@octane-xplat/auth 0.8.0 → 0.10.0

package/README.md

@@ -0,0 +1,73 @@
+# `@octane-xplat/auth`
+
+```sh
+pnpm add @octane-xplat/auth
+```
+
+Sign in with Apple and Google Sign-In for Octane xplat apps — the native
+SDKs (`@nativescript/apple-sign-in`, `@nativescript/google-signin`) on
+iOS/Android, the providers' web SDKs (Apple JS / Google Identity Services)
+in the browser, and AuthenticationServices through the ObjC bridge plus a
+app-configured hosted Google flow on the macOS AppKit host. One `AuthUser`/`AuthCredential`
+contract everywhere.
+
+```ts
+import { appleAuth } from '@octane-xplat/auth'
+
+appleAuth.configure({ clientId: 'com.example.app.web' })
+if (appleAuth.supported) {
+	const result = await appleAuth.signIn({ scopes: ['email', 'name'] })
+	if (result.status === 'success') {
+		// Send this credential to your backend for verification.
+		const { idToken, user } = result.credential
+	}
+}
+```
+
+Each provider object reports `supported` — Apple is `false` on Android —
+and exposes `configure`, `signIn`, and provider extras
+(`appleAuth.getCredentialState`, `googleAuth.signOut`). `SignInResult`
+distinguishes `success` / `cancelled` / `error`; a dismissed sheet is
+`cancelled`, not a throw. Apple uses the official ASAuthorizationAppleIDButton on AppKit; Google
+uses a text trigger for the hosted flow there. The other sign-in buttons are
+platform-authentic components, so render them from platform-suffixed files or accept each
+target's native styling.
+
+The following component belongs in an `.ios.tsx` file.
+
+```tsx
+import { AppleSignInButton, appleAuth, googleAuth } from '@octane-xplat/auth'
+
+export function SignIn() {
+	return (
+		<AppleSignInButton
+			onResult={(result) => {
+				if (result.status === 'success') {
+					void appleAuth.getCredentialState(result.credential.user.id)
+				}
+			}}
+		/>
+	)
+}
+// When ending a Google session:
+await googleAuth.signOut()
+```
+
+Web needs registered client IDs; iOS needs the `applesignin` entitlement
+and Google's `GoogleService-Info.plist`/reversed-client-id URL scheme;
+Android needs `google-services.json` and a `serverClientId` for
+`serverAuthCode`. Guide: [Using device
+features](../../docs/platform/platform-services.md). Exercised by
+[`AuthDemo`](../demos/src/AuthDemo.tsrx).
+
+On macOS, `supported` reports AuthenticationServices availability, not completed
+provider registration. Apple needs a signed app ID with Sign in with Apple
+enabled and a matching provisioning profile and entitlement. Google needs
+`googleAuth.configure({ hostedFlow })`, where `createRequest` starts a fresh
+backend attempt and `complete` validates/redeems the captured callback on that
+backend, returning `AuthCredential`. A client ID alone is insufficient on
+AppKit. The adapter receives the configured client IDs, scopes, hosted domain,
+and per-attempt nonce; the backend must apply and verify them.
+
+See [macOS provider setup](../../docs/platform/platform-services.md#macos-provider-sign-in)
+and the [maintained hosted adapter](../../examples/auth/google-hosted.macos.ts).

package/dist/native/octane-client-build.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "buildId": "b22aa5b8-e210-4f27-babd-a9c30bb0a8dd",
+  "buildId": "fc764ad7-51bc-48e0-b465-8a53d74ea14e",
   "mode": "production",
   "capabilities": {
     "independentHydration": false

package/dist/web/octane-client-build.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "buildId": "321142a6-1005-48c0-850a-256122cdddf2",
+  "buildId": "500fb75c-1e7a-46fe-8b9a-4a439f2dfd7e",
   "mode": "production",
   "capabilities": {
     "independentHydration": false

