@craft-native/ios 0.0.143 → 0.0.145

package/README.md

@@ -178,6 +178,7 @@ Edit `craft.config.json` in your iOS project:
   "enableBluetooth": true,
   "enableNFC": true,
   "enableHealthKit": false,
+  "enableAppleMusic": false,
   "enableScreenCapture": true,
   "iosVersion": "15.0",
   "teamId": ""
@@ -188,6 +189,18 @@ The app name is shown as written (`"HQ.training"` is fine); the Xcode
 project, target and Swift types use a PascalCase identifier made from it
 (`HQTraining`). A key left out of the file keeps its default.
 
+Purpose strings in your own words, by Info.plist key (each replaces Craft's
+generic sentence; the keys for frameworks the shell links are always written,
+since App Store Connect checks the binary):
+
+```json
+{
+  "usageDescriptions": {
+    "NSAppleMusicUsageDescription": "Shows the song playing during a workout and lets you pause or skip it."
+  }
+}
+```
+
 Appearance and navigation:
 
 ```json
@@ -520,6 +533,31 @@ window.craft.setKeepAwake(false); // Allow screen dimming
 const level = await window.craft.getBrightness();   // 0.62
 await window.craft.setBrightness(0.1);              // resolves with what the screen reports
 
+// Apple Music (enableAppleMusic): what the Music app is playing, and its
+// transport, through MPMusicPlayerController.systemMusicPlayer. Only Apple
+// Music: iOS gives no app another player's controls, so while Spotify or a
+// podcast app plays, the song fields are null and otherAudioPlaying is true.
+// Nothing is read until the person allows media library access, which only
+// requestAuthorization() asks for (call it from their tap, never at launch).
+// Word the prompt with usageDescriptions.NSAppleMusicUsageDescription.
+await window.craft.music.requestAuthorization(); // 'authorized' | 'denied' | 'restricted' | 'notDetermined'
+const now = await window.craft.music.getNowPlaying();
+// { available, authorization, source: 'appleMusic', playbackState: 'playing', isPlaying,
+//   itemId, title, artist, album, duration, position, timestamp,
+//   artworkDataURL: 'data:image/jpeg;base64,…' (120 px, or null), otherAudioPlaying }
+await window.craft.music.togglePlayPause(); // play() / pause() too; each resolves with the snapshot
+await window.craft.music.skipToNext();
+await window.craft.music.skipToPrevious({ restartAfter: 3 }); // like Music's own button; 0 = always previous
+await window.craft.music.observe(true); // then every change arrives as craftMusicChange
+window.addEventListener('craftMusicChange', (event) => render(event.detail));
+// Or `import { music } from 'craft-native/mobile'`: music.onChange(callback)
+// observes while anyone listens, and off a phone every call answers
+// { available: false } without doing anything.
+// The simulator's Music app has nothing to play: launch with
+// `-CraftFakeMusicPlayer YES` (or `simctl spawn <device> defaults write <bundle id>
+// CraftFakeMusicPlayer -bool YES`) for three made-up songs that play and skip.
+// Simulator builds only; a device always talks to the Music app.
+
 // Speech: short spoken cues that duck the person's music instead of stopping
 // it, and play with the silent switch on. Always available (no config flag).
 // Resolves when the utterance ends: true if spoken, false if stopped or

package/dist/cli.js

@@ -114,6 +114,7 @@ var DEFAULT_CONFIG = {
   enablePDFViewer: false,
   enableAR: false,
   enableMLKit: false,
+  enableAppleMusic: false,
   iosVersion: "16.0",
   watchosVersion: "9.0",
   teamId: "",
@@ -157,7 +158,8 @@ var LINKED_PURPOSES = {
   NSCalendarsUsageDescription: "your calendar",
   NSBluetoothAlwaysUsageDescription: "Bluetooth",
   NSMotionUsageDescription: "motion data",
-  NSFaceIDUsageDescription: "Face ID"
+  NSFaceIDUsageDescription: "Face ID",
+  NSAppleMusicUsageDescription: "your music"
 };
 function renderUsageDescriptions(config) {
   const entries = [
@@ -175,9 +177,14 @@ function renderUsageDescriptions(config) {
     [config.enableLocalNetwork, "NSLocalNetworkUsageDescription", `${config.appName} connects to your own devices on this network.`],
     [config.enableHealthKit, "NSHealthShareUsageDescription", `${config.appName} reads health data you choose to share.`],
     [config.enableHealthKit, "NSHealthUpdateUsageDescription", `${config.appName} writes health data only with your permission.`],
-    [config.enableBiometric, "NSFaceIDUsageDescription", `${config.appName} uses Face ID to protect your account.`]
+    [config.enableBiometric, "NSFaceIDUsageDescription", `${config.appName} uses Face ID to protect your account.`],
+    [config.enableAppleMusic, "NSAppleMusicUsageDescription", `${config.appName} shows and controls the music playing in the Music app.`]
   ];
+  const own = config.usageDescriptions ?? {};
   return entries.map(([enabled, key, value]) => {
+    const custom = own[key]?.trim();
+    if (custom)
+      return [key, custom];
     if (enabled)
       return [key, value];
     const linked = LINKED_PURPOSES[key];
@@ -724,6 +731,7 @@ async function init(options) {
   cpSync(join(TEMPLATES_DIR, "CraftNativeFlatList.swift"), join(output, "Sources", "CraftNativeFlatList.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftNativeActions.swift"), join(output, "Sources", "CraftNativeActions.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftHealth.swift"), join(output, "Sources", "CraftHealth.swift"));
+  cpSync(join(TEMPLATES_DIR, "CraftMusic.swift"), join(output, "Sources", "CraftMusic.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftNativeMutation.swift"), join(output, "Sources", "CraftNativeMutation.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftNativeUI.swift"), join(output, "Sources", "CraftNativeUI.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftHybrid.swift"), join(output, "Sources", "CraftHybrid.swift"));

package/dist/index.d.ts

@@ -60,6 +60,20 @@ export interface CraftConfig {
     enablePDFViewer?: boolean;
     enableAR?: boolean;
     enableMLKit?: boolean;
+    /**
+     * Show and control what the Music app is playing (`craft.music`, through
+     * MPMusicPlayerController.systemMusicPlayer). Only Apple Music: iOS gives
+     * no app the controls of another player such as Spotify. iOS asks the
+     * person for media library access the first time the page calls
+     * `craft.music.requestAuthorization()`, never at launch.
