+    }
+  }
+
+  /**
+   * Returns `true` when this app's [PasskeyAutofillCredentialProviderService]
+   * is registered as an active credential provider for the current user.
+   *
+   * Android stores the enabled credential providers as a colon-separated list
+   * of flattened [ComponentName]s in the `credential_service` and
+   * `credential_service_primary` Secure settings (API 34+). However those
+   * keys are `@hide` on Android 12+, so reading them from a regular app
+   * throws `SecurityException`. We therefore combine two signals:
+   *
+   *  1. Best-effort: try [Settings.Secure.getString]; if it returns the
+   *     expected component we know for sure we're the provider.
+   *  2. Fallback: inspect the MMKV timestamp written by the service itself
+   *     whenever the system routes a `BeginCreate/BeginGetCredentialRequest`
+   *     to it ([PasskeyAutofillCredentialProviderService.KEY_LAST_INVOKED_AT_MS]).
+   *     The Credential Manager only routes requests to *enabled* providers,
+   *     so a non-zero stamp is proof that we were selected at least once.
+   */
+  private fun isProviderEnabled(context: Context): Boolean {
+    val expected = ComponentName(
+      context.packageName,
+      PasskeyAutofillCredentialProviderService::class.java.name,
+    ).flattenToString()
+    val resolver = context.contentResolver
+    val keys = arrayOf("credential_service", "credential_service_primary")
+    for (key in keys) {
+      val value = try {
+        Settings.Secure.getString(resolver, key)
+      } catch (e: SecurityException) {
+        // `credential_service[_primary]` are @hide on Android 12+; fall
+        // through to the MMKV stamp check below.
+        Log.d("ReactNativePasskeyAutofill", "Secure key $key not readable: ${e.message}")
+        null
+      } ?: continue
+      if (value.isEmpty()) continue
+      val enabled = value.split(':').any { it.equals(expected, ignoreCase = true) } ||
+        value.contains(expected, ignoreCase = true)
+      if (enabled) return true
+    }
+    // Fallback: look for a timestamp written by our CredentialProviderService.
+    return try {
+      MMKV.initialize(context)
+      (MMKV.defaultMMKV()?.decodeLong(KEY_LAST_INVOKED_AT_MS, 0L) ?: 0L) > 0L
+    } catch (e: Exception) {
+      Log.w("ReactNativePasskeyAutofill", "Failed to read provider stamp: ${e.message}")
+      false
+    }
+  }
+
+  /**
+   * Best-effort deep link into the user's credential-provider preferences so
+   * they can toggle our service on. Falls back to the app-details page when
+   * the credential provider screen is not available on the device.
+   */
+  private fun openCredentialProviderSettings(context: Context): Boolean {
+    val intents = listOf(
+      Intent("android.settings.CREDENTIAL_PROVIDER"),
+      Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS).apply {
+        data = Uri.fromParts("package", context.packageName, null)
+      },
+    )
+    for (intent in intents) {
+      intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+      try {
+        context.startActivity(intent)
+        return true
+      } catch (e: Exception) {
+        Log.w("ReactNativePasskeyAutofill", "Failed to open ${intent.action}: ${e.message}")
+      }
+    }
+    return false
   }
 }

package/android/src/main/java/co/algorand/passkeyautofill/credentials/CredentialRepository.kt

@@ -45,6 +45,7 @@ interface CredentialRepository {
     fun getCreatePasskeyAction(context: Context): String?
     fun getGetPasskeyAction(context: Context): String?
     fun clearCredentials(context: Context)
+    fun deleteCredential(context: Context, credentialId: String)
     
     fun getBiometricCipherForEncryption(): Cipher
     fun getBiometricCipherForDecryption(iv: ByteArray): Cipher
@@ -60,6 +61,15 @@ interface CredentialRepository {
         const val KEYCHAIN_STORAGE_NAME = "PasskeyAutofillKeychain"
         const val PASSKEY_AUTOFILL_MMKV_ID = "passkey_autofill"
         const val HD_ROOT_KEY_ID_KEY = "hd_root_key_id"
+
+        /**
+         * JCE provider that exposes AndroidKeyStore-backed symmetric Cipher
+         * transformations (including AES/GCM). Pinning to this provider avoids
+         * BouncyCastle — which this module installs at position 1 — trying to
+         * extract raw bytes from a hardware-bound SecretKey and crashing with
+         * NullPointerException in `KeyParameter.<init>`.
+         */
+        const val ANDROID_KEYSTORE_CIPHER_PROVIDER = "AndroidKeyStoreBCWorkaround"
     }
 }
 