package/package.json

@@ -1,26 +1,26 @@
 {
   "name": "@octane-xplat/auth",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Sign in with Apple + Google Sign-In for Octane xplat — native SDKs on iOS/Android, platform web SDKs in the browser",
   "keywords": [
-    "octane",
-    "xplat",
-    "cross-platform",
-    "auth",
-    "sign-in",
+    "android",
     "apple",
+    "auth",
+    "cross-platform",
     "google",
-    "oauth",
-    "nativescript",
     "ios",
-    "android",
-    "web"
+    "nativescript",
+    "oauth",
+    "octane",
+    "sign-in",
+    "web",
+    "xplat"
   ],
-  "license": "MIT",
   "homepage": "https://github.com/octane-xplat/octane-xplat/tree/main/packages/auth",
+  "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/octane-xplat/octane-xplat.git",
+    "url": "https://github.com/octane-xplat/octane-xplat",
     "directory": "packages/auth"
   },
   "files": [
@@ -52,15 +52,17 @@
   },
   "dependencies": {
     "@nativescript/apple-sign-in": "2.0.0",
-    "@nativescript/google-signin": "2.1.1"
+    "@nativescript/google-signin": "2.1.1",
+    "@octane-xplat/platform": "0.10.0"
   },
   "devDependencies": {
     "@nativescript-community/octane": "0.2.4",
     "@nativescript/core": "9.1.2",
+    "@octane-xplat/macos-renderer": "0.10.0",
     "@octanejs/vite-plugin": "0.1.61",
     "@tsrx/typescript-plugin": "0.4.11",
     "octane": "0.6.3",
-    "tsrx-typegen": "0.2.0",
+    "tsrx-typegen": "0.2.2",
     "typescript": "5.9.3",
     "vite": "8.3.0"
   },
@@ -81,6 +83,8 @@
     "build": "vite build && vite build --mode native && pnpm typegen && node ../../scripts/check-native-dist.mjs",
     "test:packed": "node tests/packed-consumer.mjs",
     "typegen": "tsrx-typegen --target octane",
-    "pack:check": "tsrx-typegen --pack-check"
+    "pack:check": "tsrx-typegen --pack-check",
+    "test": "node --test tests/*.test.mjs",
+    "typecheck:macos": "tsrx-tsc --noEmit -p tsconfig.macos.json"
   }
 }

package/src/AppleSignInButton.macos.tsrx

@@ -1,36 +1,34 @@
-/** @jsxImportSource @xplat/macos/renderer */
+/** @jsxImportSource @octane-xplat/macos-renderer */
+import { useEffect, useRef } from 'octane'
 import { appleAuth } from './apple.macos'
-import type { AppleSignInButtonProps, SignInResult } from './types'
+import { attachAppleButton } from './apple-button.macos'
+import type { AppleSignInButtonProps } from './types'
 
-const LABELS = {
-	default: 'Sign in with Apple',
-	signUp: 'Sign up with Apple',
-	continue: 'Continue with Apple',
-} as const
-
-/** Sign in with Apple button — macOS leaf. The AppKit renderer has no
- *  ASAuthorizationAppleIDButton in its vocabulary, so this is a flexbox row
- *  with a click-gesture tap (the same shape as Pressable/controls.macos)
- *  that runs the AuthenticationServices flow and reports through `onResult`.
- *  onPress on the intrinsic <button> is not used — the universal compile
- *  emits DOM-only delegateEvents for it. */
+/** Official ASAuthorizationAppleIDButton, embedded in the leaf's host view. */
 export function AppleSignInButton(props: AppleSignInButtonProps) @{
+	const anchor = useRef<any>(null)
+	const handle = useRef<ReturnType<typeof attachAppleButton> | null>(null)
+	const current = useRef(props)
+	current.current = props
+
+	useEffect(() => {
+		if (!anchor.current) return
+		handle.current = attachAppleButton(anchor.current, current.current, () => {
+			const latest = current.current
+			if (latest.disabled) return
+			latest.onPress?.()
+			void appleAuth.signIn().then((result) => current.current.onResult?.(result))
+		})
+
+		return () => { handle.current?.detach(); handle.current = null }
+	}, [props.type, props.theme])
+
+	useEffect(() => { handle.current?.update(!!props.disabled) })
+
 	<flexboxlayout
+		ref={(view: any) => { anchor.current = view }}
 		id={props.id}
-		className={['vx-button', props.className]}
-		style={props.style}
-		accessibilityLabel={LABELS[props.type ?? 'default']}
-		onTap={
-			props.disabled === true
-				? undefined
-				: () => {
-						props.onPress?.()
-						if (props.onResult) {
-							void appleAuth.signIn().then((result: SignInResult) => props.onResult?.(result))
-						}
-					}
-		}
-	>
-		<label text={LABELS[props.type ?? 'default']} />
-	</flexboxlayout>
+		className={props.className}
+		style={{ width: 240, height: 44, ...props.style }}
+	/>;
 }

package/src/GoogleSignInButton.macos.tsrx

@@ -1,7 +1,21 @@
-/** @jsxImportSource @xplat/macos/renderer */
+/** @jsxImportSource @octane-xplat/macos-renderer */
+import { googleAuth } from './google.macos'
 import type { GoogleSignInButtonProps } from './types'
 
