@oxy.so/bloom 4.30.1 → 4.31.0

package/src/__tests__/support/collision-fixture-barrel.ts

@@ -0,0 +1,20 @@
+/**
+ * A barrel that DELIBERATELY offers one name from two declarations, so that
+ * `barrel-name-collisions.test.ts` can prove its detector fires. It reproduces
+ * the shipped `Item` shape: a star export carrying `Item` from `item/`, and an
+ * explicit re-export binding that same name to a different component.
+ *
+ * Nothing imports this at runtime. bob's `exclude` keeps it out of `lib/`, and
+ * `files: ["src", …]` does ship it inside the tarball's `src/` like the other
+ * test files there — but no entry point reaches it, so no bundler links it, and
+ * `package.json#exports` never names it.
+ *
+ * The `Card` lines below are the other half of the
+ * control: one name offered twice from ONE declaration, which the detector must
+ * stay quiet about — otherwise its cheapest fix would be deleting a legitimate
+ * redundant re-export.
+ */
+export * from '../../item';
+export { Card as Item } from '../../card';
+export { Card } from '../../card';
+export * from '../../card';

package/src/__tests__/support/commerce-harness.tsx

@@ -0,0 +1,97 @@
+/**
+ * The mount harness the four commerce suites share.
+ *
+ * Every one of them asserts EMITTED DOM — an `aria-*` attribute, a computed
+ * colour, whether a node exists at all — rather than the props it just passed,
+ * so each renders through the real react-native-web. The mock has to be
+ * installed by the SUITE (a `jest.mock` call is hoisted to the top of the file
+ * it is written in and does not travel through an import), which is why this
+ * module exports the harness and not the mock.
+ */
+import React from 'react';
+import { act } from 'react';
+import { createRoot, type Root } from 'react-dom/client';
+
+import { BloomThemeProvider } from '../../theme/BloomThemeProvider';
+import type { Theme } from '../../theme/types';
+import { useTheme } from '../../theme/use-theme';
+
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+let container: HTMLDivElement;
+let root: Root;
+let lastTheme: Theme | null = null;
+
+function ThemeProbe() {
+  lastTheme = useTheme();
+  return null;
+}
+
+export function setupHarness(): void {
+  beforeEach(() => {
+    container = document.createElement('div');
+    document.body.appendChild(container);
+    root = createRoot(container);
+  });
+  afterEach(() => {
+    act(() => root.unmount());
+    container.remove();
+    lastTheme = null;
+  });
+}
+
+export function mount(ui: React.ReactElement, mode: 'light' | 'dark' = 'light'): HTMLElement {
+  act(() => {
+    root.render(
+      <BloomThemeProvider mode={mode} colorPreset="teal">
+        <ThemeProbe />
+        {ui}
+      </BloomThemeProvider>,
+    );
+  });
+  return container;
+}
+
+export function theme(): Theme {
+  if (!lastTheme) throw new Error('theme not captured');
+  return lastTheme;
+}
+
+export function root$(): HTMLElement {
+  return container;
+}
+
+export function byTestId(id: string): HTMLElement {
+  const el = document.querySelector(`[data-testid="${id}"]`);
+  if (!(el instanceof HTMLElement)) throw new Error(`No element for testID "${id}"`);
+  return el;
+}
+
+export function queryTestId(id: string): HTMLElement | null {
+  return document.querySelector(`[data-testid="${id}"]`);
+}
+
+export function byLabel(label: string): HTMLElement {
+  const el = document.querySelector(`[aria-label="${label}"]`);
+  if (!(el instanceof HTMLElement)) throw new Error(`No element labelled "${label}"`);
+  return el;
+}
+
+export function allByRole(role: string): HTMLElement[] {
+  return Array.from(document.querySelectorAll(`[role="${role}"]`)).filter(
+    (el): el is HTMLElement => el instanceof HTMLElement,
+  );
+}
+
+export function click(el: HTMLElement): void {
+  act(() => {
+    el.click();
+  });
+}
+
+/** A colour as the DOM serialises it, for comparing against a computed style. */
+export function css(color: string): string {
+  const probe = document.createElement('div');
+  probe.style.color = color;
+  return probe.style.color;
+}

