react-native-ensys-camera-x 1.0.7

package/android/src/main/java/com/customcamera/SecureMediaDeleter.kt

@@ -0,0 +1,493 @@
+package com.customcamera
+
+import android.content.Context
+import android.net.Uri
+import android.provider.MediaStore
+import android.util.Log
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import java.io.File
+import java.util.Locale
+
+/**
+ * The single native entry point for destroying one media item and every trace of it.
+ *
+ * Deleting a photo or video in this app is not one delete. A single captured clip can exist as the
+ * published file under `media_documents/`, the cache file it was published from, a compressed
+ * variant under `compressed/`, a format-converted copy under `exported/`, an edited render and a
+ * chosen cover frame under `edited/`, a downloaded copy under `downloads/`, a decoded bitmap in
+ * [ThumbnailLoader]'s LruCache, an entry in [MediaCacheManager]'s metadata, another in
+ * [MediaMetadataStore], and a row in SQLCipher. Unlinking only the file the UI happened to be
+ * showing leaves the media fully recoverable from any of the others — and leaves the library
+ * counting an item whose file is gone.
+ *
+ * So the order here is deliberate and each step depends on the one before it:
+ *
+ *  1. Resolve every on-disk copy of this asset — the primary file plus each derived variant.
+ *  2. [SecureFileEraser] overwrites each one with encrypted CSPRNG garbage `2 MiB` longer than
+ *     the file, flushes it to storage, then unlinks it. The primary file's outcome is what the
+ *     caller is told about; a variant that resists deletion is logged and reported separately
+ *     rather than being allowed to fail the whole operation silently.
+ *  3. Only then are the in-memory and on-disk REFERENCES dropped (thumbnail bitmaps, cache
+ *     metadata, storage metadata). Dropping them first would lose the very paths step 1 needs,
+ *     which is how an orphaned copy survives a delete.
+ *
+ * The SQLCipher row is deliberately NOT touched here — it is owned by the JS repository layer
+ * ([MediaRepository]), which removes it once this reports the file is gone. Native and JS writing
+ * to the same encrypted database from two directions is how rows and files drift apart.
+ *
+ * Every method is `suspend` on [Dispatchers.IO]. A 2 GB clip takes real seconds to overwrite, and
+ * none of it may run on the main thread.
+ */
+internal object SecureMediaDeleter {
+  private const val TAG = "SecureMediaDeleter"
+
+  /**
+   * Cache subdirectories that can hold a copy — or a derivative — of a media file.
+   *
+   * Every one of these is swept for files belonging to the asset being deleted, because each is a
+   * place the editor, the compressor, the exporter or the viewer is known to write a second copy
+   * of the same pixels. Kept as a list of names (rather than resolved paths) so it stays readable
+   * next to `file_paths.xml`, which declares the same set.
+   */
+  private val DERIVED_CACHE_DIRS = listOf(
+    "camera_media_cache", // MediaCacheManager's own store
+    "media_cache",        // CacheCleanupManager's sweep target
+    "media",
+    "compressed",         // Compress Video / Compress Image variants
+    "compression_cache",  // persistent CompressionCacheStore master outputs
+    "exported",           // "Export By" format conversions
+    "edited",             // baked edits + chosen video cover frames
+    "downloads",          // viewer "download a copy"
+    "shared"              // copies staged for the share sheet
+  )
+
+  /** What one secure deletion actually achieved. */
+  data class Report(
+    /** True when the primary file is gone from the filesystem. */
+    val deleted: Boolean,
+    /**
+     * True ONLY when the primary file's bytes were overwritten and flushed before it was
+     * unlinked. When this is false the caller must NOT tell the user the media was securely
+     * erased, even if [deleted] is true — see [SecureFileEraser.Result.securelyOverwritten].
