expo-secure-keypad-jsi 0.1.0

package/android/src/main/java/expo/modules/securekeypadjsi/SecureKeypadJsiView.kt

@@ -0,0 +1,317 @@
+// Copyright (c) 2026 expo-secure-keypad-jsi contributors. MIT License.
+package expo.modules.securekeypadjsi
+
+import android.content.Context
+import android.graphics.Color
+import android.os.Handler
+import android.os.Looper
+import android.view.View
+import android.widget.FrameLayout
+import expo.modules.kotlin.AppContext
+import expo.modules.kotlin.viewevent.EventDispatcher
+import expo.modules.kotlin.views.ExpoView
+import java.util.Collections
+import java.util.WeakHashMap
+
+/**
+ * Hosts the Canvas keypad (digit) or QWERTY keyboard (full) and owns the
+ * [PinSessionHandle]. JS receives only the entered-key count and the
+ * ciphertext envelope. Screen capture and device integrity are deliberately
+ * out of scope — see README.
+ */
+class SecureKeypadJsiView(context: Context, appContext: AppContext) :
+  ExpoView(context, appContext), KeypadCanvasView.Listener, KeyboardCanvasView.Listener {
+
+  companion object {
+    // Digit pad policy cap; the full keyboard uses the 64-byte payload cap.
+    // Mirrors kMaxPinLength / kMaxSecretLength in the C++ core so the
+    // autoSubmit comparison below agrees with what the core actually stores.
+    private const val MAX_DIGIT_CAP = 12
+    private const val MAX_FULL_CAP = 64
+
+    // Live views, so the module's activity-background hook can reach them.
+    // Weak keys: a view that Fabric dropped without OnViewDestroys must not
+    // be pinned here. Main thread only.
+    private val liveViews: MutableSet<SecureKeypadJsiView> =
+      Collections.newSetFromMap(WeakHashMap())
+
+    /** Called by [SecureKeypadJsiModule] when the host activity pauses. */
+    fun onActivityEntersBackground() {
+      for (v in liveViews.toList()) v.onAppBackground()
+    }
+  }
+
+  private val onDigitCountChanged by EventDispatcher<Map<String, Any>>()
+  private val onComplete by EventDispatcher<Map<String, Any>>()
+  private val onError by EventDispatcher<Map<String, Any>>()
+
+  private var digitKeypad: KeypadCanvasView? = null
+  private var fullKeyboard: KeyboardCanvasView? = null
+  private var handle: PinSessionHandle? = null
+  private val mainHandler = Handler(Looper.getMainLooper())
+
+  // Rebuilt on the next frame so a batch of prop updates collapses into one
+  // native session.
+  private var publicKeyPem: String? = null
+  private var keypadType = "digit" // digit | full
+  private var minLength = 4
+  private var maxLength = 6
+  private var autoSubmit = true
+  private var shuffleMode = KeypadCanvasView.ShuffleMode.MOUNT
+  private var theme: Map<String, Any?>? = null
+
+  private var rebuildScheduled = false
+  // Set by dispose(). A rebuild posted before OnViewDestroys must not create a
+  // session nobody will ever destroy.
+  private var disposed = false
+
+  // Last count handed to JS. A rebuild reports 0 for the fresh session even
+  // when JS was already at 0, and that redundant event can land before the JS
+  // component has mounted (a React "state update on a component that hasn't
+  // mounted yet" warning). Nothing changed, so do not send it.
+  private var lastReportedCount = 0
+
+  init {
+    setBackgroundColor(Color.TRANSPARENT)
+    rebuildInputView()
+    applyAccessibilityHardening()
+    scheduleRebuild()
+    liveViews.add(this)
+  }
+
+  /** maxLength after the per-type clamp the C++ core applies. */
+  private fun effectiveMaxLength(): Int =
+    maxLength.coerceIn(4, if (keypadType == "full") MAX_FULL_CAP else MAX_DIGIT_CAP)
+
+  fun setPublicKeyPem(pem: String) { publicKeyPem = pem; scheduleRebuild() }
+  fun setMinLength(v: Int) { minLength = v.coerceIn(4, 64); scheduleRebuild() }
+  fun setMaxLength(v: Int) { maxLength = v.coerceIn(4, 64); scheduleRebuild() }
+  fun setAutoSubmit(v: Boolean) { autoSubmit = v }
+
+  fun setKeypadType(v: String) {
+    val next = if (v == "full") "full" else "digit"
+    if (next == keypadType) return
+    keypadType = next
+    rebuildInputView()
+    scheduleRebuild()
+  }
+
+  fun setShuffle(mode: String) {
+    shuffleMode = when (mode) {
+      "perKey" -> KeypadCanvasView.ShuffleMode.PER_KEY
+      "off" -> KeypadCanvasView.ShuffleMode.OFF
+      else -> KeypadCanvasView.ShuffleMode.MOUNT
+    }
+    digitKeypad?.let { it.shuffleMode = shuffleMode; it.reshuffle() }
+    fullKeyboard?.let { it.shuffleMode = shuffleMode; it.reshuffle() }
+  }
+
+  fun setTheme(t: Map<String, Any?>) {
+    theme = t
+    digitKeypad?.let { applyTheme(it) }
+    fullKeyboard?.let { applyTheme(it) }
+  }
+
+  // #RRGGBB / #RRGGBBAA, same reading as the iOS side.
+  private fun safeColor(s: String, fallback: Int): Int = ThemeColor.parse(s) ?: fallback
+
+  private fun applyTheme(v: ThemedKeypadView) {
+    val t = theme ?: return
+    (t["keyColor"] as? String)?.let { v.keyColor = safeColor(it, v.keyColor) }
+    (t["keyTextColor"] as? String)?.let { v.keyTextColor = safeColor(it, v.keyTextColor) }
+    (t["actionTextColor"] as? String)?.let { v.actionTextColor = safeColor(it, v.actionTextColor) }
+    (t["cornerRadius"] as? Number)?.let { v.keyCornerRadiusDp = it.toFloat() }
+    (t["digitTextSize"] as? Number)?.let { v.digitTextSizeDp = it.toFloat() }
+    (t["pressedHighlight"] as? Boolean)?.let { v.pressedHighlight = it }
+    // Absent key vs. explicit null: both mean "system font", so this one is
+    // assigned unconditionally instead of only on a hit.
+    v.fontFamily = (t["fontFamily"] as? String)?.takeIf { it.isNotEmpty() }
+    v.invalidate()
+  }
+
+  private fun rebuildInputView() {
+    removeAllViews()
+    digitKeypad = null
+    fullKeyboard = null
+    val lp = FrameLayout.LayoutParams(
+      FrameLayout.LayoutParams.MATCH_PARENT, FrameLayout.LayoutParams.MATCH_PARENT)
+    if (keypadType == "full") {
