@authon/react-native-wallet 0.4.0 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # @authon/react-native-wallet
 
+## 0.5.0
+
+- `signInWithAppleNative(client, { appId? })` (iOS): native Sign in with Apple through the system sheet, with no browser or web page, using the server's single-use start/complete flow. JS receives only the final session or MFA challenge, which `client.adoptSignInResult()` (@authon/react-native 0.9.4) makes the app session. Apple's identity token, authorization code, nonce and verifier stay in Swift. Errors carry the shared sign-in codes (`OAUTH_CANCELLED`, `OAUTH_REDIRECT_NOT_ALLOWED` with `serverCode` APP_NOT_REGISTERED / APP_NOT_APPROVED, `OAUTH_STATE_MISMATCH`, `OAUTH_EXCHANGE_FAILED`, ...) and `diagnosticId`; cancel and errors never fall back to a web flow. Android throws `UNSUPPORTED_PLATFORM` (use `startOAuth('apple')`).
+
 ## 0.4.0
 
 - `signChainTransaction({ chain, account, address, payload })` for app-built transactions on other chains (NATIVE.md section 12): Solana (`{ message }` → `{ signature }`), TRON (`{ rawDataHex }` → `{ txID, signature }`), Bitcoin and Bitcoin testnet (`{ psbt }` → `{ psbt, txHex? }`) and XRP (`{ txBlobHex }` → `{ signature }`). EVM stays on `signTransaction` (`INVALID_PARAMS` for `chain: 'evm'`). The native approval UI summarizes the transaction before the key is assembled.

package/README.md

@@ -4,7 +4,7 @@
 > (`AuthonWallet`) and Kotlin (`dev.authon.sdk.wallet`) wallet implementations.
 
 [![License](https://img.shields.io/badge/license-MIT-blue)](../../LICENSE)
-[![Version](https://img.shields.io/badge/version-0.4.0-blue)]()
+[![Version](https://img.shields.io/badge/version-0.5.0-blue)]()
 
 It is the same wallet as the web SDK (`@authon/js`): same wallet row, same `/v1/wallet/me/*` API,
 same shares. A user gets the same address in your web app and your mobile app, and the app install
@@ -186,6 +186,30 @@ ignored).
 | `deviceLock` | `DEVICE_LOCK_NOT_SET` | `CHECK_FAILED` |
 | `passkeyBackup` | `OS_UNSUPPORTED` (iOS < 18, Android < 9), `PASSKEY_API_UNAVAILABLE` | `PRF_PROVIDER_UNVERIFIED` (the provider's PRF support is confirmed on the first `protect()`) |
 
+### Native Sign in with Apple (iOS)
+
+```tsx
+import { useAuthon, AuthonAuthError, AuthonMfaRequiredError } from '@authon/react-native';
+import { signInWithAppleNative } from '@authon/react-native-wallet';
+
+const { client } = useAuthon();
+try {
+  await signInWithAppleNative(client); // system Apple sheet, then the session is the app session
+} catch (e) {
+  if (e instanceof AuthonMfaRequiredError) return showMfa(e.mfaToken); // then verifyMfa()
+  if (e instanceof AuthonAuthError && e.code === 'OAUTH_CANCELLED') return; // show nothing
+  throw e;
+}
+```
+
+The app needs the "Sign in with Apple" capability (`ios.entitlements` `com.apple.developer.applesignin: ["Default"]` in app.json, or `expo-apple-authentication`) and must be
+registered and approved in the Authon console (`TEAMID.bundleId`). JS never receives Apple's identity
+token, authorization code, nonce or the PKCE verifier. Codes: `OAUTH_CANCELLED`,
+`OAUTH_REDIRECT_NOT_ALLOWED` (`serverCode` `APP_NOT_REGISTERED` / `APP_NOT_APPROVED`),
+`OAUTH_STATE_MISMATCH`, `OAUTH_EXCHANGE_FAILED`, `ACCOUNT_LINK_REQUIRED`, `NETWORK_ERROR`,
+`RATE_LIMITED`, `API_ERROR`, with `diagnosticId`. There is no web fallback. On Android it throws
+`UNSUPPORTED_PLATFORM`; use `startOAuth('apple')` there.
+
 ### Errors
 
 Every failure is an `AuthonWalletError` with `code`, `message`, `diagnosticId` (the server's request ID