-/** Explicit placeholder — the AppKit host has no Google sign-in button. */
-export function GoogleSignInButton(_props: GoogleSignInButtonProps) @{
-	<label className="vx-unsupported">Google Sign-In is unsupported by the AppKit host</label>
+/** Hosted Google sign-in trigger; Google does not provide an AppKit button. */
+export function GoogleSignInButton(props: GoogleSignInButtonProps) @{
+	<flexboxlayout
+		id={props.id}
+		className={['vx-button', props.className]}
+		style={props.style}
+		accessibilityRole="button"
+		accessibilityLabel="Sign in with Google"
+		accessibilityState={{ disabled: !!props.disabled }}
+		onTap={props.disabled ? undefined : () => {
+			props.onPress?.()
+			void googleAuth.signIn().then((result) => props.onResult?.(result))
+		}}
+	>
+		<label text="Sign in with Google" />
+	</flexboxlayout>;
 }

package/src/apple-button.macos.ts

@@ -0,0 +1,75 @@
+// Leaf-owned attachment: no renderer vocabulary or shared host change needed.
+import type { AppleSignInButtonProps } from './types'
+
+declare const objc: any
+declare const NSObject: any
+declare const interop: any
+declare const ASAuthorizationAppleIDButton: any
+
+let ActionTarget: any
+
+export function attachAppleButton(view: any, props: AppleSignInButtonProps, press: () => void) {
+	try {
+		objc.import('AuthenticationServices')
+	} catch {}
+
+	if (typeof ASAuthorizationAppleIDButton === 'undefined') {
+		throw new Error('The official Sign in with Apple button is unavailable on this host')
+	}
+
+	if (!ActionTarget) {
+		ActionTarget = NSObject.extend(
+			{
+				press(this: any, _sender: any) {
+					this.callback?.()
+				},
+			},
+			{ exposedMethods: { 'press:': { params: [interop.types.id], returns: interop.types.void } } },
+		)
+	}
+
+	const target = ActionTarget.new()
+	target.callback = press
+	// Values from ASAuthorizationAppleIDButton.h (macOS 10.15+).
+	const type = props.type === 'continue' ? 1 : props.type === 'signUp' ? 2 : 0
+	const theme = props.theme === 'white' ? 0 : props.theme === 'whiteOutline' ? 1 : 2
+	const button =
+		ASAuthorizationAppleIDButton.alloc().initWithAuthorizationButtonTypeAuthorizationButtonStyle(
+			type,
+			theme,
+		)
+
+	button.target = target
+	button.action = 'press:'
+	button.enabled = !props.disabled
+	button.translatesAutoresizingMaskIntoConstraints = false
+	view.addSubview(button)
+	const constraints = [
+		button.leadingAnchor.constraintEqualToAnchor(view.leadingAnchor),
+		button.trailingAnchor.constraintEqualToAnchor(view.trailingAnchor),
+		button.topAnchor.constraintEqualToAnchor(view.topAnchor),
+		button.bottomAnchor.constraintEqualToAnchor(view.bottomAnchor),
+	]
+
+	for (const constraint of constraints) {
+		constraint.active = true
+	}
+
+	return {
+		// Target is weak in AppKit: retain its wrapper with the attachment handle.
+		target,
+		button,
+		update(disabled: boolean) {
+			button.enabled = !disabled
+		},
+		detach() {
+			target.callback = null
+			button.target = null
+			for (const constraint of constraints) {
+				constraint.active = false
+			}
+
+			button.removeFromSuperview()
+		},
+	}
+}

package/src/apple.macos.ts

@@ -40,7 +40,10 @@ const SCOPE_MAP: Record<string, () => any> = {
 
 function isCancel(error: unknown): boolean {
 	// ASAuthorizationError.canceled = 1001 (NSError.code).
-	return (error as any)?.code === 1001 || /cancel/i.test(String((error as any)?.localizedDescription ?? error))
+	return (
+		(error as any)?.domain === 'com.apple.AuthenticationServices.AuthorizationError' &&
+		Number((error as any)?.code) === 1001
+	)
 }
 
 function utf8Bytes(input: string): Uint8Array {
@@ -63,7 +66,10 @@ function sha256Hex(input: string): string {
 		0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,
 	])
 