@@ -254,6 +264,19 @@ class Repository() : CredentialRepository {
                 val paramSpec = (keyPairGen.generateKeyPair().public as java.security.interfaces.ECPublicKey).params
                 val factory = KeyFactory.getInstance("EC")
 
+                val publicKeyFromX509 = try {
+                    factory.generatePublic(X509EncodedKeySpec(publicKeyBytes))
+                } catch (_: Exception) {
+                    null
+                }
+
+                if (publicKeyFromX509 != null && privateKeyBytes.size == 32) {
+                    val s = java.math.BigInteger(1, privateKeyBytes)
+                    val privSpec = ECPrivateKeySpec(s, paramSpec)
+                    val privateKey = factory.generatePrivate(privSpec)
+                    return KeyPair(publicKeyFromX509, privateKey)
+                }
+
                 // privateKey is 32-byte scalar
                 val rawXY: Pair<ByteArray, ByteArray>? = when {
                     // 65-byte uncompressed point: 04 || x(32) || y(32)
@@ -534,6 +557,36 @@ class Repository() : CredentialRepository {
         }
     }
 
+    override fun deleteCredential(context: Context, credentialId: String) {
+        try {
+            val mmkvPasskeys = getPasskeysMMKV(context)
+            for (candidateId in credentialIdCandidates(credentialId)) {
+                mmkvPasskeys.removeValueForKey(candidateId)
+            }
+        } catch (e: Exception) {
+            Log.e(CredentialRepository.TAG, "Error deleting credential", e)
+        }
+    }
+
+    private fun credentialIdCandidates(id: String): Set<String> {
+        val candidates = mutableSetOf(id)
+        val decoded = try {
+            AndroidBase64.decode(id, AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP)
+        } catch (_: Exception) {
+            try {
+                AndroidBase64.decode(id, AndroidBase64.DEFAULT)
+            } catch (_: Exception) {
+                null
+            }
+        }
+
+        if (decoded != null) {
+            candidates.add(AndroidBase64.encodeToString(decoded, AndroidBase64.DEFAULT).trim())
+            candidates.add(AndroidBase64.encodeToString(decoded, AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING))
+        }
+        return candidates
+    }
+
     private fun hexToBytes(hex: String): ByteArray {
         val result = ByteArray(hex.length / 2)
         for (i in 0 until hex.length step 2) {
@@ -576,14 +629,40 @@ class Repository() : CredentialRepository {
         return keyStore.getKey(CredentialRepository.BIOMETRIC_KEY_ALIAS, null) as SecretKey
     }
 
+    /**
+     * Build an AES/GCM Cipher tied to the AndroidKeyStore-backed biometric key.
+     *
+     * We request the provider explicitly because this module installs
+     * BouncyCastle at position 1 (see [co.algorand.passkeyautofill.ReactNativePasskeyAutofillModule]).
+     * Without a pinned provider, [Cipher.getInstance] resolves to BouncyCastle, which
+     * then tries to extract raw key material from an AndroidKeyStore SecretKey
+     * (whose `getEncoded()` is null for hardware-bound keys) and crashes with:
+     *
+     *   java.lang.NullPointerException: Attempt to get length of null array
+     *       at org.bouncycastle.crypto.params.KeyParameter.<init>(...)
+     *
+     * AndroidKeyStore AES keys are served by the "AndroidKeyStoreBCWorkaround"
+     * JCE provider on all supported Android versions.
+     */
+    private fun newAndroidKeyStoreAesGcmCipher(): Cipher {
+        return try {
+            Cipher.getInstance("AES/GCM/NoPadding", CredentialRepository.ANDROID_KEYSTORE_CIPHER_PROVIDER)
+        } catch (e: NoSuchProviderException) {
+            // Extremely unlikely on stock Android, but fall back to provider discovery
+            // by key rather than by name so we never hand the key to BouncyCastle.
+            Log.w(CredentialRepository.TAG, "${CredentialRepository.ANDROID_KEYSTORE_CIPHER_PROVIDER} unavailable, falling back to default provider resolution", e)
+            Cipher.getInstance("AES/GCM/NoPadding")
+        }
+    }
+
     override fun getBiometricCipherForEncryption(): Cipher {
-        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        val cipher = newAndroidKeyStoreAesGcmCipher()
         cipher.init(Cipher.ENCRYPT_MODE, getBiometricSecretKey())
         return cipher
     }
 