package/src/__tests__/support/composite.ts

@@ -0,0 +1,68 @@
+/**
+ * Compositing and WCAG maths for suites that measure a TRANSLUCENT surface.
+ *
+ * A pane you can see through has no colour of its own to read off a style prop:
+ * what a label lands on is the fill flattened onto whatever is behind it. Every
+ * gate on a glass material therefore needs the same four functions, and they
+ * are here so a new one does not start by copying them — which is how two
+ * copies of a luminance formula end up disagreeing about the sRGB knee.
+ *
+ * `theme/__tests__/glass-colors.test.ts` keeps its OWN copies, deliberately and
+ * with its own reasons written down; this is for everything since.
+ */
+
+export interface Rgba {
+  r: number;
+  g: number;
+  b: number;
+  a: number;
+}
+
+/** Parse `#rgb`, `#rrggbb`, `rgb(...)` or `rgba(...)`. Throws on anything else. */
+export function parseColor(value: string): Rgba {
+  const hex = /^#([0-9a-f]{3}|[0-9a-f]{6})$/i.exec(value.trim());
+  if (hex?.[1] !== undefined) {
+    const h = hex[1].length === 3 ? hex[1].replace(/./g, (c) => c + c) : hex[1];
+    return {
+      r: parseInt(h.slice(0, 2), 16),
+      g: parseInt(h.slice(2, 4), 16),
+      b: parseInt(h.slice(4, 6), 16),
+      a: 1,
+    };
+  }
+  const fn = /^rgba?\(([^)]*)\)$/.exec(value.trim());
+  if (!fn?.[1]) throw new Error(`unparseable colour: ${JSON.stringify(value)}`);
+  const parts = fn[1].split(/[\s,/]+/).filter(Boolean).map(Number);
+  if (parts.length < 3 || parts.some((n) => Number.isNaN(n))) {
+    throw new Error(`unparseable colour: ${JSON.stringify(value)}`);
+  }
+  return { r: parts[0] ?? 0, g: parts[1] ?? 0, b: parts[2] ?? 0, a: parts[3] ?? 1 };
+}
+
+/** Flatten a translucent colour onto an opaque one — source-over. */
+export function over(top: Rgba, bottom: Rgba): Rgba {
+  return {
+    r: top.r * top.a + bottom.r * (1 - top.a),
+    g: top.g * top.a + bottom.g * (1 - top.a),
+    b: top.b * top.a + bottom.b * (1 - top.a),
+    a: 1,
+  };
+}
+
+/** WCAG relative luminance. */
+export function luminance({ r, g, b }: Rgba): number {
+  const channel = (v: number): number => {
+    const c = v / 255;
+    return c <= 0.03928 ? c / 12.92 : Math.pow((c + 0.055) / 1.055, 2.4);
+  };
+  return 0.2126 * channel(r) + 0.7152 * channel(g) + 0.0722 * channel(b);
+}
+
+/** WCAG contrast ratio, order-independent. */
+export function contrastRatio(a: Rgba, b: Rgba): number {
+  const [hi, lo] = [luminance(a), luminance(b)].sort((x, y) => y - x) as [number, number];
+  return (hi + 0.05) / (lo + 0.05);
+}
+
+export const WHITE: Rgba = { r: 255, g: 255, b: 255, a: 1 };
+export const BLACK: Rgba = { r: 0, g: 0, b: 0, a: 1 };

