@atlasauth/expo 0.3.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @atlasauth/expo changelog
 
+## 0.5.0 — 2026-11-12
+
+- `useAppApproval`, `exchangeLegacyToken` (upgrade bridge), `signInWithApple` / `signInWithGoogle` / `signInWithIdToken`.
+
+## Unreleased
+
+### Added
+
+- `useAppApproval(id)`: approve-in-your-app for the signed-in app. Reads the pending request, polls while it is pending, and offers `approve(number)` and `deny()` with the shuffled number choices.
+- `exchangeLegacyToken(client, { source, token, clear, storage })`: the upgrade bridge. Trades the legacy session token an existing app still holds for an Atlas session, with no sign-in screen.
+- `signInWithApple`, `signInWithGoogle` and `signInWithIdToken`: native system-sheet sign-in over the provider's client.
+
+## 0.4.0 — 2026-10-26
+
+### Changed
+
+- `<AtlasProvider>` provides the bearer client it builds over the token cache to the policy hooks.
+
 ## 0.3.0 — 2026-10-24
 Requires `@atlasauth/react-native` with policy acceptance (new dependency).
 - **Policy acceptance** (terms of service, privacy, any policy the app defines). `<PolicyConsent>`, `<PolicyClickwrap>`,

package/dist/AtlasProvider.d.ts

@@ -1,4 +1,5 @@
 import { type ReactElement } from 'react';
+import { type AttestationProvider } from '@atlasauth/js';
 import { type AtlasProviderProps as ReactAtlasProviderProps } from '@atlasauth/react';
 import { type TokenCache } from './token-cache';
 /**
@@ -39,5 +40,7 @@ export interface AtlasProviderProps extends Omit<ReactAtlasProviderProps, 'fetch
     tokenKey?: string;
     /** Injectable for tests; defaults to the platform `fetch`. */
     fetchImpl?: typeof fetch;
+    /** App Attest / Play Integrity provider, once the instance requires app attestation. Read once. */
+    attestation?: AttestationProvider;
 }
 export declare function AtlasProvider(props: AtlasProviderProps): ReactElement;

package/dist/AtlasProvider.js

@@ -8,7 +8,7 @@ const cache_fetch_1 = require("./cache-fetch");
 const fapi_context_1 = require("./fapi-context");
 const token_cache_1 = require("./token-cache");
 function AtlasProvider(props) {
-    const { tokenCache, tokenKey = token_cache_1.DEFAULT_SESSION_KEY, fetchImpl, ...rest } = props;
+    const { tokenCache, tokenKey = token_cache_1.DEFAULT_SESSION_KEY, fetchImpl, attestation, ...rest } = props;
     // Built exactly once — the initializer runs on first render only, so the cache
     // (and the default in-memory one, when no adapter is passed) survives
     // re-renders rather than being re-created and losing the session every render.
@@ -24,6 +24,7 @@ function AtlasProvider(props) {
                 baseUrl: (0, js_1.resolveFrontendApi)(rest.frontendApi, { component: '<AtlasProvider> (expo)', allowSameOrigin: false }),
                 fetchImpl: cacheFetch,
                 locale: rest.locale,
+                attestation,
             }),
             // Sign-out tombstones persist beside the token (there is no localStorage).
             tombstoneStore: (0, token_cache_1.tombstoneStoreFor)(cache),