package/build/appleSignIn.d.ts

@@ -0,0 +1,26 @@
+/** The part of @authon/react-native's AuthonMobileClient this helper uses. */
+export interface AppleSignInClient {
+    getApiUrl(): string;
+    getPublishableKey(): string;
+    adoptSignInResult(result: never): Promise<unknown>;
+}
+export interface SignInWithAppleNativeOptions {
+    /** `TEAMID.bundleId` as registered in the Authon console; detected from the app when omitted. */
+    appId?: string;
+}
+/**
+ * Native Sign in with Apple on iOS: shows the system Apple sheet right away (no browser, no web page)
+ * and makes the resulting session the session of `client` (an AuthonMobileClient from
+ * @authon/react-native, e.g. `useAuthon().client`), like a completed OAuth sign-in.
+ *
+ * JS never sees Apple's identity token, authorization code, nonce or the PKCE verifier; only the
+ * final result reaches JS. Errors are AuthonAuthError with the shared sign-in codes: OAUTH_CANCELLED
+ * (the user closed the sheet, show nothing), OAUTH_REDIRECT_NOT_ALLOWED (app not registered or not
+ * approved; `serverCode` tells APP_NOT_REGISTERED from APP_NOT_APPROVED), OAUTH_STATE_MISMATCH
+ * (server OAUTH_STATE_INVALID), OAUTH_EXCHANGE_FAILED, ACCOUNT_LINK_REQUIRED, NETWORK_ERROR,
+ * RATE_LIMITED, API_ERROR, with `diagnosticId` when the server answered.
+ * MFA: throws AuthonMfaRequiredError, finish with verifyMfa(). Cancel and errors never fall back to
+ * a web flow. Android: UNSUPPORTED_PLATFORM, use the normal OAuth flow (`startOAuth('apple')`).
+ */
+export declare function signInWithAppleNative(client: AppleSignInClient, options?: SignInWithAppleNativeOptions): Promise<unknown>;
+//# sourceMappingURL=appleSignIn.d.ts.map

package/build/appleSignIn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"appleSignIn.d.ts","sourceRoot":"","sources":["../src/appleSignIn.ts"],"names":[],"mappings":"AAKA,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,SAAS,IAAI,MAAM,CAAC;IACpB,iBAAiB,IAAI,MAAM,CAAC;IAC5B,iBAAiB,CAAC,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpD;AAiCD,MAAM,WAAW,4BAA4B;IAC3C,iGAAiG;IACjG,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,iBAAiB,EAAE,OAAO,GAAE,4BAAiC,GAAG,OAAO,CAAC,OAAO,CAAC,CA+BnI"}

package/build/appleSignIn.js

@@ -0,0 +1,76 @@
+import { Platform } from 'expo-modules-core';
+import { getNativeModule } from './native';
+/** Fallback with the same shape as @authon/react-native's AuthonAuthError. */
+class AppleSignInError extends Error {
+    code;
+    diagnosticId;
+    retryable;
+    constructor(code, message, options = {}) {
+        super(message ?? code);
+        this.name = 'AuthonAuthError';
+        this.code = code;
+        this.diagnosticId = options.diagnosticId ?? null;
+        this.retryable = options.retryable ?? false;
+    }
+}
+function authError(code, message, options = {}) {
+    let Ctor = AppleSignInError;
+    try {
+        const mod = require('@authon/react-native');
+        if (mod?.AuthonAuthError)
+            Ctor = mod.AuthonAuthError;
+    }
+    catch {
+        // @authon/react-native not installed: same fields, local class.
+    }
+    return new Ctor(code, message, options);
+}
+/**
+ * Native Sign in with Apple on iOS: shows the system Apple sheet right away (no browser, no web page)
+ * and makes the resulting session the session of `client` (an AuthonMobileClient from
+ * @authon/react-native, e.g. `useAuthon().client`), like a completed OAuth sign-in.
+ *
+ * JS never sees Apple's identity token, authorization code, nonce or the PKCE verifier; only the
+ * final result reaches JS. Errors are AuthonAuthError with the shared sign-in codes: OAUTH_CANCELLED
+ * (the user closed the sheet, show nothing), OAUTH_REDIRECT_NOT_ALLOWED (app not registered or not
+ * approved; `serverCode` tells APP_NOT_REGISTERED from APP_NOT_APPROVED), OAUTH_STATE_MISMATCH
+ * (server OAUTH_STATE_INVALID), OAUTH_EXCHANGE_FAILED, ACCOUNT_LINK_REQUIRED, NETWORK_ERROR,
+ * RATE_LIMITED, API_ERROR, with `diagnosticId` when the server answered.
+ * MFA: throws AuthonMfaRequiredError, finish with verifyMfa(). Cancel and errors never fall back to
+ * a web flow. Android: UNSUPPORTED_PLATFORM, use the normal OAuth flow (`startOAuth('apple')`).
+ */
+export async function signInWithAppleNative(client, options = {}) {
+    if (Platform.OS !== 'ios') {
+        throw authError('UNSUPPORTED_PLATFORM', 'Native Sign in with Apple is iOS only; on Android use startOAuth("apple")');
+    }
+    const native = getNativeModule();
+    if (!native?.signInWithApple) {
+        throw authError('NOT_CONFIGURED', '@authon/react-native-wallet native module not found. Use a development build and rebuild the app.');
+    }
+    const result = await native.signInWithApple({
+        publishableKey: client.getPublishableKey(),
+        apiUrl: client.getApiUrl(),
+        appId: options.appId ?? null,
+    });
+    if (!result || typeof result !== 'object')
+        throw authError('API_ERROR', 'Apple sign-in returned no result');
+    if (result.ok !== true) {
+        const code = typeof result.code === 'string' && result.code ? result.code : 'API_ERROR';
+        const error = authError(code, typeof result.message === 'string' && result.message ? result.message : code, {
+            diagnosticId: typeof result.diagnosticId === 'string' && result.diagnosticId ? result.diagnosticId : null,
+            retryable: result.retryable === true,
+        });
+        // The server's own code (APP_NOT_REGISTERED, APP_NOT_APPROVED, OAUTH_STATE_INVALID, ...), when sent.
+        const serverCode = result.serverCode;
+        throw Object.assign(error, { serverCode: typeof serverCode === 'string' && serverCode ? serverCode : null });
+    }
+    let session;
+    try {
+        session = typeof result.value === 'string' ? JSON.parse(result.value) : result.value;
+    }
+    catch {
+        throw authError('API_ERROR', 'Apple sign-in returned an unreadable result');
+    }
+    return client.adoptSignInResult(session);
+}
+//# sourceMappingURL=appleSignIn.js.map