+      val v = KeyboardCanvasView(context)
+      v.listener = this
+      v.shuffleMode = shuffleMode
+      v.digitsProvider = { handle?.shuffledLayout() ?: identityLayout() }
+      applyTheme(v)
+      addView(v, lp)
+      layoutChildNow(v)
+      fullKeyboard = v
+    } else {
+      val v = KeypadCanvasView(context)
+      v.listener = this
+      v.shuffleMode = shuffleMode
+      v.layoutProvider = { handle?.shuffledLayout() ?: identityLayout() }
+      applyTheme(v)
+      addView(v, lp)
+      layoutChildNow(v)
+      digitKeypad = v
+    }
+  }
+
+  /**
+   * Sizes a child that was added *after* the first layout pass — what a
+   * `keypadType` switch does. Fabric drives layout from the shadow tree and
+   * ignores the [requestLayout] that `addView` schedules (React Native
+   * #17968), so such a child would stay 0x0 and draw nothing. At init the view
+   * has no size yet and the normal mount cascade handles it, hence the guard.
+   */
+  private fun layoutChildNow(child: View) {
+    if (width <= 0 || height <= 0) return
+    child.measure(
+      MeasureSpec.makeMeasureSpec(width, MeasureSpec.EXACTLY),
+      MeasureSpec.makeMeasureSpec(height, MeasureSpec.EXACTLY))
+    child.layout(0, 0, width, height)
+  }
+
+  // A parent resize (rotation, a container animating) arrives as a real layout
+  // pass, but the children are laid out from their *measured* size, which is
+  // stale after a mid-life swap. Re-measure them against the new bounds.
+  override fun onSizeChanged(w: Int, h: Int, oldw: Int, oldh: Int) {
+    super.onSizeChanged(w, h, oldw, oldh)
+    digitKeypad?.let { layoutChildNow(it) }
+    fullKeyboard?.let { layoutChildNow(it) }
+  }
+
+  private fun scheduleRebuild() {
+    if (rebuildScheduled) return
+    rebuildScheduled = true
+    mainHandler.post {
+      rebuildScheduled = false
+      rebuildHandle()
+    }
+  }
+
+  private fun rebuildHandle() {
+    if (disposed) return
+    // A new session starts empty; tell JS so a masked-dot UI never shows
+    // digits that no longer exist in the buffer.
+    val hadSession = handle != null
+    handle?.destroy()
+
+    val type = if (keypadType == "full") PinSessionHandle.TYPE_FULL else PinSessionHandle.TYPE_DIGIT
+    val h = PinSessionHandle(minLength = minLength, maxLength = maxLength, keypadType = type)
+    handle = h
+    digitKeypad?.reshuffle()
+    fullKeyboard?.reshuffle()
+    if (hadSession) reportCount(0)
+
+    publicKeyPem?.let { pem ->
+      val err = h.arm(pem)
+      if (err != null) {
+        onError(mapOf("code" to err, "phase" to "arm"))
+      }
+    }
+  }
+
+  // KeypadCanvasView.Listener (digit pad)
+
+  override fun onDigitPressed(digit: Int) {
+    val h = handle ?: return
+    val count = h.press(digit)
+    // Negative = the core refused the call (ESK_COUNT_ERROR); the buffer is
+    // unchanged, so do not tell JS "0 entered".
+    if (count < 0) return
+    reportCount(count)
+    if (autoSubmit && count >= effectiveMaxLength()) submit()
+  }
+
+  // KeyboardCanvasView.Listener (full keyboard)
+
+  override fun onKeyPressed(asciiChar: Int) {
+    val h = handle ?: return
+    val count = h.pressKey(asciiChar)
+    if (count < 0) return
+    reportCount(count)
+    if (autoSubmit && count >= effectiveMaxLength()) submit()
+  }
+
+  override fun onDone() = submit()
+
+  // Shared listener members
+
+  override fun onBackspace() {
+    val h = handle ?: return
+    val count = h.backspace()
+    if (count < 0) return
+    reportCount(count)
+  }
+
+  override fun onClear() {
+    val h = handle ?: return
+    h.clear()
+    reportCount(0)
+  }
+
+  // filterTouchesWhenObscured already dropped the touch; this only lets the
+  // host explain why the keypad did not respond (overlay app, screen dimmer).
+  override fun onObscuredTouch() {
+    onError(mapOf("code" to "ERR_OBSCURED_TOUCH", "phase" to "input"))
+  }
+
+  private fun reportCount(count: Int) {
+    if (count == lastReportedCount) return
+    lastReportedCount = count
+    onDigitCountChanged(mapOf("count" to count))
+  }
+
+  fun submit() {
+    val h = handle ?: return
+    val result = h.submit()
+    if (result.startsWith("{")) {
+      onComplete(mapOf("envelope" to result))
+      reportCount(0)
+    } else {
+      onError(mapOf("code" to result, "phase" to "submit"))
+    }
+  }
+
+  fun clearPin() {
+    handle?.clear()
+    reportCount(0)
+  }
+
+  // Backgrounding = the host activity pausing (home button, app switcher) or
+  // this view leaving the window (react-native-screens detaches inactive
+  // screens). Either way the buffer is wiped and JS is told the count is 0,
+  // so the masked-dot UI cannot drift from the real buffer.
+  private fun onAppBackground() {
+    val h = handle ?: return
+    h.onBackground()
+    reportCount(0)
+  }
+
+  override fun onDetachedFromWindow() {
+    onAppBackground()
+    super.onDetachedFromWindow()
+  }
+
+  private fun applyAccessibilityHardening() {
+    // Unconditional. The keys are canvas glyphs with no child nodes, so a11y
+    // services could never read them anyway; hiding the container too denies
+    // a malicious AccessibilityService even the fact that a keypad is here.
+    // The keypad is not screen-reader usable by design — see README.
+    importantForAccessibility = IMPORTANT_FOR_ACCESSIBILITY_NO_HIDE_DESCENDANTS
+    if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.O) {
+      importantForAutofill = IMPORTANT_FOR_AUTOFILL_NO_EXCLUDE_DESCENDANTS
+    }
+  }
+
+  fun dispose() {
+    disposed = true
+    // Drop any rebuild still queued from a prop set in this same frame;
+    // otherwise it would run after us and leak a fresh session.
+    mainHandler.removeCallbacksAndMessages(null)
+    rebuildScheduled = false
+    liveViews.remove(this)
+    handle?.destroy()
+    handle = null
+  }
+}