package/dist/AtlasProvider.js.map

@@ -1 +1 @@
-{"version":3,"file":"AtlasProvider.js","sourceRoot":"","sources":["../src/AtlasProvider.tsx"],"names":[],"mappings":";;AAwDA,sCA8BC;AAtFD,iCAAmE;AACnE,sCAA+D;AAC/D,4CAG0B;AAC1B,+CAAiD;AACjD,iDAAiD;AACjD,+CAKuB;AA2CvB,SAAgB,aAAa,CAAC,KAAyB;IACrD,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,iCAAmB,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAEjF,+EAA+E;IAC/E,sEAAsE;IACtE,+EAA+E;IAC/E,MAAM,CAAC,MAAM,CAAC,GAAG,IAAA,gBAAQ,EAAC,GAAG,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,IAAI,IAAA,sCAAwB,GAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAA,8BAAgB,EAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO;YACL,UAAU;YACV,qFAAqF;YACrF,0EAA0E;YAC1E,IAAI,EAAE,IAAI,eAAU,CAAC;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,IAAA,uBAAkB,EAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,wBAAwB,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBAC9G,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;aACpB,CAAC;YACF,2EAA2E;YAC3E,cAAc,EAAE,IAAA,+BAAiB,EAAC,KAAK,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,IAAA,qBAAa,EAAC,qBAAkB,EAAE;QACvC,GAAG,IAAI;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc;QAC5D,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,QAAQ,EAAE,IAAA,qBAAa,EAAC,8BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC;KACzF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"AtlasProvider.js","sourceRoot":"","sources":["../src/AtlasProvider.tsx"],"names":[],"mappings":";;AA0DA,sCA+BC;AAzFD,iCAAmE;AACnE,sCAAyF;AACzF,4CAG0B;AAC1B,+CAAiD;AACjD,iDAAiD;AACjD,+CAKuB;AA6CvB,SAAgB,aAAa,CAAC,KAAyB;IACrD,MAAM,EAAE,UAAU,EAAE,QAAQ,GAAG,iCAAmB,EAAE,SAAS,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAE9F,+EAA+E;IAC/E,sEAAsE;IACtE,+EAA+E;IAC/E,MAAM,CAAC,MAAM,CAAC,GAAG,IAAA,gBAAQ,EAAC,GAAG,EAAE;QAC7B,MAAM,KAAK,GAAG,UAAU,IAAI,IAAA,sCAAwB,GAAE,CAAC;QACvD,MAAM,UAAU,GAAG,IAAA,8BAAgB,EAAC,EAAE,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC;QAC7F,OAAO;YACL,UAAU;YACV,qFAAqF;YACrF,0EAA0E;YAC1E,IAAI,EAAE,IAAI,eAAU,CAAC;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;gBACnC,OAAO,EAAE,IAAA,uBAAkB,EAAC,IAAI,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,wBAAwB,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC;gBAC9G,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,WAAW;aACZ,CAAC;YACF,2EAA2E;YAC3E,cAAc,EAAE,IAAA,+BAAiB,EAAC,KAAK,CAAC;SACzC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,IAAA,qBAAa,EAAC,qBAAkB,EAAE;QACvC,GAAG,IAAI;QACP,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,cAAc;QAC5D,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,QAAQ,EAAE,IAAA,qBAAa,EAAC,8BAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC;KACzF,CAAC,CAAC;AACL,CAAC"}

package/dist/app-approval.d.ts

@@ -0,0 +1,22 @@
+import { type AppApprovalDetails, type FapiClient } from '@atlasauth/js';
+export interface AppApprovalController {
+    /** The request, or null while loading / when it does not exist. */
+    details: AppApprovalDetails | null;
+    loading: boolean;
+    /** Approve with the number the person tapped. Resolves true when the answer was accepted. */
+    approve(number: string): Promise<boolean>;
+    /** "This was not me". */
+    deny(): Promise<boolean>;
+    error: string | null;
+}
+/** Controller logic, separated from React so it is testable with a fake client. */
+export declare function createAppApprovalActions(client: FapiClient, id: string): {
+    load: () => Promise<AppApprovalDetails | null>;
+    approve: (number: string) => Promise<boolean>;
+    deny: () => Promise<boolean>;
+};
+/**
+ * @param id the approval id from your push or webhook; null does nothing.
+ * @param pollMs while the request is pending, re-read it this often (default 3000; 0 disables).
+ */
+export declare function useAppApproval(id: string | null, pollMs?: number): AppApprovalController;