package/build/appleSignIn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"appleSignIn.js","sourceRoot":"","sources":["../src/appleSignIn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAiB3C,8EAA8E;AAC9E,MAAM,gBAAiB,SAAQ,KAAK;IACzB,IAAI,CAAS;IACb,YAAY,CAAgB;IAC5B,SAAS,CAAU;IAC5B,YAAY,IAAY,EAAE,OAAgB,EAAE,UAAiE,EAAE;QAC7G,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC9C,CAAC;CACF;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe,EAAE,UAAiE,EAAE;IACnH,IAAI,IAAI,GAAkB,gBAAgB,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,sBAAsB,CAAoD,CAAC;QAC/F,IAAI,GAAG,EAAE,eAAe;YAAE,IAAI,GAAG,GAAG,CAAC,eAAe,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,gEAAgE;IAClE,CAAC;IACD,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAOD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,MAAyB,EAAE,UAAwC,EAAE;IAC/G,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,SAAS,CAAC,sBAAsB,EAAE,2EAA2E,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,CAAC,MAAM,EAAE,eAAe,EAAE,CAAC;QAC7B,MAAM,SAAS,CAAC,gBAAgB,EAAE,mGAAmG,CAAC,CAAC;IACzI,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC;QAC1C,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE;QAC1C,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,MAAM,SAAS,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAC;IAC5G,IAAI,MAAM,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;QACxF,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE;YAC1G,YAAY,EAAE,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;YACzG,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,IAAI;SACrC,CAAC,CAAC;QACH,qGAAqG;QACrG,MAAM,UAAU,GAAI,MAAmC,CAAC,UAAU,CAAC;QACnE,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,UAAU,EAAE,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,SAAS,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,iBAAiB,CAAC,OAAgB,CAAC,CAAC;AACpD,CAAC"}

package/build/index.d.ts

@@ -2,6 +2,8 @@ export { AuthonWalletClient, createAuthonWallet } from './client';
 export { AuthonWalletError } from './errors';
 export type { WalletErrorCode } from './errors';
 export { useAuthonWallet } from './useAuthonWallet';
+export { signInWithAppleNative } from './appleSignIn';
+export type { AppleSignInClient, SignInWithAppleNativeOptions } from './appleSignIn';
 export type { UseAuthonWalletOptions, UseAuthonWalletResult } from './useAuthonWallet';
 export type { AuthonWalletOptions, CapabilityCheck, CapabilityStatus, WalletCapabilities, WalletChain, WalletChainSignRequest, EIP1193Provider, EIP1193RequestArguments, EmbeddedWallet, EmbeddedWalletDevice, Hex, TokenGetter, TypedDataPayload, WalletAccount, WalletAppConfig, WalletChangeListener, WalletMessage, WalletSignOptions, WalletTransactionRequest, } from './types';
 //# sourceMappingURL=index.d.ts.map

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACvF,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,oBAAoB,EACpB,GAAG,EACH,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,YAAY,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AACrF,YAAY,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AACvF,YAAY,EACV,mBAAmB,EACnB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,eAAe,EACf,uBAAuB,EACvB,cAAc,EACd,oBAAoB,EACpB,GAAG,EACH,WAAW,EACX,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,oBAAoB,EACpB,aAAa,EACb,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,SAAS,CAAC"}

package/build/index.js

@@ -1,4 +1,5 @@
 export { AuthonWalletClient, createAuthonWallet } from './client';
 export { AuthonWalletError } from './errors';
 export { useAuthonWallet } from './useAuthonWallet';
+export { signInWithAppleNative } from './appleSignIn';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAC"}

package/build/native.d.ts

@@ -36,6 +36,12 @@ export interface AuthonWalletNativeModule {
     upgradeBackup(id: string, token: string): Promise<NativeResult<unknown>>;
     restore(id: string, token: string, reset: boolean): Promise<NativeResult<unknown>>;
     revokeDevice(id: string, token: string, deviceId: string): Promise<NativeResult<unknown>>;
+    /** iOS only: native Sign in with Apple; resolves the server's sign-in result (JSON), never Apple's tokens. */
+    signInWithApple?(config: {
+        publishableKey: string;
+        apiUrl: string;
+        appId: string | null;
+    }): Promise<NativeResult<unknown>>;
 }
 export declare function getNativeModule(): AuthonWalletNativeModule | null;
 /** Tests only: replaces the native module (pass undefined to restore). */