package/android/src/main/java/expo/modules/securekeypadjsi/ThemeColor.kt

@@ -0,0 +1,27 @@
+// Copyright (c) 2026 expo-secure-keypad-jsi contributors. MIT License.
+package expo.modules.securekeypadjsi
+
+/**
+ * Parses the theme colour format the JS API documents: `#RRGGBB` or
+ * `#RRGGBBAA`, alpha last. `android.graphics.Color.parseColor` is deliberately
+ * not used — it reads 8-digit values as `#AARRGGBB` and accepts colour names,
+ * so the same string would render differently from iOS. Pure Kotlin so the
+ * JVM unit test needs no Android runtime.
+ */
+object ThemeColor {
+  /** Packed ARGB int (what Paint.color takes), or null when not `#RRGGBB` / `#RRGGBBAA`. */
+  fun parse(s: String): Int? {
+    var hex = s.trim()
+    if (hex.startsWith("#")) hex = hex.substring(1)
+    if (hex.length != 6 && hex.length != 8) return null
+    if (!hex.all { it in '0'..'9' || it in 'a'..'f' || it in 'A'..'F' }) return null
+    val value = hex.toLong(16)
+    val r: Long; val g: Long; val b: Long; val a: Long
+    if (hex.length == 6) {
+      r = (value shr 16) and 0xff; g = (value shr 8) and 0xff; b = value and 0xff; a = 0xff
+    } else {
+      r = (value shr 24) and 0xff; g = (value shr 16) and 0xff; b = (value shr 8) and 0xff; a = value and 0xff
+    }
+    return ((a shl 24) or (r shl 16) or (g shl 8) or b).toInt()
+  }
+}

