expo-secure-keypad-jsi 0.1.0 → 0.1.1

package/README.md

@@ -38,13 +38,13 @@ and what to use instead.
 
 ## Requirements
 
-- Expo SDK 57+, React Native 0.86+, New Architecture only
+- Expo SDK 54+, React Native 0.81+, New Architecture only
 - A development build (`expo run:*`) or an EAS build, because the module ships
   native code. Expo Go's prebuilt binary does not contain it, and an OTA update
   replaces only JS, so it cannot add a native module either. Once the module is
   in a build, later JS-only changes can still ship over OTA
-- iOS 16.4+
-- Android 7.0 (API 24)+ — the Expo SDK 57 default; the module adds no floor of
+- iOS 15.1+
+- Android 7.0 (API 24)+ — the Expo SDK default; the module adds no floor of
   its own. Ships `arm64-v8a`, `armeabi-v7a`, `x86`, `x86_64`
 
 ## Installation
@@ -99,8 +99,11 @@ export function PinScreen({ serverPublicKeyPem }: { serverPublicKeyPem: string }
 
 **This keypad does not support screen readers on either platform, and there is
 no option to enable it.** The keys are canvas glyphs with no child views, so no
-key is ever an accessibility node, and the container is hidden from a11y
-services and autofill unconditionally.
+key is ever an accessibility node and no digit or character is ever exposed as
+text. On Android the container is also marked not important for accessibility
+and excluded from autofill, so screen readers skip it; a service that requests
+`FLAG_INCLUDE_NOT_IMPORTANT_VIEWS` still sees the keypad as one text-less node
+(its position and size only).
 
 The reason is that an Android `AccessibilityService` can read the node tree and
 input events of other apps — the standard keylogging route — and an app cannot
@@ -336,7 +339,7 @@ Dirty pages: 0x102b64000.
 |---|---|---|
 | JS heap dump, Hermes snapshot | Yes | The value never enters the JS VM |
 | Bridge / JSI traffic sniffing | Yes | Key mapping and the value exist only in native code |
-| Layout Inspector, accessibility tree scraping | Yes | Glyphs are drawn directly; there are no text nodes, and the container is hidden from a11y services unconditionally |
+| Layout Inspector, accessibility tree scraping | Yes | Glyphs are drawn directly; there are no text nodes. A service that asks for not-important views sees only a text-less keypad node (position and size) |
 | Userland memory scan | Mostly | cleanse always, mlock when it succeeds. The value lives for microseconds. Transient copies inside libcrypto do exist |
 | Swap leakage | Conditional (Android) | mlock + MADV_DONTDUMP. On devices with a small `RLIMIT_MEMLOCK` mlock fails silently and only cleanse remains. iOS compresses RAM instead of swapping |
 | Ciphertext replay | Yes (with server support) | The server verifies nonce + timestamp |

package/SecureKeypadJsi.podspec

@@ -15,7 +15,7 @@ Pod::Spec.new do |s|
   s.license        = package['license']
   s.author         = package['author']
   s.homepage       = package['homepage']
-  s.platforms      = { :ios => '16.4' }
+  s.platforms      = { :ios => '15.1' }
   s.swift_version  = '5.9'
   s.source         = { git: 'https://github.com/0610studio/expo-secure-keypad-jsi' }
   s.static_framework = true

package/android/src/main/java/expo/modules/securekeypadjsi/SecureKeypadJsiView.kt

@@ -295,9 +295,8 @@ class SecureKeypadJsiView(context: Context, appContext: AppContext) :
 
   private fun applyAccessibilityHardening() {
     // Unconditional. The keys are canvas glyphs with no child nodes, so a11y
-    // services could never read them anyway; hiding the container too denies
-    // a malicious AccessibilityService even the fact that a keypad is here.
-    // The keypad is not screen-reader usable by design — see README.
+    // services could never read them anyway; this keeps screen readers off the
+    // container too. The keypad is not screen-reader usable by design — see README.
     importantForAccessibility = IMPORTANT_FOR_ACCESSIBILITY_NO_HIDE_DESCENDANTS
     if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
       importantForAutofill = IMPORTANT_FOR_AUTOFILL_NO_EXCLUDE_DESCENDANTS

package/docs/README.ko.md

@@ -29,7 +29,7 @@ RSA-OAEP 암호화되어 **암호문만** JS로 전달됩니다.
 
 ## 요구 사항
 
-Expo SDK 57+, React Native 0.86+, New Architecture 전용
+Expo SDK 54+, React Native 0.81+, New Architecture 전용
 
 ## 설치
 
@@ -268,7 +268,7 @@ Dirty pages: 0x102b64000.
 |---|---|---|
 | JS 힙 덤프, Hermes 스냅샷 | O | 입력값이 JS VM에 진입하지 않음 |
 | 브릿지·JSI 트래픽 스니핑 | O | 키 매핑과 입력값이 네이티브에만 존재 |
-| Layout Inspector, 접근성 트리 스크래핑 | O | 글리프 직접 렌더, 텍스트 노드 없음. 컨테이너도 접근성 서비스에서 무조건 숨김 |
+| Layout Inspector, 접근성 트리 스크래핑 | O | 글리프 직접 렌더, 텍스트 노드 없음. 중요하지 않은 뷰까지 요청하는 서비스에는 텍스트 없는 키패드 노드(위치·크기)만 보임 |
 | 유저랜드 메모리 스캔 | 대체로 O | cleanse는 항상, mlock은 성공 시. 입력값 수명 마이크로초. libcrypto 내부 일시 사본은 존재 |
 | 스왑 누출 | 조건부 O (Android) | mlock + MADV_DONTDUMP. `RLIMIT_MEMLOCK`이 작은 기기에서 mlock이 실패하면 조용히 cleanse만 남음. iOS는 RAM 압축이라 해당 없음 |
 | 암호문 재전송 | O (서버 협조 시) | nonce + timestamp를 서버가 검증 |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "expo-secure-keypad-jsi",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Secure PIN / password keypad for Expo (New Architecture). Natively rendered shuffled keys, the entered value never enters the JS runtime, mlock'd C++ buffer, OpenSSL RSA-OAEP ciphertext only. Screen-capture blocking and device integrity are the host app's job.",
   "main": "build/index.js",
   "types": "build/index.d.ts",
@@ -73,8 +73,8 @@
     }
   },
   "peerDependencies": {
-    "expo": ">=57.0.0",
+    "expo": ">=54.0.0",
     "react": ">=19.0.0",
-    "react-native": ">=0.86.0"
+    "react-native": ">=0.81.0"
   }
 }