package/dist/app-approval.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAppApprovalActions = createAppApprovalActions;
+exports.useAppApproval = useAppApproval;
+/**
+ * Approve-in-your-app for the signed-in app: read the pending request (its id
+ * arrives in your push notification, or by polling), show the person the
+ * shuffled number choices, and answer. A thin hook over the `@atlasauth/js`
+ * calls, bound to the provider's bearer-authenticated client.
+ */
+const react_1 = require("react");
+const js_1 = require("@atlasauth/js");
+const policies_1 = require("./policies");
+/** Controller logic, separated from React so it is testable with a fake client. */
+function createAppApprovalActions(client, id) {
+    return {
+        load: () => (0, js_1.getAppApproval)(client, id),
+        approve: async (number) => (await (0, js_1.approveSignIn)(client, { id, number })).ok,
+        deny: async () => (await (0, js_1.denySignIn)(client, id)).ok,
+    };
+}
+/**
+ * @param id the approval id from your push or webhook; null does nothing.
+ * @param pollMs while the request is pending, re-read it this often (default 3000; 0 disables).
+ */
+function useAppApproval(id, pollMs = 3000) {
+    const client = (0, policies_1.useExpoFapiClient)();
+    const [details, setDetails] = (0, react_1.useState)(null);
+    const [loading, setLoading] = (0, react_1.useState)(id !== null);
+    const [error, setError] = (0, react_1.useState)(null);
+    const actions = (0, react_1.useRef)(null);
+    actions.current = id ? createAppApprovalActions(client, id) : null;
+    (0, react_1.useEffect)(() => {
+        if (!id)
+            return;
+        let live = true;
+        let timer;
+        const tick = async () => {
+            const next = await actions.current?.load();
+            if (!live)
+                return;
+            setDetails(next ?? null);
+            setLoading(false);
+            if (pollMs > 0 && next?.status === 'pending')
+                timer = setTimeout(tick, pollMs);
+        };
+        setLoading(true);
+        void tick();
+        return () => { live = false; if (timer)
+            clearTimeout(timer); };
+    }, [id, pollMs]);
+    const answer = (0, react_1.useCallback)(async (run) => {
+        const ok = (await run()) ?? false;
+        setError(ok ? null : 'The answer was not accepted.');
+        if (ok)
+            setDetails((d) => (d ? { ...d, status: 'approved' } : d));
+        return ok;
+    }, []);
+    return {
+        details,
+        loading,
+        error,
+        approve: (n) => answer(() => actions.current?.approve(n)),
+        deny: async () => {
+            const ok = (await actions.current?.deny()) ?? false;
+            setError(ok ? null : 'The answer was not accepted.');
+            if (ok)
+                setDetails((d) => (d ? { ...d, status: 'denied' } : d));
+            return ok;
+        },
+    };
+}
+//# sourceMappingURL=app-approval.js.map