package/android/src/main/java/expo/modules/securekeypadjsi/ThemedKeypadView.kt

@@ -0,0 +1,78 @@
+// Copyright (c) 2026 expo-secure-keypad-jsi contributors. MIT License.
+package expo.modules.securekeypadjsi
+
+import android.content.Context
+import android.graphics.Canvas
+import android.graphics.Color
+import android.graphics.Paint
+import android.graphics.RectF
+import android.graphics.Typeface
+import com.facebook.react.common.assets.ReactFontManager
+
+/** Identity 0..9 order: the fallback whenever the native CSPRNG layout is unavailable. */
+internal fun identityLayout(): ByteArray = ByteArray(10) { it.toByte() }
+
+/**
+ * The theme surface both canvas views expose, so [SecureKeypadJsiView] applies
+ * a JS theme map through one code path instead of one per keypad type.
+ */
+internal interface ThemedKeypadView {
+  var keyColor: Int
+  var keyTextColor: Int
+  var actionTextColor: Int
+  var keyCornerRadiusDp: Float
+  var digitTextSizeDp: Float
+
+  /** Digit / character glyphs only; action glyphs stay on the system font. */
+  var fontFamily: String?
+
+  /** false hides the press feedback entirely, for apps that cannot block capture. */
+  var pressedHighlight: Boolean
+
+  fun invalidate()
+}
+
+/**
+ * A held key is drawn at 70% opacity. One rule reads correctly on any theme,
+ * so no per-theme luminance branch is needed.
+ */
+internal fun pressedDim(color: Int, held: Boolean): Int =
+  if (held) {
+    Color.argb((Color.alpha(color) * 0.7f).toInt(), Color.red(color), Color.green(color), Color.blue(color))
+  } else {
+    color
+  }
+
+/** Shared by both canvas views: baseline-corrected centred text. */
+internal fun drawCentered(canvas: Canvas, text: String, r: RectF, paint: Paint) {
+  val cx = r.centerX()
+  val cy = r.centerY() - (paint.descent() + paint.ascent()) / 2f
+  canvas.drawText(text, cx, cy, paint)
+}
+
+
+/**
+ * Resolves a theme `fontFamily` to a [Typeface], memoised because `onDraw`
+ * runs on every press and a miss hits the asset manager.
+ *
+ * [ReactFontManager] is the same registry `expo-font`'s `loadAsync` writes
+ * into, so a family loaded from JS resolves here under the name JS used, and
+ * `assets/fonts/<name>.ttf` bundled at build time resolves too. An unknown
+ * name degrades to [Typeface.create]'s own fallback (the system font) rather
+ * than throwing.
+ */
+internal object EskFont {
+  private val cache = HashMap<String, Typeface>()
+
+  fun resolve(context: Context, family: String?): Typeface? {
+    if (family.isNullOrEmpty()) return null
+    cache[family]?.let { return it }
+    val typeface = try {
+      ReactFontManager.getInstance().getTypeface(family, Typeface.NORMAL, context.assets)
+    } catch (_: Throwable) {
+      // No React font registry on the classpath, or a corrupt font file.
+      Typeface.create(family, Typeface.NORMAL)
+    }
+    return typeface?.also { cache[family] = it }
+  }
+}

package/build/SecureKeypad.d.ts

@@ -0,0 +1,51 @@
+import * as React from 'react';
+import { type StyleProp, type ViewStyle } from 'react-native';
+import type { KeypadError, KeypadTheme, KeypadType, SecureKeypadHandle, ShuffleMode } from './SecureKeypadJsi.types';
+export interface SecureKeypadProps {
+    /** Server RSA-2048+ public key, PEM SubjectPublicKeyInfo. Required. */
+    publicKey: string;
+    /**
+     * 'digit' = 3x4 shuffled PIN pad. 'full' = QWERTY keyboard with shift and
+     * symbol layers (its Enter key submits). Default 'digit'.
+     */
+    keypadType?: KeypadType;
+    /** Defaults: 4 / 6 ('digit') or 4 / 64 ('full'). Clamped to 4~12 / 4~64. */
+    minLength?: number;
+    maxLength?: number;
+    shuffle?: ShuffleMode;
+    /**
+     * Auto-encrypt at maxLength. Default true for 'digit', false for 'full' —
+     * passwords are variable-length, so the keyboard's Enter key submits.
+     */
+    autoSubmit?: boolean;
+    theme?: KeypadTheme;
+    /**
+     * Applied to the keypad, or to the container when `accessory` is set.
+     */
+    style?: StyleProp<ViewStyle>;
+    /**
+     * Rendered directly above the keypad, inside the same container — the place
+     * for a masked-length indicator or a confirm button when the keypad covers
+     * the field it fills (bottom sheets, overlays). Ordinary React content: it
+     * never receives the entered value, only what you pass it.
+     */
+    accessory?: React.ReactNode;
+    /** Ciphertext envelope JSON — send this to your server. */
+    onComplete?: (envelope: string) => void;
+    /** Drive your masked-dot UI from this. */
+    onDigitCountChanged?: (count: number) => void;
+    /**
+     * Key rejected at mount ('arm'), encryption failed on submit ('submit'), or
+     * Android dropped an obscured touch ('input', "ERR_OBSCURED_TOUCH").
+     */
+    onError?: (error: KeypadError) => void;
+}
+/**
+ * Unwraps `nativeEvent` for the caller. PIN digits never enter JavaScript —
+ * `onComplete` yields only the ciphertext envelope. The buffer is wiped
+ * whenever the app backgrounds or the view leaves the window; that is not
+ * configurable.
+ */
+export declare const SecureKeypad: React.ForwardRefExoticComponent<SecureKeypadProps & React.RefAttributes<SecureKeypadHandle>>;
+export default SecureKeypad;
+//# sourceMappingURL=SecureKeypad.d.ts.map

package/build/SecureKeypad.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureKeypad.d.ts","sourceRoot":"","sources":["../src/SecureKeypad.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,MAAM,cAAc,CAAC;AAEhF,OAAO,KAAK,EACV,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,WAAW,EACZ,MAAM,yBAAyB,CAAC;AAGjC,MAAM,WAAW,iBAAiB;IAChC,uEAAuE;IACvE,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;OAEG;IACH,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IAE5B,2DAA2D;IAC3D,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,0CAA0C;IAC1C,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9C;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;CACxC;AAwBD;;;;;GAKG;AACH,eAAO,MAAM,YAAY,8FAsDxB,CAAC;AAIF,eAAe,YAAY,CAAC"}