     override fun getBiometricCipherForDecryption(iv: ByteArray): Cipher {
-        val cipher = Cipher.getInstance("AES/GCM/NoPadding")
+        val cipher = newAndroidKeyStoreAesGcmCipher()
         cipher.init(Cipher.DECRYPT_MODE, getBiometricSecretKey(), GCMParameterSpec(128, iv))
         return cipher
     }
@@ -629,4 +708,4 @@ class Repository() : CredentialRepository {
         val certHash = md.digest(cert)
         return "android:apk-key-hash:${AndroidBase64.encodeToString(certHash, AndroidBase64.URL_SAFE or AndroidBase64.NO_WRAP or AndroidBase64.NO_PADDING)}"
     }
-}
+}

package/android/src/main/java/co/algorand/passkeyautofill/service/PasskeyAutofillCredentialProviderService.kt

@@ -50,6 +50,25 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         const val CREATE_PASSKEY_INTENT = 2
         const val DEFAULT_GET_PASSKEY_ACTION = "co.algorand.passkeyautofill.GET_PASSKEY"
         const val DEFAULT_CREATE_PASSKEY_ACTION = "co.algorand.passkeyautofill.CREATE_PASSKEY"
+
+        /**
+         * MMKV key holding the last time Android routed a credential request to
+         * this service. Set from both `onBeginCreate` and `onBeginGet` callbacks.
+         * Consumed by `ReactNativePasskeyAutofillModule.isProviderActive` as a
+         * reliable "this app is a registered provider" signal, since the raw
+         * `Settings.Secure("credential_service")` key is @hide-restricted on
+         * Android 12+ and not readable from regular apps.
+         */
+        const val KEY_LAST_INVOKED_AT_MS = "provider_last_invoked_at_ms"
+
+        internal fun stampActivated(context: android.content.Context) {
+            try {
+                MMKV.initialize(context)
+                MMKV.defaultMMKV()?.encode(KEY_LAST_INVOKED_AT_MS, System.currentTimeMillis())
+            } catch (e: Exception) {
+                Log.w(TAG, "Failed to stamp provider activation: ${e.message}")
+            }
+        }
     }
     /**
      * Handle Create Credential Requests
@@ -60,6 +79,7 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         cancellationSignal: CancellationSignal,
         callback: OutcomeReceiver<BeginCreateCredentialResponse, CreateCredentialException>
     ) {
+        stampActivated(this)
         val response: BeginCreateCredentialResponse? = processCreateCredentialRequest(request)
         if (response != null) {
             callback.onResult(response)
@@ -142,6 +162,7 @@ class PasskeyAutofillCredentialProviderService: CredentialProviderService() {
         cancellationSignal: CancellationSignal,
         callback: OutcomeReceiver<BeginGetCredentialResponse, GetCredentialException>,
     ) {
+        stampActivated(this)
         try {
             val response = processGetCredentialRequest(request)
             callback.onResult(response)

package/android/src/main/res/values/styles.xml

@@ -5,6 +5,6 @@
         <item name="android:windowContentOverlay">@null</item>
         <item name="android:windowNoTitle">true</item>
         <item name="android:windowIsFloating">true</item>
-        <item name="android:backgroundDimEnabled">true</item>
+        <item name="android:backgroundDimEnabled">false</item>
     </style>
 </resources>