package/dist/app-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-approval.js","sourceRoot":"","sources":["../src/app-approval.ts"],"names":[],"mappings":";;AAsBA,4DAMC;AAMD,wCA2CC;AA7ED;;;;;GAKG;AACH,iCAAiE;AACjE,sCAAoH;AACpH,yCAA+C;AAa/C,mFAAmF;AACnF,SAAgB,wBAAwB,CAAC,MAAkB,EAAE,EAAU;IACrE,OAAO;QACL,IAAI,EAAE,GAAG,EAAE,CAAC,IAAA,mBAAc,EAAC,MAAM,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,KAAK,EAAE,MAAc,EAAE,EAAE,CAAC,CAAC,MAAM,IAAA,kBAAa,EAAC,MAAM,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;QACnF,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,IAAA,eAAU,EAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE;KACpD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,EAAiB,EAAE,MAAM,GAAG,IAAI;IAC7D,MAAM,MAAM,GAAG,IAAA,4BAAiB,GAAE,CAAC;IACnC,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAA4B,IAAI,CAAC,CAAC;IACxE,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG,IAAA,gBAAQ,EAAC,EAAE,KAAK,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,IAAA,gBAAQ,EAAgB,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,IAAA,cAAM,EAAqD,IAAI,CAAC,CAAC;IACjF,OAAO,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEnE,IAAA,iBAAS,EAAC,GAAG,EAAE;QACb,IAAI,CAAC,EAAE;YAAE,OAAO;QAChB,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,IAAI,KAAgD,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3C,IAAI,CAAC,IAAI;gBAAE,OAAO;YAClB,UAAU,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC;YACzB,UAAU,CAAC,KAAK,CAAC,CAAC;YAClB,IAAI,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,MAAM,KAAK,SAAS;gBAAE,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjF,CAAC,CAAC;QACF,UAAU,CAAC,IAAI,CAAC,CAAC;QACjB,KAAK,IAAI,EAAE,CAAC;QACZ,OAAO,GAAG,EAAE,GAAG,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAEjB,MAAM,MAAM,GAAG,IAAA,mBAAW,EAAC,KAAK,EAAE,GAAuC,EAAE,EAAE;QAC3E,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,KAAK,CAAC;QAClC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;QACrD,IAAI,EAAE;YAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClE,OAAO,EAAE,CAAC;IACZ,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,OAAO;QACL,OAAO;QACP,OAAO;QACP,KAAK;QACL,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;YACpD,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC;YACrD,IAAI,EAAE;gBAAE,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO,EAAE,CAAC;QACZ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/bridge.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Upgrade bridge for apps that already have signed-in users: trade the legacy
+ * session token the app still holds for an Atlas session, with no sign-in screen.
+ *
+ * The exchange asks for the tokens in the response body (a native app has no
+ * cookies). Pass the provider's client (`useExpoFapiClient()`) and the session
+ * JWT is stored by the token cache like any other; pass `storage` as well to keep
+ * the refresh token for `createNativeSessionManager`.
+ */
+import { type FapiClient, type NativeSession } from '@atlasauth/js';
+import type { TokenStorage } from './token-cache';
+export type LegacyTokenExchangeOutcome = {
+    status: 'none';
+} | {
+    status: 'complete';
+    session: NativeSession;
+    userId: string;
+} | {
+    status: 'needs_second_factor' | 'needs_mfa_enrollment';
+    attemptId: string;
+} | {
+    status: 'refused';
+    outcome: string;
+};
+export declare function exchangeLegacyToken(client: FapiClient, input: {
+    /** The legacy provider key, e.g. `better_auth`, `firebase`, `supabase`. */
+    source: string;
+    /** The token the app holds; absent means nothing to do. */
+    token?: string | null;
+    /** Called after a success or a final refusal: delete the legacy token here. */
+    clear?: () => void | Promise<void>;
+    /** Where to keep the refresh token (a slot dedicated to the native session). */
+    storage?: TokenStorage;
+}): Promise<LegacyTokenExchangeOutcome>;