+     */
+    val securelyOverwritten: Boolean,
+    /** Exact size of the primary file before the overwrite. */
+    val originalBytes: Long,
+    /** Bytes written over the primary file, including the padding past its end. */
+    val overwrittenBytes: Long,
+    /** Extra copies (variants, thumbnails on disk, temp files) securely erased alongside it. */
+    val derivedFilesErased: Int,
+    /** Extra copies that could NOT be erased. Non-zero means media may still be on the device. */
+    val derivedFilesFailed: Int,
+    /** Present when any part of the operation failed. */
+    val error: String? = null
+  ) {
+    /** Rolled-up truth for the UI: everything found was overwritten, nothing was left behind. */
+    val fullySecure: Boolean get() = deleted && securelyOverwritten && derivedFilesFailed == 0
+  }
+
+  /**
+   * Securely delete the media behind [uriString], plus every cached copy, derived variant and
+   * metadata reference the app holds for it.
+   *
+   * [assetId] and [fileName], when known, widen the sweep in step 1: derived variants are named
+   * after the asset id (`cmp_<id>_p60.mp4`, `edit_<id>_webp.webp`, `cover_<id>_<ts>.jpg`) rather
+   * than after the primary file, so without the id those copies are invisible to a path-based
+   * search and would survive the delete.
+   *
+   * [extraUris] is for copies the CALLER knows about that name-matching cannot find — most
+   * importantly the cache file of an item whose published document is the primary. Each is erased
+   * with the same guarantees as the primary and counted among the derived copies.
+   */
+  suspend fun secureDelete(
+    context: Context,
+    uriString: String,
+    assetId: String? = null,
+    fileName: String? = null,
+    coverUri: String? = null,
+    extraUris: List<String> = emptyList()
+  ): Report = withContext(Dispatchers.IO) {
+    val appContext = context.applicationContext
+    val primary = resolveFile(appContext, uriString)
+
+    // Collect derived copies BEFORE the primary is erased: the primary's own name is one of the
+    // things that identifies them, and once it is renamed-and-unlinked that link is gone.
+    val derived = collectDerivedFiles(
+      appContext,
+      primary = primary,
+      assetId = assetId,
+      fileName = fileName ?: primary?.name,
+      coverUri = coverUri,
+      extraUris = extraUris
+    )
+
+    val primaryResult = erasePrimary(appContext, uriString, primary)
+
+    var erased = 0
+    var failed = 0
+    for (file in derived) {
+      val result = SecureFileEraser.erase(file)
+      if (result.securelyOverwritten && !file.exists()) {
+        erased++
+      } else {
+        failed++
+        Log.e(
+          TAG,
+          "Derived copy survived secure deletion: ${file.absolutePath} (${result.error ?: "unlink failed"})"
+        )
+      }
+    }
+
+    // References last — see the class doc. These are best-effort by design: a stale metadata entry
+    // is a cosmetic bug, whereas failing the whole delete over one would leave the caller unsure
+    // whether the media is gone.
+    dropReferences(appContext, uriString, assetId, coverUri)
+
+    val report = Report(
+      deleted = primaryResult.deleted,
+      securelyOverwritten = primaryResult.securelyOverwritten,
+      originalBytes = primaryResult.originalBytes,
+      overwrittenBytes = primaryResult.overwrittenBytes,
+      derivedFilesErased = erased,
+      derivedFilesFailed = failed,
+      error = primaryResult.error
+    )
+
+    if (report.fullySecure) {
+      Log.i(
+        TAG,
+        "Securely deleted $uriString: ${MediaFileIo.formatMegabytes(report.originalBytes)} " +
+          "overwritten with ${MediaFileIo.formatMegabytes(report.overwrittenBytes)} of garbage, " +
+          "$erased derived copies erased"
+      )
+    } else {
+      // Deliberately ERROR level, and deliberately explicit about which guarantee was missed. A
+      // failed secure-erase that reads like a success in logcat is how this silently degrades to
+      // an ordinary delete.
