@authon/react-native-wallet 0.4.0 → 0.5.1

package/build/native.d.ts

@@ -8,6 +8,9 @@ export type NativeResult<T> = {
     message?: string;
     diagnosticId?: string | null;
     retryable?: boolean;
+    reason?: string | null;
+    phase?: string | null;
+    clientAttemptId?: string | null;
 };
 export interface NativeConfig {
     publishableKey: string;
@@ -36,6 +39,12 @@ export interface AuthonWalletNativeModule {
     upgradeBackup(id: string, token: string): Promise<NativeResult<unknown>>;
     restore(id: string, token: string, reset: boolean): Promise<NativeResult<unknown>>;
     revokeDevice(id: string, token: string, deviceId: string): Promise<NativeResult<unknown>>;
+    /** iOS only: native Sign in with Apple; resolves the server's sign-in result (JSON), never Apple's tokens. */
+    signInWithApple?(config: {
+        publishableKey: string;
+        apiUrl: string;
+        appId: string | null;
+    }): Promise<NativeResult<unknown>>;
 }
 export declare function getNativeModule(): AuthonWalletNativeModule | null;
 /** Tests only: replaces the native module (pass undefined to restore). */

package/build/native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,MAAM,YAAY,CAAC,CAAC,IACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAErG,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2BAA2B,EAAE,OAAO,CAAC;IACrC,OAAO,EAAE;QAAE,iBAAiB,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/D;AAED,iGAAiG;AACjG,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACjH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,KAAK,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzI,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7I,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtJ,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;CAC3F;AAID,wBAAgB,eAAe,IAAI,wBAAwB,GAAG,IAAI,CAGjE;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAEnG"}
+{"version":3,"file":"native.d.ts","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAEA,uEAAuE;AACvE,MAAM,MAAM,YAAY,CAAC,CAAC,IACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GACtB;IACE,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC,CAAC;AAEN,MAAM,WAAW,YAAY;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,2BAA2B,EAAE,OAAO,CAAC;IACrC,OAAO,EAAE;QAAE,iBAAiB,EAAE,OAAO,CAAC;QAAC,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/D;AAED,iGAAiG;AACjG,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACjH,WAAW,CACT,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,KAAK,EACpB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GAAG,IAAI,GACrB,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClC,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzI,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7I,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACtJ,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnE,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IACnF,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1F,8GAA8G;IAC9G,eAAe,CAAC,CAAC,MAAM,EAAE;QAAE,cAAc,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;CAC5H;AAID,wBAAgB,eAAe,IAAI,wBAAwB,GAAG,IAAI,CAGjE;AAED,0EAA0E;AAC1E,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,wBAAwB,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAEnG"}

package/build/native.js.map

@@ -1 +1 @@
-{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAyChE,IAAI,QAAqD,CAAC;AAE1D,MAAM,UAAU,eAAe;IAC7B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,2BAA2B,CAA2B,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,MAAmD;IAC3F,QAAQ,GAAG,MAAM,CAAC;AACpB,CAAC"}
+{"version":3,"file":"native.js","sourceRoot":"","sources":["../src/native.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAoDhE,IAAI,QAAqD,CAAC;AAE1D,MAAM,UAAU,eAAe;IAC7B,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,2BAA2B,CAA2B,cAAc,CAAC,CAAC;AAC/E,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,yBAAyB,CAAC,MAAmD;IAC3F,QAAQ,GAAG,MAAM,CAAC;AACpB,CAAC"}

package/ios/AuthonReactNativeWallet.podspec

@@ -17,12 +17,14 @@ Pod::Spec.new do |s|
   s.dependency 'ExpoModulesCore'
   s.frameworks = 'Security', 'CryptoKit', 'LocalAuthentication', 'AuthenticationServices', 'SwiftUI'
 
-  # vendor/ is generated from swift/Sources by scripts/sync-native-wallet.mjs.
+  # vendor/ is generated from swift/Sources by scripts/sync-native-wallet.mjs (wallet core and the
+  # standalone native Sign in with Apple).
   # CSecp256k1: compile only build/*.c (they include src/*.c); CKeccak: sha3.c, ripemd160.c and memzero.c;
   # CMonocypher (Ed25519, deterministic like the web wallet): both .c files, no flags.
   s.source_files = [
     '*.swift',
     'vendor/AuthonWallet/**/*.swift',
+    'vendor/AuthonAppleSignIn/*.swift',
     'vendor/CSecp256k1/build/*.c',
     'vendor/CSecp256k1/include/*.h',
     'vendor/CKeccak/sha3.c',

package/ios/AuthonWalletModule.swift

@@ -18,6 +18,12 @@ public final class AuthonWalletModule: Module {
       self.envelope { try self.configure(id, config); return NSNull() }
     }
 