package/dist/bridge.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangeLegacyToken = exchangeLegacyToken;
+/**
+ * Upgrade bridge for apps that already have signed-in users: trade the legacy
+ * session token the app still holds for an Atlas session, with no sign-in screen.
+ *
+ * The exchange asks for the tokens in the response body (a native app has no
+ * cookies). Pass the provider's client (`useExpoFapiClient()`) and the session
+ * JWT is stored by the token cache like any other; pass `storage` as well to keep
+ * the refresh token for `createNativeSessionManager`.
+ */
+const js_1 = require("@atlasauth/js");
+/** Refusals after which the legacy token will never exchange, so it is safe to delete. */
+const FINAL = new Set(['invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'user_unknown']);
+async function exchangeLegacyToken(client, input) {
+    if (!input.token)
+        return { status: 'none' };
+    const clear = async () => { try {
+        await input.clear?.();
+    }
+    catch { /* best effort */ } };
+    let response;
+    try {
+        response = await client.post((0, js_1.migrationBrowserExchangePath)(input.source), { token: input.token, delivery: 'body' });
+    }
+    catch {
+        return { status: 'refused', outcome: 'error' };
+    }
+    const d = response.data;
+    if (response.ok && d?.jwt && d.session_id) {
+        const session = { sessionToken: d.jwt, refreshToken: d.refresh_token ?? '', sessionId: d.session_id, expiresInSeconds: d.expires_in ?? 0 };
+        if (input.storage && session.refreshToken)
+            await input.storage.setToken((0, js_1.serializeNativeSession)(session));
+        await clear();
+        return { status: 'complete', session, userId: d.user_id ?? '' };
+    }
+    if (response.ok && d?.id && (d.status === 'needs_second_factor' || d.status === 'needs_mfa_enrollment')) {
+        await clear();
+        return { status: d.status, attemptId: d.id };
+    }
+    const reason = response.errors[0]?.meta?.bridge_outcome;
+    const outcome = typeof reason === 'string' ? reason : 'error';
+    if (FINAL.has(outcome))
+        await clear();
+    return { status: 'refused', outcome };
+}
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":";;AAqBA,kDAuCC;AA5DD;;;;;;;;GAQG;AACH,sCAA0H;AAS1H,0FAA0F;AAC1F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC,CAAC;AAE1G,KAAK,UAAU,mBAAmB,CACvC,MAAkB,EAClB,KASC;IAED,IAAI,CAAC,KAAK,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,IAAI,EAAE,GAAG,IAAI,CAAC;QAAC,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAC1B,IAAA,iCAA4B,EAAC,KAAK,CAAC,MAAM,CAAC,EAC1C,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CACzC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC;IACxB,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAkB,EAAE,YAAY,EAAE,CAAC,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,gBAAgB,EAAE,CAAC,CAAC,UAAU,IAAI,CAAC,EAAE,CAAC;QAC1J,IAAI,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,YAAY;YAAE,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAA,2BAAsB,EAAC,OAAO,CAAC,CAAC,CAAC;QACzG,MAAM,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,IAAI,QAAQ,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,CAAC,MAAM,KAAK,sBAAsB,CAAC,EAAE,CAAC;QACxG,MAAM,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;IAC/C,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACxD,MAAM,OAAO,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;IAC9D,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,MAAM,KAAK,EAAE,CAAC;IACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC"}

package/dist/index.d.ts

@@ -4,3 +4,6 @@ export * from './AtlasProvider';
 export * from './native-session';
 export { useAuth, useUser, useSession, useSessionList, useOrganization, SignedIn, SignedOut, Protect, AtlasLoading, AtlasLoaded, } from '@atlasauth/react';
 export * from './policies';
+export * from './social';
+export * from './bridge';
+export * from './app-approval';

package/dist/index.js

@@ -46,4 +46,8 @@ Object.defineProperty(exports, "AtlasLoading", { enumerable: true, get: function
 Object.defineProperty(exports, "AtlasLoaded", { enumerable: true, get: function () { return react_1.AtlasLoaded; } });
 // Policy acceptance (terms, privacy, any policy): native components + hooks bound to this provider.
 __exportStar(require("./policies"), exports);
+// Native social sign-in, the upgrade bridge for apps with existing users, and approve-in-your-app.
+__exportStar(require("./social"), exports);
+__exportStar(require("./bridge"), exports);
+__exportStar(require("./app-approval"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,2EAA2E;AAC3E,kEAAkE;AAClE,gDAA8B;AAC9B,gDAA8B;AAC9B,kDAAgC;AAEhC,8EAA8E;AAC9E,mDAAiC;AAEjC;;;;;;;;;;GAUG;AACH,0CAW0B;AAVxB,gGAAA,OAAO,OAAA;AACP,gGAAA,OAAO,OAAA;AACP,mGAAA,UAAU,OAAA;AACV,uGAAA,cAAc,OAAA;AACd,wGAAA,eAAe,OAAA;AACf,iGAAA,QAAQ,OAAA;AACR,kGAAA,SAAS,OAAA;AACT,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA;AAGb,oGAAoG;AACpG,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,2EAA2E;AAC3E,kEAAkE;AAClE,gDAA8B;AAC9B,gDAA8B;AAC9B,kDAAgC;AAEhC,8EAA8E;AAC9E,mDAAiC;AAEjC;;;;;;;;;;GAUG;AACH,0CAW0B;AAVxB,gGAAA,OAAO,OAAA;AACP,gGAAA,OAAO,OAAA;AACP,mGAAA,UAAU,OAAA;AACV,uGAAA,cAAc,OAAA;AACd,wGAAA,eAAe,OAAA;AACf,iGAAA,QAAQ,OAAA;AACR,kGAAA,SAAS,OAAA;AACT,gGAAA,OAAO,OAAA;AACP,qGAAA,YAAY,OAAA;AACZ,oGAAA,WAAW,OAAA;AAGb,oGAAoG;AACpG,6CAA2B;AAE3B,mGAAmG;AACnG,2CAAyB;AACzB,2CAAyB;AACzB,iDAA+B"}