+      Log.e(
+        TAG,
+        "INSECURE DELETION for $uriString — deleted=${report.deleted}, " +
+          "overwritten=${report.securelyOverwritten}, derivedFailures=$failed, " +
+          "error=${report.error ?: "none"}"
+      )
+    }
+
+    report
+  }
+
+  /** Outcome of the primary file/URI, before derived copies are considered. */
+  private data class PrimaryResult(
+    val deleted: Boolean,
+    val securelyOverwritten: Boolean,
+    val originalBytes: Long,
+    val overwrittenBytes: Long,
+    val error: String? = null
+  )
+
+  /**
+   * Erase whatever [uriString] actually points at.
+   *
+   * A path-backed URI takes the [File] route — overwrite in place, rename, unlink. A
+   * `content://` URI cannot be renamed or unlinked as a path, so its bytes are overwritten
+   * through a read/write descriptor obtained from the provider and the row is then deleted
+   * through the resolver. Providers may refuse `"rw"` (many are read-only); that refusal is
+   * reported as a failed overwrite rather than hidden, because the row delete that follows would
+   * otherwise look like a secure erase while leaving the file's blocks intact.
+   */
+  private fun erasePrimary(context: Context, uriString: String, primary: File?): PrimaryResult {
+    if (primary != null) {
+      val result = SecureFileEraser.erase(primary)
+      return PrimaryResult(
+        deleted = !primary.exists(),
+        securelyOverwritten = result.securelyOverwritten,
+        originalBytes = result.originalBytes,
+        overwrittenBytes = result.overwrittenBytes,
+        error = result.error
+      )
+    }
+
+    val uri = runCatching { Uri.parse(uriString) }.getOrNull()
+      ?: return PrimaryResult(false, false, 0L, 0L, "Unparseable uri: $uriString")
+
+    if (uri.scheme != "content") {
+      // http/https or anything else with no local bytes: nothing to overwrite and nothing to
+      // delete. Reported as not-deleted so the caller does not claim a wipe it never performed.
+      return PrimaryResult(false, false, 0L, 0L, "No local file behind $uriString")
+    }
+
+    val resolver = context.contentResolver
+    var overwrite: SecureFileEraser.Result? = null
+    val openError = runCatching {
+      resolver.openFileDescriptor(uri, "rw")?.use { pfd ->
+        overwrite = SecureFileEraser.overwrite(pfd)
+      } ?: throw IllegalStateException("Provider returned no descriptor")
+    }.exceptionOrNull()
+
+    if (openError != null) {
+      Log.e(TAG, "Could not open $uriString read/write for secure overwrite", openError)
+    }
+
+    val rowsDeleted = runCatching { resolver.delete(uri, null, null) }.getOrDefault(0)
+    val result = overwrite
+
+    return PrimaryResult(
+      deleted = rowsDeleted > 0,
+      securelyOverwritten = result?.securelyOverwritten == true,
+      originalBytes = result?.originalBytes ?: 0L,
+      overwrittenBytes = result?.overwrittenBytes ?: 0L,
+      error = when {
+        result?.error != null -> result.error
+        openError != null -> "Provider refused read/write access: ${openError.message}"
+        rowsDeleted <= 0 -> "Provider deleted no rows for $uriString"
+        else -> null
+      }
+    )
+  }
+
+  /**
+   * The on-disk file behind [uriString], or null when there is not one we can address as a path.
+   *
+   * `file://` and bare paths resolve directly. A `content://` URI from this app's own FileProvider
+   * is mapped back to its path through [providerRoot], which mirrors `file_paths.xml` exactly —
+   * that turns a provider-backed delete into the far stronger path-based erase (overwrite, rename,
+   * unlink) instead of depending on the provider honouring an `"rw"` open.
+   *
+   * The mapping is a lookup, deliberately NOT a search of candidate directories: this path feeds
+   * an irreversible overwrite, and a URI resolved to the wrong directory would destroy an
+   * unrelated file that happened to share a name. A foreign provider's URI stays null and is
+   * handled through the descriptor route, since only that provider knows how its authority maps
+   * to storage.