+    // Native Sign in with Apple. Resolves the API's sign-in result as JSON (a session or an MFA
+    // challenge); Apple's identity token, authorization code, nonce and verifier stay in Swift.
+    AsyncFunction("signInWithApple") { (config: [String: Any]) async -> [String: Any] in
+      await Self.signInWithApple(config)
+    }
+
     AsyncFunction("release") { (id: String) -> [String: Any] in
       self.lock.withLock { self.wallets[id] = nil }
       return ["ok": true, "value": NSNull()]
@@ -153,6 +159,26 @@ public final class AuthonWalletModule: Module {
     }
   }
 
+  private static func signInWithApple(_ config: [String: Any]) async -> [String: Any] {
+    guard let publishableKey = config["publishableKey"] as? String, !publishableKey.isEmpty else {
+      return ["ok": false, "code": "OAUTH_START_FAILED", "message": "publishableKey required", "diagnosticId": NSNull(), "retryable": false]
+    }
+    let apiUrl = (config["apiUrl"] as? String).flatMap { $0.isEmpty ? nil : $0 } ?? "https://api.authon.dev"
+    let appId = (config["appId"] as? String).flatMap { $0.isEmpty ? nil : $0 }
+    do {
+      let result = try await AuthonAppleSignIn(publishableKey: publishableKey, apiURL: apiUrl, appId: appId).signIn()
+      let data = try JSONSerialization.data(withJSONObject: result)
+      return ["ok": true, "value": String(decoding: data, as: UTF8.self)]
+    } catch let e as AppleSignInError {
+      return [
+        "ok": false, "code": e.code, "message": e.message, "diagnosticId": orNull(e.diagnosticId),
+        "serverCode": orNull(e.serverCode), "retryable": e.retryable,
+      ]
+    } catch {
+      return ["ok": false, "code": "API_ERROR", "message": "unexpected error", "diagnosticId": NSNull(), "retryable": true]
+    }
+  }
+
   private static func failure(_ error: Error) -> [String: Any] {
     let e: WalletError
     if let w = error as? WalletError {