package/build/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,MAAM,YAAY,CAAC,CAAC,IACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2BAA2B,EAAE,OAAO,CAAC;IACrC,OAAO,EAAE;QAAE,iBAAiB,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/D;AAED,iGAAiG;AACjG,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACjH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,KAAK,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzI,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7I,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtJ,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;CAC3F;AAID,wBAAgB,eAAe,IAAI,wBAAwB,GAAG,IAAI,CAGjE;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAEnG"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,MAAM,YAAY,CAAC,CAAC,IACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2BAA2B,EAAE,OAAO,CAAC;IACrC,OAAO,EAAE;QAAE,iBAAiB,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/D;AAED,iGAAiG;AACjG,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACjH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,KAAK,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzI,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7I,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtJ,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,8GAA8G;IAC9G,eAAe,CAAC,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;CAC5H;AAID,wBAAgB,eAAe,IAAI,wBAAwB,GAAG,IAAI,CAGjE;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAEnG"}

package/build/native.js.map

@@ -1 +1 @@
-{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAyChE,IAAI,QAAqD,CAAC;AAE1D,MAAM,UAAU,eAAe;IAC7B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,2BAA2B,CAA2B,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,MAAmD;IAC3F,QAAQ,GAAG,MAAM,CAAC;AACpB,CAAC"}
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AA2ChE,IAAI,QAAqD,CAAC;AAE1D,MAAM,UAAU,eAAe;IAC7B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,2BAA2B,CAA2B,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,MAAmD;IAC3F,QAAQ,GAAG,MAAM,CAAC;AACpB,CAAC"}

package/ios/AuthonReactNativeWallet.podspec

@@ -17,12 +17,14 @@ Pod::Spec.new do |s|
   s.dependency 'ExpoModulesCore'
   s.frameworks = 'Security', 'CryptoKit', 'LocalAuthentication', 'AuthenticationServices', 'SwiftUI'
 
-  # vendor/ is generated from swift/Sources by scripts/sync-native-wallet.mjs.
+  # vendor/ is generated from swift/Sources by scripts/sync-native-wallet.mjs (wallet core and the
+  # standalone native Sign in with Apple).
   # CSecp256k1: compile only build/*.c (they include src/*.c); CKeccak: sha3.c, ripemd160.c and memzero.c;
   # CMonocypher (Ed25519, deterministic like the web wallet): both .c files, no flags.
   s.source_files = [
     '*.swift',
     'vendor/AuthonWallet/**/*.swift',
+    'vendor/AuthonAppleSignIn/*.swift',
     'vendor/CSecp256k1/build/*.c',
     'vendor/CSecp256k1/include/*.h',
     'vendor/CKeccak/sha3.c',

package/ios/AuthonWalletModule.swift

@@ -18,6 +18,12 @@ public final class AuthonWalletModule: Module {
       self.envelope { try self.configure(id, config); return NSNull() }
     }
 
+    // Native Sign in with Apple. Resolves the API's sign-in result as JSON (a session or an MFA
+    // challenge); Apple's identity token, authorization code, nonce and verifier stay in Swift.
+    AsyncFunction("signInWithApple") { (config: [String: Any]) async -> [String: Any] in
+      await Self.signInWithApple(config)
+    }
+
     AsyncFunction("release") { (id: String) -> [String: Any] in
       self.lock.withLock { self.wallets[id] = nil }
       return ["ok": true, "value": NSNull()]
@@ -153,6 +159,26 @@ public final class AuthonWalletModule: Module {
     }
   }
 
+  private static func signInWithApple(_ config: [String: Any]) async -> [String: Any] {
+    guard let publishableKey = config["publishableKey"] as? String, !publishableKey.isEmpty else {
+      return ["ok": false, "code": "OAUTH_START_FAILED", "message": "publishableKey required", "diagnosticId": NSNull(), "retryable": false]
+    }
+    let apiUrl = (config["apiUrl"] as? String).flatMap { $0.isEmpty ? nil : $0 } ?? "https://api.authon.dev"
+    let appId = (config["appId"] as? String).flatMap { $0.isEmpty ? nil : $0 }
+    do {
+      let result = try await AuthonAppleSignIn(publishableKey: publishableKey, apiURL: apiUrl, appId: appId).signIn()
+      let data = try JSONSerialization.data(withJSONObject: result)
+      return ["ok": true, "value": String(decoding: data, as: UTF8.self)]
+    } catch let e as AppleSignInError {
+      return [
+        "ok": false, "code": e.code, "message": e.message, "diagnosticId": orNull(e.diagnosticId),
+        "serverCode": orNull(e.serverCode), "retryable": e.retryable,
+      ]
+    } catch {
+      return ["ok": false, "code": "API_ERROR", "message": "unexpected error", "diagnosticId": NSNull(), "retryable": true]
+    }
+  }
+
   private static func failure(_ error: Error) -> [String: Any] {
     let e: WalletError
     if let w = error as? WalletError {

