expo-secure-keypad-jsi 0.1.0 → 0.1.2

package/README.md

@@ -38,13 +38,13 @@ and what to use instead.
 
 ## Requirements
 
-- Expo SDK 57+, React Native 0.86+, New Architecture only
+- Expo SDK 54+, React Native 0.81+, New Architecture only
 - A development build (`expo run:*`) or an EAS build, because the module ships
   native code. Expo Go's prebuilt binary does not contain it, and an OTA update
   replaces only JS, so it cannot add a native module either. Once the module is
   in a build, later JS-only changes can still ship over OTA
-- iOS 16.4+
-- Android 7.0 (API 24)+ — the Expo SDK 57 default; the module adds no floor of
+- iOS 15.1+
+- Android 7.0 (API 24)+ — the Expo SDK default; the module adds no floor of
   its own. Ships `arm64-v8a`, `armeabi-v7a`, `x86`, `x86_64`
 
 ## Installation
@@ -89,7 +89,7 @@ export function PinScreen({ serverPublicKeyPem }: { serverPublicKeyPem: string }
 | `publicKey` | `string` | required | RSA 2048–8192 bit PEM. Weaker keys are rejected |
 | `keypadType` | `'digit' \| 'full'` | `'digit'` | `'full'` is the QWERTY keyboard |
 | `minLength` / `maxLength` | `number` | `4` / `6` (digit), `4` / `64` (full) | Valid range is 4–12 (digit) and 4–64 (full). An out-of-range **prop value** is clamped into it (`maxLength={20}` on the digit pad behaves as 12), and a `minLength` above `maxLength` is lowered to it. Once the input reaches `maxLength`, further key presses are ignored without an error |
-| `shuffle` | `'mount' \| 'perKey' \| 'off'` | `'mount'` | When the layout is reshuffled |
+| `shuffle` | `'mount' \| 'perKey' \| 'off'` | `'mount'` | When the layout is reshuffled. `'off'` lays the digits out phone-style, 1–9 then 0 |
 | `autoSubmit` | `boolean` | `true` (digit), `false` (full) | Encrypt automatically once `maxLength` is reached |
 | `theme` | `KeypadTheme` | see [Theme](#theme) | Colours, corner radius and text size |
 | `accessory` | `ReactNode` | | React content rendered directly above the keypad. The place for a masked-length indicator or a confirm button when the keypad covers the field it fills (bottom sheets) |
@@ -99,8 +99,11 @@ export function PinScreen({ serverPublicKeyPem }: { serverPublicKeyPem: string }
 
 **This keypad does not support screen readers on either platform, and there is
 no option to enable it.** The keys are canvas glyphs with no child views, so no
-key is ever an accessibility node, and the container is hidden from a11y
-services and autofill unconditionally.
+key is ever an accessibility node and no digit or character is ever exposed as
+text. On Android the container is also marked not important for accessibility
+and excluded from autofill, so screen readers skip it; a service that requests
+`FLAG_INCLUDE_NOT_IMPORTANT_VIEWS` still sees the keypad as one text-less node
+(its position and size only).
 
 The reason is that an Android `AccessibilityService` can read the node tree and
 input events of other apps — the standard keylogging route — and an app cannot
@@ -128,11 +131,20 @@ Examples: [InlineDemo](example/demos/InlineDemo.tsx),
 
 ### QWERTY keyboard (`keypadType: 'full'`)
 
-A password keyboard for upper- and lowercase letters, digits, and the 32 ASCII
-specials (``!@#$%^&*()-_=+[]{}\|;:'",.<>?/`~``). Space is not accepted.
+A password keyboard for upper- and lowercase letters, digits, the 32 ASCII
+specials (``!@#$%^&*()-_=+[]{}\|;:'",.<>?/`~``), and the 33 non-ASCII symbols
+the stock iOS and Android (Gboard, Samsung Keyboard) keyboards show on their
+symbol layers: `₩ € £ ¥ ¢ ¤ § ¶ © ® ™ ✓ ° • × ÷ √ π ∆ ¡ ¿ 《 》 ○ ● □ ■ ▪ ◇ ☆ ♤ ♡ ♧`.
+Long-press alternates are not included. Space is not accepted.
 
 - Layout: digit row / `qwertyuiop` / `asdfghjkl` / `⇧ zxcvbnm ⌫` / `[!#1] [✕] [⏎]`.
-  `!#1` switches to the symbol layer
+  `!#1` switches to the symbol layer, where the `1/2` key flips between the
+  ASCII page and the non-ASCII page (`2/2`)
+- Length: `minLength` / `maxLength` and `onDigitCountChanged` count characters.
+  The non-ASCII symbols are 2–3 bytes each in UTF-8 and the secret field holds
+  64 bytes, so a symbol-heavy input can stop accepting keys before `maxLength`
+  (21 × `♡` = 63 bytes, for example). The extra key is ignored like any press
+  past `maxLength`
 - Shuffle: the letter rows keep the standard QWERTY order while the digit row is
   fully shuffled, and each letter row gets one blank dummy key at a random slot.