+   */
+  private fun resolveFile(context: Context, uriString: String): File? {
+    if (uriString.isBlank()) return null
+
+    val uri = runCatching { Uri.parse(uriString) }.getOrNull() ?: return null
+    val scheme = uri.scheme
+
+    if (scheme == null || scheme == "file") {
+      val path = if (scheme == null) uriString else uri.path
+      return path?.takeIf { it.isNotBlank() }?.let { File(it) }?.takeIf { it.isFile }
+    }
+
+    if (scheme != "content") return null
+    // Only OUR authority may be mapped back to a path.
+    if (uri.authority != "${context.packageName}.camera.fileprovider") return null
+
+    val segments = uri.pathSegments
+    if (segments.size < 2) return null
+
+    // FileProvider URIs are /<declared-name>/<path/under/that/root>.
+    val rootDir = providerRoot(context, segments[0]) ?: return null
+    val relative = segments.drop(1).joinToString("/")
+    val candidate = File(rootDir, relative)
+
+    // Confine the result to the declared root: a URI carrying `..` segments must not be able to
+    // steer an overwrite outside the directory its provider entry exposes.
+    val rootPath = runCatching { rootDir.canonicalPath }.getOrNull() ?: return null
+    val candidatePath = runCatching { candidate.canonicalPath }.getOrNull() ?: return null
+    if (candidatePath != rootPath && !candidatePath.startsWith("$rootPath${File.separator}")) {
+      Log.w(TAG, "Refusing to resolve $uriString outside its provider root")
+      return null
+    }
+
+    return candidate.takeIf { it.isFile }
+  }
+
+  /**
+   * Directory behind one `file_paths.xml` entry name, or null for a name this app never declared.
+   *
+   * Kept as a `when` over the declared names rather than a map so it stays obviously
+   * side-by-side-comparable with the XML — if an entry is added there and not here, a provider URI
+   * for it resolves to null and falls back to the descriptor route rather than resolving wrongly.
+   */
+  private fun providerRoot(context: Context, name: String): File? {
+    val externalFiles = context.getExternalFilesDir(null)
+    return when (name) {
+      "camera_media_cache" -> File(context.cacheDir, "camera_media_cache")
+      "edited_images" -> File(context.cacheDir, "edited")
+      "compressed_videos" -> File(context.cacheDir, "compressed")
+      "exported_media" -> File(context.cacheDir, "exported")
+      "shared_media" -> File(context.cacheDir, "shared")
+      "documents" -> externalFiles
+      "media_documents" -> externalFiles?.let { File(it, "media_documents") }
+      "photos" -> externalFiles?.let { File(it, "media_documents/photos") }
+      "videos" -> externalFiles?.let { File(it, "media_documents/videos") }
+      else -> null
+    }
+  }
+
+  /**
+   * Every OTHER file on disk that holds this asset's content.
+   *
+   * Matching is by file name against two keys — the asset id and the primary file's base name —
+   * because that is how each producer in this codebase names its output
+   * ([CompressionFileNameUtils.createUniqueFileName] prefixes with `<verb>_<assetId>`, and
+   * [MediaCacheManager.generateFileName] names the cache file after the id itself). The primary
+   * file is excluded so it is never erased twice, and directory entries are skipped.
+   *
+   * A blank/short id is ignored rather than matched loosely: a two-character key would match
+   * unrelated media and this function's output is fed straight into an irreversible overwrite.
+   */
+  private fun collectDerivedFiles(
+    context: Context,
+    primary: File?,
+    assetId: String?,
+    fileName: String?,
+    coverUri: String?,
+    extraUris: List<String>
+  ): List<File> {
+    val keys = mutableSetOf<String>()
+    assetId?.trim()?.lowercase(Locale.US)?.takeIf { it.length >= MIN_MATCH_KEY_LENGTH }?.let(keys::add)
+    fileName?.let { name ->
+      File(name).nameWithoutExtension
+        .trim()
+        .lowercase(Locale.US)
+        .takeIf { it.length >= MIN_MATCH_KEY_LENGTH }
+        ?.let(keys::add)
+    }
+
+    val primaryPath = primary?.absolutePath
+    val found = LinkedHashMap<String, File>()
+
+    fun consider(file: File) {
+      if (!file.isFile) return
+      val path = file.absolutePath
+      if (path == primaryPath) return
+      if (!found.containsKey(path)) found[path] = file
+    }
+
+    // The chosen cover frame is a real JPEG of a video frame — an image of the deleted media —
+    // so it is erased with the same guarantees rather than merely unlinked.