package/src/__tests__/support/constructed-style-sheets.ts

@@ -0,0 +1,68 @@
+/**
+ * A spec-shaped stand-in for constructed stylesheets, for the jsdom suites.
+ *
+ * jsdom 26 ships the `CSSStyleSheet` CONSTRUCTOR but neither `replaceSync` nor
+ * `document.adoptedStyleSheets`, so every jsdom test takes Bloom's `<style>`
+ * fallback. That makes the whole CSP-safe path — the reason
+ * `styles/adopt-style-sheet.ts` exists — invisible to jest unless a test
+ * installs the API itself. Without this, a mutation that deleted the adoption
+ * branch entirely would leave the suite green.
+ *
+ * Not collected as a suite: jest's `testMatch` wants `*.test.ts` / `*.spec.ts`.
+ */
+
+export interface FakeStyleSheet {
+  /** The CSS most recently handed to `replaceSync`. */
+  cssText: string;
+  /** How many times the sheet has been re-parsed, so a test can prove it wasn't. */
+  replaceSyncCalls: number;
+  replaceSync(css: string): void;
+}
+
+export interface ConstructedStyleSheetsHarness {
+  /** The document's adopted sheets, read live (the code reassigns the array). */
+  adopted(): readonly FakeStyleSheet[];
+  /** Drop the API again, restoring jsdom's own `CSSStyleSheet`. */
+  uninstall(): void;
+}
+
+export function installConstructedStyleSheets(): ConstructedStyleSheetsHarness {
+  class FakeCSSStyleSheet implements FakeStyleSheet {
+    cssText = '';
+    replaceSyncCalls = 0;
+
+    replaceSync(css: string): void {
+      this.cssText = css;
+      this.replaceSyncCalls += 1;
+    }
+  }
+
+  const previousConstructor = Object.getOwnPropertyDescriptor(
+    globalThis,
+    'CSSStyleSheet',
+  );
+
+  Object.defineProperty(globalThis, 'CSSStyleSheet', {
+    value: FakeCSSStyleSheet,
+    writable: true,
+    configurable: true,
+  });
+  Object.defineProperty(document, 'adoptedStyleSheets', {
+    value: [],
+    writable: true,
+    configurable: true,
+  });
+
+  return {
+    adopted: () =>
+      document.adoptedStyleSheets as unknown as readonly FakeStyleSheet[],
+    uninstall: () => {
+      Reflect.deleteProperty(document, 'adoptedStyleSheets');
+      if (previousConstructor) {
+        Object.defineProperty(globalThis, 'CSSStyleSheet', previousConstructor);
+      } else {
+        Reflect.deleteProperty(globalThis, 'CSSStyleSheet');
+      }
+    },
+  };
+}

package/src/__tests__/support/press-host.ts

@@ -0,0 +1,30 @@
+/**
+ * Pressing a component's OWN host node, and proving the component is what
+ * installed the handler being measured.
+ *
+ * `fireEvent.press` walks UP from the element it is handed to the nearest
+ * ancestor carrying an `onPress` prop, and it does not stop at host nodes — a
+ * COMPOSITE counts, because `getEventHandler` only reads `element.props`. So
+ * `<Thing onPress={fn}>` written in a test's own JSX catches the press itself.
+ * Measured on a (since removed) card component: with the handler deleted from the
+ * component the card rendered as an inert `View`, and the test still reported exactly one
+ * call. Green, and measuring nothing. Nine suites had the same shape.
+ *
+ * Asserting the host node's own `onPress` FIRST closes both halves:
+ *
+ *  - a component that installs no handler at all fails here, and
+ *  - a component that installs one which drops the caller's fails on the call
+ *    count, because `fireEvent` now finds a handler AT the node and never walks
+ *    past it to the test's own JSX.
+ *
+ * `host` must therefore be the node the component itself made pressable — the
+ * one carrying its `testID` / `accessibilityLabel` — not a `Text` deep inside
+ * it, or the walk-up is back and so is the hole.
+ */
+import { fireEvent } from '@testing-library/react-native';
+import type { ReactTestInstance } from 'react-test-renderer';
+
+export function pressHost(host: ReactTestInstance): void {
+  expect(typeof host.props.onPress).toBe('function');
+  fireEvent.press(host);
+}