package/build/SecureKeypad.js

@@ -0,0 +1,51 @@
+import * as React from 'react';
+import { StyleSheet, View } from 'react-native';
+import SecureKeypadJsiView from './SecureKeypadJsiView';
+// Yoga sizes Expo views purely from style — their shadow node has no measure
+// function, so a keypad with no height renders at zero. Applied only when the
+// caller gave nothing to size it by. 3x4 near-square keys for the digit pad;
+// the QWERTY keyboard is 5 rows of ~10 keys, so it is wider than tall.
+const digitSizing = { aspectRatio: 3 / 4 };
+const fullSizing = { aspectRatio: 4 / 3 };
+// With an accessory the caller's size lands on the container; the keypad
+// then fills whatever the accessory leaves.
+const fillRest = { flex: 1 };
+function hasOwnSize(style) {
+    const flat = StyleSheet.flatten(style);
+    if (!flat)
+        return false;
+    return (flat.height != null ||
+        flat.aspectRatio != null ||
+        flat.flex != null ||
+        flat.flexGrow != null ||
+        flat.flexBasis != null);
+}
+/**
+ * Unwraps `nativeEvent` for the caller. PIN digits never enter JavaScript —
+ * `onComplete` yields only the ciphertext envelope. The buffer is wiped
+ * whenever the app backgrounds or the view leaves the window; that is not
+ * configurable.
+ */
+export const SecureKeypad = React.forwardRef((props, ref) => {
+    const { publicKey, keypadType = 'digit', minLength = 4, maxLength = keypadType === 'full' ? 64 : 6, shuffle = 'mount', autoSubmit = keypadType !== 'full', theme, style, accessory, onComplete, onDigitCountChanged, onError, } = props;
+    const sized = React.useMemo(() => hasOwnSize(style), [style]);
+    const defaultSizing = keypadType === 'full' ? fullSizing : digitSizing;
+    const hasAccessory = accessory != null && accessory !== false;
+    let keypadStyle;
+    if (hasAccessory) {
+        keypadStyle = sized ? fillRest : defaultSizing;
+    }
+    else {
+        keypadStyle = sized ? style : [defaultSizing, style];
+    }
+    const keypad = (<SecureKeypadJsiView ref={ref} publicKey={publicKey} keypadType={keypadType} minLength={minLength} maxLength={maxLength} shuffle={shuffle} autoSubmit={autoSubmit} theme={theme} style={keypadStyle} onComplete={(e) => onComplete?.(e.nativeEvent.envelope)} onDigitCountChanged={(e) => onDigitCountChanged?.(e.nativeEvent.count)} onError={(e) => onError?.(e.nativeEvent)}/>);
+    if (!hasAccessory)
+        return keypad;
+    return (<View style={style}>
+        {accessory}
+        {keypad}
+      </View>);
+});
+SecureKeypad.displayName = 'SecureKeypad';
+export default SecureKeypad;
+//# sourceMappingURL=SecureKeypad.js.map

