@octane-xplat/auth 0.0.0-stage → 0.8.0

package/package.json

@@ -1,6 +1,86 @@
 {
   "name": "@octane-xplat/auth",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.8.0",
+  "description": "Sign in with Apple + Google Sign-In for Octane xplat — native SDKs on iOS/Android, platform web SDKs in the browser",
+  "keywords": [
+    "octane",
+    "xplat",
+    "cross-platform",
+    "auth",
+    "sign-in",
+    "apple",
+    "google",
+    "oauth",
+    "nativescript",
+    "ios",
+    "android",
+    "web"
+  ],
+  "license": "MIT",
+  "homepage": "https://github.com/octane-xplat/octane-xplat/tree/main/packages/auth",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/octane-xplat/octane-xplat.git",
+    "directory": "packages/auth"
+  },
+  "files": [
+    "dist",
+    "types",
+    "src"
+  ],
+  "type": "module",
+  "exports": {
+    ".": {
+      "macos": {
+        "types": "./types/index.macos.d.ts",
+        "default": "./src/index.macos.ts"
+      },
+      "web": {
+        "types": "./types/generated/index.web.d.ts",
+        "default": "./dist/web/index.js"
+      },
+      "native": {
+        "types": "./types/generated/index.d.ts",
+        "default": "./dist/native/index.js"
+      },
+      "types": "./types/generated/index.d.ts",
+      "default": "./dist/native/index.js"
+    }
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@nativescript/apple-sign-in": "2.0.0",
+    "@nativescript/google-signin": "2.1.1"
+  },
+  "devDependencies": {
+    "@nativescript-community/octane": "0.2.4",
+    "@nativescript/core": "9.1.2",
+    "@octanejs/vite-plugin": "0.1.61",
+    "@tsrx/typescript-plugin": "0.4.11",
+    "octane": "0.6.3",
+    "tsrx-typegen": "0.2.0",
+    "typescript": "5.9.3",
+    "vite": "8.3.0"
+  },
+  "peerDependencies": {
+    "@nativescript-community/octane": ">=0.2.1 <1",
+    "@nativescript/core": ">=9.1.0 <10",
+    "octane": ">=0.6.3 <1"
+  },
+  "peerDependenciesMeta": {
+    "@nativescript-community/octane": {
+      "optional": true
+    },
+    "@nativescript/core": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "vite build && vite build --mode native && pnpm typegen && node ../../scripts/check-native-dist.mjs",
+    "test:packed": "node tests/packed-consumer.mjs",
+    "typegen": "tsrx-typegen --target octane",
+    "pack:check": "tsrx-typegen --pack-check"
+  }
 }

package/src/AppleSignInButton.macos.tsrx

@@ -0,0 +1,36 @@
+/** @jsxImportSource @xplat/macos/renderer */
+import { appleAuth } from './apple.macos'
+import type { AppleSignInButtonProps, SignInResult } from './types'
+
+const LABELS = {
+	default: 'Sign in with Apple',
+	signUp: 'Sign up with Apple',
+	continue: 'Continue with Apple',
+} as const
+
+/** Sign in with Apple button — macOS leaf. The AppKit renderer has no
+ *  ASAuthorizationAppleIDButton in its vocabulary, so this is a flexbox row
+ *  with a click-gesture tap (the same shape as Pressable/controls.macos)
+ *  that runs the AuthenticationServices flow and reports through `onResult`.
+ *  onPress on the intrinsic <button> is not used — the universal compile
+ *  emits DOM-only delegateEvents for it. */
+export function AppleSignInButton(props: AppleSignInButtonProps) @{
+	<flexboxlayout
+		id={props.id}
+		className={['vx-button', props.className]}
+		style={props.style}
+		accessibilityLabel={LABELS[props.type ?? 'default']}
+		onTap={
+			props.disabled === true
+				? undefined
+				: () => {
+						props.onPress?.()
+						if (props.onResult) {
+							void appleAuth.signIn().then((result: SignInResult) => props.onResult?.(result))
+						}
+					}
+		}
+	>
+		<label text={LABELS[props.type ?? 'default']} />
+	</flexboxlayout>
+}