package/ios/vendor/AuthonAppleSignIn/AppleSignIn.swift

@@ -0,0 +1,285 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonAppleSignIn/AppleSignIn.swift. Do not edit: change the source and run the script.
+import AuthenticationServices
+import CryptoKit
+import Foundation
+import Security
+#if canImport(UIKit)
+import UIKit
+#elseif canImport(AppKit)
+import AppKit
+#endif
+
+/// Error of the native Apple sign-in. `code` is a sign-in code shared by every Authon SDK
+/// (docs/wallet/NATIVE.md section 10): OAUTH_CANCELLED (show nothing), OAUTH_START_FAILED,
+/// OAUTH_REDIRECT_NOT_ALLOWED (app not registered or approved), OAUTH_PROVIDER_ERROR,
+/// OAUTH_STATE_MISMATCH, OAUTH_EXCHANGE_FAILED, ACCOUNT_LINK_REQUIRED, NETWORK_ERROR,
+/// RATE_LIMITED, API_ERROR.
+public struct AppleSignInError: Error, Equatable, LocalizedError, Sendable {
+    public let code: String
+    public let message: String
+    /// The server's request ID when the error came from an API response.
+    public let diagnosticId: String?
+    /// The server's own `code`, when it sent one (e.g. APP_NOT_APPROVED).
+    public let serverCode: String?
+    public let statusCode: Int
+    /// Whether the same call can succeed again. False for Apple ID sheet failures: showing the
+    /// same sheet again does not help (e.g. no Apple account on the device).
+    public let retryable: Bool
+
+    public var errorDescription: String? { message }
+
+    init(_ code: String, _ message: String, diagnosticId: String? = nil, serverCode: String? = nil, statusCode: Int = 0, retryable: Bool? = nil) {
+        self.code = code
+        self.message = message
+        self.diagnosticId = diagnosticId
+        self.serverCode = serverCode
+        self.statusCode = statusCode
+        self.retryable = retryable ?? ["OAUTH_START_FAILED", "OAUTH_PROVIDER_ERROR", "OAUTH_STATE_MISMATCH", "OAUTH_EXCHANGE_FAILED", "NETWORK_ERROR", "RATE_LIMITED", "API_ERROR"].contains(code)
+    }
+}
+
+/// What the Apple ID sheet returned. Credentials only travel to the Authon API.
+public struct AppleIDResult: Sendable {
+    public var identityToken: Data?
+    public var authorizationCode: Data?
+    public var fullName: PersonNameComponents?
+
+    public init(identityToken: Data?, authorizationCode: Data?, fullName: PersonNameComponents?) {
+        self.identityToken = identityToken
+        self.authorizationCode = authorizationCode
+        self.fullName = fullName
+    }
+}
+
+/// Shows the Apple ID sheet for a nonce (already hashed: lowercase hex SHA-256 of the server nonce).
+public protocol AppleIDAuthorizing: Sendable {
+    func authorize(hashedNonce: String) async throws -> AppleIDResult
+}
+
+/// Native Sign in with Apple against Authon's nonce-bound flow:
+/// `POST /v1/auth/oauth/native/apple/start` → Apple ID sheet → `POST /v1/auth/oauth/native/apple/complete`.
+/// There is no browser and no web fallback. An attempt is used once: after any failure, start again.
+/// The identity token, authorization code, nonce and verifier are never logged or returned.
+public final class AuthonAppleSignIn: @unchecked Sendable {
+    private let base: String
+    private let publishableKey: String
+    private let appId: String?
+    private let authorizer: AppleIDAuthorizing
+    private let session: URLSession
+
+    /// - Parameters:
+    ///   - appId: `TEAMID.bundleId` as registered in the Authon console; detected from the default
+    ///     keychain access group when nil.
+    ///   - anchor: The window for the Apple ID sheet (the key window when nil).
+    public convenience init(publishableKey: String, apiURL: String = "https://api.authon.dev", appId: String? = nil,
+                            anchor: (@MainActor () -> ASPresentationAnchor?)? = nil) {
+        self.init(publishableKey: publishableKey, apiURL: apiURL, appId: appId, authorizer: SystemAppleIDAuthorizer(anchor: anchor), session: .shared)
+    }
+
+    public init(publishableKey: String, apiURL: String, appId: String?, authorizer: AppleIDAuthorizing, session: URLSession = .shared) {
+        var b = apiURL
+        while b.hasSuffix("/") { b.removeLast() }
+        base = b
+        self.publishableKey = publishableKey
+        self.appId = appId
+        self.authorizer = authorizer
+        self.session = session
+    }
+
+    /// Runs the sign-in and returns the API's JSON result: a session
+    /// (`accessToken`, `refreshToken`, `expiresIn`, `user`) or an MFA challenge (`mfaRequired`, `mfaToken`).
+    public func signIn() async throws -> [String: Any] {
+        guard let appId = appId ?? Self.detectAppIdentifier() else {
+            throw AppleSignInError("OAUTH_REDIRECT_NOT_ALLOWED", "appId (TEAMID.bundleId) could not be determined")