package/src/__tests__/support/rendered-style.ts

@@ -0,0 +1,99 @@
+/**
+ * Reading what actually landed on a rendered node — shared by every suite that
+ * asserts the "className lands on the node the parent lays out" rule.
+ *
+ * Three components had the same two-node defect (`Button`, then `Fab` and
+ * `FrostedIconButton`), and asserting it needs the same two things each time:
+ * the HOST tree (composites do not appear in `toJSON()`, so a wrapper is only
+ * visible there) and a deep flatten of the `style` prop, because react-native-css
+ * merges a caller's class in as a `{ $$css: true, className }` descriptor
+ * ALONGSIDE the style objects rather than in a prop of its own.
+ */
+import type { ReactTestRendererJSON } from 'react-test-renderer';
+
+export type StyleEntry = Record<string, unknown>;
+
+export interface HostNode {
+  type: string;
+  props: Record<string, unknown>;
+  children: Array<HostNode | string> | null;
+}
+
+/**
+ * Deep-flatten an RN `style` prop (nested arrays, `false`/`null` holes) into the
+ * list of style objects that actually reached the node.
+ */
+export function styleEntries(style: unknown, out: StyleEntry[] = []): StyleEntry[] {
+  if (!style || typeof style !== 'object') return out;
+  if (Array.isArray(style)) {
+    for (const entry of style) styleEntries(entry, out);
+    return out;
+  }
+  out.push(style as StyleEntry);
+  return out;
+}
+
+/** Every style key/value that landed on a node, later entries winning. */
+export function resolvedStyle(style: unknown): StyleEntry {
+  return Object.assign({}, ...styleEntries(style)) as StyleEntry;
+}
+
+/** The class tokens react-native-css accepted for a node, in arrival order. */
+export function classNamesOn(style: unknown): string[] {
+  return styleEntries(style)
+    .filter((entry) => entry.$$css === true && typeof entry.className === 'string')
+    .map((entry) => String(entry.className));
+}
+
+export function isHostNode(value: unknown): value is HostNode {
+  return (
+    typeof value === 'object' && value !== null && typeof (value as HostNode).type === 'string'
+  );
+}
+
+/** Walk the HOST tree (composites are absent from `toJSON()`) for a testID. */
+export function findHost(
+  node: ReactTestRendererJSON | ReactTestRendererJSON[] | unknown,
+  testID: string,
+): HostNode | null {
+  if (Array.isArray(node)) {
+    for (const child of node) {
+      const hit = findHost(child, testID);
+      if (hit) return hit;
+    }
+    return null;
+  }
+  if (!isHostNode(node)) return null;
+  if (node.props.testID === testID) return node;
+  return findHost(node.children, testID);
+}
+
+/**
+ * Every host node in a rendered tree, in document order.
+ *
+ * The reason to walk `toJSON()` rather than `UNSAFE_root.findAll` is that the
+ * latter yields COMPOSITE instances too, so a `memo(fn)` component contributes
+ * two matches for one rendered element and every count is silently doubled —
+ * which reads as "the component rendered the thing twice", not as an artefact
+ * of the query.
+ */
+export function hostNodes(tree: unknown, out: HostNode[] = []): HostNode[] {
+  if (Array.isArray(tree)) {
+    for (const child of tree) hostNodes(child, out);
+    return out;
+  }
+  if (!isHostNode(tree)) return out;
+  out.push(tree);
+  return hostNodes(tree.children, out);
+}
+
+/**
+ * The host nodes a parent laid out. Callers assert the LENGTH themselves —
+ * "exactly one" is the property, and a helper that returned only the first would
+ * hide the second.
+ */
+export function renderedChildren(tree: unknown, hostTestID: string): HostNode[] {
+  const host = findHost(tree, hostTestID);
+  if (host === null) throw new Error(`no host rendered for testID "${hostTestID}"`);
+  return (host.children ?? []).filter(isHostNode);
+}