   `'perKey'` redraws after every keystroke
@@ -152,17 +164,27 @@ Android, points on iOS), so the same number looks the same on both.
 |---|---|---|---|
 | `keyColor` | `string` | `#1C1C1E` | Key background |
 | `keyTextColor` | `string` | `#FFFFFF` | Digit and letter glyphs |
-| `actionTextColor` | `string` | `#8E8E93` | Action keys (`⌫`, `✕`, `⇧`, `!#1`, `⏎`) |
+| `actionTextColor` | `string` | `#8E8E93` | Action keys (`⌫`, `✕`, `⇧`, `!#1`, `1/2`, `⏎`), including `clearKeyLabel` / `submitKeyLabel` text |
 | `cornerRadius` | `number` | `12` (digit), `8` (full) | Key corner radius |
 | `digitTextSize` | `number` | `32` | Base glyph size; despite the name it drives `keypadType: 'full'` too. Each kind of key scales off it — digit keys 1×, action keys 0.7×; on the QWERTY keyboard characters 0.6× and action keys 0.5×. The factors are the same on both platforms |
-| `pressedHighlight` | `boolean` | `true` | A held key dims to 70% opacity. `false` disables the press highlight entirely |
-| `fontFamily` | `string` | system font | Font for the digit / character glyphs. Any name the platform already resolves: a family registered by `expo-font` (`useFonts` / `loadAsync`), a font bundled at build time, or a system family. An unresolvable name falls back to the system font instead of throwing |
-
-`fontFamily` covers only the glyphs drawn from a value — digits, letters,
-symbols. The action glyphs (`⌫`, `✕`, `⇧`, `⏎`) always render in the system
-font: most custom fonts have no glyph for them, and a missing glyph would draw
-as tofu (□) on an unlabelled key. For `keypadType: 'full'`, pick a font that
-covers all of printable ASCII (0x21~0x7E) or some keys will show tofu.
+| `pressedHighlight` | `boolean` | `true` | Whether a held key shows a press effect. `false` disables it entirely, `pressedKeyColor` included |
+| `pressedKeyColor` | `string` | `keyColor` at 70% opacity | Background of a held key. On the digit pad the `✕` / `⌫` cells, which have no background, get this fill while held |
+| `clearKeyLabel` | `string` | `✕` | Text shown on the clear key instead of the glyph, e.g. `"취소"` / `"Cancel"` |
+| `submitKeyLabel` | `string` | `⏎` | Text shown on the submit key instead of the glyph, e.g. `"완료"` / `"Done"`. `keypadType: 'full'` only — the digit pad has no submit key |
+| `fontFamily` | `string` | system font | Font for the digit / character / symbol glyphs. Any name the platform already resolves: a family registered by `expo-font` (`useFonts` / `loadAsync`), a font bundled at build time, or a system family. An unresolvable name falls back to the system font instead of throwing |
+
+`fontFamily` covers every glyph drawn from a value — digits, letters, and both
+symbol pages. A character the font has no glyph for is drawn by the platform's
+per-character font fallback (a system font), not as tofu: with Space Mono, for
+example, `€` and `π` come from Space Mono while `♡` and `₩` come from the
+fallback. The action glyphs (`⌫`, `✕`, `⇧`, `⏎`) always render in the system
+font, so the action keys look the same whatever font the app picks. For
+`keypadType: 'full'`, a font that covers printable ASCII (0x21~0x7E) keeps
+every letter and digit key in one face.
+
+`clearKeyLabel` / `submitKeyLabel` render in the system font with
+`actionTextColor`, at the action-glyph size, and shrink to fit when the text is
+wider than the key. Leaving them unset (or `""`) keeps the glyphs.
 `example/demos/FontDemo.tsx` is a working screen with two `expo-font` families.
 
 There is no `backgroundColor` theme field: the keypad is a regular view, so its
@@ -213,8 +235,8 @@ the same structure.
 |---|---|---|---|
 | 0 | 2 | magic `"SK"` | Fixed. Confirms the plaintext came from this library |
 | 2 | 1 | version = 2 | Version of this 96-byte layout. Reject anything you don't know |
-| 3 | 1 | secretLength (4–64) | Actual input length; where to cut `secret` |
-| 4 | 64 | secret (ASCII, zero-padded) | The input. Printable ASCII (0x21–0x7E), rest is zero |
+| 3 | 1 | secretLength (4–64) | Input length **in bytes**; where to cut `secret` |
+| 4 | 64 | secret (UTF-8, zero-padded) | The input. Printable ASCII (0x21–0x7E) is one byte each; the full keyboard's non-ASCII symbols are 2–3 bytes. Rest is zero |
 | 68 | 16 | nonce | Single-use random. Must match the envelope's `nonce` |
 | 84 | 8 | timestamp (unix seconds, big endian) | When it was encrypted; for the freshness check |
 | 92 | 4 | reserved | Always zero. Room for the next version |
@@ -232,11 +254,17 @@ const plain = crypto.privateDecrypt(
   Buffer.from(msg.ct, 'base64')
 );
 if (plain.subarray(0, 2).toString() !== 'SK' || plain[2] !== 2) throw new Error('bad payload');
-const secret = plain.subarray(4, 4 + plain[3]).toString('ascii');
+const secret = plain.subarray(4, 4 + plain[3]).toString('utf8');
 const nonce = plain.subarray(68, 84).toString('base64');
 const timestamp = Number(plain.readBigUInt64BE(84));
 ```
 
+Decode `secret` as UTF-8. Digit PINs and ASCII-only passwords are
+byte-identical to earlier releases, so an `'ascii'` decoder keeps working for
+them, but it garbles `₩` or `♡`. The symbols are sent exactly as the stock
+keyboards produce them (`₩` is U+20A9, not the fullwidth U+FFE6), so a
+password set through an ordinary text field compares equal byte for byte.