+    coverUri?.let { cover -> resolveFile(context, cover)?.let(::consider) }
+
+    // Copies the caller named explicitly (e.g. the cache file behind a published document).
+    for (extra in extraUris) {
+      resolveFile(context, extra)?.let(::consider)
+    }
+
+    // The cache manager's own record is authoritative for the cached copy, and survives even when
+    // the published file is what the UI handed us.
+    assetId?.takeIf { it.isNotBlank() }?.let { id ->
+      MediaCacheManager.getInstance(context).getMetadata(id)?.cachePath
+        ?.let { File(it) }
+        ?.let(::consider)
+    }
+
+    if (keys.isEmpty()) return found.values.toList()
+
+    val roots = listOfNotNull(context.cacheDir, context.getExternalFilesDir(null), context.filesDir)
+    for (root in roots) {
+      for (dirName in DERIVED_CACHE_DIRS) {
+        val dir = File(root, dirName)
+        if (!dir.isDirectory) continue
+        // listFiles (one level) rather than a recursive walk: every producer writes variants flat
+        // into these directories, and a deep walk over the external files dir would drag in
+        // unrelated app data on a device with a large media library.
+        dir.listFiles()?.forEach { file ->
+          val name = file.name.lowercase(Locale.US)
+          if (keys.any { key -> containsDelimitedKey(name, key) }) consider(file)
+        }
+      }
+    }
+
+    return found.values.toList()
+  }
+
+  /**
+   * True when [name] contains [key] as a whole token rather than as an arbitrary substring.
+   *
+   * Every producer builds its output name as `<verb>_<key>_<suffix>` or `<key>.<ext>`, so a match
+   * must begin at the start of the name or immediately after a `_`/`-`. A bare `contains` would
+   * let a short-but-legal key like `picture` also match `mypicture.jpg`, and the caller feeds this
+   * straight into an irreversible overwrite — a false positive here destroys an unrelated file.
+   */
+  private fun containsDelimitedKey(name: String, key: String): Boolean {
+    var from = 0
+    while (true) {
+      val at = name.indexOf(key, from)
+      if (at < 0) return false
+      if (at == 0 || name[at - 1] == '_' || name[at - 1] == '-') return true
+      from = at + 1
+    }
+  }
+
+  /**
+   * Drop every REFERENCE to the deleted media: cached bitmaps, cache metadata, storage metadata,
+   * and any MediaStore thumbnail rows.
+   *
+   * All of it is best-effort and none of it can fail the deletion — the bytes are already gone by
+   * the time this runs. What it prevents is the deleted item continuing to appear: a thumbnail
+   * served from the LruCache renders a photo whose file no longer exists, and a surviving metadata
+   * entry keeps it in the cache-size accounting and the duplicate index forever.
+   */
+  private suspend fun dropReferences(
+    context: Context,
+    uriString: String,
+    assetId: String?,
+    coverUri: String?
+  ) {
+    // Decoded bitmaps first: this is the only reference that can still be DISPLAYED.
+    runCatching { MediaThumbnailView.evictFromSharedCache(uriString) }
+      .onFailure { Log.w(TAG, "Failed to evict thumbnail for $uriString", it) }
+    coverUri?.let { cover ->
+      runCatching { MediaThumbnailView.evictFromSharedCache(cover) }
+        .onFailure { Log.w(TAG, "Failed to evict cover thumbnail", it) }
+    }
+
+    assetId?.takeIf { it.isNotBlank() }?.let { id ->
+      // deleteCachedMedia also unlinks the cache file, which by now is already erased and gone —
+      // it treats a missing file as deleted, so this just clears the metadata entry.