+     */
+    enableAppleMusic?: boolean;
+    /**
+     * Purpose strings in the app's own words, by Info.plist key
+     * (`{ NSAppleMusicUsageDescription: 'Shows the song playing during a workout.' }`).
+     * Each replaces the generic sentence Craft writes for that key.
+     */
+    usageDescriptions?: Record<string, string>;
     devServerURL?: string;
     iosVersion?: string;
     watchosVersion?: string;

package/dist/index.js

@@ -169,6 +169,7 @@ var DEFAULT_CONFIG = {
   enablePDFViewer: false,
   enableAR: false,
   enableMLKit: false,
+  enableAppleMusic: false,
   iosVersion: "16.0",
   watchosVersion: "9.0",
   teamId: "",
@@ -212,7 +213,8 @@ var LINKED_PURPOSES = {
   NSCalendarsUsageDescription: "your calendar",
   NSBluetoothAlwaysUsageDescription: "Bluetooth",
   NSMotionUsageDescription: "motion data",
-  NSFaceIDUsageDescription: "Face ID"
+  NSFaceIDUsageDescription: "Face ID",
+  NSAppleMusicUsageDescription: "your music"
 };
 function renderUsageDescriptions(config) {
   const entries = [
@@ -230,9 +232,14 @@ function renderUsageDescriptions(config) {
     [config.enableLocalNetwork, "NSLocalNetworkUsageDescription", `${config.appName} connects to your own devices on this network.`],
     [config.enableHealthKit, "NSHealthShareUsageDescription", `${config.appName} reads health data you choose to share.`],
     [config.enableHealthKit, "NSHealthUpdateUsageDescription", `${config.appName} writes health data only with your permission.`],
-    [config.enableBiometric, "NSFaceIDUsageDescription", `${config.appName} uses Face ID to protect your account.`]
+    [config.enableBiometric, "NSFaceIDUsageDescription", `${config.appName} uses Face ID to protect your account.`],
+    [config.enableAppleMusic, "NSAppleMusicUsageDescription", `${config.appName} shows and controls the music playing in the Music app.`]
   ];
+  const own = config.usageDescriptions ?? {};
   return entries.map(([enabled, key, value]) => {
+    const custom = own[key]?.trim();
+    if (custom)
+      return [key, custom];
     if (enabled)
       return [key, value];
     const linked = LINKED_PURPOSES[key];
@@ -779,6 +786,7 @@ async function init(options) {
   cpSync(join(TEMPLATES_DIR, "CraftNativeFlatList.swift"), join(output, "Sources", "CraftNativeFlatList.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftNativeActions.swift"), join(output, "Sources", "CraftNativeActions.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftHealth.swift"), join(output, "Sources", "CraftHealth.swift"));
+  cpSync(join(TEMPLATES_DIR, "CraftMusic.swift"), join(output, "Sources", "CraftMusic.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftNativeMutation.swift"), join(output, "Sources", "CraftNativeMutation.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftNativeUI.swift"), join(output, "Sources", "CraftNativeUI.swift"));
   cpSync(join(TEMPLATES_DIR, "CraftHybrid.swift"), join(output, "Sources", "CraftHybrid.swift"));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@craft-native/ios",
-  "version": "0.0.143",
+  "version": "0.0.145",
   "homepage": "https://github.com/craft-native/craft/tree/main/packages/ios#readme",
   "repository": {
     "type": "git",

package/templates/CraftApp.swift

@@ -1105,6 +1105,8 @@ struct CraftConfig: Codable {
     var enablePDFViewer: Bool = false
     var enableAR: Bool = false
     var enableMLKit: Bool = false
+    /// The Music app's song and transport through `craft.music` (CraftMusic.swift).
+    var enableAppleMusic: Bool = false
     var devServerURL: String? = nil
     var trustedOrigins: [String] = []
     /// The longest the launch splash stays up when the page neither says it is
@@ -2162,6 +2164,43 @@ struct CraftWebView: UIViewRepresentable {
                 } else {
                     rejectCallback(callbackId, error: "setBrightness was called without the values it needs", code: "INVALID_ARGUMENT")
                 }
+            // MARK: - Apple Music (CraftMusic.swift)
+            // Gated on enableAppleMusic. Only musicRequestAuthorization asks
+            // the person anything; the rest answer from what is allowed.
+            case "musicGetAuthorization":
+                if config.enableAppleMusic {
+                    DispatchQueue.main.async { self.resolveCallback(callbackId, result: CraftMusic.shared.authorization) }
+                } else {
+                    rejectCallback(callbackId, error: "Apple Music is disabled", code: "CAPABILITY_DISABLED")
+                }
+            case "musicRequestAuthorization":
+                if config.enableAppleMusic {
+                    DispatchQueue.main.async {
+                        CraftMusic.shared.requestAuthorization { [weak self] status in self?.resolveCallback(callbackId, result: status) }
+                    }
+                } else {
+                    rejectCallback(callbackId, error: "Apple Music is disabled", code: "CAPABILITY_DISABLED")
+                }
+            case "musicGetNowPlaying":
+                if config.enableAppleMusic {
+                    DispatchQueue.main.async { self.resolveCallback(callbackId, result: CraftMusic.shared.snapshot()) }
+                } else {
+                    rejectCallback(callbackId, error: "Apple Music is disabled", code: "CAPABILITY_DISABLED")
+                }
+            case "musicControl":
+                if !config.enableAppleMusic {
+                    rejectCallback(callbackId, error: "Apple Music is disabled", code: "CAPABILITY_DISABLED")
+                } else if let command = body["command"] as? String {
+                    musicControl(command, restartAfter: (body["restartAfter"] as? NSNumber)?.doubleValue, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "musicControl was called without a command", code: "INVALID_ARGUMENT")
+                }
+            case "musicObserve":
+                if config.enableAppleMusic {
+                    musicObserve(body["enabled"] as? Bool ?? true, callbackId: callbackId)
+                } else {
+                    rejectCallback(callbackId, error: "Apple Music is disabled", code: "CAPABILITY_DISABLED")
+                }
             // MARK: - Orientation Lock
             case "lockOrientation":
                 if config.enableOrientationLock {
@@ -3146,6 +3185,7 @@ struct CraftWebView: UIViewRepresentable {
                     deepLinks: \(config.enableDeepLinks),
                     flashlight: true,
                     brightness: true,
+                    music: \(config.enableAppleMusic),
                     speech: true,
                     network: true,
                     deviceInfo: true,
@@ -4684,6 +4724,7 @@ struct CraftWebView: UIViewRepresentable {
                 // still open; these wait for the answer instead.
                 var personFacing = {
                     requestHealthAuthorization: true,
+                    musicRequestAuthorization: true,
                     requestPermission: true,
                     signInWithApple: true,
                     dialogAlert: true,
@@ -4881,6 +4922,23 @@ struct CraftWebView: UIViewRepresentable {
                         return craft._invoke('getHealthSleepIntervals', {startDate: options.startDate, endDate: options.endDate});
                     }
                 };
+                // The Music app's song and transport. Nothing is read until
+                // requestAuthorization() has been allowed; observe(true) makes
+                // every change arrive as a craftMusicChange event.