+
 What the server must verify:
 
 - magic and version
@@ -336,7 +364,7 @@ Dirty pages: 0x102b64000.
 |---|---|---|
 | JS heap dump, Hermes snapshot | Yes | The value never enters the JS VM |
 | Bridge / JSI traffic sniffing | Yes | Key mapping and the value exist only in native code |
-| Layout Inspector, accessibility tree scraping | Yes | Glyphs are drawn directly; there are no text nodes, and the container is hidden from a11y services unconditionally |
+| Layout Inspector, accessibility tree scraping | Yes | Glyphs are drawn directly; there are no text nodes. A service that asks for not-important views sees only a text-less keypad node (position and size) |
 | Userland memory scan | Mostly | cleanse always, mlock when it succeeds. The value lives for microseconds. Transient copies inside libcrypto do exist |
 | Swap leakage | Conditional (Android) | mlock + MADV_DONTDUMP. On devices with a small `RLIMIT_MEMLOCK` mlock fails silently and only cleanse remains. iOS compresses RAM instead of swapping |
 | Ciphertext replay | Yes (with server support) | The server verifies nonce + timestamp |

package/SecureKeypadJsi.podspec

@@ -15,7 +15,7 @@ Pod::Spec.new do |s|
   s.license        = package['license']
   s.author         = package['author']
   s.homepage       = package['homepage']
-  s.platforms      = { :ios => '16.4' }
+  s.platforms      = { :ios => '15.1' }
   s.swift_version  = '5.9'
   s.source         = { git: 'https://github.com/0610studio/expo-secure-keypad-jsi' }
   s.static_framework = true

package/android/src/main/cpp/JniBridge.cpp

@@ -68,8 +68,8 @@ Java_expo_modules_securekeypadjsi_PinSessionHandle_nativePress(JNIEnv*, jobject,
 
 JNIEXPORT jint JNICALL
 Java_expo_modules_securekeypadjsi_PinSessionHandle_nativePressKey(
-    JNIEnv*, jobject, jlong ptr, jint asciiChar) {
-  return esk_keypad_press_key(asKeypad(ptr), static_cast<uint8_t>(asciiChar));
+    JNIEnv*, jobject, jlong ptr, jint codePoint) {
+  return esk_keypad_press_key(asKeypad(ptr), static_cast<uint32_t>(codePoint));
 }
 
 JNIEXPORT jint JNICALL
@@ -102,7 +102,8 @@ Java_expo_modules_securekeypadjsi_PinSessionHandle_nativeSubmit(JNIEnv* env,
 JNIEXPORT jbyteArray JNICALL
 Java_expo_modules_securekeypadjsi_PinSessionHandle_nativeShuffledLayout(
     JNIEnv* env, jobject, jlong ptr) {
-  uint8_t layout[10] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9};
+  // Unshuffled fallback, same 1..9,0 order as identityLayout() in Kotlin.
+  uint8_t layout[10] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 0};
   esk_keypad_shuffled_layout(asKeypad(ptr), layout);
   jbyteArray arr = env->NewByteArray(10);
   env->SetByteArrayRegion(arr, 0, 10, reinterpret_cast<jbyte*>(layout));

package/android/src/main/java/expo/modules/securekeypadjsi/KeyboardCanvasView.kt

@@ -13,7 +13,7 @@ import java.security.SecureRandom
 
 /**
  * Full QWERTY secure keyboard drawn with [Canvas] and no child views, so key
- * glyphs never become scrapeable text. Touches resolve to a final ASCII value
+ * glyphs never become scrapeable text. Touches resolve to a final code point
  * here (shift and symbol layer included); the on-screen position never leaves
  * this class.
  *
@@ -26,8 +26,8 @@ import java.security.SecureRandom
 class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
 
   interface Listener {
-    /** Final ASCII character — shift/layer already applied. */
-    fun onKeyPressed(asciiChar: Int)
+    /** Final Unicode code point — shift/layer already applied. */
+    fun onKeyPressed(codePoint: Int)
     fun onBackspace()
     fun onClear()
     fun onDone()
@@ -38,7 +38,7 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
 
   var shuffleMode: KeypadCanvasView.ShuffleMode = KeypadCanvasView.ShuffleMode.MOUNT
 
-  /** Shuffled 0..9 from the native core; identity order when shuffle is off. */
+  /** Shuffled 0..9 from the native core; 1..9,0 when shuffle is off. */
   var digitsProvider: (() -> ByteArray)? = null
 
   private val density = context.resources.displayMetrics.density
@@ -51,6 +51,9 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
   override var fontFamily: String? = null
 
   override var pressedHighlight: Boolean = true
+  override var pressedKeyColor: Int? = null
+  override var clearKeyLabel: String? = null
+  override var submitKeyLabel: String? = null
 
   private companion object {
     const val ACTION_SHIFT = -1
@@ -59,18 +62,26 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
     const val ACTION_DONE = -4
     const val ACTION_TOGGLE = -5
     const val DUMMY = -6
+    const val ACTION_SYMBOL_PAGE = -7
 
     const val ROW_QWERTY_TOP = "qwertyuiop"
     const val ROW_QWERTY_MID = "asdfghjkl"
     const val ROW_QWERTY_BOT = "zxcvbnm"
-    // All 32 printable ASCII specials, three rows + a short fourth row.
+    // Symbol page 1/2: all 32 printable ASCII specials, three rows + a short fourth row.
     const val ROW_SYM_0 = "!@#$%^&*()"
     const val ROW_SYM_1 = "-_=+[]{}\\|"
     const val ROW_SYM_2 = ";:'\",.<>?/"
     const val ROW_SYM_3 = "`~"
+    // Symbol page 2/2: the non-ASCII symbols the stock iOS / Gboard / Samsung
+    // keyboards show. Must match kExtraSymbols in common/include/esk/SecureBuffer.h,
+    // or the core silently drops the key.