package/src/__tests__/support/unread-hook-fixture.ts

@@ -0,0 +1,33 @@
+/**
+ * A module that DELIBERATELY throws away one of the values a hook hands back, so
+ * `hook-subscriptions-are-read.test.ts` can prove its detector fires. It carries
+ * both halves of the control: `unreadFlag` is bound and never read, which the
+ * detector must report, and `readFlag` is bound and read, which it must stay
+ * quiet about — otherwise the cheapest way to green the gate would be deleting a
+ * binding that is doing its job.
+ *
+ * Nothing imports this at runtime. bob's `exclude` keeps it out of `lib/`, and
+ * `files: ["src", …]` does ship it inside the tarball's `src/` like the other
+ * 137 test files there — but no entry point reaches it, so no bundler links it.
+ * It is a plain `.ts` with no React import because the
+ * detector reads source, never types: a call named `use…` bound to a name is all
+ * the shape there is.
+ *
+ * The destructuring RENAMES, which is not decoration — it reproduces the shipped
+ * shape (`const { state: pressed, onIn: onPressIn } = useInteractionState()`) and
+ * it is what keeps the control honest. A hook declared in the same file as its
+ * caller mentions its own property names in its return type and its return
+ * object, and the detector counts every occurrence of a spelling as a possible
+ * read, so an unrenamed fixture would be silently unreportable for a reason no
+ * real call site has.
+ */
+
+/** Stands in for a real subscription — a hook by name, with two return values. */
+function useFixtureInteractionState(): { first: boolean; second: boolean } {
+  return { first: false, second: false };
+}
+
+export function fixtureComponentBody(): boolean {
+  const { first: readFlag, second: unreadFlag } = useFixtureInteractionState();
+  return readFlag;
+}

package/src/__tests__/support/worklet-capture-fixture.tsx

@@ -0,0 +1,28 @@
+/**
+ * Positive control for `worklet-captures.test.ts`. Never rendered: the gate
+ * builds a program over this file and reads its worklets.
+ *
+ * `history` carries a `Date` and `slot` a React element — the two shapes the
+ * native worklet runtime cannot copy — and each is captured whole by a mapper.
+ * `hasHistory` is the fix: the primitive derived OUTSIDE the worklet, which the
+ * gate must leave alone.
+ */
+import type { ReactNode } from 'react';
+import { Gesture } from 'react-native-gesture-handler';
+import { useAnimatedStyle, useSharedValue } from 'react-native-reanimated';
+
+interface Conversation {
+  title: string;
+  createdAt: Date;
+}
+
+export function useWorkletCaptureFixture(history: Conversation[] | undefined, slot: ReactNode) {
+  const progress = useSharedValue(0);
+  const hasHistory = Boolean(history);
+  const whole = useAnimatedStyle(() => ({ opacity: history ? progress.value : 1 }), [progress, history]);
+  const derived = useAnimatedStyle(() => ({ opacity: hasHistory ? progress.value : 1 }), [progress, hasHistory]);
+  const pan = Gesture.Pan().onUpdate(() => {
+    progress.value = slot ? 1 : 0;
+  });
+  return { whole, derived, pan };
+}

package/src/input-otp/InputOtp.tsx

@@ -19,13 +19,14 @@ import {
   TEXT_FIELD_TRANSITION_MS,
 } from '../text-field/shared';
 import { TYPE_SCALE } from '../typography/scale';
-import type { InputOtpProps } from './types';
+import type { InputOtpProps, InputOtpType } from './types';
 import { useFieldMembership } from '../field/membership';
 
 /**
  * `InputOtp`: one box per digit, side by side, behaving as ONE value.
  *
- *   box     48 × 48, radius 10, 1px border, shadow-xs
+ *   box     48 × 48, radius 10, 1px border, shadow-xs; narrower (never
+ *           wider) when the row does not fit its container
  *   digit   mono, title-3-medium 18/26 500, centred, tabular numerals
  *   gap     8 between boxes, +12 before each `groupEvery` group
  *   focus   accent-500 border + 2px accent-500 ring (outside the border)
@@ -46,12 +47,19 @@ import { useFieldMembership } from '../field/membership';
  * Digits are monospace so the boxes stay optically even — in a proportional
  * face a `1` is visibly narrower than an `8`.
  *
+ * `type="alphanumeric"` is the same field for codes that carry letters: every
+ * character is upper-cased, anything outside `A`–`Z`/`0`–`9` is dropped (so a
+ * code printed as `ABCDE-12345` pastes whole), and the keyboard is a letters
+ * one with auto-capitalisation instead of the number pad.
+ *
  * Focus paints on EVERY focus, not only keyboard focus: a text input matches
  * `:focus-visible` on a pointer focus too, so the ring shows on click, and
  * state (not CSS) carries it here so native paints the same ring.
  */
 