-	const H = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19])
+	const H = new Uint32Array([
+		0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19,
+	])
+
 	const bytes = utf8Bytes(input)
 	const bitLen = bytes.length * 8
 	const padded = new Uint8Array((bytes.length + 9 + 63) & ~63)
@@ -74,25 +80,48 @@ function sha256Hex(input: string): string {
 	dv.setUint32(padded.length - 4, bitLen >>> 0)
 	const w = new Uint32Array(64)
 	for (let block = 0; block < padded.length; block += 64) {
-		for (let t = 0; t < 16; t++) {w[t] = dv.getUint32(block + t * 4)}
+		for (let t = 0; t < 16; t++) {
+			w[t] = dv.getUint32(block + t * 4)
+		}
+
 		for (let t = 16; t < 64; t++) {
-			const s0 = (w[t - 15] >>> 7 | w[t - 15] << 25) ^ (w[t - 15] >>> 18 | w[t - 15] << 14) ^ (w[t - 15] >>> 3)
-			const s1 = (w[t - 2] >>> 17 | w[t - 2] << 15) ^ (w[t - 2] >>> 19 | w[t - 2] << 13) ^ (w[t - 2] >>> 10)
+			const s0 =
+				((w[t - 15] >>> 7) | (w[t - 15] << 25)) ^
+				((w[t - 15] >>> 18) | (w[t - 15] << 14)) ^
+				(w[t - 15] >>> 3)
+
+			const s1 =
+				((w[t - 2] >>> 17) | (w[t - 2] << 15)) ^
+				((w[t - 2] >>> 19) | (w[t - 2] << 13)) ^
+				(w[t - 2] >>> 10)
+
 			w[t] = (w[t - 16] + s0 + w[t - 7] + s1) >>> 0
 		}
 
 		let [a, b, c, d, e, f, g, h] = H
 		for (let t = 0; t < 64; t++) {
-			const S1 = (e >>> 6 | e << 26) ^ (e >>> 11 | e << 21) ^ (e >>> 25 | e << 7)
+			const S1 = ((e >>> 6) | (e << 26)) ^ ((e >>> 11) | (e << 21)) ^ ((e >>> 25) | (e << 7))
 			const t1 = (h + S1 + ((e & f) ^ (~e & g)) + K[t] + w[t]) >>> 0
-			const S0 = (a >>> 2 | a << 30) ^ (a >>> 13 | a << 19) ^ (a >>> 22 | a << 10)
+			const S0 = ((a >>> 2) | (a << 30)) ^ ((a >>> 13) | (a << 19)) ^ ((a >>> 22) | (a << 10))
 			const t2 = (S0 + ((a & b) ^ (a & c) ^ (b & c))) >>> 0
-			h = g; g = f; f = e; e = (d + t1) >>> 0
-			d = c; c = b; b = a; a = (t1 + t2) >>> 0
+			h = g
+			g = f
+			f = e
+			e = (d + t1) >>> 0
+			d = c
+			c = b
+			b = a
+			a = (t1 + t2) >>> 0
 		}
 
-		H[0] = (H[0] + a) >>> 0; H[1] = (H[1] + b) >>> 0; H[2] = (H[2] + c) >>> 0; H[3] = (H[3] + d) >>> 0
-		H[4] = (H[4] + e) >>> 0; H[5] = (H[5] + f) >>> 0; H[6] = (H[6] + g) >>> 0; H[7] = (H[7] + h) >>> 0
+		H[0] = (H[0] + a) >>> 0
+		H[1] = (H[1] + b) >>> 0
+		H[2] = (H[2] + c) >>> 0
+		H[3] = (H[3] + d) >>> 0
+		H[4] = (H[4] + e) >>> 0
+		H[5] = (H[5] + f) >>> 0
+		H[6] = (H[6] + g) >>> 0
+		H[7] = (H[7] + h) >>> 0
 	}
 
 	return [...H].map((x) => x.toString(16).padStart(8, '0')).join('')
@@ -102,15 +131,21 @@ function toCredential(credential: any): AuthCredential {
 	const tokenData = credential.valueForKey('identityToken')
 	const codeData = credential.valueForKey('authorizationCode')
 	const fullName = credential.fullName
-	const name =
-		[fullName?.givenName, fullName?.familyName].filter(Boolean).join(' ') || undefined
+	const name = [fullName?.givenName, fullName?.familyName].filter(Boolean).join(' ') || undefined
 
 	return {
 		provider: 'apple',
 		idToken: tokenData ? String(NSString.alloc().initWithDataEncoding(tokenData, 4)) : undefined,
-		authorizationCode: codeData ? String(NSString.alloc().initWithDataEncoding(codeData, 4)) : undefined,
-		scopes: (credential.authorizedScopes ? Array.from(credential.authorizedScopes as any) : []).map((s: any) =>
-			s === ASAuthorizationScopeEmail ? 'email' : s === ASAuthorizationScopeFullName ? 'name' : String(s),
+		authorizationCode: codeData
+			? String(NSString.alloc().initWithDataEncoding(codeData, 4))
+			: undefined,
+		scopes: (credential.authorizedScopes ? Array.from(credential.authorizedScopes as any) : []).map(
+			(s: any) =>
+				s === ASAuthorizationScopeEmail
+					? 'email'
+					: s === ASAuthorizationScopeFullName
+						? 'name'
+						: String(s),
 		),
 		user: {
 			id: String(credential.user ?? ''),
@@ -154,15 +189,24 @@ function ensureClasses() {
 