+                craft.music = {
+                    getAuthorizationStatus: function() { return craft._invoke('musicGetAuthorization'); },
+                    requestAuthorization: function() { return craft._invoke('musicRequestAuthorization'); },
+                    getNowPlaying: function() { return craft._invoke('musicGetNowPlaying'); },
+                    play: function() { return craft._invoke('musicControl', {command: 'play'}); },
+                    pause: function() { return craft._invoke('musicControl', {command: 'pause'}); },
+                    togglePlayPause: function() { return craft._invoke('musicControl', {command: 'togglePlayPause'}); },
+                    skipToNext: function() { return craft._invoke('musicControl', {command: 'skipToNext'}); },
+                    skipToPrevious: function(options) {
+                        var restartAfter = options && typeof options.restartAfter === 'number' ? options.restartAfter : null;
+                        return craft._invoke('musicControl', {command: 'skipToPrevious', restartAfter: restartAfter});
+                    },
+                    observe: function(enabled) { return craft._invoke('musicObserve', {enabled: enabled !== false}); }
+                };
                 craft.liveActivity = {
                     start: function(options) { return craft._invoke('startLiveActivity', options || {}); },
                     update: function(idOrState, state) {
@@ -6636,17 +6694,14 @@ struct CraftWebView: UIViewRepresentable {
 
         // MARK: - Social Auth (Apple Sign In)
         private func signInWithApple(nonce: String?, callbackId: String?) {
+            // The same sheet a native screen asks for (CraftNativeUI.swift).
             DispatchQueue.main.async {
-                self.pendingCallbackId = callbackId
-                let provider = ASAuthorizationAppleIDProvider()
-                let request = provider.createRequest()
-                request.requestedScopes = [.fullName, .email]
-                if let nonce, !nonce.isEmpty { request.nonce = nonce }
-
-                let controller = ASAuthorizationController(authorizationRequests: [request])
-                controller.delegate = self
-                controller.presentationContextProvider = self
-                controller.performRequests()
+                CraftSignInWithApple.shared.signIn(nonce: nonce) { [weak self] result in
+                    switch result {
+                    case .success(let value): self?.resolveCallback(callbackId, result: value)
+                    case .failure(let failure): self?.rejectCallback(callbackId, error: failure.message, code: failure.code)
+                    }
+                }
             }
         }
 
@@ -6932,6 +6987,29 @@ struct CraftWebView: UIViewRepresentable {
             CraftHealth.shared.getSleepIntervals(startDate: startDate, endDate: endDate) { [weak self] in self?.answer(callbackId, $0) }
         }
 
+        // MARK: - Apple Music
+        // The player itself is CraftMusic.swift.
+        private func musicControl(_ command: String, restartAfter: Double?, callbackId: String?) {
+            DispatchQueue.main.async {
+                CraftMusic.shared.control(command, restartAfter: restartAfter) { [weak self] result in
+                    switch result {
+                    case .success(let snapshot): self?.resolveCallback(callbackId, result: snapshot)
+                    case .failure(let failure): self?.rejectCallback(callbackId, error: failure.message, code: failure.code)
+                    }
+                }
+            }
+        }
+
+        /// Every change of song or playback state reaches the page as
+        /// `craftMusicChange`, carrying the same snapshot musicGetNowPlaying
+        /// answers with.
+        private func musicObserve(_ enabled: Bool, callbackId: String?) {
+            DispatchQueue.main.async {
+                CraftMusic.shared.observe(enabled ? { [weak self] snapshot in self?.sendToWeb("craftMusicChange", data: snapshot) } : nil)
+                self.resolveCallback(callbackId, result: enabled)
+            }
+        }
+
         // MARK: - Live Activities
         private func startLiveActivity(body: [String: Any], callbackId: String?) {
             guard #available(iOS 16.2, *), ActivityAuthorizationInfo().areActivitiesEnabled else {
@@ -7887,56 +7965,6 @@ extension CraftWebView.Coordinator: UIDocumentPickerDelegate {
     }
 }
 
-// MARK: - Apple Sign In Delegate
-extension CraftWebView.Coordinator: ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
-    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
-        if let appleIDCredential = authorization.credential as? ASAuthorizationAppleIDCredential {
-            let userId = appleIDCredential.user
-            let email = appleIDCredential.email
-            let fullName = appleIDCredential.fullName
-
-            var name = ""
-            if let givenName = fullName?.givenName {
-                name = givenName
-            }
-            if let familyName = fullName?.familyName {
-                name += (name.isEmpty ? "" : " ") + familyName
-            }
-
-            var result: [String: Any] = ["userId": userId]
-            if let email = email { result["email"] = email }
-            if !name.isEmpty { result["name"] = name }
-
-            if let identityToken = appleIDCredential.identityToken,
-               let tokenString = String(data: identityToken, encoding: .utf8) {
-                result["identityToken"] = tokenString
-            }
-            // One use, five minutes: the server redeems it at Apple's token
-            // endpoint and so reads the identity straight from Apple.
-            if let authorizationCode = appleIDCredential.authorizationCode,
-               let codeString = String(data: authorizationCode, encoding: .utf8) {
-                result["authorizationCode"] = codeString
-            }
-
-            resolveCallback(pendingCallbackId, result: result)
-        }
-        pendingCallbackId = nil
-    }
-
-    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
-        rejectCallback(pendingCallbackId, error: error.localizedDescription)
-        pendingCallbackId = nil
-    }
-
-    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
-        guard let windowScene = UIApplication.shared.connectedScenes.first as? UIWindowScene,
-              let window = windowScene.windows.first else {
-            return UIWindow()
-        }
-        return window
-    }
-}
-
 // MARK: - Bluetooth Delegate
 extension CraftWebView.Coordinator: CBCentralManagerDelegate {
     func centralManagerDidUpdateState(_ central: CBCentralManager) {

package/templates/CraftHybrid.swift

@@ -247,8 +247,33 @@ final class CraftHybrid: NSObject {
     fileprivate(set) var pageDepth = 0
     fileprivate(set) var pageReady = false
 
+    /// Shared keys a native screen wrote, by the page's own key (NSNull for a
+    /// removal), until the page has them: it reports each back as its own
+    /// write, which is when it leaves this list.
