Rebuilt as a self-contained plugin — no pin_code_fields or sms_autofill dependency. Both are reimplemented.

• AutoOtpField — OTP field combining own PIN cells + own Android SMS Retriever bridge + iOS oneTimeCode keyboard autofill.
• OtpPinField — single-hidden-input PIN widget. Fixes the per-cell paste / soft-backspace / partial-autofill bugs of pin_code_fields.
• OtpRetriever — own Android SMS Retriever bridge (native Kotlin plugin): leak-free, idempotent, timeout-aware. Fixes the sms_autofill receiver / stream leak and duplicate-receiver bug.
• AutoOtpController — code, setCode (length-clamped), clearCode, triggerError, clearError, requestFocus, hasError. Fully owned — no surprise auto-dispose, no double-dispose.
• AutoOtpTheme / AutoOtpShape — null-safe styling resolved from ThemeData.
• AutoOtp.getAppSignature() / requestPhoneHint() static helpers.
• OtpResendTimer + OtpResendController — resend cooldown (default 1 minute), theme-adaptive, fully customizable via builder / resendBuilder; auto-restarts after a successful resend.

Refill / re-verify correctness:

• SMS Retriever treated as one-shot (it is): torn down on delivery so a later attempt can re-arm.
• reArmOnClear (default true) re-arms automatically when the field is cleared — a resent OTP autofills and onCompleted fires again.
• Completion is driven explicitly from the autofill path, so a repeated / unchanged code can no longer be swallowed and onCompleted (your verify) always runs after autofill.
• OtpRetriever.restart() for manual re-arm.
• Completion is detected centrally from AutoOtpController (notifies on every change — typed, OS keyboard autofill, or SMS), so onCompleted can't be missed by a child widget's private listener.
• onAutoFill fires before onCompleted (informational first); the SMS path also guarantees onCompleted even if the field already held the code.

Behavioral guarantees:

• SMS listener and native receiver are always torn down.
• start() is idempotent — no duplicate native receivers.
• SMS Retriever timeout (~5 min) surfaced via onTimeout.
• Retriever armed only on Android; iOS uses keyboard autofill.
• Caller-supplied controller is never double-disposed.
• onCompleted fires exactly once per code.