package/ios/vendor/AuthonAppleSignIn/AppleSignIn.swift

@@ -0,0 +1,285 @@
+// GENERATED by scripts/sync-native-wallet.mjs from swift/Sources/AuthonAppleSignIn/AppleSignIn.swift. Do not edit: change the source and run the script.
+import AuthenticationServices
+import CryptoKit
+import Foundation
+import Security
+#if canImport(UIKit)
+import UIKit
+#elseif canImport(AppKit)
+import AppKit
+#endif
+
+/// Error of the native Apple sign-in. `code` is a sign-in code shared by every Authon SDK
+/// (docs/wallet/NATIVE.md section 10): OAUTH_CANCELLED (show nothing), OAUTH_START_FAILED,
+/// OAUTH_REDIRECT_NOT_ALLOWED (app not registered or approved), OAUTH_PROVIDER_ERROR,
+/// OAUTH_STATE_MISMATCH, OAUTH_EXCHANGE_FAILED, ACCOUNT_LINK_REQUIRED, NETWORK_ERROR,
+/// RATE_LIMITED, API_ERROR.
+public struct AppleSignInError: Error, Equatable, LocalizedError, Sendable {
+    public let code: String
+    public let message: String
+    /// The server's request ID when the error came from an API response.
+    public let diagnosticId: String?
+    /// The server's own `code`, when it sent one (e.g. APP_NOT_APPROVED).
+    public let serverCode: String?
+    public let statusCode: Int
+    /// Whether the same call can succeed again. False for Apple ID sheet failures: showing the
+    /// same sheet again does not help (e.g. no Apple account on the device).
+    public let retryable: Bool
+
+    public var errorDescription: String? { message }
+
+    init(_ code: String, _ message: String, diagnosticId: String? = nil, serverCode: String? = nil, statusCode: Int = 0, retryable: Bool? = nil) {
+        self.code = code
+        self.message = message
+        self.diagnosticId = diagnosticId
+        self.serverCode = serverCode
+        self.statusCode = statusCode
+        self.retryable = retryable ?? ["OAUTH_START_FAILED", "OAUTH_PROVIDER_ERROR", "OAUTH_STATE_MISMATCH", "OAUTH_EXCHANGE_FAILED", "NETWORK_ERROR", "RATE_LIMITED", "API_ERROR"].contains(code)
+    }
+}
+
+/// What the Apple ID sheet returned. Credentials only travel to the Authon API.
+public struct AppleIDResult: Sendable {
+    public var identityToken: Data?
+    public var authorizationCode: Data?
+    public var fullName: PersonNameComponents?
+
+    public init(identityToken: Data?, authorizationCode: Data?, fullName: PersonNameComponents?) {
+        self.identityToken = identityToken
+        self.authorizationCode = authorizationCode
+        self.fullName = fullName
+    }
+}
+
+/// Shows the Apple ID sheet for a nonce (already hashed: lowercase hex SHA-256 of the server nonce).
+public protocol AppleIDAuthorizing: Sendable {
+    func authorize(hashedNonce: String) async throws -> AppleIDResult
+}
+
+/// Native Sign in with Apple against Authon's nonce-bound flow:
+/// `POST /v1/auth/oauth/native/apple/start` → Apple ID sheet → `POST /v1/auth/oauth/native/apple/complete`.
+/// There is no browser and no web fallback. An attempt is used once: after any failure, start again.
+/// The identity token, authorization code, nonce and verifier are never logged or returned.
+public final class AuthonAppleSignIn: @unchecked Sendable {
+    private let base: String
+    private let publishableKey: String
+    private let appId: String?
+    private let authorizer: AppleIDAuthorizing
+    private let session: URLSession
+
+    /// - Parameters:
+    ///   - appId: `TEAMID.bundleId` as registered in the Authon console; detected from the default
+    ///     keychain access group when nil.
+    ///   - anchor: The window for the Apple ID sheet (the key window when nil).
+    public convenience init(publishableKey: String, apiURL: String = "https://api.authon.dev", appId: String? = nil,
+                            anchor: (@MainActor () -> ASPresentationAnchor?)? = nil) {
+        self.init(publishableKey: publishableKey, apiURL: apiURL, appId: appId, authorizer: SystemAppleIDAuthorizer(anchor: anchor), session: .shared)
+    }
+
+    public init(publishableKey: String, apiURL: String, appId: String?, authorizer: AppleIDAuthorizing, session: URLSession = .shared) {
+        var b = apiURL
+        while b.hasSuffix("/") { b.removeLast() }
+        base = b
+        self.publishableKey = publishableKey
+        self.appId = appId
+        self.authorizer = authorizer
+        self.session = session
+    }
+
+    /// Runs the sign-in and returns the API's JSON result: a session
+    /// (`accessToken`, `refreshToken`, `expiresIn`, `user`) or an MFA challenge (`mfaRequired`, `mfaToken`).
+    public func signIn() async throws -> [String: Any] {
+        guard let appId = appId ?? Self.detectAppIdentifier() else {
+            throw AppleSignInError("OAUTH_REDIRECT_NOT_ALLOWED", "appId (TEAMID.bundleId) could not be determined")
+        }
+        var verifierBytes = [UInt8](repeating: 0, count: 32)