+    private var pendingShared: [String: Any] = [:]
+
     private override init() {}
 
+    /// A native screen wrote a key the page shares (`shareStorage`, named
+    /// here by its native name): both Keychain copies, and the page's own
+    /// storage, now if it is loaded or when it next loads. Nothing for a key
+    /// the config does not share.
+    func nativeWroteShared(nativeKey: String, value: String?) {
+        guard let webKey = config.shareStorage?.first(where: { $0.value == nativeKey })?.key else { return }
+        CraftHybridKeychain.set(nativeKey, value: value)
+        DispatchQueue.main.async {
+            self.pendingShared[webKey] = value ?? NSNull()
+            self.flushShared()
+        }
+    }
+
+    private func flushShared() {
+        guard pageReady, let webView, !pendingShared.isEmpty,
+              let data = try? JSONSerialization.data(withJSONObject: pendingShared),
+              let json = String(data: data, encoding: .utf8) else { return }
+        webView.evaluateJavaScript("window.__craftHybrid && window.__craftHybrid.adopt && window.__craftHybrid.adopt(\(json))")
+    }
+
     static var bundleURL: URL? {
         Bundle.main.url(forResource: "native-screen", withExtension: "js", subdirectory: "dist")
             ?? Bundle.main.url(forResource: "native-screen", withExtension: "js")
@@ -511,8 +536,26 @@ final class CraftHybrid: NSObject {
         SHARE.forEach(share);
       }
 
+      // A shared key a native screen wrote (a sign-in there): into this
+      // page's storage, which reports it back as the page's own write, and
+      // a `craftsharedstorage` event for whoever holds it in memory.
+      function adopt(values) {
+        Object.keys(values || {}).forEach(function (key) {
+          if (SHARE.indexOf(key) < 0) return;
+          var value = values[key];
+          try {
+            window.sessionStorage.removeItem(key);
+            if (value === null) window.localStorage.removeItem(key);
+            else window.localStorage.setItem(key, String(value));
+          } catch (e) {}
+          share(key);
+          try { window.dispatchEvent(new CustomEvent('craftsharedstorage', { detail: { key: key, value: value } })); } catch (e) {}
+        });
+      }
+
       window.__craftHybrid = {
         match: function (url) { var path = local(url); return path === null ? null : match(path); },
+        adopt: adopt,
         // The shell's own navigation: never handed back to it, and without
         // the page's slide, since the shell animates the push itself.
         // Answers once the page has drawn `path` (its router settles before
@@ -593,12 +636,15 @@ final class CraftHybrid: NSObject {
             for name in names { CraftSnapshots.write(name, json: nil) }
         case .shareStorage(let key, let value):
             guard let nativeKey = config.shareStorage?[key] else { return }
+            // The page's own write, or its echo of one a native screen made.
+            pendingShared.removeValue(forKey: key)
             CraftHybridKeychain.set(nativeKey, value: value)
         case .navigated(let path, let direction, let depth, let byHost):
             pagePath = path
             pageDepth = depth
             if direction == "load" { pageReady = true }
             controller?.pageNavigated(path: path, direction: direction, depth: depth, byHost: byHost)
+            if direction == "load" { flushShared() }
         case .navigateNative(let path, let replace):
             controller?.showNative(path: path, replace: replace)
         case .open(let path):

package/templates/CraftMusic.swift

@@ -0,0 +1,413 @@
+import AVFoundation
+import Foundation
+import MediaPlayer
+import UIKit
+
+/// A music call that did not happen: the message a page sees, and the
+/// bridge's error code.
+struct CraftMusicError: Error {
+    let message: String
+    var code: String = "CRAFT_ERROR"
+}
+
+/// The song a player has up, whoever the player is.
+struct CraftMusicItem {
+    let id: String
+    let title: String?
+    let artist: String?
+    let album: String?
+    let duration: TimeInterval
+    /// The artwork drawn at about `size`, or nil when the song has none.
+    let artwork: (CGSize) -> UIImage?
+}
+
+/// The slice of MPMusicPlayerController the bridge uses, so the simulator,
+/// whose Music app has nothing to play, can stand a fake in for it.
+protocol CraftMusicPlayer: AnyObject {
+    /// "appleMusic" for the Music app, "simulated" for the fake.
+    var source: String { get }
+    var item: CraftMusicItem? { get }
+    var playbackState: MPMusicPlaybackState { get }
+    var currentPlaybackTime: TimeInterval { get }
+    /// Called on main whenever the song or the playback state changes.
+    var onChange: (() -> Void)? { get set }
+    func play()
+    func pause()
+    func skipToNextItem()
+    func skipToPreviousItem()
+    func skipToBeginning()
+    func startObserving()
+    func stopObserving()
+}
+
+/// What the Music app is playing, and its transport: the page's
+/// `craft.music` (CraftApp.swift).
+///
+/// Through `MPMusicPlayerController.systemMusicPlayer`, which is the Music
+/// app's own queue: what it plays, this sees and steers, and nothing else.
+/// iOS gives no app another player's controls, so while Spotify or a podcast
+/// app plays, `title` is null and `otherAudioPlaying` is true; a page should
+/// say so rather than show controls that do nothing.
+///
+/// Media library access is asked for only by `requestAuthorization`, which a
+/// page calls when the person chooses to see their music; until then the
+/// player is not touched at all, so nothing is read without consent.
+///
+/// Everything here runs on main: MediaPlayer wants it, and every caller hops
+/// there first.
+final class CraftMusic {
+    typealias Listener = ([String: Any]) -> Void
+
+    static let shared = CraftMusic()
+
+    /// The longest side of the artwork a page is sent, in pixels. Small on
+    /// purpose: it is a thumbnail beside a title, and it crosses the bridge as
+    /// base64 on every change.