 	AppleAuthDelegate = NSObject.extend(
 		{
-			authorizationControllerDidCompleteWithAuthorization(_controller: any, authorization: any) {
-				const finish = activeFinish
-				activeFinish = null
-				finish?.({ status: 'success', credential: toCredential(authorization.credential) })
+			authorizationControllerDidCompleteWithAuthorization(
+				this: any,
+				_controller: any,
+				authorization: any,
+			) {
+				try {
+					const credential = toCredential(authorization.credential)
+					if (!credential.user.id || !credential.idToken) {
+						throw new Error('Sign in with Apple returned an incomplete credential')
+					}
+
+					this.finish?.({ status: 'success', credential })
+				} catch (error) {
+					this.finish?.({ status: 'error', message: String((error as any)?.message ?? error) })
+				}
 			},
-			authorizationControllerDidCompleteWithError(_controller: any, error: any) {
-				const finish = activeFinish
-				activeFinish = null
-				finish?.(
+			authorizationControllerDidCompleteWithError(this: any, _controller: any, error: any) {
+				this.finish?.(
 					isCancel(error)
 						? { status: 'cancelled' }
 						: { status: 'error', message: String((error as any)?.localizedDescription ?? error) },
@@ -208,7 +252,7 @@ function ensureClasses() {
 let activeController: any = null
 let activeDelegate: any = null
 let activeAnchor: any = null
-let activeFinish: ((result: SignInResult) => void) | null = null
+let active = false
 
 export const appleAuth: AppleAuth = {
 	get supported() {
@@ -222,37 +266,59 @@ export const appleAuth: AppleAuth = {
 			return { status: 'error', message: 'AuthenticationServices is unavailable on this host' }
 		}
 
-		if (activeController) {
+		if (active) {
 			return { status: 'error', message: 'a Sign in with Apple flow is already active' }
 		}
 
+		active = true
 		return new Promise<SignInResult>((resolve) => {
+			let settled = false
 			const finish = (result: SignInResult) => {
+				if (settled) {
+					return
+				}
+
+				settled = true
+				active = false
 				activeController = null
 				activeDelegate = null
 				activeAnchor = null
-				activeFinish = null
 				resolve(result)
 			}
 
-			ensureClasses()
-			activeDelegate = AppleAuthDelegate.new()
-			activeFinish = finish
-			const provider = ASAuthorizationAppleIDProvider.new()
-			const request = provider.createRequest()
-			if (options?.scopes?.length) {
-				request.requestedScopes = options.scopes.map((s) => SCOPE_MAP[s]?.()).filter(Boolean)
-			}
+			try {
+				const app = NSApplication.sharedApplication
+				if (!(app.keyWindow ?? app.mainWindow ?? app.windows?.firstObject)) {
+					throw new Error('Sign in with Apple requires an AppKit presentation window')
+				}
 
-			if (options?.nonce !== undefined) {
-				request.nonce = sha256Hex(options.nonce)
-			}
+				ensureClasses()
+				activeDelegate = AppleAuthDelegate.new()
+				activeDelegate.finish = finish
+				const provider = ASAuthorizationAppleIDProvider.new()
+				const request = provider.createRequest()
+				if (options?.scopes?.length) {
+					request.requestedScopes = options.scopes.map((s) => SCOPE_MAP[s]?.()).filter(Boolean)
+				}
+
+				if (options?.nonce !== undefined) {
+					request.nonce = sha256Hex(options.nonce)
+				}
+
+				activeAnchor = AppleAuthAnchor.new()
+				activeController = ASAuthorizationController.alloc().initWithAuthorizationRequests([
+					request,
+				])
 
-			activeAnchor = AppleAuthAnchor.new()
-			activeController = ASAuthorizationController.alloc().initWithAuthorizationRequests([request])
-			activeController.delegate = activeDelegate
-			activeController.presentationContextProvider = activeAnchor
-			activeController.performRequests()
+				activeController.delegate = activeDelegate
+				activeController.presentationContextProvider = activeAnchor
+				activeController.performRequests()
+			} catch (error) {
+				finish({
+					status: 'error',
+					message: String((error as any)?.localizedDescription ?? (error as any)?.message ?? error),
+				})
+			}
 		})
 	},
 	async getCredentialState(userId: string): Promise<AppleCredentialState> {
@@ -261,17 +327,31 @@ export const appleAuth: AppleAuth = {
 		}
 
 		return new Promise<AppleCredentialState>((resolve) => {
-			ASAuthorizationAppleIDProvider.new().getCredentialStateForUserIDCompletion(
-				userId,
-				(state: number, error: any) => {
-					if (error) {
-						resolve('unknown')
-						return
-					}
+			try {
+				ASAuthorizationAppleIDProvider.new().getCredentialStateForUserIDCompletion(
+					userId,
+					(state: number, error: any) => {
+						if (error) {
+							resolve('unknown')
+							return
+						}
 