package/src/AppleSignInButton.tsrx

@@ -0,0 +1,46 @@
+/** @jsxImportSource @nativescript-community/octane */
+import { registerElement } from '@nativescript-community/octane';
+import * as applePlugin from '@nativescript/apple-sign-in';
+import { appleAuth } from './apple';
+import type { AppleSignInButtonProps, SignInResult } from './types';
+
+// The plugin's SignInButton wraps ASAuthorizationAppleIDButton — iOS only
+// (the class is absent from the plugin's Android module), so register it
+// conditionally and fall back to a plain button everywhere else.
+const PluginButton = (applePlugin as any).SignInButton;
+if (PluginButton) {
+	registerElement('applesigninbutton', PluginButton);
+}
+
+/** Sign in with Apple button — the platform-authentic
+ *  ASAuthorizationAppleIDButton on iOS, a plain fallback button elsewhere.
+ *  A tap starts `appleAuth.signIn()`; `onResult` reports the outcome. */
+export function AppleSignInButton(props: AppleSignInButtonProps) @{
+	const run = () => {
+		props.onPress?.();
+		if (props.onResult) {
+			appleAuth.signIn().then((result: SignInResult) => props.onResult?.(result));
+		}
+	};
+
+	@if (PluginButton && appleAuth.supported) {
+		<applesigninbutton
+			id={props.id}
+			className={props.className}
+			style={props.style}
+			type={props.type ?? 'default'}
+			buttonStyle={props.theme ?? 'black'}
+			isEnabled={props.disabled !== true}
+			onTap={run}
+		/>
+	} @else {
+		<button
+			id={props.id}
+			className={props.className}
+			style={props.style}
+			text={props.type === 'signUp' ? 'Sign up with Apple' : props.type === 'continue' ? 'Continue with Apple' : 'Sign in with Apple'}
+			isEnabled={props.disabled !== true}
+			onTap={run}
+		/>
+	}
+}

package/src/AppleSignInButton.web.tsrx

@@ -0,0 +1,54 @@
+import { appleAuth } from './apple.web';
+import type { AppleSignInButtonProps, SignInResult } from './types';
+
+const LABELS = {
+	default: 'Sign in with Apple',
+	signUp: 'Sign up with Apple',
+	continue: 'Continue with Apple',
+} as const;
+
+const THEMES = {
+	black: { background: '#000', color: '#fff', border: '1px solid #000' },
+	white: { background: '#fff', color: '#000', border: '1px solid #fff' },
+	whiteOutline: { background: '#fff', color: '#000', border: '1px solid #000' },
+} as const;
+
+/** Sign in with Apple button — web leaf. Apple's JS API renders official
+ *  markup only through its own stylesheet hooks, so this is a styled fallback
+ *  matching Apple's published button spec; the click runs the popup flow via
+ *  `appleAuth.signIn()` and reports through `onResult`. */
+export function AppleSignInButton(props: AppleSignInButtonProps) @{
+	const theme = THEMES[props.theme ?? 'black'];
+
+	<button
+		type="button"
+		id={props.id}
+		className={props.className}
+		disabled={props.disabled}
+		style={{
+			display: 'inline-flex',
+			alignItems: 'center',
+			justifyContent: 'center',
+			gap: 6,
+			minHeight: 40,
+			padding: '0 16px',
+			borderRadius: 6,
+			fontFamily: "-apple-system, 'Helvetica Neue', Helvetica, Arial, sans-serif",
+			fontSize: 15,
+			cursor: props.disabled ? 'default' : 'pointer',
+			...theme,
+			...props.style,
+		}}
+		onClick={() => {
+			props.onPress?.();
+			if (props.onResult) {
+				void appleAuth.signIn().then((result: SignInResult) => props.onResult?.(result));
+			}
+		}}
+	>
+		<svg width="15" height="18" viewBox="0 0 24 24" fill="currentColor" aria-hidden="true">
+			<path d="M15.53 3.83c.843-1.012 1.4-2.427 1.245-3.83-1.207.052-2.662.805-3.532 1.818-.78.896-1.454 2.338-1.273 3.714 1.338.104 2.715-.688 3.559-1.701M12.152 6.896c-.948 0-2.415-1.078-3.96-1.04-2.04.027-3.91 1.183-4.961 3.014-2.117 3.675-.546 9.103 1.519 12.09 1.013 1.454 2.208 3.09 3.792 3.039 1.52-.065 2.09-.987 3.935-.987 1.831 0 2.35.987 3.96.948 1.637-.026 2.676-1.48 3.676-2.948 1.156-1.688 1.636-3.325 1.662-3.415-.039-.013-3.182-1.221-3.22-4.857-.026-3.04 2.48-4.494 2.597-4.559-1.429-2.09-3.623-2.324-4.39-2.376-2-.156-3.675 1.09-4.61 1.09z" />
+		</svg>
+		{LABELS[props.type ?? 'default']}
+	</button>
+}