-const DIGITS_ONLY = /\D/g;
+const NOT_DIGIT = /\D/g;
+/** Filtered BEFORE upper-casing: `'ß'.toUpperCase()` is `SS`, `'ı'` becomes `I`. */
+const NOT_ALPHANUMERIC = /[^A-Za-z0-9]/g;
 const BOX_SIZE = 48;
 const BOX_GAP = 8;
 const GROUP_GAP = 12;
@@ -141,7 +149,34 @@ export function resolveInputOtpBoxPaint(
   return { backgroundColor, borderColor, color, boxShadow };
 }
 
-const clean = (raw: string, length: number) => raw.replace(DIGITS_ONLY, '').slice(0, length);
+/** The characters `type` accepts, in order; everything else is dropped. Pure. */
+export function cleanInputOtpValue(raw: string, type: InputOtpType = 'numeric'): string {
+  return type === 'alphanumeric' ? raw.replace(NOT_ALPHANUMERIC, '').toUpperCase() : raw.replace(NOT_DIGIT, '');
+}
+
+const clean = (raw: string, length: number, type: InputOtpType) => cleanInputOtpValue(raw, type).slice(0, length);
+
+/**
+ * Keyboard and input hints per `type`. The one-time-code autofill hint is
+ * shared (below); only what the keyboard offers differs. Android has no
+ * `ascii-capable`, and its `visible-password` is the letters keyboard without
+ * suggestions or autocorrect — both of which would rewrite a code.
+ *
+ * Alphanumeric sets `inputMode` on web ONLY: React Native gives `inputMode`
+ * precedence over `keyboardType`, so `inputMode: 'text'` on native would open
+ * the ordinary keyboard instead of `ascii-capable` / `visible-password`.
+ */
+const KEYBOARD_PROPS: Record<InputOtpType, Record<string, unknown>> = {
+  numeric: { inputMode: 'numeric', keyboardType: 'number-pad' },
+  alphanumeric: {
+    ...(IS_WEB
+      ? { inputMode: 'text' }
+      : { keyboardType: Platform.OS === 'android' ? 'visible-password' : 'ascii-capable' }),
+    autoCapitalize: 'characters',
+    autoCorrect: false,
+    spellCheck: false,
+  },
+};
 
 const WEB_BOX_STYLE: TextStyle | undefined = IS_WEB
   ? ({
@@ -155,6 +190,7 @@ const WEB_BOX_STYLE: TextStyle | undefined = IS_WEB
 
 export function InputOtp({
   length = 6,
+  type = 'numeric',
   value,
   defaultValue = '',
   onChange,
@@ -186,21 +222,24 @@ export function InputOtp({
   const groupName = membership.accessibilityLabel ?? 'One-time code';
 
   const inputsRef = useRef<Array<TextInput | null>>([]);
-  const [internal, setInternal] = useState(() => clean(defaultValue, length));
+  const [internal, setInternal] = useState(() => clean(defaultValue, length, type));
   const [focusedIndex, setFocusedIndex] = useState<number | null>(null);
   const [hoveredIndex, setHoveredIndex] = useState<number | null>(null);
 
   const controlled = value !== undefined;
-  const code = clean(controlled ? value : internal, length);
+  const code = clean(controlled ? value : internal, length, type);
+  const unit = type === 'alphanumeric' ? 'Character' : 'Digit';
 
   const commit = useCallback(
     (next: string) => {
-      const cleaned = clean(next, length);
+      // `next` is already cleaned per character (a cleared box is a space
+      // placeholder, which `clean` drops along with anything else).
+      const cleaned = clean(next, length, type);
       if (!controlled) setInternal(cleaned);
       onChange?.(cleaned);
       if (cleaned.length === length) onComplete?.(cleaned);
     },
-    [controlled, length, onChange, onComplete],
+    [controlled, length, type, onChange, onComplete],
   );
 
   const focusBox = useCallback(
@@ -210,9 +249,9 @@ export function InputOtp({
     [length],
   );
 