+    const val ROW_EXT_0 = "₩€£¥¢¤§¶©®"
+    const val ROW_EXT_1 = "™✓°•×÷√π∆"
+    const val ROW_EXT_2 = "¡¿《》○●□■▪"
+    const val ROW_EXT_3 = "◇☆♤♡♧"
   }
 
-  private enum class Layer { LETTERS, SYMBOLS }
+  private enum class Layer { LETTERS, SYMBOLS, SYMBOLS_EXTRA }
   private enum class ShiftState { OFF, ONE_SHOT, LOCK }
 
   private data class Key(val code: Int, val weight: Float = 1f)
@@ -87,6 +98,9 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
   private var keyRects = ArrayList<Pair<RectF, Key>>(48)
 
   private val keyPaint = Paint(Paint.ANTI_ALIAS_FLAG).apply { style = Paint.Style.FILL }
+  // Every character key, symbols included, uses the theme font. A glyph that
+  // font lacks (Space Mono has no ♡) is drawn by the typeface's built-in
+  // system fallback, per character, instead of tofu.
   private val textPaint = Paint(Paint.ANTI_ALIAS_FLAG).apply { textAlign = Paint.Align.CENTER }
   private val actionPaint = Paint(Paint.ANTI_ALIAS_FLAG).apply { textAlign = Paint.Align.CENTER }
   private val gap = 6f * density
@@ -134,15 +148,27 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
         it.addAll(letters)
         it.add(Key(ACTION_BACKSPACE, 1.5f))
       })
-    } else {
+    } else if (layer == Layer.SYMBOLS) {
       rows.add(ArrayList<Key>(ROW_SYM_0.map { Key(it.code) }).also { withDummy(it, 4) })
       rows.add(ArrayList<Key>(ROW_SYM_1.map { Key(it.code) }).also { withDummy(it, 0) })
       rows.add(ArrayList<Key>(ROW_SYM_2.map { Key(it.code) }).also { withDummy(it, 1) })
       rows.add(ArrayList<Key>().also {
+        it.add(Key(ACTION_SYMBOL_PAGE, 1.5f))
         val syms = ArrayList<Key>(ROW_SYM_3.map { c -> Key(c.code, 2f) })
         withDummy(syms, 3)
         it.addAll(syms)
-        it.add(Key(ACTION_BACKSPACE, 2f))
+        it.add(Key(ACTION_BACKSPACE, 1.5f))
+      })
+    } else {
+      rows.add(ArrayList<Key>(ROW_EXT_0.map { Key(it.code) }).also { withDummy(it, 4) })
+      rows.add(ArrayList<Key>(ROW_EXT_1.map { Key(it.code) }).also { withDummy(it, 0) })
+      rows.add(ArrayList<Key>(ROW_EXT_2.map { Key(it.code) }).also { withDummy(it, 1) })
+      rows.add(ArrayList<Key>().also {
+        it.add(Key(ACTION_SYMBOL_PAGE, 1.5f))
+        val syms = ArrayList<Key>(ROW_EXT_3.map { c -> Key(c.code) })
+        withDummy(syms, 3)
+        it.addAll(syms)
+        it.add(Key(ACTION_BACKSPACE, 1.5f))
       })
     }
     rows.add(listOf(Key(ACTION_TOGGLE, 1f), Key(ACTION_CLEAR, 1f), Key(ACTION_DONE, 1f)))
@@ -180,9 +206,10 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
     DUMMY -> null
     ACTION_SHIFT -> "⇧"
     ACTION_BACKSPACE -> "⌫"
-    ACTION_CLEAR -> "✕"
-    ACTION_DONE -> "⏎"
+    ACTION_CLEAR -> clearKeyLabel ?: "✕"
+    ACTION_DONE -> submitKeyLabel ?: "⏎"
     ACTION_TOGGLE -> if (layer == Layer.LETTERS) "!#1" else "abc"
+    ACTION_SYMBOL_PAGE -> if (layer == Layer.SYMBOLS) "1/2" else "2/2"
     else -> {
       val c = key.code.toChar()
       if (shift != ShiftState.OFF && c in 'a'..'z') c.uppercaseChar().toString() else c.toString()
@@ -200,7 +227,7 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
     for ((index, entry) in keyRects.withIndex()) {
       val (rect, key) = entry
       val held = pressedHighlight && index == pressedIndex
-      keyPaint.color = pressedDim(keyColor, held)
+      keyPaint.color = keyFill(held)
       canvas.drawRoundRect(rect, r, r, keyPaint)
       val label = labelFor(key)
       if (label != null) {
@@ -211,7 +238,9 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
         } else {
           actionTextColor
         }
-        drawCentered(canvas, label, rect, paint)
+        val custom = (key.code == ACTION_CLEAR && clearKeyLabel != null) ||
+          (key.code == ACTION_DONE && submitKeyLabel != null)
+        drawCentered(canvas, label, rect, paint, fit = custom)
       }
     }
   }
@@ -271,6 +300,11 @@ class KeyboardCanvasView(context: Context) : View(context), ThemedKeypadView {
         layoutKeys()
         invalidate()
       }
+      ACTION_SYMBOL_PAGE -> {
+        layer = if (layer == Layer.SYMBOLS) Layer.SYMBOLS_EXTRA else Layer.SYMBOLS
+        layoutKeys()
+        invalidate()
+      }
       else -> {
         var c = key.code.toChar()
         if (shift != ShiftState.OFF && c in 'a'..'z') c = c.uppercaseChar()

package/android/src/main/java/expo/modules/securekeypadjsi/KeypadCanvasView.kt

@@ -44,6 +44,10 @@ class KeypadCanvasView(context: Context) : View(context), ThemedKeypadView {
   override var fontFamily: String? = null
 
   override var pressedHighlight: Boolean = true
+  override var pressedKeyColor: Int? = null
+  override var clearKeyLabel: String? = null
+  // No submit key on the digit pad (autoSubmit / ref.submit()); kept for the interface.
+  override var submitKeyLabel: String? = null
 
   var layoutProvider: (() -> ByteArray)? = null
 
@@ -111,17 +115,23 @@ class KeypadCanvasView(context: Context) : View(context), ThemedKeypadView {
 
       val digit = digitAtCell[cell]
       val held = pressedHighlight && cell == pressedCell
-      keyPaint.color = pressedDim(keyColor, held)
-      // Action cells have no key fill, so the glyph itself carries the dim.
-      actionPaint.color = pressedDim(actionTextColor, held)
+      val r = keyCornerRadiusDp * density
+      keyPaint.color = keyFill(held)
+      // Action cells have no key fill. A held one gets the pressedKeyColor
+      // fill when the theme sets it; otherwise the glyph itself carries the dim.