package/src/GoogleSignInButton.macos.tsrx

@@ -0,0 +1,7 @@
+/** @jsxImportSource @xplat/macos/renderer */
+import type { GoogleSignInButtonProps } from './types'
+
+/** Explicit placeholder — the AppKit host has no Google sign-in button. */
+export function GoogleSignInButton(_props: GoogleSignInButtonProps) @{
+	<label className="vx-unsupported">Google Sign-In is unsupported by the AppKit host</label>
+}

package/src/GoogleSignInButton.tsrx

@@ -0,0 +1,31 @@
+/** @jsxImportSource @nativescript-community/octane */
+import { registerElement } from '@nativescript-community/octane';
+import { GoogleSignInButton as NSGoogleSignInButton } from '@nativescript/google-signin';
+import { googleAuth } from './google';
+import type { GoogleSignInButtonProps, SignInResult } from './types';
+
+// GIDSignInButton (iOS) / the plugin's Google button (Android). The plugin
+// emits the standard `tap` event — the driver's onTap alias wires it.
+registerElement('googlesigninbutton', NSGoogleSignInButton);
+
+/** Google Sign-In button — the provider's button view on iOS/Android. A tap
+ *  starts `googleAuth.signIn()`; `onResult` reports the outcome. Requires a
+ *  `googleAuth.configure()` call first where the platform needs it. */
+export function GoogleSignInButton(props: GoogleSignInButtonProps) @{
+	const run = () => {
+		props.onPress?.();
+		if (props.onResult) {
+			googleAuth.signIn().then((result: SignInResult) => props.onResult?.(result));
+		}
+	};
+
+	<googlesigninbutton
+		id={props.id}
+		className={props.className}
+		style={props.style}
+		colorScheme={props.theme ?? 'auto'}
+		colorStyle={props.variant ?? 'standard'}
+		isEnabled={props.disabled !== true}
+		onTap={run}
+	/>
+}

package/src/GoogleSignInButton.web.tsrx

@@ -0,0 +1,23 @@
+import { renderGoogleButton } from './google.web';
+import type { GoogleSignInButtonProps, SignInResult } from './types';
+
+/** Google Sign-In button — web leaf. Renders the official GIS button via
+ *  `renderButton` when a `clientId` is configured; without one it falls back
+ *  to a plain button that runs `googleAuth.signIn()` (One Tap). `onResult`
+ *  reports the outcome either way. */
+export function GoogleSignInButton(props: GoogleSignInButtonProps) @{
+	<div
+		id={props.id}
+		className={props.className}
+		style={props.style}
+		ref={(el: HTMLElement | null) => {
+			if (el && !props.disabled) {
+				void renderGoogleButton(
+					el,
+					{ theme: props.theme, variant: props.variant },
+					(result: SignInResult) => props.onResult?.(result),
+				);
+			}
+		}}
+	/>
+}