-  /** Writes `digits` starting at `index`, which covers typing, paste and autofill. */
-  const writeFrom = (index: number, digits: string) => {
-    const incoming = digits.replace(DIGITS_ONLY, '');
+  /** Writes `text` starting at `index`, which covers typing, paste and autofill. */
+  const writeFrom = (index: number, text: string) => {
+    const incoming = cleanInputOtpValue(text, type);
     if (incoming === '') return;
     const chars = code.padEnd(length, ' ').split('');
     for (let offset = 0; offset < incoming.length && index + offset < length; offset += 1) {
@@ -281,16 +320,18 @@ export function InputOtp({
                 } as Record<string, unknown>)
               : {})}
             testID={testID ? `${testID}-${index}` : undefined}
-            // `text` with a numeric keyboard rather than a number input: a number
-            // input brings spinners, accepts `e` and `-`, and reports an empty
-            // value for anything it considers malformed.
-            inputMode="numeric"
-            keyboardType="number-pad"
+            // Numeric is `text` with a numeric keyboard rather than a number
+            // input: a number input brings spinners, accepts `e` and `-`, and
+            // reports an empty value for anything it considers malformed.
+            {...KEYBOARD_PROPS[type]}
             autoComplete={Platform.OS === 'android' ? 'sms-otp' : 'one-time-code'}
             textContentType="oneTimeCode"
             autoFocus={autoFocus && index === 0}
-            // Long enough to accept a full autofilled code in one box.
-            maxLength={length}
+            // Long enough to accept a full autofilled or pasted code in one box,
+            // separators included: a browser truncates a paste to `maxLength`
+            // BEFORE the change handler sees it, so `length` alone lost the
+            // last character of `ABCDE-12345`.
+            maxLength={length * 2}
             // Typing into a filled box must REPLACE its digit, so the digit is
             // selected on focus. Web's `selectTextOnFocus` does that. Android's
             // does not: it selects on the input's next layout, and focusing a box
@@ -300,7 +341,7 @@ export function InputOtp({
             selectTextOnFocus={IS_WEB}
             caretHidden={false}
             editable={!disabled}
-            accessibilityLabel={`Digit ${index + 1} of ${length}`}
+            accessibilityLabel={`${unit} ${index + 1} of ${length}`}
             aria-invalid={invalid || undefined}
             aria-disabled={disabled || undefined}
             value={digit === ' ' ? '' : digit}
@@ -315,6 +356,12 @@ export function InputOtp({
             style={[
               {
                 width: BOX_SIZE,
+                // A box shrinks (never grows) when the row is narrower than
+                // its natural width, so ten boxes still fit a phone. `minWidth`
+                // 0 is what lets it: a flex item's automatic minimum is its
+                // specified width, and an `<input>` would otherwise overflow.
+                flexShrink: 1,
+                minWidth: 0,
                 height: BOX_SIZE,
                 marginLeft: gapBefore ? GROUP_GAP : 0,
                 padding: 0,

package/src/input-otp/index.ts

@@ -1,2 +1,2 @@
-export { InputOtp } from './InputOtp';
-export type { InputOtpProps } from './types';
+export { InputOtp, cleanInputOtpValue } from './InputOtp';
+export type { InputOtpProps, InputOtpType } from './types';

package/src/input-otp/types.ts

@@ -1,9 +1,22 @@
 import type { ViewStyleProp } from '../styles';
 
+/**
+ * What a box accepts. `numeric` (the default) keeps digits only;
+ * `alphanumeric` upper-cases and keeps `A`–`Z` and `0`–`9`.
+ */
+export type InputOtpType = 'numeric' | 'alphanumeric';
+
 export interface InputOtpProps extends ViewStyleProp {
-  /** Number of digit boxes, default `6`. */
+  /** Number of boxes, default `6`. */
   length?: number;
-  /** Controlled value. Non-digits are dropped and longer strings truncated to `length`. */
+  /**
+   * `numeric` (default): digits only, number pad. `alphanumeric`: letters and
+   * digits, upper-cased, on a letters keyboard with auto-capitalisation.
+   * Anything else — a dash, a space — is dropped either way, so a pasted
+   * `ABCDE-12345` fills ten boxes.
+   */
+  type?: InputOtpType;
+  /** Controlled value. Characters the `type` does not accept are dropped and longer strings truncated to `length`. */
   value?: string;
   /** Initial value when uncontrolled. */
   defaultValue?: string;