+        guard SecRandomCopyBytes(kSecRandomDefault, verifierBytes.count, &verifierBytes) == errSecSuccess else {
+            throw AppleSignInError("OAUTH_START_FAILED", "random source unavailable")
+        }
+        let verifier = Self.base64url(Data(verifierBytes))
+        let challenge = Self.base64url(Data(SHA256.hash(data: Data(verifier.utf8))))
+
+        let start: [String: Any]
+        do {
+            start = try await post("/v1/auth/oauth/native/apple/start", ["appId": appId, "codeChallenge": challenge])
+        } catch let e as AppleSignInError where e.code == "API_ERROR" {
+            throw AppleSignInError("OAUTH_START_FAILED", e.message, diagnosticId: e.diagnosticId, serverCode: e.serverCode, statusCode: e.statusCode)
+        }
+        guard let attemptId = start["attemptId"] as? String, let nonce = start["nonce"] as? String, !nonce.isEmpty else {
+            throw AppleSignInError("OAUTH_START_FAILED", "Unexpected response from the server")
+        }
+
+        let apple = try await authorizer.authorize(hashedNonce: Self.hashNonce(nonce))
+        guard let tokenData = apple.identityToken, let identityToken = String(data: tokenData, encoding: .utf8),
+              let codeData = apple.authorizationCode, let authorizationCode = String(data: codeData, encoding: .utf8) else {
+            throw AppleSignInError("OAUTH_PROVIDER_ERROR", "Apple returned no identity token or authorization code", retryable: false)
+        }
+        var body: [String: Any] = ["attemptId": attemptId, "codeVerifier": verifier, "identityToken": identityToken, "authorizationCode": authorizationCode]
+        if let name = apple.fullName.map({ PersonNameComponentsFormatter.localizedString(from: $0, style: .default) })?
+            .trimmingCharacters(in: .whitespacesAndNewlines), !name.isEmpty {
+            body["displayName"] = name
+        }
+        // Single use: no retry, whatever the outcome.
+        return try await post("/v1/auth/oauth/native/apple/complete", body)
+    }
+
+    /// Lowercase hex SHA-256 of the server nonce (what ASAuthorizationAppleIDRequest.nonce carries).
+    public static func hashNonce(_ nonce: String) -> String {
+        SHA256.hash(data: Data(nonce.utf8)).map { String(format: "%02x", $0) }.joined()
+    }
+
+    static func base64url(_ data: Data) -> String {
+        data.base64EncodedString().replacingOccurrences(of: "+", with: "-").replacingOccurrences(of: "/", with: "_").replacingOccurrences(of: "=", with: "")
+    }
+
+    // MARK: - HTTP
+
+    private func post(_ path: String, _ body: [String: Any]) async throws -> [String: Any] {
+        guard let url = URL(string: base + path) else { throw AppleSignInError("API_ERROR", "Invalid URL") }
+        var req = URLRequest(url: url)
+        req.httpMethod = "POST"
+        req.setValue("application/json", forHTTPHeaderField: "content-type")
+        req.setValue("application/json", forHTTPHeaderField: "accept")
+        req.setValue(publishableKey, forHTTPHeaderField: "x-api-key")
+        req.httpShouldHandleCookies = false
+        req.httpBody = try JSONSerialization.data(withJSONObject: body)
+        let data: Data
+        let response: URLResponse
+        do {
+            (data, response) = try await session.data(for: req)
+        } catch {
+            throw AppleSignInError("NETWORK_ERROR", "The server could not be reached")
+        }
+        let http = response as? HTTPURLResponse
+        let status = http?.statusCode ?? 0
+        let json = (try? JSONSerialization.jsonObject(with: data)) as? [String: Any]
+        guard (200..<300).contains(status) else {
+            let serverCode = json?["code"] as? String
+            let id = (json?["requestId"] as? String) ?? http?.value(forHTTPHeaderField: "X-Request-Id")
+            let message = (json?["message"] as? String) ?? HTTPURLResponse.localizedString(forStatusCode: status)
+            throw AppleSignInError(Self.code(status: status, serverCode: serverCode), message, diagnosticId: id, serverCode: serverCode, statusCode: status)
+        }
+        guard let json else { throw AppleSignInError("API_ERROR", "Unexpected response from the server", statusCode: status) }
+        return json
+    }
+
+    static func code(status: Int, serverCode: String?) -> String {
+        switch serverCode {
+        case "OAUTH_STATE_INVALID": return "OAUTH_STATE_MISMATCH"
+        case "OAUTH_EXCHANGE_FAILED": return "OAUTH_EXCHANGE_FAILED"
+        case "OAUTH_REDIRECT_NOT_ALLOWED", "APP_NOT_REGISTERED", "APP_NOT_APPROVED": return "OAUTH_REDIRECT_NOT_ALLOWED"
+        case "EXPLICIT_IDENTITY_LINK_REQUIRED": return "ACCOUNT_LINK_REQUIRED"
+        case "RATE_LIMITED": return "RATE_LIMITED"
+        default: return status == 429 ? "RATE_LIMITED" : "API_ERROR"
+        }
+    }
+