package/src/apple.macos.ts

@@ -0,0 +1,277 @@
+// Sign in with Apple — macOS leaf over AuthenticationServices via the
+// appkit-node-api ObjC bridge (the same framework the iOS plugin wraps,
+// available since macOS 10.15). The `com.apple.developer.applesignin`
+// entitlement must sit on the packaged app for the sheet to present;
+// hosts without it still load the framework and surface the OS error.
+import type {
+	AppleAuth,
+	AppleAuthConfig,
+	AppleCredentialState,
+	AppleSignInOptions,
+	AuthCredential,
+	SignInResult,
+} from './types'
+
+declare const ASAuthorizationAppleIDProvider: any
+declare const ASAuthorizationController: any
+declare const ASAuthorizationControllerDelegate: any
+declare const ASAuthorizationControllerPresentationContextProviding: any
+declare const ASAuthorizationScopeEmail: any
+declare const ASAuthorizationScopeFullName: any
+declare const NSApplication: any
+declare const NSString: any
+declare const NSObject: any
+declare const interop: any
+declare const objc: any
+
+// Import before the NSObject.extend classes below are built — their
+// protocol/exposed-method constants resolve at extend() time, so the
+// framework's metadata has to be loaded first.
+try {
+	objc.import('AuthenticationServices')
+} catch {
+	// Symbols may already be bound — failures surface via `supported: false`.
+}
+
+const SCOPE_MAP: Record<string, () => any> = {
+	email: () => ASAuthorizationScopeEmail,
+	name: () => ASAuthorizationScopeFullName,
+}
+
+function isCancel(error: unknown): boolean {
+	// ASAuthorizationError.canceled = 1001 (NSError.code).
+	return (error as any)?.code === 1001 || /cancel/i.test(String((error as any)?.localizedDescription ?? error))
+}
+
+function utf8Bytes(input: string): Uint8Array {
+	const data = NSString.stringWithString(input).dataUsingEncoding(4 /* NSUTF8StringEncoding */)
+	return new Uint8Array(interop.bufferFromData(data))
+}
+
+// FIPS 180-4 — the request nonce must be the hex SHA-256 of the app's nonce
+// (same transform the iOS plugin applies via CommonCrypto, which has no
+// node-api metadata). Kept local to stay dependency-free.
+function sha256Hex(input: string): string {
+	const K = new Uint32Array([
+		0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,
+		0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,
+		0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,
+		0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,
+		0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,
+		0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,
+		0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+		0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
+	])
+
+	const H = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19])
+	const bytes = utf8Bytes(input)
+	const bitLen = bytes.length * 8
+	const padded = new Uint8Array((bytes.length + 9 + 63) & ~63)
+	padded.set(bytes)
+	padded[bytes.length] = 0x80
+	const dv = new DataView(padded.buffer)
+	dv.setUint32(padded.length - 8, Math.floor(bitLen / 0x100000000))
+	dv.setUint32(padded.length - 4, bitLen >>> 0)
+	const w = new Uint32Array(64)
+	for (let block = 0; block < padded.length; block += 64) {
+		for (let t = 0; t < 16; t++) {w[t] = dv.getUint32(block + t * 4)}
+		for (let t = 16; t < 64; t++) {
+			const s0 = (w[t - 15] >>> 7 | w[t - 15] << 25) ^ (w[t - 15] >>> 18 | w[t - 15] << 14) ^ (w[t - 15] >>> 3)
+			const s1 = (w[t - 2] >>> 17 | w[t - 2] << 15) ^ (w[t - 2] >>> 19 | w[t - 2] << 13) ^ (w[t - 2] >>> 10)
+			w[t] = (w[t - 16] + s0 + w[t - 7] + s1) >>> 0
+		}
+
+		let [a, b, c, d, e, f, g, h] = H
+		for (let t = 0; t < 64; t++) {
+			const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7)
+			const t1 = (h + S1 + ((e & f) ^ (~e & g)) + K[t] + w[t]) >>> 0
+			const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10)
+			const t2 = (S0 + ((a & b) ^ (a & c) ^ (b & c))) >>> 0
+			h = g; g = f; f = e; e = (d + t1) >>> 0
+			d = c; c = b; b = a; a = (t1 + t2) >>> 0
+		}
+
+		H[0] = (H[0] + a) >>> 0; H[1] = (H[1] + b) >>> 0; H[2] = (H[2] + c) >>> 0; H[3] = (H[3] + d) >>> 0
+		H[4] = (H[4] + e) >>> 0; H[5] = (H[5] + f) >>> 0; H[6] = (H[6] + g) >>> 0; H[7] = (H[7] + h) >>> 0
+	}
+
+	return [...H].map((x) => x.toString(16).padStart(8, '0')).join('')
+}
+
+function toCredential(credential: any): AuthCredential {
+	const tokenData = credential.valueForKey('identityToken')
+	const codeData = credential.valueForKey('authorizationCode')
+	const fullName = credential.fullName
+	const name =
+		[fullName?.givenName, fullName?.familyName].filter(Boolean).join(' ') || undefined
+
+	return {
+		provider: 'apple',
+		idToken: tokenData ? String(NSString.alloc().initWithDataEncoding(tokenData, 4)) : undefined,
+		authorizationCode: codeData ? String(NSString.alloc().initWithDataEncoding(codeData, 4)) : undefined,
+		scopes: (credential.authorizedScopes ? Array.from(credential.authorizedScopes as any) : []).map((s: any) =>
+			s === ASAuthorizationScopeEmail ? 'email' : s === ASAuthorizationScopeFullName ? 'name' : String(s),
+		),