+    static let artworkPixels: CGFloat = 120
+
+    private lazy var player: CraftMusicPlayer = {
+        let player = CraftMusic.makePlayer()
+        player.onChange = { [weak self] in self?.playerDidChange() }
+        return player
+    }()
+
+    private var listener: Listener?
+    private var observing = false
+    private var changeScheduled = false
+    private var foregroundObserver: NSObjectProtocol?
+    private var artworkCache: (id: String, dataURL: String?)?
+
+    /// The real player, or on the simulator the fake when the
+    /// `CraftFakeMusicPlayer` default is set: as a launch argument
+    /// (`-CraftFakeMusicPlayer YES`) or with
+    /// `xcrun simctl spawn booted defaults write <bundle id> CraftFakeMusicPlayer -bool YES`.
+    private static func makePlayer() -> CraftMusicPlayer {
+        #if targetEnvironment(simulator)
+        if UserDefaults.standard.bool(forKey: "CraftFakeMusicPlayer") { return CraftFakeMusicPlayer() }
+        #endif
+        return CraftSystemMusicPlayer()
+    }
+
+    // MARK: Authorization
+
+    static func authorizationName(_ status: MPMediaLibraryAuthorizationStatus) -> String {
+        switch status {
+        case .authorized: return "authorized"
+        case .denied: return "denied"
+        case .restricted: return "restricted"
+        case .notDetermined: return "notDetermined"
+        @unknown default: return "denied"
+        }
+    }
+
+    var authorization: String { Self.authorizationName(MPMediaLibrary.authorizationStatus()) }
+    var isAuthorized: Bool { MPMediaLibrary.authorizationStatus() == .authorized }
+
+    /// Ask once; iOS answers from memory after that. Resolves with the
+    /// status's name.
+    func requestAuthorization(completion: @escaping (String) -> Void) {
+        guard MPMediaLibrary.authorizationStatus() == .notDetermined else {
+            completion(authorization)
+            return
+        }
+        MPMediaLibrary.requestAuthorization { status in
+            DispatchQueue.main.async {
+                completion(Self.authorizationName(status))
+                // A page that was already listening hears what there is now.
+                if status == .authorized, self.observing { self.startPlayerObservation() }
+            }
+        }
+    }
+
+    // MARK: Now playing
+
+    static func playbackStateName(_ state: MPMusicPlaybackState) -> String {
+        switch state {
+        case .stopped: return "stopped"
+        case .playing: return "playing"
+        case .paused: return "paused"
+        case .interrupted: return "interrupted"
+        case .seekingForward: return "seekingForward"
+        case .seekingBackward: return "seekingBackward"
+        @unknown default: return "stopped"
+        }
+    }
+
+    /// Everything a page shows about the music, in one answer. Without
+    /// access, only what can be said without touching the player.
+    func snapshot() -> [String: Any] {
+        var result: [String: Any] = [
+            "available": true,
+            "authorization": authorization,
+            "otherAudioPlaying": AVAudioSession.sharedInstance().isOtherAudioPlaying,
+            "timestamp": Int(Date().timeIntervalSince1970 * 1000),
+            "source": NSNull(),
+            "playbackState": "unknown",
+            "isPlaying": false,
+            "itemId": NSNull(),
+            "title": NSNull(),
+            "artist": NSNull(),
+            "album": NSNull(),
+            "duration": NSNull(),
+            "position": NSNull(),
+            "artworkDataURL": NSNull(),
+        ]
+        guard isAuthorized else { return result }
+
+        let player = self.player
+        let state = player.playbackState
+        result["source"] = player.source
+        result["playbackState"] = Self.playbackStateName(state)
+        result["isPlaying"] = state == .playing || state == .seekingForward || state == .seekingBackward
+        guard let item = player.item else { return result }
+
+        result["itemId"] = item.id
+        result["title"] = Self.orNull(item.title)
+        result["artist"] = Self.orNull(item.artist)
+        result["album"] = Self.orNull(item.album)
+        result["duration"] = Self.orNull(item.duration.isFinite && item.duration > 0 ? item.duration : nil)
+        let position = player.currentPlaybackTime
+        result["position"] = Self.orNull(position.isFinite && position >= 0 ? position : nil)
+        result["artworkDataURL"] = Self.orNull(artworkDataURL(for: item))
+        return result
+    }
+
+    private static func orNull(_ value: Any?) -> Any { value ?? NSNull() }
+
+    /// A small JPEG of the artwork as a data URL, drawn once per song.
+    private func artworkDataURL(for item: CraftMusicItem) -> String? {
+        if let cached = artworkCache, cached.id == item.id { return cached.dataURL }
+        let side = Self.artworkPixels
+        var dataURL: String?
+        if let image = item.artwork(CGSize(width: side, height: side)) {
+            let format = UIGraphicsImageRendererFormat()
+            format.scale = 1
+            format.opaque = true
+            let fitted = UIGraphicsImageRenderer(size: CGSize(width: side, height: side), format: format).image { _ in
+                // Fill the square, as a cover does, cropping the long side.
+                let scale = max(side / max(image.size.width, 1), side / max(image.size.height, 1))
+                let size = CGSize(width: image.size.width * scale, height: image.size.height * scale)
+                image.draw(in: CGRect(x: (side - size.width) / 2, y: (side - size.height) / 2, width: size.width, height: size.height))
+            }
+            if let jpeg = fitted.jpegData(compressionQuality: 0.75) {
+                dataURL = "data:image/jpeg;base64," + jpeg.base64EncodedString()
+            }
+        }
+        artworkCache = (item.id, dataURL)
+        return dataURL
+    }
+
+    // MARK: Transport
+
+    /// play, pause, togglePlayPause, skipToNext or skipToPrevious. Resolves
+    /// with the snapshot a moment later, once the Music app has moved, so a
+    /// page can show the outcome without waiting for the change event.
+    ///
+    /// skipToPrevious behaves like the Music app's own back button: more
+    /// than `restartAfter` seconds into a song (3 unless given) it goes back
+    /// to the start of that song; 0 always goes to the previous one.