package/build/SecureKeypad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureKeypad.js","sourceRoot":"","sources":["../src/SecureKeypad.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,OAAO,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,IAAI,EAAkC,MAAM,cAAc,CAAC;AAShF,OAAO,mBAAmB,MAAM,uBAAuB,CAAC;AA2CxD,6EAA6E;AAC7E,8EAA8E;AAC9E,6EAA6E;AAC7E,uEAAuE;AACvE,MAAM,WAAW,GAAc,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AACtD,MAAM,UAAU,GAAc,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AACrD,yEAAyE;AACzE,4CAA4C;AAC5C,MAAM,QAAQ,GAAc,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAExC,SAAS,UAAU,CAAC,KAA2B;IAC7C,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,CACL,IAAI,CAAC,MAAM,IAAI,IAAI;QACnB,IAAI,CAAC,WAAW,IAAI,IAAI;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI;QACjB,IAAI,CAAC,QAAQ,IAAI,IAAI;QACrB,IAAI,CAAC,SAAS,IAAI,IAAI,CACvB,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,CAAC,UAAU,CAC1C,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;IACb,MAAM,EACJ,SAAS,EACT,UAAU,GAAG,OAAO,EACpB,SAAS,GAAG,CAAC,EACb,SAAS,GAAG,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAC1C,OAAO,GAAG,OAAO,EACjB,UAAU,GAAG,UAAU,KAAK,MAAM,EAClC,KAAK,EACL,KAAK,EACL,SAAS,EACT,UAAU,EACV,mBAAmB,EACnB,OAAO,GACR,GAAG,KAAK,CAAC;IAEV,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9D,MAAM,aAAa,GAAG,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;IACvE,MAAM,YAAY,GAAG,SAAS,IAAI,IAAI,IAAI,SAAS,KAAK,KAAK,CAAC;IAE9D,IAAI,WAAiC,CAAC;IACtC,IAAI,YAAY,EAAE,CAAC;QACjB,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;IACjD,CAAC;SAAM,CAAC;QACN,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,CACb,CAAC,mBAAmB,CAClB,GAAG,CAAC,CAAC,GAAG,CAAC,CACT,SAAS,CAAC,CAAC,SAAS,CAAC,CACrB,UAAU,CAAC,CAAC,UAAU,CAAC,CACvB,SAAS,CAAC,CAAC,SAAS,CAAC,CACrB,SAAS,CAAC,CAAC,SAAS,CAAC,CACrB,OAAO,CAAC,CAAC,OAAO,CAAC,CACjB,UAAU,CAAC,CAAC,UAAU,CAAC,CACvB,KAAK,CAAC,CAAC,KAAK,CAAC,CACb,KAAK,CAAC,CAAC,WAAW,CAAC,CACnB,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CACxD,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CACvE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EACzC,CACH,CAAC;IAEF,IAAI,CAAC,YAAY;QAAE,OAAO,MAAM,CAAC;IAEjC,OAAO,CACL,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CACjB;QAAA,CAAC,SAAS,CACV;QAAA,CAAC,MAAM,CACT;MAAA,EAAE,IAAI,CAAC,CACR,CAAC;AACJ,CAAC,CACF,CAAC;AAEF,YAAY,CAAC,WAAW,GAAG,cAAc,CAAC;AAE1C,eAAe,YAAY,CAAC","sourcesContent":["import * as React from 'react';\nimport { StyleSheet, View, type StyleProp, type ViewStyle } from 'react-native';\n\nimport type {\n  KeypadError,\n  KeypadTheme,\n  KeypadType,\n  SecureKeypadHandle,\n  ShuffleMode,\n} from './SecureKeypadJsi.types';\nimport SecureKeypadJsiView from './SecureKeypadJsiView';\n\nexport interface SecureKeypadProps {\n  /** Server RSA-2048+ public key, PEM SubjectPublicKeyInfo. Required. */\n  publicKey: string;\n  /**\n   * 'digit' = 3x4 shuffled PIN pad. 'full' = QWERTY keyboard with shift and\n   * symbol layers (its Enter key submits). Default 'digit'.\n   */\n  keypadType?: KeypadType;\n  /** Defaults: 4 / 6 ('digit') or 4 / 64 ('full'). Clamped to 4~12 / 4~64. */\n  minLength?: number;\n  maxLength?: number;\n  shuffle?: ShuffleMode;\n  /**\n   * Auto-encrypt at maxLength. Default true for 'digit', false for 'full' —\n   * passwords are variable-length, so the keyboard's Enter key submits.\n   */\n  autoSubmit?: boolean;\n  theme?: KeypadTheme;\n  /**\n   * Applied to the keypad, or to the container when `accessory` is set.\n   */\n  style?: StyleProp<ViewStyle>;\n  /**\n   * Rendered directly above the keypad, inside the same container — the place\n   * for a masked-length indicator or a confirm button when the keypad covers\n   * the field it fills (bottom sheets, overlays). Ordinary React content: it\n   * never receives the entered value, only what you pass it.\n   */\n  accessory?: React.ReactNode;\n\n  /** Ciphertext envelope JSON — send this to your server. */\n  onComplete?: (envelope: string) => void;\n  /** Drive your masked-dot UI from this. */\n  onDigitCountChanged?: (count: number) => void;\n  /**\n   * Key rejected at mount ('arm'), encryption failed on submit ('submit'), or\n   * Android dropped an obscured touch ('input', \"ERR_OBSCURED_TOUCH\").\n   */\n  onError?: (error: KeypadError) => void;\n}\n\n// Yoga sizes Expo views purely from style — their shadow node has no measure\n// function, so a keypad with no height renders at zero. Applied only when the\n// caller gave nothing to size it by. 3x4 near-square keys for the digit pad;\n// the QWERTY keyboard is 5 rows of ~10 keys, so it is wider than tall.\nconst digitSizing: ViewStyle = { aspectRatio: 3 / 4 };\nconst fullSizing: ViewStyle = { aspectRatio: 4 / 3 };\n// With an accessory the caller's size lands on the container; the keypad\n// then fills whatever the accessory leaves.\nconst fillRest: ViewStyle = { flex: 1 };\n\nfunction hasOwnSize(style: StyleProp<ViewStyle>): boolean {\n  const flat = StyleSheet.flatten(style);\n  if (!flat) return false;\n  return (\n    flat.height != null ||\n    flat.aspectRatio != null ||\n    flat.flex != null ||\n    flat.flexGrow != null ||\n    flat.flexBasis != null\n  );\n}\n\n/**\n * Unwraps `nativeEvent` for the caller. PIN digits never enter JavaScript —\n * `onComplete` yields only the ciphertext envelope. The buffer is wiped\n * whenever the app backgrounds or the view leaves the window; that is not\n * configurable.\n */\nexport const SecureKeypad = React.forwardRef<SecureKeypadHandle, SecureKeypadProps>(\n  (props, ref) => {\n    const {\n      publicKey,\n      keypadType = 'digit',\n      minLength = 4,\n      maxLength = keypadType === 'full' ? 64 : 6,\n      shuffle = 'mount',\n      autoSubmit = keypadType !== 'full',\n      theme,\n      style,\n      accessory,\n      onComplete,\n      onDigitCountChanged,\n      onError,\n    } = props;\n\n    const sized = React.useMemo(() => hasOwnSize(style), [style]);\n    const defaultSizing = keypadType === 'full' ? fullSizing : digitSizing;\n    const hasAccessory = accessory != null && accessory !== false;\n\n    let keypadStyle: StyleProp<ViewStyle>;\n    if (hasAccessory) {\n      keypadStyle = sized ? fillRest : defaultSizing;\n    } else {\n      keypadStyle = sized ? style : [defaultSizing, style];\n    }\n\n    const keypad = (\n      <SecureKeypadJsiView\n        ref={ref}\n        publicKey={publicKey}\n        keypadType={keypadType}\n        minLength={minLength}\n        maxLength={maxLength}\n        shuffle={shuffle}\n        autoSubmit={autoSubmit}\n        theme={theme}\n        style={keypadStyle}\n        onComplete={(e) => onComplete?.(e.nativeEvent.envelope)}\n        onDigitCountChanged={(e) => onDigitCountChanged?.(e.nativeEvent.count)}\n        onError={(e) => onError?.(e.nativeEvent)}\n      />\n    );\n\n    if (!hasAccessory) return keypad;\n\n    return (\n      <View style={style}>\n        {accessory}\n        {keypad}\n      </View>\n    );\n  }\n);\n\nSecureKeypad.displayName = 'SecureKeypad';\n\nexport default SecureKeypad;\n"]}