-					resolve(state === 1 ? 'authorized' : state === 0 ? 'revoked' : state === 3 ? 'transferred' : 'notFound')
-				},
-			)
+						resolve(
+							state === 1
+								? 'authorized'
+								: state === 0
+									? 'revoked'
+									: state === 3
+										? 'transferred'
+										: state === 2
+											? 'notFound'
+											: 'unknown',
+						)
+					},
+				)
+			} catch {
+				resolve('unknown')
+			}
 		})
 	},
 }

package/src/apple.web.ts

@@ -47,9 +47,9 @@ function decodeJwt(token: string): Record<string, any> {
 function toCredential(response: any): AuthCredential {
 	const auth = response?.authorization ?? {}
 	const claims = auth.id_token ? decodeJwt(auth.id_token) : {}
-	const name = [response?.user?.name?.firstName, response?.user?.name?.lastName]
-		.filter(Boolean)
-		.join(' ') || undefined
+	const name =
+		[response?.user?.name?.firstName, response?.user?.name?.lastName].filter(Boolean).join(' ') ||
+		undefined
 
 	return {
 		provider: 'apple',
@@ -101,7 +101,10 @@ export const appleAuth: AppleAuth = {
 		} catch (error) {
 			return isCancel(error)
 				? { status: 'cancelled' }
-				: { status: 'error', message: String((error as any)?.message ?? (error as any)?.error ?? error) }
+				: {
+						status: 'error',
+						message: String((error as any)?.message ?? (error as any)?.error ?? error),
+					}
 		}
 	},
 	async getCredentialState(): Promise<AppleCredentialState> {

package/src/google.macos.ts

@@ -1,18 +1,85 @@
-// Google Sign-In — macOS leaf. The AppKit host has no NativeScript plugin
-// runtime; apps that need Google sign-in on macOS run the hosted ceremony
-// through `@octane-xplat/platform`'s `authSession` instead.
-import type { GoogleAuth, SignInResult } from './types'
-
-const UNSUPPORTED: SignInResult = {
-	status: 'error',
-	message: 'Google Sign-In is unsupported by the AppKit host — use a hosted authSession flow',
-}
+// Google credentials on AppKit come from the app's hosted OAuth backend.
+// The shared methods/result stay identical to the SDK leaves.
+import { authSession } from '@octane-xplat/platform'
+import type { GoogleAuth, GoogleAuthConfig, SignInResult } from './types'
+
+let configuration: GoogleAuthConfig | undefined
+let active = false
 
 export const googleAuth: GoogleAuth = {
-	supported: false,
-	async configure() {},
-	async signIn(): Promise<SignInResult> {
-		return UNSUPPORTED
+	get supported() {
+		return authSession.supported
+	},
+	async configure(config) {
+		configuration = config ? { ...config, scopes: config.scopes?.slice() } : undefined
+	},
+	async signIn(options = {}): Promise<SignInResult> {
+		const config = configuration
+		const flow = config?.hostedFlow
+		const session = authSession.impl
+		if (!session) {
+			return { status: 'error', message: 'AuthenticationServices is unavailable on this host' }
+		}
+
+		if (!flow) {
+			return {
+				status: 'error',
+				message: 'Google Sign-In on macOS requires configure({ hostedFlow })',
+			}
+		}
+
+		if (active) {
+			return { status: 'error', message: 'a Google Sign-In flow is already active' }
+		}
+
+		active = true
+		try {
+			const request = await flow.createRequest({
+				...options,
+				clientId: config?.clientId,
+				serverClientId: config?.serverClientId,
+				scopes: config?.scopes?.slice(),
+				hostedDomain: config?.hostedDomain,
+			})
+
+			// Backend URLs must use TLS; the backend owns Google registration,
+			// state/nonce binding and single-use callback-code redemption.
+			if (!/^https:\/\//i.test(request.url)) {
+				throw new Error('Google hosted sign-in requires an HTTPS URL')
+			}
+
+			const result = await session.open(request.url, {
+				callbackScheme: request.callbackScheme,
+				prefersEphemeralSession: true,
+			})
+
+			if (result.type === 'cancel') {
+				return { status: 'cancelled' }
+			}
+
+			if (result.type === 'error') {
+				return { status: 'error', message: result.message }
+			}
+
+			const credential = await flow.complete(result.url)
+			if (
+				credential?.provider !== 'google' ||
+				typeof credential.user?.id !== 'string' ||
+				!credential.user.id ||
+				!Array.isArray(credential.scopes) ||
+				credential.scopes.some((scope) => typeof scope !== 'string')
+			) {
+				throw new Error('Google hosted sign-in returned an invalid credential')
+			}
+
+			return { status: 'success', credential }
+		} catch (error) {
+			return { status: 'error', message: String((error as any)?.message ?? error) }
+		} finally {
+			active = false
+		}
+	},
+	async signOut() {
+		await configuration?.hostedFlow?.signOut?.()
 	},
-	async signOut() {},
 }