+        }
+        var verifierBytes = [UInt8](repeating: 0, count: 32)
+        guard SecRandomCopyBytes(kSecRandomDefault, verifierBytes.count, &verifierBytes) == errSecSuccess else {
+            throw AppleSignInError("OAUTH_START_FAILED", "random source unavailable")
+        }
+        let verifier = Self.base64url(Data(verifierBytes))
+        let challenge = Self.base64url(Data(SHA256.hash(data: Data(verifier.utf8))))
+
+        let start: [String: Any]
+        do {
+            start = try await post("/v1/auth/oauth/native/apple/start", ["appId": appId, "codeChallenge": challenge])
+        } catch let e as AppleSignInError where e.code == "API_ERROR" {
+            throw AppleSignInError("OAUTH_START_FAILED", e.message, diagnosticId: e.diagnosticId, serverCode: e.serverCode, statusCode: e.statusCode)
+        }
+        guard let attemptId = start["attemptId"] as? String, let nonce = start["nonce"] as? String, !nonce.isEmpty else {
+            throw AppleSignInError("OAUTH_START_FAILED", "Unexpected response from the server")
+        }
+
+        let apple = try await authorizer.authorize(hashedNonce: Self.hashNonce(nonce))
+        guard let tokenData = apple.identityToken, let identityToken = String(data: tokenData, encoding: .utf8),
+              let codeData = apple.authorizationCode, let authorizationCode = String(data: codeData, encoding: .utf8) else {
+            throw AppleSignInError("OAUTH_PROVIDER_ERROR", "Apple returned no identity token or authorization code", retryable: false)
+        }
+        var body: [String: Any] = ["attemptId": attemptId, "codeVerifier": verifier, "identityToken": identityToken, "authorizationCode": authorizationCode]
+        if let name = apple.fullName.map({ PersonNameComponentsFormatter.localizedString(from: $0, style: .default) })?
+            .trimmingCharacters(in: .whitespacesAndNewlines), !name.isEmpty {
+            body["displayName"] = name
+        }
+        // Single use: no retry, whatever the outcome.
+        return try await post("/v1/auth/oauth/native/apple/complete", body)
+    }
+
+    /// Lowercase hex SHA-256 of the server nonce (what ASAuthorizationAppleIDRequest.nonce carries).
+    public static func hashNonce(_ nonce: String) -> String {
+        SHA256.hash(data: Data(nonce.utf8)).map { String(format: "%02x", $0) }.joined()
+    }
+
+    static func base64url(_ data: Data) -> String {
+        data.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
+    }
+
+    // MARK: - HTTP
+
+    private func post(_ path: String, _ body: [String: Any]) async throws -> [String: Any] {
+        guard let url = URL(string: base + path) else { throw AppleSignInError("API_ERROR", "Invalid URL") }
+        var req = URLRequest(url: url)
+        req.httpMethod = "POST"
+        req.setValue("application/json", forHTTPHeaderField: "content-type")
+        req.setValue("application/json", forHTTPHeaderField: "accept")
+        req.setValue(publishableKey, forHTTPHeaderField: "x-api-key")
+        req.httpShouldHandleCookies = false
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+        let data: Data
+        let response: URLResponse
+        do {
+            (data, response) = try await session.data(for: req)
+        } catch {
+            throw AppleSignInError("NETWORK_ERROR", "The server could not be reached")
+        }
+        let http = response as? HTTPURLResponse
+        let status = http?.statusCode ?? 0
+        let json = (try? JSONSerialization.jsonObject(with: data)) as? [String: Any]
+        guard (200..<300).contains(status) else {
+            let serverCode = json?["code"] as? String
+            let id = (json?["requestId"] as? String) ?? http?.value(forHTTPHeaderField: "X-Request-Id")
+            let message = (json?["message"] as? String) ?? HTTPURLResponse.localizedString(forStatusCode: status)
+            throw AppleSignInError(Self.code(status: status, serverCode: serverCode), message, diagnosticId: id, serverCode: serverCode, statusCode: status)
+        }
+        guard let json else { throw AppleSignInError("API_ERROR", "Unexpected response from the server", statusCode: status) }
+        return json
+    }
+
+    static func code(status: Int, serverCode: String?) -> String {
+        switch serverCode {
+        case "OAUTH_STATE_INVALID": return "OAUTH_STATE_MISMATCH"
+        case "OAUTH_EXCHANGE_FAILED": return "OAUTH_EXCHANGE_FAILED"
+        case "OAUTH_REDIRECT_NOT_ALLOWED", "APP_NOT_REGISTERED", "APP_NOT_APPROVED": return "OAUTH_REDIRECT_NOT_ALLOWED"
+        case "EXPLICIT_IDENTITY_LINK_REQUIRED": return "ACCOUNT_LINK_REQUIRED"
+        case "RATE_LIMITED": return "RATE_LIMITED"