package/dist/social.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Native Google / Apple sign-in for the provider's client: the system sheet
+ * yields a provider ID token, which is sent to Atlas (`POST
+ * /v1/client/sign_ins/id_token`) and traded for a session. The provider's token
+ * cache stores the returned session JWT.
+ */
+import { type FapiClient, type FieldError } from '@atlasauth/js';
+export interface NativeSocialResult {
+    status: 'complete' | 'needs_more' | 'error' | 'cancelled';
+    jwt?: string;
+    attemptId?: string;
+    errors: FieldError[];
+}
+/** Send a provider ID token (with the nonce it was minted with) and finish the sign-in. */
+export declare function signInWithIdToken(client: FapiClient, input: {
+    provider: string;
+    idToken: string;
+    nonce?: string;
+}): Promise<NativeSocialResult>;
+/** The slice of `expo-apple-authentication` used here. */
+export interface AppleAuthenticationLike {
+    signInAsync(options: {
+        requestedScopes?: unknown[];
+        nonce?: string;
+    }): Promise<{
+        identityToken: string | null;
+    }>;
+    AppleAuthenticationScope: {
+        EMAIL: unknown;
+        FULL_NAME: unknown;
+    };
+}
+/** Sign in with the Apple system sheet. A dismissed sheet resolves as `cancelled`. */
+export declare function signInWithApple(client: FapiClient, apple: AppleAuthenticationLike): Promise<NativeSocialResult>;
+/** The slice of `@react-native-google-signin/google-signin` used here. */
+export interface GoogleSigninLike {
+    signIn(options?: {
+        nonce?: string;
+    }): Promise<unknown>;
+}
+/** Sign in with the Google system sheet (use `@atlasauth/expo-google-signin` for Play Services checks). */
+export declare function signInWithGoogle(client: FapiClient, google: GoogleSigninLike): Promise<NativeSocialResult>;

package/dist/social.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.signInWithIdToken = signInWithIdToken;
+exports.signInWithApple = signInWithApple;
+exports.signInWithGoogle = signInWithGoogle;
+/**
+ * Native Google / Apple sign-in for the provider's client: the system sheet
+ * yields a provider ID token, which is sent to Atlas (`POST
+ * /v1/client/sign_ins/id_token`) and traded for a session. The provider's token
+ * cache stores the returned session JWT.
+ */
+const js_1 = require("@atlasauth/js");
+/** Send a provider ID token (with the nonce it was minted with) and finish the sign-in. */
+async function signInWithIdToken(client, input) {
+    const flow = await (0, js_1.nativeSignIn)(client, input);
+    if (flow.errors.length)
+        return { status: 'error', errors: flow.errors };
+    const attempt = flow.attempt;
+    if (!flow.ticket)
+        return { status: 'needs_more', ...(attempt?.id ? { attemptId: attempt.id } : {}), errors: [] };
+    const ex = await client.post('/v1/client/tickets/exchange', { attempt_id: attempt?.id ?? '', ticket: flow.ticket });
+    if (!ex.ok || !ex.data?.jwt)
+        return { status: 'error', errors: ex.errors.length ? ex.errors : [{ code: 'EXCHANGE_FAILED', message: 'Could not complete sign-in.' }] };
+    return { status: 'complete', jwt: ex.data.jwt, ...(attempt?.id ? { attemptId: attempt.id } : {}), errors: [] };
+}
+/** Sign in with the Apple system sheet. A dismissed sheet resolves as `cancelled`. */
+async function signInWithApple(client, apple) {
+    const nonce = (await (0, js_1.mintNativeNonce)(client, 'apple')) ?? undefined;
+    if (!nonce)
+        return { status: 'error', errors: [{ code: 'NONCE', message: 'Could not start Apple sign-in.' }] };
+    let idToken;
+    try {
+        ({ identityToken: idToken } = await apple.signInAsync({ requestedScopes: [apple.AppleAuthenticationScope.EMAIL, apple.AppleAuthenticationScope.FULL_NAME], nonce }));
+    }
+    catch {
+        return { status: 'cancelled', errors: [] };
+    }
+    if (!idToken)
+        return { status: 'cancelled', errors: [] };
+    return signInWithIdToken(client, { provider: 'apple', idToken, nonce });
+}
+/** Sign in with the Google system sheet (use `@atlasauth/expo-google-signin` for Play Services checks). */
+async function signInWithGoogle(client, google) {
+    const nonce = (await (0, js_1.mintNativeNonce)(client, 'google')) ?? undefined;
+    if (!nonce)
+        return { status: 'error', errors: [{ code: 'NONCE', message: 'Could not start Google sign-in.' }] };
+    let response;
+    try {
+        response = await google.signIn({ nonce });
+    }
+    catch {
+        return { status: 'cancelled', errors: [] };
+    }
+    const r = response;
+    const idToken = r?.data?.idToken ?? r?.idToken;
+    if (!idToken)
+        return { status: 'cancelled', errors: [] };
+    return signInWithIdToken(client, { provider: 'google', idToken, nonce });
+}
+//# sourceMappingURL=social.js.map