+      runCatching { MediaCacheManager.getInstance(context).deleteCachedMedia(id) }
+        .onFailure { Log.w(TAG, "Failed to clear cache metadata for $id", it) }
+      runCatching { MediaMetadataStore.getInstance(context).removeMedia(id) }
+        .onFailure { Log.w(TAG, "Failed to clear storage metadata for $id", it) }
+    }
+
+    // MediaStore keeps its own generated thumbnails for anything that was ever published to the
+    // gallery. Deleting the media row does not always take them with it, leaving a recoverable
+    // downscaled copy of a "securely deleted" photo in the system's thumbnail store.
+    runCatching { deleteMediaStoreThumbnails(context, uriString) }
+      .onFailure { Log.w(TAG, "Failed to clear MediaStore thumbnails for $uriString", it) }
+  }
+
+  /**
+   * Remove MediaStore's own thumbnail rows for a published file.
+   *
+   * Only meaningful pre-Android Q: from Q onward thumbnails live in a system-managed store that
+   * is keyed to the media row and removed with it, and the legacy `Images.Thumbnails` table is no
+   * longer writable by apps.
+   */
+  private fun deleteMediaStoreThumbnails(context: Context, uriString: String) {
+    if (android.os.Build.VERSION.SDK_INT >= android.os.Build.VERSION_CODES.Q) return
+
+    val path = resolveFile(context, uriString)?.absolutePath
+      ?: Uri.parse(uriString).path
+      ?: return
+
+    val resolver = context.contentResolver
+    @Suppress("DEPRECATION")
+    val imageId = resolver.query(
+      MediaStore.Images.Media.EXTERNAL_CONTENT_URI,
+      arrayOf(MediaStore.Images.Media._ID),
+      "${MediaStore.Images.Media.DATA} = ?",
+      arrayOf(path),
+      null
+    )?.use { cursor ->
+      if (cursor.moveToFirst()) cursor.getLong(0) else null
+    } ?: return
+
+    @Suppress("DEPRECATION")
+    resolver.delete(
+      MediaStore.Images.Thumbnails.EXTERNAL_CONTENT_URI,
+      "${MediaStore.Images.Thumbnails.IMAGE_ID} = ?",
+      arrayOf(imageId.toString())
+    )
+  }
+
+  /**
+   * Shortest name fragment accepted as an identity match in [collectDerivedFiles]. Anything
+   * shorter risks matching unrelated files, and the match feeds an irreversible overwrite.
+   */
+  private const val MIN_MATCH_KEY_LENGTH = 6
+}

package/android/src/main/java/com/customcamera/StickerPickerData.kt

@@ -0,0 +1,107 @@
+package com.customcamera
+
+import android.content.Context
+import android.graphics.Paint
+
+/**
+ * Categorized sticker collection for the preview editor's sticker picker.
+ *
+ * A sticker is either:
+ *  - [Sticker.Res] — a bundled vector drawable (the classic hand-authored set, listed in
+ *    R.array.editor_stickers so the collection stays resource-extensible), or
+ *  - [Sticker.Emoji] — an emoji glyph rendered to a high-resolution bitmap at pick time.
+ *
+ * Emoji-backed stickers are what make the collection complete and scalable: adding a
+ * sticker is a one-line data change with zero new binary assets, and nothing is
+ * rasterized until the user actually picks it (nothing but text is held in memory while
+ * browsing — important on low-end devices).
+ *
+ * Like [EmojiPickerData], glyphs are filtered once per process through [Paint.hasGlyph]
+ * so devices with older emoji fonts never show tofu boxes.