package/build/SecureKeypadJsi.types.d.ts

@@ -0,0 +1,94 @@
+import type { StyleProp, ViewStyle } from 'react-native';
+/**
+ * Which step failed. 'arm' = public key rejected at mount, 'submit' =
+ * encryption failed, 'input' = a touch was rejected before reaching the
+ * keypad (Android tapjacking filter; see KeypadError.code). None of these is
+ * a security finding — hooking, device posture and screen capture are out of
+ * scope, see README.
+ */
+export type KeypadErrorPhase = 'arm' | 'submit' | 'input';
+export type ShuffleMode = 'mount' | 'perKey' | 'off';
+/**
+ * 'digit' = 3x4 shuffled PIN pad.
+ * 'full' = QWERTY keyboard with shift + symbol layers. The digit
+ * row is fully shuffled and each character row gets a blank dummy key at a
+ * random slot, so the same character is not at the same coordinate across
+ * sessions. Layout and shift state live only in native code.
+ */
+export type KeypadType = 'digit' | 'full';
+export interface KeypadError {
+    /**
+     * Stable code, e.g. "ERR_WEAK_KEY", "ERR_TOO_SHORT". Phase 'input' only
+     * emits "ERR_OBSCURED_TOUCH": Android dropped a touch because another window
+     * (overlay app, screen dimmer) was drawn over the keypad. The tap was never
+     * registered — tell the user to close the overlay.
+     */
+    code: string;
+    phase: KeypadErrorPhase;
+}
+/**
+ * Colors are #RRGGBB or #RRGGBBAA. Sizes are density-independent (dp on
+ * Android, points on iOS), so the same number looks the same on both.
+ */
+export interface KeypadTheme {
+    keyColor?: string;
+    keyTextColor?: string;
+    actionTextColor?: string;
+    cornerRadius?: number;
+    digitTextSize?: number;
+    /**
+     * Font for the digit / character glyphs. Any name the platform can already
+     * resolve: a family registered by `expo-font`'s `loadAsync` / `useFonts`, a
+     * font bundled at build time, or a system family ("Courier", "monospace").
+     * Unresolvable names fall back to the system font instead of throwing.
+     *
+     * NOTE: the action glyphs (⌫ ✕ ⇧ ⏎) always render in the system font. Most
+     * custom fonts have no glyph for them, and a missing glyph would draw as
+     * tofu (□) on an unlabelled key. For `keypadType: 'full'`, pick a font that
+     * covers all of printable ASCII (0x21~0x7E) or some keys will show tofu.
+     */
+    fontFamily?: string;
+    /**
+     * Whether a held key dims to 70% opacity (default true). NOTE: any visible
+     * press effect lets a screen recording reconstruct the input — block capture
+     * at the app level (FLAG_SECURE / UIScreen.isCaptured) or pass false here.
+     */
+    pressedHighlight?: boolean;
+}
+export type OnCompleteEvent = {
+    nativeEvent: {
+        envelope: string;
+    };
+};
+export type OnDigitCountChangedEvent = {
+    nativeEvent: {
+        count: number;
+    };
+};
+export type OnErrorEvent = {
+    nativeEvent: KeypadError;
+};
+/** Raw native view props; most apps want `SecureKeypad` instead. */
+export interface SecureKeypadJsiViewProps {
+    /** Server RSA-2048+ public key, PEM SubjectPublicKeyInfo. */
+    publicKey: string;
+    /** Default 'digit'. */
+    keypadType?: KeypadType;
+    /** Clamped to 4~12 ('digit') or 4~64 ('full'). */
+    minLength?: number;
+    maxLength?: number;
+    shuffle?: ShuffleMode;
+    autoSubmit?: boolean;
+    theme?: KeypadTheme;
+    onComplete?: (event: OnCompleteEvent) => void;
+    onDigitCountChanged?: (event: OnDigitCountChangedEvent) => void;
+    onError?: (event: OnErrorEvent) => void;
+    style?: StyleProp<ViewStyle>;
+}
+export interface SecureKeypadHandle {
+    /** Clears the entered digits; does not disarm. */
+    clear: () => Promise<void>;
+    /** Encrypts now if the PIN meets minLength. */
+    submit: () => Promise<void>;
+}
+//# sourceMappingURL=SecureKeypadJsi.types.d.ts.map

package/build/SecureKeypadJsi.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureKeypadJsi.types.d.ts","sourceRoot":"","sources":["../src/SecureKeypadJsi.types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,OAAO,CAAC;AAE1D,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;;;;;OAUG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,MAAM,eAAe,GAAG;IAAE,WAAW,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AACpE,MAAM,MAAM,wBAAwB,GAAG;IAAE,WAAW,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAC1E,MAAM,MAAM,YAAY,GAAG;IAAE,WAAW,EAAE,WAAW,CAAA;CAAE,CAAC;AAExD,oEAAoE;AACpE,MAAM,WAAW,wBAAwB;IACvC,6DAA6D;IAC7D,SAAS,EAAE,MAAM,CAAC;IAClB,uBAAuB;IACvB,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,IAAI,CAAC;IAC9C,mBAAmB,CAAC,EAAE,CAAC,KAAK,EAAE,wBAAwB,KAAK,IAAI,CAAC;IAChE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACxC,KAAK,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;CAC9B;AAED,MAAM,WAAW,kBAAkB;IACjC,kDAAkD;IAClD,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B"}