package/dist/social.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"social.js","sourceRoot":"","sources":["../src/social.ts"],"names":[],"mappings":";;AAgBA,8CAQC;AASD,0CAWC;AAQD,4CAaC;AAjED;;;;;GAKG;AACH,sCAAgG;AAShG,2FAA2F;AACpF,KAAK,UAAU,iBAAiB,CAAC,MAAkB,EAAE,KAA4D;IACtH,MAAM,IAAI,GAAG,MAAM,IAAA,iBAAY,EAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,MAAM,OAAO,GAAG,IAAI,CAAC,OAAiC,CAAC;IACvD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACjH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAmB,6BAA6B,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACtI,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,6BAA6B,EAAE,CAAC,EAAE,CAAC;IACtK,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACjH,CAAC;AAQD,sFAAsF;AAC/E,KAAK,UAAU,eAAe,CAAC,MAAkB,EAAE,KAA8B;IACtF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAA,oBAAe,EAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,SAAS,CAAC;IACpE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,EAAE,CAAC;IAC/G,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,CAAC,wBAAwB,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACvK,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzD,OAAO,iBAAiB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1E,CAAC;AAOD,2GAA2G;AACpG,KAAK,UAAU,gBAAgB,CAAC,MAAkB,EAAE,MAAwB;IACjF,MAAM,KAAK,GAAG,CAAC,MAAM,IAAA,oBAAe,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,SAAS,CAAC;IACrE,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,EAAE,CAAC;IAChH,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,GAAG,QAAoE,CAAC;IAC/E,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,EAAE,OAAO,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzD,OAAO,iBAAiB,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC"}

package/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@atlasauth/expo",
-  "version": "0.3.0",
+  "version": "0.5.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {
-    "@atlasauth/react-native": "^0.6.0",
-    "@atlasauth/react": "^0.16.0",
-    "@atlasauth/js": "0.19.0"
+    "@atlasauth/js": "0.38.0",
+    "@atlasauth/react": "^0.34.0",
+    "@atlasauth/react-native": "^0.7.0"
   },
   "peerDependencies": {
     "react": ">=18",
@@ -43,12 +43,13 @@
   },
   "files": [
     "dist",
+    "!dist/*.tsbuildinfo",
     "README.md",
     "CHANGELOG.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
-    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "typecheck": "tsgo -p tsconfig.json --noEmit --module preserve --moduleResolution bundler --incremental --tsBuildInfoFile node_modules/.cache/typecheck.tsbuildinfo",
     "test": "vitest run"
   }
 }