+		user: {
+			id: String(credential.user ?? ''),
+			email: credential.email ? String(credential.email) : undefined,
+			name,
+			givenName: fullName?.givenName ? String(fullName.givenName) : undefined,
+			familyName: fullName?.familyName ? String(fullName.familyName) : undefined,
+		},
+	}
+}
+
+let frameworkReady: boolean | null = null
+
+function frameworkAvailable(): boolean {
+	if (frameworkReady !== null) {
+		return frameworkReady
+	}
+
+	try {
+		objc.import('AuthenticationServices')
+	} catch {
+		// The framework ships in every macOS ≥ 10.15 SDK — a failed import just
+		// means the symbols still resolve lazily below.
+	}
+
+	frameworkReady = typeof ASAuthorizationAppleIDProvider !== 'undefined'
+	return frameworkReady
+}
+
+// NSObject.extend is the registration shape this node-api runtime binds
+// (class syntax + NativeClass registers the class but not the methods —
+// verified by probe: respondsToSelector is only true for .extend). Classes
+// are built lazily so the protocol constants resolve after import.
+let AppleAuthDelegate: any = null
+let AppleAuthAnchor: any = null
+
+function ensureClasses() {
+	if (AppleAuthDelegate !== null) {
+		return
+	}
+
+	AppleAuthDelegate = NSObject.extend(
+		{
+			authorizationControllerDidCompleteWithAuthorization(_controller: any, authorization: any) {
+				const finish = activeFinish
+				activeFinish = null
+				finish?.({ status: 'success', credential: toCredential(authorization.credential) })
+			},
+			authorizationControllerDidCompleteWithError(_controller: any, error: any) {
+				const finish = activeFinish
+				activeFinish = null
+				finish?.(
+					isCancel(error)
+						? { status: 'cancelled' }
+						: { status: 'error', message: String((error as any)?.localizedDescription ?? error) },
+				)
+			},
+		},
+		{
+			protocols: [ASAuthorizationControllerDelegate],
+			exposedMethods: {
+				'authorizationController:didCompleteWithAuthorization:': {
+					params: [interop.types.id, interop.types.id],
+					returns: interop.types.void,
+				},
+				'authorizationController:didCompleteWithError:': {
+					params: [interop.types.id, interop.types.id],
+					returns: interop.types.void,
+				},
+			},
+		},
+	)
+
+	AppleAuthAnchor = NSObject.extend(
+		{
+			presentationAnchorForAuthorizationController(_controller: any): any {
+				const app = NSApplication.sharedApplication
+				return app.keyWindow ?? app.mainWindow ?? app.windows?.firstObject
+			},
+		},
+		{
+			protocols: [ASAuthorizationControllerPresentationContextProviding],
+			exposedMethods: {
+				'presentationAnchorForAuthorizationController:': {
+					params: [interop.types.id],
+					returns: interop.types.id,
+				},
+			},
+		},
+	)
+}
+
+// Retain the ObjC objects + resolver for the ceremony's lifetime — the
+// bridge sees no JS-side reference after signIn returns.
+let activeController: any = null
+let activeDelegate: any = null
+let activeAnchor: any = null
+let activeFinish: ((result: SignInResult) => void) | null = null
+
+export const appleAuth: AppleAuth = {
+	get supported() {
+		return frameworkAvailable()
+	},
+	configure(_config: AppleAuthConfig) {
+		// No native configuration — the flow is bound to the app id entitlement.
+	},
+	async signIn(options?: AppleSignInOptions): Promise<SignInResult> {
+		if (!frameworkAvailable()) {
+			return { status: 'error', message: 'AuthenticationServices is unavailable on this host' }
+		}
+
+		if (activeController) {
+			return { status: 'error', message: 'a Sign in with Apple flow is already active' }
+		}
+
+		return new Promise<SignInResult>((resolve) => {
+			const finish = (result: SignInResult) => {
+				activeController = null
+				activeDelegate = null
+				activeAnchor = null
+				activeFinish = null
+				resolve(result)
+			}
+
+			ensureClasses()
+			activeDelegate = AppleAuthDelegate.new()
+			activeFinish = finish
+			const provider = ASAuthorizationAppleIDProvider.new()
+			const request = provider.createRequest()
+			if (options?.scopes?.length) {
+				request.requestedScopes = options.scopes.map((s) => SCOPE_MAP[s]?.()).filter(Boolean)
+			}
+
+			if (options?.nonce !== undefined) {
+				request.nonce = sha256Hex(options.nonce)
+			}
+
+			activeAnchor = AppleAuthAnchor.new()
+			activeController = ASAuthorizationController.alloc().initWithAuthorizationRequests([request])
+			activeController.delegate = activeDelegate
+			activeController.presentationContextProvider = activeAnchor
+			activeController.performRequests()
+		})
+	},
+	async getCredentialState(userId: string): Promise<AppleCredentialState> {
+		if (!frameworkAvailable()) {
+			return 'unknown'
+		}
+
+		return new Promise<AppleCredentialState>((resolve) => {
+			ASAuthorizationAppleIDProvider.new().getCredentialStateForUserIDCompletion(
+				userId,
+				(state: number, error: any) => {
+					if (error) {
+						resolve('unknown')
+						return
+					}
+
+					resolve(state === 1 ? 'authorized' : state === 0 ? 'revoked' : state === 3 ? 'transferred' : 'notFound')
+				},
+			)
+		})
+	},
+}