+    /// `TEAMID.bundleId` from the app's default keychain access group.
+    static func detectAppIdentifier() -> String? {
+        var q: [String: Any] = [
+            kSecClass as String: kSecClassGenericPassword,
+            kSecAttrService as String: "dev.authon.apple-sign-in.app-id",
+            kSecAttrAccount as String: "probe",
+            kSecReturnAttributes as String: true,
+        ]
+        #if os(macOS)
+        q[kSecUseDataProtectionKeychain as String] = true
+        #endif
+        var out: AnyObject?
+        var status = SecItemCopyMatching(q as CFDictionary, &out)
+        if status == errSecItemNotFound {
+            var add = q
+            add[kSecAttrAccessible as String] = kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly
+            status = SecItemAdd(add as CFDictionary, &out)
+        }
+        guard status == errSecSuccess, let attrs = out as? [String: Any], let group = attrs[kSecAttrAccessGroup as String] as? String,
+              group.contains(".") else { return nil }
+        return group
+    }
+}
+
+/// The system Apple ID sheet (ASAuthorizationController), shown immediately.
+public final class SystemAppleIDAuthorizer: AppleIDAuthorizing, @unchecked Sendable {
+    private let anchor: (@MainActor () -> ASPresentationAnchor?)?
+
+    public init(anchor: (@MainActor () -> ASPresentationAnchor?)? = nil) {
+        self.anchor = anchor
+    }
+
+    @MainActor
+    public func authorize(hashedNonce: String) async throws -> AppleIDResult {
+        let request = ASAuthorizationAppleIDProvider().createRequest()
+        request.requestedScopes = [.fullName, .email]
+        request.nonce = hashedNonce
+        let delegate = AppleIDDelegate(anchor: anchor?() ?? Self.keyWindow())
+        let credential = try await delegate.run(request)
+        return AppleIDResult(identityToken: credential.identityToken, authorizationCode: credential.authorizationCode, fullName: credential.fullName)
+    }
+
+    @MainActor
+    static func keyWindow() -> ASPresentationAnchor {
+        #if canImport(UIKit)
+        let scenes = UIApplication.shared.connectedScenes.compactMap { $0 as? UIWindowScene }
+        return scenes.flatMap(\.windows).first(where: \.isKeyWindow) ?? scenes.first?.windows.first ?? ASPresentationAnchor()
+        #else
+        return NSApplication.shared.keyWindow ?? NSApplication.shared.windows.first ?? ASPresentationAnchor()
+        #endif
+    }
+
+    /// ASAuthorizationError → sign-in code. Only `.canceled` is a cancel; everything else (including
+    /// 1000 `.unknown` after dismissing "sign in to your Apple account") is a provider error that
+    /// retrying the same sheet will not fix.
+    static func map(_ error: Error) -> AppleSignInError {
+        if let e = error as? ASAuthorizationError, e.code == .canceled {
+            return AppleSignInError("OAUTH_CANCELLED", "Sign in with Apple was cancelled")
+        }
+        return AppleSignInError("OAUTH_PROVIDER_ERROR", "Sign in with Apple failed (\((error as NSError).code))", retryable: false)
+    }
+}
+
+@MainActor
+private final class AppleIDDelegate: NSObject, ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
+    private let anchor: ASPresentationAnchor
+    private var continuation: CheckedContinuation<ASAuthorizationAppleIDCredential, Error>?
+    private var retain: AppleIDDelegate?
+
+    init(anchor: ASPresentationAnchor) {
+        self.anchor = anchor
+    }
+
+    func run(_ request: ASAuthorizationRequest) async throws -> ASAuthorizationAppleIDCredential {
+        try await withCheckedThrowingContinuation { cont in
+            continuation = cont
+            retain = self
+            let controller = ASAuthorizationController(authorizationRequests: [request])
+            controller.delegate = self
+            controller.presentationContextProvider = self
+            controller.performRequests()
+        }
+    }
+
+    nonisolated func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
+        MainActor.assumeIsolated { anchor }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
+        MainActor.assumeIsolated {
+            if let credential = authorization.credential as? ASAuthorizationAppleIDCredential {
+                finish(.success(credential))
+            } else {
+                finish(.failure(AppleSignInError("OAUTH_PROVIDER_ERROR", "Unexpected Apple credential type", retryable: false)))
+            }
+        }
+    }
+
+    nonisolated func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+        let mapped = SystemAppleIDAuthorizer.map(error)
+        MainActor.assumeIsolated { finish(.failure(mapped)) }
+    }
+
+    private func finish(_ result: Result<ASAuthorizationAppleIDCredential, Error>) {
+        continuation?.resume(with: result)
+        continuation = nil
+        retain = nil
+    }
+}