+    func control(_ command: String, restartAfter: Double?, completion: @escaping (Result<[String: Any], CraftMusicError>) -> Void) {
+        guard isAuthorized else {
+            completion(.failure(CraftMusicError(message: "Music access has not been allowed", code: "NOT_AUTHORIZED")))
+            return
+        }
+        let player = self.player
+        switch command {
+        case "play":
+            player.play()
+        case "pause":
+            player.pause()
+        case "togglePlayPause":
+            if player.playbackState == .playing { player.pause() } else { player.play() }
+        case "skipToNext":
+            player.skipToNextItem()
+        case "skipToPrevious":
+            let threshold = max(restartAfter ?? 3, 0)
+            if threshold > 0, player.currentPlaybackTime > threshold { player.skipToBeginning() } else { player.skipToPreviousItem() }
+        default:
+            completion(.failure(CraftMusicError(message: "Unknown music command: \(command)", code: "INVALID_ARGUMENT")))
+            return
+        }
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.25) {
+            completion(.success(self.snapshot()))
+        }
+    }
+
+    // MARK: Change events
+
+    /// Hear every change of song or playback state as a snapshot, or stop
+    /// hearing them (`nil`). One listener: the web view's page.
+    func observe(_ listener: Listener?) {
+        self.listener = listener
+        if listener != nil, !observing {
+            observing = true
+            if isAuthorized { startPlayerObservation() }
+            // Notifications stop while the app is suspended; coming back,
+            // the page hears where the music is now.
+            foregroundObserver = NotificationCenter.default.addObserver(
+                forName: UIApplication.willEnterForegroundNotification, object: nil, queue: .main
+            ) { [weak self] _ in self?.playerDidChange() }
+        } else if listener == nil, observing {
+            observing = false
+            if let observer = foregroundObserver { NotificationCenter.default.removeObserver(observer) }
+            foregroundObserver = nil
+            if isAuthorized { player.stopObserving() }
+        }
+    }
+
+    private func startPlayerObservation() {
+        player.startObserving()
+    }
+
+    /// A song change arrives as two or three notifications at once; the page
+    /// gets one snapshot for them.
+    private func playerDidChange() {
+        guard observing, !changeScheduled else { return }
+        changeScheduled = true
+        DispatchQueue.main.asyncAfter(deadline: .now() + 0.1) {
+            self.changeScheduled = false
+            guard self.observing, let listener = self.listener else { return }
+            listener(self.snapshot())
+        }
+    }
+}
+
+// MARK: - The Music app
+
+/// `MPMusicPlayerController.systemMusicPlayer`: the Music app's queue.
+final class CraftSystemMusicPlayer: CraftMusicPlayer {
+    let source = "appleMusic"
+    var onChange: (() -> Void)?
+    private var observers: [NSObjectProtocol] = []
+    private var player: MPMusicPlayerController { MPMusicPlayerController.systemMusicPlayer }
+
+    var item: CraftMusicItem? {
+        guard let item = player.nowPlayingItem else { return nil }
+        // A song streamed from the catalog and not in the library has no
+        // persistent ID; its store ID, or what it is called, still tells one
+        // song from the next.
+        let id: String
+        if item.persistentID != 0 { id = String(item.persistentID) }
+        else if !item.playbackStoreID.isEmpty && item.playbackStoreID != "0" { id = "store:" + item.playbackStoreID }
+        else { id = "title:" + (item.title ?? "") + "|" + (item.artist ?? "") }
+        let artwork = item.artwork
+        return CraftMusicItem(
+            id: id,
+            title: item.title,
+            artist: item.artist ?? item.albumArtist,
+            album: item.albumTitle,
+            duration: item.playbackDuration,
+            artwork: { size in artwork?.image(at: size) }
+        )
+    }
+
+    var playbackState: MPMusicPlaybackState { player.playbackState }
+    var currentPlaybackTime: TimeInterval { player.currentPlaybackTime }
+
+    func play() { player.play() }
+    func pause() { player.pause() }
+    func skipToNextItem() { player.skipToNextItem() }
+    func skipToPreviousItem() { player.skipToPreviousItem() }
+    func skipToBeginning() { player.skipToBeginning() }
+
+    func startObserving() {
+        guard observers.isEmpty else { return }
+        let player = self.player
+        player.beginGeneratingPlaybackNotifications()
+        let center = NotificationCenter.default
+        for name in [Notification.Name.MPMusicPlayerControllerNowPlayingItemDidChange, .MPMusicPlayerControllerPlaybackStateDidChange] {
+            observers.append(center.addObserver(forName: name, object: player, queue: .main) { [weak self] _ in self?.onChange?() })
+        }
+    }
+
+    func stopObserving() {
+        guard !observers.isEmpty else { return }
+        observers.forEach { NotificationCenter.default.removeObserver($0) }
+        observers.removeAll()
+        player.endGeneratingPlaybackNotifications()
+    }
+}
+
+// MARK: - The simulator's stand-in
+
+/// Three made-up songs that play, pause and skip like the Music app, so the
+/// bridge, the page's bar and its events can be tried in the simulator.
+/// Never used on a device (see `CraftMusic.makePlayer`).
+final class CraftFakeMusicPlayer: CraftMusicPlayer {
+    let source = "simulated"
+    var onChange: (() -> Void)?
+    private var observing = false
+
+    private let songs: [(title: String, artist: String, album: String, duration: TimeInterval, hue: CGFloat)] = [
+        ("Intervals", "The Pacers", "Tempo Run", 214, 0.02),
+        ("Long Way Home", "Zone Two", "Base Miles", 251, 0.58),
+        ("Cooldown", "Recovery Club", "Easy Days", 187, 0.33),
+    ]
+    private var index = 0
+    private var state: MPMusicPlaybackState = .paused
+    /// Where the song was when it last started or stopped, and when that was.
+    private var offset: TimeInterval = 0
+    private var startedAt: Date?