package/src/google.web.ts

@@ -78,7 +78,11 @@ function initialize(google: any) {
 /** Internal — the button leaf renders the official GIS button into `host`. */
 export async function renderGoogleButton(
 	host: HTMLElement,
-	options: { theme?: 'dark' | 'light' | 'auto'; variant?: 'standard' | 'wide' | 'icon'; width?: number },
+	options: {
+		theme?: 'dark' | 'light' | 'auto'
+		variant?: 'standard' | 'wide' | 'icon'
+		width?: number
+	},
 	onResult: (result: SignInResult) => void,
 ): Promise<void> {
 	if (!config.clientId) {

package/src/index.macos.ts

@@ -13,6 +13,7 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,

package/src/index.ts

@@ -1,9 +1,9 @@
 // Platform barrels — explicit .tsrx leaf imports (moduleSuffixes don't
 // reach .tsrx; same convention as @octane-xplat/ui index.*.ts).
-export { appleAuth } from './apple';
-export { googleAuth } from './google';
-export { AppleSignInButton } from './AppleSignInButton.tsrx';
-export { GoogleSignInButton } from './GoogleSignInButton.tsrx';
+export { appleAuth } from './apple'
+export { googleAuth } from './google'
+export { AppleSignInButton } from './AppleSignInButton.tsrx'
+export { GoogleSignInButton } from './GoogleSignInButton.tsrx'
 export type {
 	AppleAuth,
 	AppleAuthConfig,
@@ -15,7 +15,8 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,
-} from './types';
+} from './types'

package/src/index.web.ts

@@ -1,9 +1,9 @@
 // Platform barrels — explicit .tsrx leaf imports (moduleSuffixes don't
 // reach .tsrx; same convention as @octane-xplat/ui index.*.ts).
-export { appleAuth } from './apple.web';
-export { googleAuth } from './google.web';
-export { AppleSignInButton } from './AppleSignInButton.web.tsrx';
-export { GoogleSignInButton } from './GoogleSignInButton.web.tsrx';
+export { appleAuth } from './apple.web'
+export { googleAuth } from './google.web'
+export { AppleSignInButton } from './AppleSignInButton.web.tsrx'
+export { GoogleSignInButton } from './GoogleSignInButton.web.tsrx'
 export type {
 	AppleAuth,
 	AppleAuthConfig,
@@ -15,7 +15,8 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,
-} from './types';
+} from './types'

package/src/types.ts

@@ -87,6 +87,19 @@ export interface AppleAuth {
 	getCredentialState(userId: string): Promise<AppleCredentialState>
 }
 
+/** App-owned Google OAuth ceremony for the macOS system browser. */
+export interface GoogleHostedAuthFlow {
+	/** Issue a fresh backend attempt, binding state, nonce, scopes and callback destination. */
+	createRequest(
+		options: GoogleSignInOptions &
+			Pick<GoogleAuthConfig, 'clientId' | 'serverClientId' | 'scopes' | 'hostedDomain'>,
+	): Promise<{ url: string; callbackScheme: string }>
+	/** Validate/redeem the callback against that attempt on your backend; return its Google credential. */
+	complete(callbackURL: string): Promise<AuthCredential>
+	/** Optional backend logout. macOS requests ephemeral browser sessions. */
+	signOut?(): Promise<void>
+}
+
 export interface GoogleAuthConfig {
 	/**
 	 * OAuth client id — the web client id on web (required there). On iOS it
@@ -99,11 +112,13 @@ export interface GoogleAuthConfig {
 	scopes?: string[]
 	/** Restrict to a Google Workspace domain. */
 	hostedDomain?: string
+	/** macOS only — hosted OAuth adapter; other targets keep using their provider SDK. */
+	hostedFlow?: GoogleHostedAuthFlow
 }
 