package/ios/vendor/GENERATED.md

@@ -1,4 +1,4 @@
 # Generated sources
 
-Everything in this folder is copied from `swift/Sources/{AuthonWallet,CSecp256k1,CKeccak,CMonocypher}` by
+Everything in this folder is copied from `swift/Sources/{AuthonWallet,AuthonAppleSignIn,CSecp256k1,CKeccak,CMonocypher}` by
 `scripts/sync-native-wallet.mjs` (run by the package build). Do not edit these files; change the native SDK sources and run the script. `--check` fails on any difference.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@authon/react-native-wallet",
-  "version": "0.4.0",
+  "version": "0.5.1",
   "description": "Authon embedded wallet for React Native (Expo native module wrapping the Swift and Kotlin wallet SDKs)",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",
@@ -24,6 +24,14 @@
     "README.md",
     "CHANGELOG.md"
   ],
+  "scripts": {
+    "sync:native": "node ../../scripts/sync-native-wallet.mjs",
+    "check:native": "node ../../scripts/sync-native-wallet.mjs --check",
+    "build": "node ../../scripts/sync-native-wallet.mjs && tsc -p tsconfig.build.json",
+    "prepublishOnly": "node ../../scripts/sync-native-wallet.mjs --check && tsc -p tsconfig.build.json",
+    "test": "vitest run --root ../.. --passWithNoTests packages/react-native-wallet",
+    "typecheck": "tsc --noEmit"
+  },
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -58,12 +66,5 @@
     "expo-modules-core": "55.0.26",
     "react": "^19.0.0",
     "typescript": "^5.9.3"
-  },
-  "scripts": {
-    "sync:native": "node ../../scripts/sync-native-wallet.mjs",
-    "check:native": "node ../../scripts/sync-native-wallet.mjs --check",
-    "build": "node ../../scripts/sync-native-wallet.mjs && tsc -p tsconfig.build.json",
-    "test": "vitest run --root ../.. --passWithNoTests packages/react-native-wallet",
-    "typecheck": "tsc --noEmit"
   }
-}
+}