+        default: return status == 429 ? "RATE_LIMITED" : "API_ERROR"
+        }
+    }
+
+    /// `TEAMID.bundleId` from the app's default keychain access group.
+    static func detectAppIdentifier() -> String? {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: "dev.authon.apple-sign-in.app-id",
+            kSecAttrAccount as String: "probe",
+            kSecReturnAttributes as String: true,
+        ]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        var out: AnyObject?
+        var status = SecItemCopyMatching(q as CFDictionary, &out)
+        if status == errSecItemNotFound {
+            var add = q
+            add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+            status = SecItemAdd(add as CFDictionary, &out)
+        }
+        guard status == errSecSuccess, let attrs = out as? [String: Any], let group = attrs[kSecAttrAccessGroup as String] as? String,
+              group.contains(".") else { return nil }
+        return group
+    }
+}
+
+/// The system Apple ID sheet (ASAuthorizationController), shown immediately.
+public final class SystemAppleIDAuthorizer: AppleIDAuthorizing, @unchecked Sendable {
+    private let anchor: (@MainActor () -> ASPresentationAnchor?)?
+
+    public init(anchor: (@MainActor () -> ASPresentationAnchor?)? = nil) {
+        self.anchor = anchor
+    }
+
+    @MainActor
+    public func authorize(hashedNonce: String) async throws -> AppleIDResult {
+        let request = ASAuthorizationAppleIDProvider().createRequest()
+        request.requestedScopes = [.fullName, .email]
+        request.nonce = hashedNonce
+        let delegate = AppleIDDelegate(anchor: anchor?() ?? Self.keyWindow())
+        let credential = try await delegate.run(request)
+        return AppleIDResult(identityToken: credential.identityToken, authorizationCode: credential.authorizationCode, fullName: credential.fullName)
+    }
+
+    @MainActor
+    static func keyWindow() -> ASPresentationAnchor {
+        #if canImport(UIKit)
+        let scenes = UIApplication.shared.connectedScenes.compactMap { $0 as? UIWindowScene }
+        return scenes.flatMap(\.windows).first(where: \.isKeyWindow) ?? scenes.first?.windows.first ?? ASPresentationAnchor()
+        #else
+        return NSApplication.shared.keyWindow ?? NSApplication.shared.windows.first ?? ASPresentationAnchor()
+        #endif
+    }
+
+    /// ASAuthorizationError → sign-in code. Only `.canceled` is a cancel; everything else (including
+    /// 1000 `.unknown` after dismissing "sign in to your Apple account") is a provider error that
+    /// retrying the same sheet will not fix.
+    static func map(_ error: Error) -> AppleSignInError {
+        if let e = error as? ASAuthorizationError, e.code == .canceled {
+            return AppleSignInError("OAUTH_CANCELLED", "Sign in with Apple was cancelled")
+        }
+        return AppleSignInError("OAUTH_PROVIDER_ERROR", "Sign in with Apple failed (\((error as NSError).code))", retryable: false)
+    }
+}
+
+@MainActor
+private final class AppleIDDelegate: NSObject, ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
+    private let anchor: ASPresentationAnchor
+    private var continuation: CheckedContinuation<ASAuthorizationAppleIDCredential, Error>?
+    private var retain: AppleIDDelegate?
+
+    init(anchor: ASPresentationAnchor) {
+        self.anchor = anchor
+    }
+
+    func run(_ request: ASAuthorizationRequest) async throws -> ASAuthorizationAppleIDCredential {
+        try await withCheckedThrowingContinuation { cont in
+            continuation = cont
+            retain = self
+            let controller = ASAuthorizationController(authorizationRequests: [request])
+            controller.delegate = self
+            controller.presentationContextProvider = self
+            controller.performRequests()
+        }
+    }
+
+    nonisolated func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
+        MainActor.assumeIsolated { anchor }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
+        MainActor.assumeIsolated {
+            if let credential = authorization.credential as? ASAuthorizationAppleIDCredential {
+                finish(.success(credential))
+            } else {
+                finish(.failure(AppleSignInError("OAUTH_PROVIDER_ERROR", "Unexpected Apple credential type", retryable: false)))
+            }
+        }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+        let mapped = SystemAppleIDAuthorizer.map(error)
+        MainActor.assumeIsolated { finish(.failure(mapped)) }
+    }
+
+    private func finish(_ result: Result<ASAuthorizationAppleIDCredential, Error>) {
+        continuation?.resume(with: result)
+        continuation = nil
+        retain = nil
+    }
+}