 export interface GoogleSignInOptions {
 	/**
-	 * Web only — nonce bound into the id token. Scope requests go through
+	 * Web/macOS — nonce bound into the id token. Scope requests go through
 	 * `GoogleAuthConfig.scopes`; neither provider SDK takes per-call scopes.
 	 */
 	nonce?: string
@@ -111,14 +126,14 @@ export interface GoogleSignInOptions {
 
 export interface GoogleAuth {
 	/**
-	 * Whether the provider SDK can run here — iOS/Android + browsers. False on
-	 * macOS (use a hosted `authSession` flow instead). Android devices without
+	 * Whether the provider can run here — iOS/Android + browsers, or macOS
+	 * AuthenticationServices (requires `configure({ hostedFlow })`). Android devices without
 	 * Play services still report true — the sign-in call surfaces the failure.
 	 */
 	readonly supported: boolean
 	configure(config?: GoogleAuthConfig): Promise<void>
 	signIn(options?: GoogleSignInOptions): Promise<SignInResult>
-	/** Clear the SDK's account selection so the next `signIn` re-prompts. */
+	/** Clear SDK account selection; macOS calls hostedFlow.signOut and requests ephemeral sessions. */
 	signOut(): Promise<void>
 }
 

package/types/generated/index.d.ts

@@ -2,4 +2,4 @@ export { appleAuth } from './apple.js';
 export { googleAuth } from './google.js';
 export { AppleSignInButton } from './AppleSignInButton.js';
 export { GoogleSignInButton } from './GoogleSignInButton.js';
-export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';
+export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleHostedAuthFlow, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';

package/types/generated/index.web.d.ts

@@ -2,4 +2,4 @@ export { appleAuth } from './apple.web.js';
 export { googleAuth } from './google.web.js';
 export { AppleSignInButton } from './AppleSignInButton.web.js';
 export { GoogleSignInButton } from './GoogleSignInButton.web.js';
-export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';
+export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleHostedAuthFlow, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';

package/types/generated/types.d.ts

@@ -77,6 +77,18 @@ export interface AppleAuth {
     /** iOS and macOS — credential state for a prior `user.id`. */
     getCredentialState(userId: string): Promise<AppleCredentialState>;
 }
+/** App-owned Google OAuth ceremony for the macOS system browser. */
+export interface GoogleHostedAuthFlow {
+    /** Issue a fresh backend attempt, binding state, nonce, scopes and callback destination. */
+    createRequest(options: GoogleSignInOptions & Pick<GoogleAuthConfig, 'clientId' | 'serverClientId' | 'scopes' | 'hostedDomain'>): Promise<{
+        url: string;
+        callbackScheme: string;
+    }>;
+    /** Validate/redeem the callback against that attempt on your backend; return its Google credential. */
+    complete(callbackURL: string): Promise<AuthCredential>;
+    /** Optional backend logout. macOS requests ephemeral browser sessions. */
+    signOut?(): Promise<void>;
+}
 export interface GoogleAuthConfig {
     /**
      * OAuth client id — the web client id on web (required there). On iOS it
@@ -89,24 +101,26 @@ export interface GoogleAuthConfig {
     scopes?: string[];
     /** Restrict to a Google Workspace domain. */
     hostedDomain?: string;
+    /** macOS only — hosted OAuth adapter; other targets keep using their provider SDK. */
+    hostedFlow?: GoogleHostedAuthFlow;
 }
 export interface GoogleSignInOptions {
     /**
-     * Web only — nonce bound into the id token. Scope requests go through
+     * Web/macOS — nonce bound into the id token. Scope requests go through
      * `GoogleAuthConfig.scopes`; neither provider SDK takes per-call scopes.
      */
     nonce?: string;
 }
 export interface GoogleAuth {
     /**
-     * Whether the provider SDK can run here — iOS/Android + browsers. False on
-     * macOS (use a hosted `authSession` flow instead). Android devices without
+     * Whether the provider can run here — iOS/Android + browsers, or macOS
+     * AuthenticationServices (requires `configure({ hostedFlow })`). Android devices without
      * Play services still report true — the sign-in call surfaces the failure.
      */
     readonly supported: boolean;
     configure(config?: GoogleAuthConfig): Promise<void>;
     signIn(options?: GoogleSignInOptions): Promise<SignInResult>;
-    /** Clear the SDK's account selection so the next `signIn` re-prompts. */
+    /** Clear SDK account selection; macOS calls hostedFlow.signOut and requests ephemeral sessions. */
     signOut(): Promise<void>;
 }
 interface SignInButtonBaseProps {

package/types/index.macos.d.ts

@@ -9,6 +9,7 @@ import type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,
@@ -25,6 +26,7 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,