package/src/appleSignIn.ts

@@ -0,0 +1,94 @@
+import { Platform } from 'expo-modules-core';
+import { getNativeModule } from './native';
+
+declare const require: (id: string) => unknown;
+
+/** The part of @authon/react-native's AuthonMobileClient this helper uses. */
+export interface AppleSignInClient {
+  getApiUrl(): string;
+  getPublishableKey(): string;
+  adoptSignInResult(result: never): Promise<unknown>;
+}
+
+type AuthErrorCtor = new (
+  code: string,
+  message?: string,
+  options?: { diagnosticId?: string | null; retryable?: boolean },
+) => Error & { code: string; diagnosticId: string | null; retryable: boolean };
+
+/** Fallback with the same shape as @authon/react-native's AuthonAuthError. */
+class AppleSignInError extends Error {
+  readonly code: string;
+  readonly diagnosticId: string | null;
+  readonly retryable: boolean;
+  constructor(code: string, message?: string, options: { diagnosticId?: string | null; retryable?: boolean } = {}) {
+    super(message ?? code);
+    this.name = 'AuthonAuthError';
+    this.code = code;
+    this.diagnosticId = options.diagnosticId ?? null;
+    this.retryable = options.retryable ?? false;
+  }
+}
+
+function authError(code: string, message: string, options: { diagnosticId?: string | null; retryable?: boolean } = {}) {
+  let Ctor: AuthErrorCtor = AppleSignInError;
+  try {
+    const mod = require('@authon/react-native') as { AuthonAuthError?: AuthErrorCtor } | undefined;
+    if (mod?.AuthonAuthError) Ctor = mod.AuthonAuthError;
+  } catch {
+    // @authon/react-native not installed: same fields, local class.
+  }
+  return new Ctor(code, message, options);
+}
+
+export interface SignInWithAppleNativeOptions {
+  /** `TEAMID.bundleId` as registered in the Authon console; detected from the app when omitted. */
+  appId?: string;
+}
+
+/**
+ * Native Sign in with Apple on iOS: shows the system Apple sheet right away (no browser, no web page)
+ * and makes the resulting session the session of `client` (an AuthonMobileClient from
+ * @authon/react-native, e.g. `useAuthon().client`), like a completed OAuth sign-in.
+ *
+ * JS never sees Apple's identity token, authorization code, nonce or the PKCE verifier; only the
+ * final result reaches JS. Errors are AuthonAuthError with the shared sign-in codes: OAUTH_CANCELLED
+ * (the user closed the sheet, show nothing), OAUTH_REDIRECT_NOT_ALLOWED (app not registered or not
+ * approved; `serverCode` tells APP_NOT_REGISTERED from APP_NOT_APPROVED), OAUTH_STATE_MISMATCH
+ * (server OAUTH_STATE_INVALID), OAUTH_EXCHANGE_FAILED, ACCOUNT_LINK_REQUIRED, NETWORK_ERROR,
+ * RATE_LIMITED, API_ERROR, with `diagnosticId` when the server answered.
+ * MFA: throws AuthonMfaRequiredError, finish with verifyMfa(). Cancel and errors never fall back to
+ * a web flow. Android: UNSUPPORTED_PLATFORM, use the normal OAuth flow (`startOAuth('apple')`).
+ */
+export async function signInWithAppleNative(client: AppleSignInClient, options: SignInWithAppleNativeOptions = {}): Promise<unknown> {
+  if (Platform.OS !== 'ios') {
+    throw authError('UNSUPPORTED_PLATFORM', 'Native Sign in with Apple is iOS only; on Android use startOAuth("apple")');
+  }
+  const native = getNativeModule();
+  if (!native?.signInWithApple) {
+    throw authError('NOT_CONFIGURED', '@authon/react-native-wallet native module not found. Use a development build and rebuild the app.');
+  }
+  const result = await native.signInWithApple({
+    publishableKey: client.getPublishableKey(),
+    apiUrl: client.getApiUrl(),
+    appId: options.appId ?? null,
+  });
+  if (!result || typeof result !== 'object') throw authError('API_ERROR', 'Apple sign-in returned no result');
+  if (result.ok !== true) {
+    const code = typeof result.code === 'string' && result.code ? result.code : 'API_ERROR';
+    const error = authError(code, typeof result.message === 'string' && result.message ? result.message : code, {
+      diagnosticId: typeof result.diagnosticId === 'string' && result.diagnosticId ? result.diagnosticId : null,
+      retryable: result.retryable === true,
+    });
+    // The server's own code (APP_NOT_REGISTERED, APP_NOT_APPROVED, OAUTH_STATE_INVALID, ...), when sent.
+    const serverCode = (result as { serverCode?: unknown }).serverCode;
+    throw Object.assign(error, { serverCode: typeof serverCode === 'string' && serverCode ? serverCode : null });
+  }
+  let session: unknown;
+  try {
+    session = typeof result.value === 'string' ? JSON.parse(result.value) : result.value;
+  } catch {
+    throw authError('API_ERROR', 'Apple sign-in returned an unreadable result');
+  }
+  return client.adoptSignInResult(session as never);
+}

package/src/client.ts

@@ -26,6 +26,8 @@ let counter = 0;
 
 const isObject = (v: unknown): v is Record<string, unknown> => typeof v === 'object' && v !== null && !Array.isArray(v);
 const str = (v: unknown): string | null => (typeof v === 'string' ? v : null);
+/** Error detail fields are short identifiers; anything else (free text) is dropped. */
+const wireToken = (v: unknown): string | null => (typeof v === 'string' && /^[A-Za-z0-9._-]{1,64}$/.test(v) ? v : null);
 
 /** Copies only the public fields, so nothing else the native side might add reaches the app. */
 function toWallet(value: unknown): EmbeddedWallet {
@@ -413,6 +415,9 @@ export class AuthonWalletClient {
     throw new AuthonWalletError(code, typeof result.message === 'string' && result.message ? result.message : code, {
       diagnosticId: typeof result.diagnosticId === 'string' && result.diagnosticId ? result.diagnosticId : null,
       retryable: result.retryable === true,
+      reason: wireToken(result.reason),
+      phase: wireToken(result.phase),
+      clientAttemptId: wireToken(result.clientAttemptId),
     });
   }
 

package/src/errors.ts

@@ -42,17 +42,43 @@ export type WalletErrorCode =
   | 'UNKNOWN'
   | (string & {});
 