+ */
+internal object StickerPickerData {
+
+  sealed class Sticker {
+    data class Res(val resId: Int) : Sticker()
+    data class Emoji(val glyph: String) : Sticker()
+  }
+
+  data class Category(val icon: String, val label: String, val stickers: List<Sticker>)
+
+  private val emojiCategories: List<Pair<Pair<String, String>, List<String>>> = listOf(
+    ("😂" to "Faces") to listOf(
+      "😀", "😂", "🤣", "🥰", "😍", "😎", "🤩", "😜", "🤪", "🥳",
+      "😇", "🤗", "🤔", "😏", "😴", "🥺", "😭", "😱", "🤯", "🥶",
+      "😈", "🤖", "💀", "👻", "🤡", "👽", "💩", "😺", "🙈", "🙉", "🙊"
+    ),
+    ("❤️" to "Love") to listOf(
+      "❤️", "🧡", "💛", "💚", "💙", "💜", "🖤", "🤍", "💕", "💞",
+      "💖", "💘", "💝", "💗", "💓", "💔", "💋", "😘", "🌹", "🥀",
+      "💐", "💍", "💒", "🕊️"
+    ),
+    ("🎉" to "Celebration") to listOf(
+      "🎉", "🎊", "🎈", "🎁", "🎀", "🎂", "🧁", "🍰", "🥂", "🍾",
+      "🏆", "🥇", "🥈", "🥉", "🏅", "✨", "🎆", "🎇", "🎄", "🎃",
+      "🎅", "🪄", "🎯", "🎮", "🎲", "🎸", "🎤", "🎧"
+    ),
+    ("🐼" to "Animals") to listOf(
+      "🐶", "🐱", "🐼", "🐨", "🦁", "🐯", "🦊", "🐰", "🐸", "🐵",
+      "🦄", "🐷", "🐮", "🐔", "🐧", "🦉", "🦋", "🐢", "🐙", "🦈",
+      "🦖", "🐳", "🐝", "🐞", "🦜", "🦩"
+    ),
+    ("🍕" to "Food") to listOf(
+      "🍕", "🍔", "🍟", "🌭", "🍿", "🌮", "🍩", "🍪", "🍦", "🍫",
+      "🍭", "🍓", "🍉", "🍒", "🍑", "🥑", "🍍", "🥕", "🍜", "🍣",
+      "☕", "🧃", "🥤", "🍺"
+    ),
+    ("🌈" to "Vibes") to listOf(
+      "🌈", "⭐", "🌟", "🌙", "☀️", "⚡", "🔥", "❄️", "🌊", "🌸",
+      "🌺", "🌻", "🍀", "🌵", "🍁", "💎", "💯", "✅", "❌", "💤",
+      "💥", "💫", "🚀", "🛸", "⚽", "🏀", "👑", "🦸"
+    )
+  )
+
+  @Volatile
+  private var cache: List<Category>? = null
+
+  fun invalidateCache() {
+    cache = null
+  }
+
+  /**
+   * The full categorized collection: the classic drawable stickers (resolved from
+   * R.array.editor_stickers) followed by the emoji-backed categories, filtered to
+   * glyphs this device's emoji font can render. Computed once per process.
+   */
+  fun categories(context: Context): List<Category> {
+    cache?.let { return it }
+    synchronized(this) {
+      cache?.let { return it }
+
+      val result = mutableListOf<Category>()
+
+      val names = context.resources.getStringArray(R.array.editor_stickers)
+      val classic = names.mapNotNull { name ->
+        val id = context.resources.getIdentifier(name, "drawable", context.packageName)
+        if (id != 0) Sticker.Res(id) else null
+      }
+      if (classic.isNotEmpty()) {
+        result.add(Category(icon = "⭐", label = Localization.getString("categoryClassic", "Classic"), stickers = classic))
+      }
+
+      val paint = Paint()
+      for ((header, glyphs) in emojiCategories) {
+        val (icon, defaultLabel) = header
+        val labelKey = "category" + defaultLabel.replace(" ", "")
+        val label = Localization.getString(labelKey, defaultLabel)
+        val supported = glyphs.filter { paint.hasGlyph(it) }
+        if (supported.isNotEmpty()) {
+          result.add(Category(icon, label, supported.map { Sticker.Emoji(it) }))
+        }
+      }
+
+      cache = result
+      return result
+    }
+  }
+}