@amisi-mobile-starter/security
@amisi-mobile-starter/security exports per-user security storage, PIN verifier helpers, biometric helpers, an external lock store, and two hooks.
PIN helpers
userId. There are no exported setupPin, verifyPin, or getUserSecuritySetupState functions.
PIN_LENGTH is 6. PIN_KEYPAD_ROWS and PinKeypadValue are exported for keypad UI. savePinForUser stores a salted PinVerifierPayload in secure storage and stores setup flags in key-value storage. It does not store the PIN string.
Lower-level exports are createPinVerifierPayload(pin) and verifyPinAgainstPayload(pin, payload).
Biometrics
authenticateWithBiometrics(promptMessage: string) requires the prompt. Its result is { success: boolean; errorMessage: string | null }. Availability is { isAvailable, hasHardware, isEnrolled }. The web implementation reports availability and authentication success without a native prompt.
Persist setup state with setHasBiometricsSetupForUser(userId, value) and setBiometricsEnabledForUser(userId, value).
Lock state
lockStore object. Key exports include:
initializeLockStateForUser(userId)setCurrentUserForLockStore(userId | null)lockUserSession(userId, route | null)unlockUserSession(userId)consumePendingUnlockRoute(userId)getLockState()andsubscribeLockState(listener)markLockStoreInteraction(),markLockStoreBackground(), andconsumeBackgroundDuration()
SecurityLockState mirrors isLocked, lockedUserId, pendingRoute, lastInteractionAt, and backgroundAt.
Inactivity manager
useAppLockManager accepts all seven fields above and returns only recordActivity. It records the current route when it locks, enforces a minimum one-second timeout, watches React Native AppState, and exports notifyAppInteraction() so the root touch handler can reset foreground inactivity.