+
+    var item: CraftMusicItem? {
+        let song = songs[index]
+        return CraftMusicItem(
+            id: "simulated-\(index)",
+            title: song.title,
+            artist: song.artist,
+            album: song.album,
+            duration: song.duration,
+            artwork: { size in
+                UIGraphicsImageRenderer(size: size).image { context in
+                    UIColor(hue: song.hue, saturation: 0.7, brightness: 0.85, alpha: 1).setFill()
+                    context.fill(CGRect(origin: .zero, size: size))
+                }
+            }
+        )
+    }
+
+    var playbackState: MPMusicPlaybackState { state }
+    var currentPlaybackTime: TimeInterval {
+        guard let startedAt = startedAt else { return offset }
+        return min(offset + Date().timeIntervalSince(startedAt), songs[index].duration)
+    }
+
+    func play() {
+        guard state != .playing else { return }
+        state = .playing
+        startedAt = Date()
+        changed()
+    }
+
+    func pause() {
+        guard state == .playing else { return }
+        offset = currentPlaybackTime
+        startedAt = nil
+        state = .paused
+        changed()
+    }
+
+    func skipToNextItem() { move(to: (index + 1) % songs.count) }
+    func skipToPreviousItem() { move(to: (index + songs.count - 1) % songs.count) }
+
+    func skipToBeginning() {
+        offset = 0
+        if state == .playing { startedAt = Date() }
+        changed()
+    }
+
+    func startObserving() { observing = true }
+    func stopObserving() { observing = false }
+
+    private func move(to next: Int) {
+        index = next
+        offset = 0
+        startedAt = state == .playing ? Date() : nil
+        changed()
+    }
+
+    private func changed() {
+        guard observing else { return }
+        DispatchQueue.main.async { self.onChange?() }
+    }
+}

package/templates/CraftNativeActions.swift

@@ -45,6 +45,9 @@ enum CraftNativeActions {
         if config.enableDeepLinks { values.append("deepLinks") }
         if config.enableLocalNotifications { values.append("notifications") }
         if config.enableHealthKit { values.append("health") }
+        // The in-app browser and the system's web sign-in sheet (CraftBrowser).
+        values.append("browser")
+        if config.enableSocialAuth { values.append("appleSignIn") }
         return values
     }
 
@@ -117,6 +120,11 @@ enum CraftNativeActions {
                 return
             }
             sync = secureStorage(method: method, args: args)
+            // A key the web page shares (`shareStorage`): the page gets it too,
+            // so a sign-in on a native screen signs the page in.
+            if case .success = sync, ["set", "remove", "delete"].contains(method), let key = args.first as? String {
+                CraftHybrid.shared.nativeWroteShared(nativeKey: key, value: method == "set" ? args.count > 1 ? args[1] as? String : nil : nil)
+            }
         case ("Biometrics", "isAvailable"):
             sync = config.enableBiometric ? .success(biometricContext().canEvaluatePolicy(.deviceOwnerAuthenticationWithBiometrics, error: nil)) : failure("CAPABILITY_DISABLED", "Biometric authentication is disabled")
         case ("Biometrics", "getBiometricType"):
@@ -146,6 +154,32 @@ enum CraftNativeActions {
             }
             databaseQueue.async { complete(requestToken, database(method: method, args: args), completion) }
             return
+        case ("Browser", "open"):
+            // SFSafariViewController, or for `mode: 'auth'` the system's web
+            // sign-in sheet, the same as a page's `craft.browser.open`.
+            guard let address = args.first as? String, let url = URL(string: address) else {
+                complete(requestToken, failure("INVALID_ARGUMENT", "Browser.open needs a URL it can parse"), completion)
+                return
+            }
+            let options = args.count > 1 ? args[1] as? [String: Any] ?? [:] : [:]
+            DispatchQueue.main.async {
+                CraftBrowser.shared.open(url, mode: options["mode"] as? String ?? "safari", callbackScheme: options["callbackScheme"] as? String, from: nil) { answer in
+                    complete(requestToken, .success(answer), completion)
+                }
+            }
+            return
+        case ("Auth", "signInWithApple"):
+            guard config.enableSocialAuth else {
+                complete(requestToken, failure("CAPABILITY_DISABLED", "Social sign-in is disabled"), completion)
+                return
+            }
+            let options = args.first as? [String: Any] ?? [:]
+            DispatchQueue.main.async {
+                CraftSignInWithApple.shared.signIn(nonce: options["nonce"] as? String) { result in
+                    complete(requestToken, result.mapError { CraftNativeActionError(code: $0.code, message: $0.message) }.map { $0 as Any }, completion)
+                }
+            }
+            return
         case ("Dialog", _):
             // The system's own alert, confirmation and action sheet, the same
             // ones a page gets (CraftNativeUI.swift), over the native screen.

package/templates/CraftNativeScreen.swift

@@ -1,9 +1,11 @@
 import Foundation
 import AVFoundation
 import AVKit
+import CryptoKit
 import Darwin
 import JavaScriptCore
 import OSLog
+import Security
 import SwiftUI
 import UIKit
 
@@ -2461,6 +2463,89 @@ final class CraftNativeScreenController: UIViewController, UIScrollViewDelegate,
         jsContext.setObject(snapshotSet, forKeyedSubscript: "craftNativeSnapshotSet" as NSString)
         jsContext.setObject(secureGet, forKeyedSubscript: "craftNativeSecureGet" as NSString)
         jsContext.setObject(setOptions, forKeyedSubscript: "craftNativeSetOptions" as NSString)
+        // `crypto` for code shared with the page (a sign-in's nonce and its
+        // SHA-256): JavaScriptCore has none. Random bytes from the system's
+        // generator, digests from CryptoKit, both as hex.