+/** Narrower causes under a code, set only when the native wallet is certain of them. */
+export type WalletErrorReason =
+  /** Android: the passkey provider could not validate the RP for this app (Digital Asset Links). Code `ORIGIN_NOT_ALLOWED`. */
+  | 'PASSKEY_RP_VALIDATION_FAILED'
+  | (string & {});
+
+export interface AuthonWalletErrorOptions {
+  diagnosticId?: string | null;
+  retryable?: boolean;
+  reason?: WalletErrorReason | null;
+  phase?: string | null;
+  clientAttemptId?: string | null;
+}
+
 export class AuthonWalletError extends Error {
   readonly code: WalletErrorCode;
   /** The server's request ID when the failure came from an API response; log this, never secrets. */
   readonly diagnosticId: string | null;
   /** Whether trying the same call again can succeed (from the native wallet's code table). */
   readonly retryable: boolean;
-  constructor(code: WalletErrorCode, message?: string, options: { diagnosticId?: string | null; retryable?: boolean } = {}) {
+  /** A narrower cause under `code` (e.g. `PASSKEY_RP_VALIDATION_FAILED`), or null when not certain. */
+  readonly reason: WalletErrorReason | null;
+  /** The step that failed, e.g. `passkey.create` or `passkey.create.rpValidation`; null when not reported (iOS, older natives). */
+  readonly phase: string | null;
+  /**
+   * A random ID the device made for an Android passkey failure (not for a cancel; null on iOS). It is
+   * not a server request ID: no API request was involved, so `diagnosticId` stays null for these.
+   */
+  readonly clientAttemptId: string | null;
+  constructor(code: WalletErrorCode, message?: string, options: AuthonWalletErrorOptions = {}) {
     super(message ?? code);
     this.name = 'AuthonWalletError';
     this.code = code;
     this.diagnosticId = options.diagnosticId ?? null;
     this.retryable = options.retryable ?? false;
+    this.reason = options.reason ?? null;
+    this.phase = options.phase ?? null;
+    this.clientAttemptId = options.clientAttemptId ?? null;
   }
 }

package/src/index.ts

@@ -1,7 +1,9 @@
 export { AuthonWalletClient, createAuthonWallet } from './client';
 export { AuthonWalletError } from './errors';
-export type { WalletErrorCode } from './errors';
+export type { WalletErrorCode, WalletErrorReason, AuthonWalletErrorOptions } from './errors';
 export { useAuthonWallet } from './useAuthonWallet';
+export { signInWithAppleNative } from './appleSignIn';
+export type { AppleSignInClient, SignInWithAppleNativeOptions } from './appleSignIn';
 export type { UseAuthonWalletOptions, UseAuthonWalletResult } from './useAuthonWallet';
 export type {
   AuthonWalletOptions,

package/src/native.ts

@@ -3,7 +3,16 @@ import { requireOptionalNativeModule } from 'expo-modules-core';
 /** Every native function resolves an envelope instead of rejecting. */
 export type NativeResult<T> =
   | { ok: true; value: T }
-  | { ok: false; code: string; message?: string; diagnosticId?: string | null; retryable?: boolean };
+  | {
+      ok: false;
+      code: string;
+      message?: string;
+      diagnosticId?: string | null;
+      retryable?: boolean;
+      reason?: string | null;
+      phase?: string | null;
+      clientAttemptId?: string | null;
+    };
 
 export interface NativeConfig {
   publishableKey: string;
@@ -37,6 +46,8 @@ export interface AuthonWalletNativeModule {
   upgradeBackup(id: string, token: string): Promise<NativeResult<unknown>>;
   restore(id: string, token: string, reset: boolean): Promise<NativeResult<unknown>>;
   revokeDevice(id: string, token: string, deviceId: string): Promise<NativeResult<unknown>>;
+  /** iOS only: native Sign in with Apple; resolves the server's sign-in result (JSON), never Apple's tokens. */
+  signInWithApple?(config: { publishableKey: string; apiUrl: string; appId: string | null }): Promise<NativeResult<unknown>>;
 }
 
 let override: AuthonWalletNativeModule | null | undefined;