+      val actionFill = held && digit < 0 && pressedKeyColor != null
+      actionPaint.color = if (actionFill) actionTextColor else pressedDim(actionTextColor, held)
+      if (actionFill && (cell == backspaceCell || cell == clearCell)) {
+        canvas.drawRoundRect(rect, r, r, keyPaint)
+      }
       when {
         digit >= 0 -> {
-          val r = keyCornerRadiusDp * density
           canvas.drawRoundRect(rect, r, r, keyPaint)
           drawCentered(canvas, digit.toString(), rect, textPaint)
         }
         cell == backspaceCell -> drawCentered(canvas, "⌫", rect, actionPaint)
-        cell == clearCell -> drawCentered(canvas, "✕", rect, actionPaint)
+        cell == clearCell ->
+          drawCentered(canvas, clearKeyLabel ?: "✕", rect, actionPaint, fit = clearKeyLabel != null)
       }
     }
   }

package/android/src/main/java/expo/modules/securekeypadjsi/PinSessionHandle.kt

@@ -22,8 +22,8 @@ class PinSessionHandle(minLength: Int, maxLength: Int, keypadType: Int = TYPE_DI
 
   fun press(digit: Int): Int = if (ptr != 0L) nativePress(ptr, digit) else 0
 
-  /** Final ASCII char (view resolves shift/layer first). Out-of-charset is ignored. */
-  fun pressKey(asciiChar: Int): Int = if (ptr != 0L) nativePressKey(ptr, asciiChar) else 0
+  /** Final code point (view resolves shift/layer first). Out-of-charset is ignored. */
+  fun pressKey(codePoint: Int): Int = if (ptr != 0L) nativePressKey(ptr, codePoint) else 0
   fun backspace(): Int = if (ptr != 0L) nativeBackspace(ptr) else 0
   fun clear() { if (ptr != 0L) nativeClear(ptr) }
 
@@ -45,7 +45,7 @@ class PinSessionHandle(minLength: Int, maxLength: Int, keypadType: Int = TYPE_DI
   private external fun nativeDestroy(ptr: Long)
   private external fun nativeArm(ptr: Long, pem: String): String?
   private external fun nativePress(ptr: Long, digit: Int): Int
-  private external fun nativePressKey(ptr: Long, asciiChar: Int): Int
+  private external fun nativePressKey(ptr: Long, codePoint: Int): Int
   private external fun nativeBackspace(ptr: Long): Int
   private external fun nativeClear(ptr: Long)
   private external fun nativeSubmit(ptr: Long): String

package/android/src/main/java/expo/modules/securekeypadjsi/SecureKeypadJsiView.kt

@@ -123,9 +123,13 @@ class SecureKeypadJsiView(context: Context, appContext: AppContext) :
     (t["cornerRadius"] as? Number)?.let { v.keyCornerRadiusDp = it.toFloat() }
     (t["digitTextSize"] as? Number)?.let { v.digitTextSizeDp = it.toFloat() }
     (t["pressedHighlight"] as? Boolean)?.let { v.pressedHighlight = it }
-    // Absent key vs. explicit null: both mean "system font", so this one is
-    // assigned unconditionally instead of only on a hit.
+    // Absent key vs. explicit null: both mean "back to the default" (system
+    // font, 70% dim, the ✕ / ⏎ glyphs), so these are assigned unconditionally
+    // instead of only on a hit.
     v.fontFamily = (t["fontFamily"] as? String)?.takeIf { it.isNotEmpty() }
+    v.pressedKeyColor = (t["pressedKeyColor"] as? String)?.let { ThemeColor.parse(it) }
+    v.clearKeyLabel = (t["clearKeyLabel"] as? String)?.takeIf { it.isNotEmpty() }
+    v.submitKeyLabel = (t["submitKeyLabel"] as? String)?.takeIf { it.isNotEmpty() }
     v.invalidate()
   }
 
@@ -225,9 +229,9 @@ class SecureKeypadJsiView(context: Context, appContext: AppContext) :
 
   // KeyboardCanvasView.Listener (full keyboard)
 
-  override fun onKeyPressed(asciiChar: Int) {
+  override fun onKeyPressed(codePoint: Int) {
     val h = handle ?: return
-    val count = h.pressKey(asciiChar)
+    val count = h.pressKey(codePoint)
     if (count < 0) return
     reportCount(count)
     if (autoSubmit && count >= effectiveMaxLength()) submit()
@@ -295,9 +299,8 @@ class SecureKeypadJsiView(context: Context, appContext: AppContext) :
 
   private fun applyAccessibilityHardening() {
     // Unconditional. The keys are canvas glyphs with no child nodes, so a11y
-    // services could never read them anyway; hiding the container too denies
-    // a malicious AccessibilityService even the fact that a keypad is here.
-    // The keypad is not screen-reader usable by design — see README.
+    // services could never read them anyway; this keeps screen readers off the
+    // container too. The keypad is not screen-reader usable by design — see README.
     importantForAccessibility = IMPORTANT_FOR_ACCESSIBILITY_NO_HIDE_DESCENDANTS
     if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
       importantForAutofill = IMPORTANT_FOR_AUTOFILL_NO_EXCLUDE_DESCENDANTS

package/android/src/main/java/expo/modules/securekeypadjsi/ThemedKeypadView.kt

@@ -9,8 +9,11 @@ import android.graphics.RectF
 import android.graphics.Typeface
 import com.facebook.react.common.assets.ReactFontManager
 
-/** Identity 0..9 order: the fallback whenever the native CSPRNG layout is unavailable. */
-internal fun identityLayout(): ByteArray = ByteArray(10) { it.toByte() }
+/**
+ * Unshuffled order, phone-keypad style (1..9 then 0): what `shuffle: 'off'`
+ * shows, and the fallback whenever the native CSPRNG layout is unavailable.