+        let randomBytes: @convention(block) (Int) -> String? = { count in
+            guard count >= 0, count <= 65_536 else { return nil }
+            var bytes = [UInt8](repeating: 0, count: count)
+            guard count == 0 || SecRandomCopyBytes(kSecRandomDefault, count, &bytes) == errSecSuccess else { return nil }
+            return bytes.map { String(format: "%02x", $0) }.joined()
+        }
+        let digest: @convention(block) (String, String) -> String? = { algorithm, hex in
+            var data = Data(capacity: hex.count / 2)
+            var index = hex.startIndex
+            while index < hex.endIndex {
+                let next = hex.index(index, offsetBy: 2, limitedBy: hex.endIndex) ?? hex.endIndex
+                guard let byte = UInt8(hex[index..<next], radix: 16) else { return nil }
+                data.append(byte)
+                index = next
+            }
+            let bytes: [UInt8]
+            switch algorithm.uppercased() {
+            case "SHA-1": bytes = Array(Insecure.SHA1.hash(data: data))
+            case "SHA-256": bytes = Array(SHA256.hash(data: data))
+            case "SHA-384": bytes = Array(SHA384.hash(data: data))
+            case "SHA-512": bytes = Array(SHA512.hash(data: data))
+            default: return nil
+            }
+            return bytes.map { String(format: "%02x", $0) }.joined()
+        }
+        jsContext.setObject(randomBytes, forKeyedSubscript: "craftNativeRandomBytes" as NSString)
+        jsContext.setObject(digest, forKeyedSubscript: "craftNativeDigest" as NSString)
+        jsContext.evaluateScript("""
+            (function() {
+                var cryptoObject = globalThis.crypto || {};
+                function hexToBytes(hex) {
+                    var bytes = new Uint8Array(hex.length / 2);
+                    for (var i = 0; i < bytes.length; i++) bytes[i] = parseInt(hex.substr(i * 2, 2), 16);
+                    return bytes;
+                }
+                function toHex(bytes) {
+                    var out = '';
+                    for (var i = 0; i < bytes.length; i++) out += (bytes[i] < 16 ? '0' : '') + bytes[i].toString(16);
+                    return out;
+                }
+                function viewOf(data) {
+                    if (data instanceof ArrayBuffer) return new Uint8Array(data);
+                    if (ArrayBuffer.isView(data)) return new Uint8Array(data.buffer, data.byteOffset, data.byteLength);
+                    throw new TypeError('crypto.subtle.digest needs an ArrayBuffer or a typed array');
+                }
+                if (typeof cryptoObject.getRandomValues !== 'function') {
+                    cryptoObject.getRandomValues = function(array) {
+                        if (!ArrayBuffer.isView(array)) throw new TypeError('crypto.getRandomValues needs a typed array');
+                        var hex = craftNativeRandomBytes(array.byteLength);
+                        if (hex == null) throw new Error('No random bytes from the system');
+                        new Uint8Array(array.buffer, array.byteOffset, array.byteLength).set(hexToBytes(hex));
+                        return array;
+                    };
+                }
+                if (typeof cryptoObject.randomUUID !== 'function') {
+                    cryptoObject.randomUUID = function() {
+                        var b = cryptoObject.getRandomValues(new Uint8Array(16));
+                        b[6] = (b[6] & 0x0f) | 0x40;
+                        b[8] = (b[8] & 0x3f) | 0x80;
+                        var h = toHex(b);
+                        return h.slice(0, 8) + '-' + h.slice(8, 12) + '-' + h.slice(12, 16) + '-' + h.slice(16, 20) + '-' + h.slice(20);
+                    };
+                }
+                if (!cryptoObject.subtle || typeof cryptoObject.subtle.digest !== 'function') {
+                    cryptoObject.subtle = Object.assign(cryptoObject.subtle || {}, {
+                        digest: function(algorithm, data) {
+                            try {
+                                var name = typeof algorithm === 'string' ? algorithm : algorithm && algorithm.name;
+                                var out = craftNativeDigest(String(name || ''), toHex(viewOf(data)));
+                                if (out == null) return Promise.reject(new Error('Unsupported digest: ' + name));
+                                return Promise.resolve(hexToBytes(out).buffer);
+                            } catch (error) {
+                                return Promise.reject(error);
+                            }
+                        }
+                    });
+                }
+                globalThis.crypto = cryptoObject;
+            })();
+        """)
         jsContext.evaluateScript("""
             (function() {
                 function text(value) {

package/templates/CraftNativeUI.swift

@@ -390,6 +390,74 @@ extension CraftBrowser: ASWebAuthenticationPresentationContextProviding {
     }
 }
 
+// MARK: - Sign in with Apple
+
+struct CraftSignInWithAppleError: Error {
+    let code: String
+    let message: String
+}
+
+/// `craft.signInWithApple`: the system's Sign in with Apple sheet, for a page
+/// and for a native screen alike. Answers with Apple's user id, the name and
+/// email when Apple shares them (the first time only), the identity token and
+/// the one-use authorization code a server redeems at Apple. `nonce` is what
+/// the caller wants written into the identity token (its SHA-256, by
+/// convention).
+final class CraftSignInWithApple: NSObject {
+    static let shared = CraftSignInWithApple()
+
+    private var completion: ((Result<[String: Any], CraftSignInWithAppleError>) -> Void)?
+    private var controller: ASAuthorizationController?
+
+    func signIn(nonce: String?, completion: @escaping (Result<[String: Any], CraftSignInWithAppleError>) -> Void) {
+        // One sheet at a time: a second request answers the first.
+        self.completion?(.failure(CraftSignInWithAppleError(code: "CANCELLED", message: "Another sign-in started")))
+        self.completion = completion
+        let request = ASAuthorizationAppleIDProvider().createRequest()
+        request.requestedScopes = [.fullName, .email]
+        if let nonce, !nonce.isEmpty { request.nonce = nonce }
+        let controller = ASAuthorizationController(authorizationRequests: [request])
+        controller.delegate = self
+        controller.presentationContextProvider = self
+        self.controller = controller
+        controller.performRequests()
+    }
+
+    private func finish(_ result: Result<[String: Any], CraftSignInWithAppleError>) {
+        let completion = self.completion
+        self.completion = nil
+        controller = nil
+        completion?(result)
+    }
+}
+
+extension CraftSignInWithApple: ASAuthorizationControllerDelegate, ASAuthorizationControllerPresentationContextProviding {
+    func authorizationController(controller: ASAuthorizationController, didCompleteWithAuthorization authorization: ASAuthorization) {
+        guard let credential = authorization.credential as? ASAuthorizationAppleIDCredential else {
+            finish(.failure(CraftSignInWithAppleError(code: "SIGN_IN_FAILED", message: "Apple answered without an Apple ID")))
+            return
+        }
+        var result: [String: Any] = ["userId": credential.user]
+        if let email = credential.email { result["email"] = email }
+        let name = [credential.fullName?.givenName, credential.fullName?.familyName].compactMap { $0 }.joined(separator: " ")
+        if !name.isEmpty { result["name"] = name }
+        if let token = credential.identityToken.flatMap({ String(data: $0, encoding: .utf8) }) { result["identityToken"] = token }
+        // One use, five minutes: the server redeems it at Apple's token
+        // endpoint and so reads the identity straight from Apple.
+        if let code = credential.authorizationCode.flatMap({ String(data: $0, encoding: .utf8) }) { result["authorizationCode"] = code }
+        finish(.success(result))
+    }
+
+    func authorizationController(controller: ASAuthorizationController, didCompleteWithError error: Error) {
+        let cancelled = (error as? ASAuthorizationError)?.code == .canceled
+        finish(.failure(CraftSignInWithAppleError(code: cancelled ? "CANCELLED" : "SIGN_IN_FAILED", message: error.localizedDescription)))
+    }
+
+    func presentationAnchor(for controller: ASAuthorizationController) -> ASPresentationAnchor {
+        CraftPresenter.keyWindow() ?? ASPresentationAnchor()
+    }
+}
+
 // MARK: - SF Symbols
 
 /// `craft.symbols.image`: an SF Symbol drawn to a PNG data URL, so a page can