package/src/apple.ts

@@ -0,0 +1,95 @@
+// Sign in with Apple — native leaf over @nativescript/apple-sign-in.
+// iOS runs ASAuthorizationAppleIDProvider directly (entitlement-driven, no
+// configure step); the plugin's Android module is a stub that reports
+// unsupported, which this leaf surfaces as `supported: false` + an error
+// result rather than a throw.
+import { SignIn } from '@nativescript/apple-sign-in'
+import type {
+	AppleAuth,
+	AppleAuthConfig,
+	AppleCredentialState,
+	AppleSignInOptions,
+	AuthCredential,
+	SignInResult,
+} from './types'
+
+function isCancel(error: unknown): boolean {
+	// ASAuthorizationErrorCanceled = 1001 (NSError.code via SignInError.native).
+	const code = (error as any)?.native?.code ?? (error as any)?.code
+	if (code === 1001) {
+		return true
+	}
+
+	return /cancel/i.test(String((error as any)?.message ?? error))
+}
+
+function toCredential(user: any): AuthCredential {
+	const fullName = user.fullName
+	const name = [fullName?.givenName, fullName?.familyName].filter(Boolean).join(' ') || undefined
+	return {
+		provider: 'apple',
+		idToken: user.identityToken ?? undefined,
+		authorizationCode: user.authorizationCode ?? undefined,
+		scopes: (user.authorizedScopes ?? []).map((s: string) =>
+			s === 'EMAIL' ? 'email' : s === 'FULL_NAME' ? 'name' : s,
+		),
+		user: {
+			id: user.user,
+			email: user.email ?? undefined,
+			name,
+			givenName: fullName?.givenName ?? undefined,
+			familyName: fullName?.familyName ?? undefined,
+		},
+	}
+}
+
+export const appleAuth: AppleAuth = {
+	supported: SignIn.isSupported(),
+	configure(_config: AppleAuthConfig) {
+		// No native configuration — the flow is bound to the app id entitlement.
+	},
+	async signIn(options?: AppleSignInOptions): Promise<SignInResult> {
+		if (!SignIn.isSupported()) {
+			return {
+				status: 'error',
+				message: 'Sign in with Apple needs iOS 13+ (unsupported on Android)',
+			}
+		}
+
+		try {
+			const user = await SignIn.signIn({
+				// The plugin SHA-256s `nonce` before binding it into the request.
+				scopes: options?.scopes?.map((s) => (s === 'email' ? 'EMAIL' : 'FULL_NAME')) as any,
+				useNonce: options?.nonce !== undefined,
+				nonce: options?.nonce,
+			})
+
+			return { status: 'success', credential: toCredential(user) }
+		} catch (error) {
+			return isCancel(error)
+				? { status: 'cancelled' }
+				: { status: 'error', message: String((error as any)?.message ?? error) }
+		}
+	},
+	async getCredentialState(userId: string): Promise<AppleCredentialState> {
+		if (!SignIn.isSupported()) {
+			return 'unknown'
+		}
+
+		try {
+			const state = await SignIn.getState(userId)
+			switch (state) {
+				case 'Authorized':
+					return 'authorized'
+				case 'Revoked':
+					return 'revoked'
+				case 'Transferred':
+					return 'transferred'
+				default:
+					return 'notFound'
+			}
+		} catch {
+			return 'unknown'
+		}
+	},
+}