+ */
+internal fun identityLayout(): ByteArray = ByteArray(10) { ((it + 1) % 10).toByte() }
 
 /**
  * The theme surface both canvas views expose, so [SecureKeypadJsiView] applies
@@ -29,6 +32,15 @@ internal interface ThemedKeypadView {
   /** false hides the press feedback entirely, for apps that cannot block capture. */
   var pressedHighlight: Boolean
 
+  /** Fill of a held key; null keeps the default 70% dim of [keyColor]. */
+  var pressedKeyColor: Int?
+
+  /** Text drawn instead of the ✕ glyph; null keeps the glyph. */
+  var clearKeyLabel: String?
+
+  /** Text drawn instead of the ⏎ glyph (full keyboard only); null keeps the glyph. */
+  var submitKeyLabel: String?
+
   fun invalidate()
 }
 
@@ -43,11 +55,25 @@ internal fun pressedDim(color: Int, held: Boolean): Int =
     color
   }
 
-/** Shared by both canvas views: baseline-corrected centred text. */
-internal fun drawCentered(canvas: Canvas, text: String, r: RectF, paint: Paint) {
+/** Key fill: [ThemedKeypadView.pressedKeyColor] while held when set, else the 70% dim. */
+internal fun ThemedKeypadView.keyFill(held: Boolean): Int =
+  if (held) pressedKeyColor ?: pressedDim(keyColor, true) else keyColor
+
+/**
+ * Shared by both canvas views: baseline-corrected centred text. [fit] shrinks
+ * the text to the key's width — for theme labels, whose length is the app's.
+ */
+internal fun drawCentered(canvas: Canvas, text: String, r: RectF, paint: Paint, fit: Boolean = false) {
+  val size = paint.textSize
+  if (fit) {
+    val maxWidth = r.width() * 0.85f
+    val width = paint.measureText(text)
+    if (width > maxWidth && width > 0f) paint.textSize = size * maxWidth / width
+  }
   val cx = r.centerX()
   val cy = r.centerY() - (paint.descent() + paint.ascent()) / 2f
   canvas.drawText(text, cx, cy, paint)
+  paint.textSize = size
 }
 
 

package/build/SecureKeypadJsi.types.d.ts

@@ -10,10 +10,11 @@ export type KeypadErrorPhase = 'arm' | 'submit' | 'input';
 export type ShuffleMode = 'mount' | 'perKey' | 'off';
 /**
  * 'digit' = 3x4 shuffled PIN pad.
- * 'full' = QWERTY keyboard with shift + symbol layers. The digit
- * row is fully shuffled and each character row gets a blank dummy key at a
- * random slot, so the same character is not at the same coordinate across
- * sessions. Layout and shift state live only in native code.
+ * 'full' = QWERTY keyboard with shift + two symbol pages (ASCII specials, then
+ * the non-ASCII symbols of the stock iOS / Android keyboards such as ₩ and ♡).
+ * The digit row is fully shuffled and each character row gets a blank dummy
+ * key at a random slot, so the same character is not at the same coordinate
+ * across sessions. Layout and shift state live only in native code.
  */
 export type KeypadType = 'digit' | 'full';
 export interface KeypadError {
@@ -42,18 +43,34 @@ export interface KeypadTheme {
      * font bundled at build time, or a system family ("Courier", "monospace").
      * Unresolvable names fall back to the system font instead of throwing.
      *
-     * NOTE: the action glyphs (⌫ ✕ ⇧ ⏎) always render in the system font. Most
-     * custom fonts have no glyph for them, and a missing glyph would draw as
-     * tofu (□) on an unlabelled key. For `keypadType: 'full'`, pick a font that
-     * covers all of printable ASCII (0x21~0x7E) or some keys will show tofu.
+     * Applies to every character key, symbols (₩ ♡ …) included. A character
+     * the font has no glyph for is drawn by the platform's per-character font
+     * fallback (a system font), not as tofu. The action glyphs (⌫ ✕ ⇧ ⏎) always
+     * render in the system font.
      */
     fontFamily?: string;
     /**
-     * Whether a held key dims to 70% opacity (default true). NOTE: any visible
+     * Whether a held key shows a press effect (default true). NOTE: any visible
      * press effect lets a screen recording reconstruct the input — block capture
      * at the app level (FLAG_SECURE / UIScreen.isCaptured) or pass false here.
      */
     pressedHighlight?: boolean;
+    /**
+     * Background of a held key. Unset = `keyColor` at 70% opacity. On the digit
+     * pad the ✕ / ⌫ cells, which have no background, get this fill while held.
+     * Ignored when `pressedHighlight` is false.
+     */
+    pressedKeyColor?: string;
+    /**
+     * Text shown on the clear key instead of ✕, e.g. "취소". Drawn in the system
+     * font with `actionTextColor`, shrunk to fit the key. Unset or "" = ✕.
+     */
+    clearKeyLabel?: string;
+    /**
+     * Text shown on the submit key instead of ⏎, e.g. "완료". `keypadType:
+     * 'full'` only — the digit pad has no submit key. Unset or "" = ⏎.
