Connect external HID device (Keyboard or remote camera trigger)

Thanks @Gordon for the hints.

NRF Connect only shows the Service, no peeking or poking possible (iOS here).

By the way, this is my code so far:

var notify = 0;
var hidService;
var modeChar, reportChar;

function onInit() {

  NRF.requestDevice({
    filters: [{namePrefix: "AB"}]
  }).then((device)=>{
    console.log("FOUND");
    return device.gatt.connect();
  }).then((gatt)=>{
    console.log("CONNECTED", gatt);
    return gatt.getPrimaryService("1812");
  }).then((service)=>{
    hidService = service;
    console.log("SERVICE", hidService);
    return hidService.getCharacteristic(0x2a4e);
    // 2a4e - protocol mode (R-W)
    // 2a4d - report (R-N)
    // 2a4b - report map (R)
    // 2a4a - hid information (R)
    // 2a4c - hid control point (W)    
  }).then((char)=>{
    console.log("MODE", char);
    modeChar = char;
    return char.readValue();
  }).then((d)=>{
    console.log("READ", d.buffer);
    console.log("WRITING 1");
    return modeChar.writeValue(1);
  }).then((d)=>{
    console.log("WRITTEN, GET REPORT");
    return hidService.getCharacteristic(0x2a4d);
  }).then((char)=>{
    console.log("REPORT", char);
    reportChar = char;
    char.on("characteristicvaluechanged",(e)=>{
      console.log("EVENT", e.targete.value);
    });
    return char.startNotifications();
  }).then((d)=>{
    console.log("DONE");
    return true;
  }).catch((err)=>{
    console.log("ERROR", err);
  }); 
}

onInit();

And this is the output:

FOUND
CONNECTED BluetoothRemoteGATTServer: {
  "device": BluetoothDevice: {
    "id": "2a:07:98:10:35:fb public",
    "rssi": -59,
    "data": new Uint8Array([2, 1, 5, 3, 2, 18, 24, 3, 25, 193, 3, 12, 9, 65, 66, 32, 83, 104, 117, 116, 116, 101, 114, 51]).buffer,
    "name": "AB Shutter3",
    "services": [
      "1812"
     ],
    "gatt":  ...
   },
  "connected": true, "handle": 1 }
SERVICE BluetoothRemoteGATTService: {
  "device": BluetoothDevice: {
    "id": "2a:07:98:10:35:fb public",
    "rssi": -59,
    "data": new Uint8Array([2, 1, 5, 3, 2, 18, 24, 3, 25, 193, 3, 12, 9, 65, 66, 32, 83, 104, 117, 116, 116, 101, 114, 51]).buffer,
    "name": "AB Shutter3",
    "services": [
      "1812"
     ],
    "gatt": BluetoothRemoteGATTServer: {
      "device":  ... ,
      "connected": true, "handle": 1 }
   },
  "uuid": "0x1812",
  "isPrimary": true, "start_handle": 15, "end_handle": 31 }
MODE BluetoothRemoteGATTCharacteristic: {
  "service": BluetoothRemoteGATTService: {
    "device": BluetoothDevice: {
      "id": "2a:07:98:10:35:fb public",
      "rssi": -59,
      "data": new Uint8Array([2, 1, 5, 3, 2, 18, 24, 3, 25, 193, 3, 12, 9, 65, 66, 32, 83, 104, 117, 116, 116, 101, 114, 51]).buffer,
      "name": "AB Shutter3",
      "services": [
        "1812"
       ],
      "gatt": BluetoothRemoteGATTServer: {
        "device":  ... ,
        "connected": true, "handle": 1 }
     },
    "uuid": "0x1812",
    "isPrimary": true, "start_handle": 15, "end_handle": 31 },
  "uuid": "0x2a4e",
  "handle_value": 17, "handle_decl": 16,
  "properties": { "broadcast": false, "read": true, "writeWithoutResponse": true, "write": false,
    "notify": false, "indicate": false, "authenticatedSignedWrites": false }
 }
READ new Uint8Array([1]).buffer
WRITING 1
WRITTEN, GET REPORT
REPORT BluetoothRemoteGATTCharacteristic: {
  "service": BluetoothRemoteGATTService: {
    "device": BluetoothDevice: {
      "id": "2a:07:98:10:35:fb public",
      "rssi": -59,
      "data": new Uint8Array([2, 1, 5, 3, 2, 18, 24, 3, 25, 193, 3, 12, 9, 65, 66, 32, 83, 104, 117, 116, 116, 101, 114, 51]).buffer,
      "name": "AB Shutter3",
      "services": [
        "1812"
       ],
      "gatt": BluetoothRemoteGATTServer: {
        "device":  ... ,
        "connected": true, "handle": 1 }
     },
    "uuid": "0x1812",
    "isPrimary": true, "start_handle": 15, "end_handle": 31 },
  "uuid": "0x2a4d",
  "handle_value": 19, "handle_decl": 18,
  "properties": { "broadcast": false, "read": true, "writeWithoutResponse": false, "write": false,
    "notify": true, "indicate": false, "authenticatedSignedWrites": false }
 }
DONE

Maybe you see something I don't.
As far as I can see PROTOCOL_MODE already is set to 1:

READ new Uint8Array([1]).buffer

What about this BLE_GATTS_EVT_RW_AUTHORIZE_REQUEST?

I will have to look at the sourcecode more in-depth though.
Any way to log what is going on when Espruino is in the HID role against a phone or computer?