package/build/SecureKeypadJsi.types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SecureKeypadJsi.types.js.map

package/build/SecureKeypadJsi.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecureKeypadJsi.types.js","sourceRoot":"","sources":["../src/SecureKeypadJsi.types.ts"],"names":[],"mappings":"","sourcesContent":["import type { StyleProp, ViewStyle } from 'react-native';\n\n/**\n * Which step failed. 'arm' = public key rejected at mount, 'submit' =\n * encryption failed, 'input' = a touch was rejected before reaching the\n * keypad (Android tapjacking filter; see KeypadError.code). None of these is\n * a security finding — hooking, device posture and screen capture are out of\n * scope, see README.\n */\nexport type KeypadErrorPhase = 'arm' | 'submit' | 'input';\n\nexport type ShuffleMode = 'mount' | 'perKey' | 'off';\n\n/**\n * 'digit' = 3x4 shuffled PIN pad.\n * 'full' = QWERTY keyboard with shift + symbol layers. The digit\n * row is fully shuffled and each character row gets a blank dummy key at a\n * random slot, so the same character is not at the same coordinate across\n * sessions. Layout and shift state live only in native code.\n */\nexport type KeypadType = 'digit' | 'full';\n\nexport interface KeypadError {\n  /**\n   * Stable code, e.g. \"ERR_WEAK_KEY\", \"ERR_TOO_SHORT\". Phase 'input' only\n   * emits \"ERR_OBSCURED_TOUCH\": Android dropped a touch because another window\n   * (overlay app, screen dimmer) was drawn over the keypad. The tap was never\n   * registered — tell the user to close the overlay.\n   */\n  code: string;\n  phase: KeypadErrorPhase;\n}\n\n/**\n * Colors are #RRGGBB or #RRGGBBAA. Sizes are density-independent (dp on\n * Android, points on iOS), so the same number looks the same on both.\n */\nexport interface KeypadTheme {\n  keyColor?: string;\n  keyTextColor?: string;\n  actionTextColor?: string;\n  cornerRadius?: number;\n  digitTextSize?: number;\n  /**\n   * Font for the digit / character glyphs. Any name the platform can already\n   * resolve: a family registered by `expo-font`'s `loadAsync` / `useFonts`, a\n   * font bundled at build time, or a system family (\"Courier\", \"monospace\").\n   * Unresolvable names fall back to the system font instead of throwing.\n   *\n   * NOTE: the action glyphs (⌫ ✕ ⇧ ⏎) always render in the system font. Most\n   * custom fonts have no glyph for them, and a missing glyph would draw as\n   * tofu (□) on an unlabelled key. For `keypadType: 'full'`, pick a font that\n   * covers all of printable ASCII (0x21~0x7E) or some keys will show tofu.\n   */\n  fontFamily?: string;\n  /**\n   * Whether a held key dims to 70% opacity (default true). NOTE: any visible\n   * press effect lets a screen recording reconstruct the input — block capture\n   * at the app level (FLAG_SECURE / UIScreen.isCaptured) or pass false here.\n   */\n  pressedHighlight?: boolean;\n}\n\nexport type OnCompleteEvent = { nativeEvent: { envelope: string } };\nexport type OnDigitCountChangedEvent = { nativeEvent: { count: number } };\nexport type OnErrorEvent = { nativeEvent: KeypadError };\n\n/** Raw native view props; most apps want `SecureKeypad` instead. */\nexport interface SecureKeypadJsiViewProps {\n  /** Server RSA-2048+ public key, PEM SubjectPublicKeyInfo. */\n  publicKey: string;\n  /** Default 'digit'. */\n  keypadType?: KeypadType;\n  /** Clamped to 4~12 ('digit') or 4~64 ('full'). */\n  minLength?: number;\n  maxLength?: number;\n  shuffle?: ShuffleMode;\n  autoSubmit?: boolean;\n  theme?: KeypadTheme;\n  onComplete?: (event: OnCompleteEvent) => void;\n  onDigitCountChanged?: (event: OnDigitCountChangedEvent) => void;\n  onError?: (event: OnErrorEvent) => void;\n  style?: StyleProp<ViewStyle>;\n}\n\nexport interface SecureKeypadHandle {\n  /** Clears the entered digits; does not disarm. */\n  clear: () => Promise<void>;\n  /** Encrypts now if the PIN meets minLength. */\n  submit: () => Promise<void>;\n}\n"]}

package/build/SecureKeypadJsiView.d.ts

@@ -0,0 +1,6 @@
+import * as React from 'react';
+import type { SecureKeypadHandle, SecureKeypadJsiViewProps } from './SecureKeypadJsi.types';
+/** Most apps should use `SecureKeypad` instead. */
+declare const SecureKeypadJsiView: React.ForwardRefExoticComponent<SecureKeypadJsiViewProps & React.RefAttributes<SecureKeypadHandle>>;
+export default SecureKeypadJsiView;
+//# sourceMappingURL=SecureKeypadJsiView.d.ts.map