+     */
+    submitKeyLabel?: string;
 }
 export type OnCompleteEvent = {
     nativeEvent: {

package/build/SecureKeypadJsi.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecureKeypadJsi.types.d.ts","sourceRoot":"","sources":["../src/SecureKeypadJsi.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AACpE,MAAM,MAAM,wBAAwB,GAAG;IAAE,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAC1E,MAAM,MAAM,YAAY,GAAG;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC;AAExD,oEAAoE;AACpE,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,IAAI,CAAC;IAChE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B"}
+{"version":3,"file":"SecureKeypadJsi.types.d.ts","sourceRoot":"","sources":["../src/SecureKeypadJsi.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AACpE,MAAM,MAAM,wBAAwB,GAAG;IAAE,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAC1E,MAAM,MAAM,YAAY,GAAG;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC;AAExD,oEAAoE;AACpE,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,IAAI,CAAC;IAChE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B"}

package/build/SecureKeypadJsi.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecureKeypadJsi.types.js","sourceRoot":"","sources":["../src/SecureKeypadJsi.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { StyleProp, ViewStyle } from 'react-native';\n\n/**\n * Which step failed. 'arm' = public key rejected at mount, 'submit' =\n * encryption failed, 'input' = a touch was rejected before reaching the\n * keypad (Android tapjacking filter; see KeypadError.code). None of these is\n * a security finding — hooking, device posture and screen capture are out of\n * scope, see README.\n */\nexport type KeypadErrorPhase = 'arm' | 'submit' | 'input';\n\nexport type ShuffleMode = 'mount' | 'perKey' | 'off';\n\n/**\n * 'digit' = 3x4 shuffled PIN pad.\n * 'full' = QWERTY keyboard with shift + symbol layers. The digit\n * row is fully shuffled and each character row gets a blank dummy key at a\n * random slot, so the same character is not at the same coordinate across\n * sessions. Layout and shift state live only in native code.\n */\nexport type KeypadType = 'digit' | 'full';\n\nexport interface KeypadError {\n  /**\n   * Stable code, e.g. \"ERR_WEAK_KEY\", \"ERR_TOO_SHORT\". Phase 'input' only\n   * emits \"ERR_OBSCURED_TOUCH\": Android dropped a touch because another window\n   * (overlay app, screen dimmer) was drawn over the keypad. The tap was never\n   * registered — tell the user to close the overlay.\n   */\n  code: string;\n  phase: KeypadErrorPhase;\n}\n\n/**\n * Colors are #RRGGBB or #RRGGBBAA. Sizes are density-independent (dp on\n * Android, points on iOS), so the same number looks the same on both.\n */\nexport interface KeypadTheme {\n  keyColor?: string;\n  keyTextColor?: string;\n  actionTextColor?: string;\n  cornerRadius?: number;\n  digitTextSize?: number;\n  /**\n   * Font for the digit / character glyphs. Any name the platform can already\n   * resolve: a family registered by `expo-font`'s `loadAsync` / `useFonts`, a\n   * font bundled at build time, or a system family (\"Courier\", \"monospace\").\n   * Unresolvable names fall back to the system font instead of throwing.\n   *\n   * NOTE: the action glyphs (⌫ ✕ ⇧ ⏎) always render in the system font. Most\n   * custom fonts have no glyph for them, and a missing glyph would draw as\n   * tofu (□) on an unlabelled key. For `keypadType: 'full'`, pick a font that\n   * covers all of printable ASCII (0x21~0x7E) or some keys will show tofu.\n   */\n  fontFamily?: string;\n  /**\n   * Whether a held key dims to 70% opacity (default true). NOTE: any visible\n   * press effect lets a screen recording reconstruct the input — block capture\n   * at the app level (FLAG_SECURE / UIScreen.isCaptured) or pass false here.\n   */\n  pressedHighlight?: boolean;\n}\n\nexport type OnCompleteEvent = { nativeEvent: { envelope: string } };\nexport type OnDigitCountChangedEvent = { nativeEvent: { count: number } };\nexport type OnErrorEvent = { nativeEvent: KeypadError };\n\n/** Raw native view props; most apps want `SecureKeypad` instead. */\nexport interface SecureKeypadJsiViewProps {\n  /** Server RSA-2048+ public key, PEM SubjectPublicKeyInfo. */\n  publicKey: string;\n  /** Default 'digit'. */\n  keypadType?: KeypadType;\n  /** Clamped to 4~12 ('digit') or 4~64 ('full'). */\n  minLength?: number;\n  maxLength?: number;\n  shuffle?: ShuffleMode;\n  autoSubmit?: boolean;\n  theme?: KeypadTheme;\n  onComplete?: (event: OnCompleteEvent) => void;\n  onDigitCountChanged?: (event: OnDigitCountChangedEvent) => void;\n  onError?: (event: OnErrorEvent) => void;\n  style?: StyleProp<ViewStyle>;\n}\n\nexport interface SecureKeypadHandle {\n  /** Clears the entered digits; does not disarm. */\n  clear: () => Promise<void>;\n  /** Encrypts now if the PIN meets minLength. */\n  submit: () => Promise<void>;\n}\n"]}