package/ios/vendor/GENERATED.md

@@ -1,4 +1,4 @@
 # Generated sources
 
-Everything in this folder is copied from `swift/Sources/{AuthonWallet,CSecp256k1,CKeccak,CMonocypher}` by
+Everything in this folder is copied from `swift/Sources/{AuthonWallet,AuthonAppleSignIn,CSecp256k1,CKeccak,CMonocypher}` by
 `scripts/sync-native-wallet.mjs` (run by the package build). Do not edit these files; change the native SDK sources and run the script. `--check` fails on any difference.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authon/react-native-wallet",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Authon embedded wallet for React Native (Expo native module wrapping the Swift and Kotlin wallet SDKs)",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",

package/src/appleSignIn.ts

@@ -0,0 +1,94 @@
+import { Platform } from 'expo-modules-core';
+import { getNativeModule } from './native';
+
+declare const require: (id: string) => unknown;
+
+/** The part of @authon/react-native's AuthonMobileClient this helper uses. */
+export interface AppleSignInClient {
+  getApiUrl(): string;
+  getPublishableKey(): string;
+  adoptSignInResult(result: never): Promise<unknown>;
+}
+
+type AuthErrorCtor = new (
+  code: string,
+  message?: string,
+  options?: { diagnosticId?: string | null; retryable?: boolean },
+) => Error & { code: string; diagnosticId: string | null; retryable: boolean };
+
+/** Fallback with the same shape as @authon/react-native's AuthonAuthError. */
+class AppleSignInError extends Error {
+  readonly code: string;
+  readonly diagnosticId: string | null;
+  readonly retryable: boolean;
+  constructor(code: string, message?: string, options: { diagnosticId?: string | null; retryable?: boolean } = {}) {
+    super(message ?? code);
+    this.name = 'AuthonAuthError';
+    this.code = code;
+    this.diagnosticId = options.diagnosticId ?? null;
+    this.retryable = options.retryable ?? false;
+  }
+}
+
+function authError(code: string, message: string, options: { diagnosticId?: string | null; retryable?: boolean } = {}) {
+  let Ctor: AuthErrorCtor = AppleSignInError;
+  try {
+    const mod = require('@authon/react-native') as { AuthonAuthError?: AuthErrorCtor } | undefined;
+    if (mod?.AuthonAuthError) Ctor = mod.AuthonAuthError;
+  } catch {
+    // @authon/react-native not installed: same fields, local class.
+  }
+  return new Ctor(code, message, options);
+}
+
+export interface SignInWithAppleNativeOptions {
+  /** `TEAMID.bundleId` as registered in the Authon console; detected from the app when omitted. */
+  appId?: string;
+}
+
+/**
+ * Native Sign in with Apple on iOS: shows the system Apple sheet right away (no browser, no web page)
+ * and makes the resulting session the session of `client` (an AuthonMobileClient from
+ * @authon/react-native, e.g. `useAuthon().client`), like a completed OAuth sign-in.
+ *
+ * JS never sees Apple's identity token, authorization code, nonce or the PKCE verifier; only the
+ * final result reaches JS. Errors are AuthonAuthError with the shared sign-in codes: OAUTH_CANCELLED
+ * (the user closed the sheet, show nothing), OAUTH_REDIRECT_NOT_ALLOWED (app not registered or not
+ * approved; `serverCode` tells APP_NOT_REGISTERED from APP_NOT_APPROVED), OAUTH_STATE_MISMATCH
+ * (server OAUTH_STATE_INVALID), OAUTH_EXCHANGE_FAILED, ACCOUNT_LINK_REQUIRED, NETWORK_ERROR,
+ * RATE_LIMITED, API_ERROR, with `diagnosticId` when the server answered.
+ * MFA: throws AuthonMfaRequiredError, finish with verifyMfa(). Cancel and errors never fall back to
+ * a web flow. Android: UNSUPPORTED_PLATFORM, use the normal OAuth flow (`startOAuth('apple')`).
+ */
+export async function signInWithAppleNative(client: AppleSignInClient, options: SignInWithAppleNativeOptions = {}): Promise<unknown> {
+  if (Platform.OS !== 'ios') {
+    throw authError('UNSUPPORTED_PLATFORM', 'Native Sign in with Apple is iOS only; on Android use startOAuth("apple")');
+  }
+  const native = getNativeModule();
+  if (!native?.signInWithApple) {
+    throw authError('NOT_CONFIGURED', '@authon/react-native-wallet native module not found. Use a development build and rebuild the app.');
+  }
+  const result = await native.signInWithApple({
+    publishableKey: client.getPublishableKey(),
+    apiUrl: client.getApiUrl(),
+    appId: options.appId ?? null,
+  });
+  if (!result || typeof result !== 'object') throw authError('API_ERROR', 'Apple sign-in returned no result');
+  if (result.ok !== true) {
+    const code = typeof result.code === 'string' && result.code ? result.code : 'API_ERROR';
+    const error = authError(code, typeof result.message === 'string' && result.message ? result.message : code, {
+      diagnosticId: typeof result.diagnosticId === 'string' && result.diagnosticId ? result.diagnosticId : null,
+      retryable: result.retryable === true,
+    });
+    // The server's own code (APP_NOT_REGISTERED, APP_NOT_APPROVED, OAUTH_STATE_INVALID, ...), when sent.
+    const serverCode = (result as { serverCode?: unknown }).serverCode;
+    throw Object.assign(error, { serverCode: typeof serverCode === 'string' && serverCode ? serverCode : null });
+  }
+  let session: unknown;
+  try {
+    session = typeof result.value === 'string' ? JSON.parse(result.value) : result.value;
+  } catch {
+    throw authError('API_ERROR', 'Apple sign-in returned an unreadable result');
+  }
+  return client.adoptSignInResult(session as never);
+}

package/src/index.ts

@@ -2,6 +2,8 @@ export { AuthonWalletClient, createAuthonWallet } from './client';
 export { AuthonWalletError } from './errors';
 export type { WalletErrorCode } from './errors';
 export { useAuthonWallet } from './useAuthonWallet';
+export { signInWithAppleNative } from './appleSignIn';
+export type { AppleSignInClient, SignInWithAppleNativeOptions } from './appleSignIn';
 export type { UseAuthonWalletOptions, UseAuthonWalletResult } from './useAuthonWallet';
 export type {
   AuthonWalletOptions,

package/src/native.ts

@@ -37,6 +37,8 @@ export interface AuthonWalletNativeModule {
   upgradeBackup(id: string, token: string): Promise<NativeResult<unknown>>;
   restore(id: string, token: string, reset: boolean): Promise<NativeResult<unknown>>;
   revokeDevice(id: string, token: string, deviceId: string): Promise<NativeResult<unknown>>;
+  /** iOS only: native Sign in with Apple; resolves the server's sign-in result (JSON), never Apple's tokens. */
+  signInWithApple?(config: { publishableKey: string; apiUrl: string; appId: string | null }): Promise<NativeResult<unknown>>;
 }
 
 let override: AuthonWalletNativeModule | null | undefined;