+{"version":3,"file":"SecureKeypadJsi.types.js","sourceRoot":"","sources":["../src/SecureKeypadJsi.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { StyleProp, ViewStyle } from 'react-native';\n\n/**\n * Which step failed. 'arm' = public key rejected at mount, 'submit' =\n * encryption failed, 'input' = a touch was rejected before reaching the\n * keypad (Android tapjacking filter; see KeypadError.code). None of these is\n * a security finding — hooking, device posture and screen capture are out of\n * scope, see README.\n */\nexport type KeypadErrorPhase = 'arm' | 'submit' | 'input';\n\nexport type ShuffleMode = 'mount' | 'perKey' | 'off';\n\n/**\n * 'digit' = 3x4 shuffled PIN pad.\n * 'full' = QWERTY keyboard with shift + two symbol pages (ASCII specials, then\n * the non-ASCII symbols of the stock iOS / Android keyboards such as ₩ and ♡).\n * The digit row is fully shuffled and each character row gets a blank dummy\n * key at a random slot, so the same character is not at the same coordinate\n * across sessions. Layout and shift state live only in native code.\n */\nexport type KeypadType = 'digit' | 'full';\n\nexport interface KeypadError {\n  /**\n   * Stable code, e.g. \"ERR_WEAK_KEY\", \"ERR_TOO_SHORT\". Phase 'input' only\n   * emits \"ERR_OBSCURED_TOUCH\": Android dropped a touch because another window\n   * (overlay app, screen dimmer) was drawn over the keypad. The tap was never\n   * registered — tell the user to close the overlay.\n   */\n  code: string;\n  phase: KeypadErrorPhase;\n}\n\n/**\n * Colors are #RRGGBB or #RRGGBBAA. Sizes are density-independent (dp on\n * Android, points on iOS), so the same number looks the same on both.\n */\nexport interface KeypadTheme {\n  keyColor?: string;\n  keyTextColor?: string;\n  actionTextColor?: string;\n  cornerRadius?: number;\n  digitTextSize?: number;\n  /**\n   * Font for the digit / character glyphs. Any name the platform can already\n   * resolve: a family registered by `expo-font`'s `loadAsync` / `useFonts`, a\n   * font bundled at build time, or a system family (\"Courier\", \"monospace\").\n   * Unresolvable names fall back to the system font instead of throwing.\n   *\n   * Applies to every character key, symbols (₩ ♡ …) included. A character\n   * the font has no glyph for is drawn by the platform's per-character font\n   * fallback (a system font), not as tofu. The action glyphs (⌫ ✕ ⇧ ⏎) always\n   * render in the system font.\n   */\n  fontFamily?: string;\n  /**\n   * Whether a held key shows a press effect (default true). NOTE: any visible\n   * press effect lets a screen recording reconstruct the input — block capture\n   * at the app level (FLAG_SECURE / UIScreen.isCaptured) or pass false here.\n   */\n  pressedHighlight?: boolean;\n  /**\n   * Background of a held key. Unset = `keyColor` at 70% opacity. On the digit\n   * pad the ✕ / ⌫ cells, which have no background, get this fill while held.\n   * Ignored when `pressedHighlight` is false.\n   */\n  pressedKeyColor?: string;\n  /**\n   * Text shown on the clear key instead of ✕, e.g. \"취소\". Drawn in the system\n   * font with `actionTextColor`, shrunk to fit the key. Unset or \"\" = ✕.\n   */\n  clearKeyLabel?: string;\n  /**\n   * Text shown on the submit key instead of ⏎, e.g. \"완료\". `keypadType:\n   * 'full'` only — the digit pad has no submit key. Unset or \"\" = ⏎.\n   */\n  submitKeyLabel?: string;\n}\n\nexport type OnCompleteEvent = { nativeEvent: { envelope: string } };\nexport type OnDigitCountChangedEvent = { nativeEvent: { count: number } };\nexport type OnErrorEvent = { nativeEvent: KeypadError };\n\n/** Raw native view props; most apps want `SecureKeypad` instead. */\nexport interface SecureKeypadJsiViewProps {\n  /** Server RSA-2048+ public key, PEM SubjectPublicKeyInfo. */\n  publicKey: string;\n  /** Default 'digit'. */\n  keypadType?: KeypadType;\n  /** Clamped to 4~12 ('digit') or 4~64 ('full'). */\n  minLength?: number;\n  maxLength?: number;\n  shuffle?: ShuffleMode;\n  autoSubmit?: boolean;\n  theme?: KeypadTheme;\n  onComplete?: (event: OnCompleteEvent) => void;\n  onDigitCountChanged?: (event: OnDigitCountChangedEvent) => void;\n  onError?: (event: OnErrorEvent) => void;\n  style?: StyleProp<ViewStyle>;\n}\n\nexport interface SecureKeypadHandle {\n  /** Clears the entered digits; does not disarm. */\n  clear: () => Promise<void>;\n  /** Encrypts now if the PIN meets minLength. */\n  submit: () => Promise<void>;\n}\n"]}

package/common/include/esk/KeypadCore.h

@@ -35,11 +35,12 @@ class KeypadCore {
   // nullopt on success; otherwise the error-code name (e.g. "ERR_WEAK_KEY").
   std::optional<std::string> arm(const std::string& publicKeyPem);
 
-  // Return the resulting entered-key count. pressKey takes the final ASCII
-  // character (the view resolves shift/layer state before calling); characters
-  // outside the type's charset are silently ignored.
+  // Return the resulting entered-character count. pressKey takes the final
+  // Unicode code point (the view resolves shift/layer state before calling);
+  // characters outside the type's charset are silently ignored, and so is a
+  // character whose UTF-8 bytes would overflow the 64-byte secret field.
   size_t pressDigit(uint8_t digit);
-  size_t pressKey(uint8_t asciiChar);
+  size_t pressKey(uint32_t codepoint);
   size_t backspace();
   void clearPin();
 
@@ -47,6 +48,7 @@ class KeypadCore {
   // on Empty / TooShort / NotArmed.
   std::string submit();
 
+  // Characters, not bytes — a multi-byte symbol counts once.
   size_t digitCount() const;
   KeypadState state() const { return state_; }
   KeypadType type() const { return type_; }

package/common/include/esk/PinEncryptor.h

@@ -14,9 +14,13 @@ namespace esk {
 // digit pad simply never fills more than 12 of the 64 secret bytes.
 //
 // v2 (96 bytes):
-//   0 2 magic {'S','K'} | 2 1 version | 3 1 secretLength
-//   4 64 secret ASCII, zero-padded | 68 16 nonce | 84 8 unix seconds BE
+//   0 2 magic {'S','K'} | 2 1 version | 3 1 secretLength (bytes)
+//   4 64 secret UTF-8, zero-padded | 68 16 nonce | 84 8 unix seconds BE
 //   | 92 4 zero
+//
+// The secret was printable ASCII only until the extra symbol page was added;
+// ASCII is a UTF-8 subset and the layout is unchanged, so that widening kept
+// version 2 — an ASCII-only secret is byte-identical to before.
 namespace payload {
 inline constexpr uint8_t kMagic0 = 'S';
 inline constexpr uint8_t kMagic1 = 'K';