@octane-xplat/auth 0.9.0 → 0.10.0

package/README.md

@@ -1,24 +1,26 @@
 # `@octane-xplat/auth`
 
+```sh
+pnpm add @octane-xplat/auth
+```
+
 Sign in with Apple and Google Sign-In for Octane xplat apps — the native
 SDKs (`@nativescript/apple-sign-in`, `@nativescript/google-signin`) on
 iOS/Android, the providers' web SDKs (Apple JS / Google Identity Services)
 in the browser, and AuthenticationServices through the ObjC bridge plus a
-Google flow on the macOS AppKit host. One `AuthUser`/`AuthCredential`
+app-configured hosted Google flow on the macOS AppKit host. One `AuthUser`/`AuthCredential`
 contract everywhere.
 
-```sh
-pnpm add @octane-xplat/auth
-```
-
-```tsx
-import { appleAuth, googleAuth, AppleSignInButton } from '@octane-xplat/auth'
-
-appleAuth.configure({ clientId: 'com.example.app.web' }) // web-only fields
+```ts
+import { appleAuth } from '@octane-xplat/auth'
 
-const result = await appleAuth.signIn({ scopes: ['email', 'name'] })
-if (result.status === 'success') {
-	const { idToken, user } = result.credential // hand idToken to your backend
+appleAuth.configure({ clientId: 'com.example.app.web' })
+if (appleAuth.supported) {
+	const result = await appleAuth.signIn({ scopes: ['email', 'name'] })
+	if (result.status === 'success') {
+		// Send this credential to your backend for verification.
+		const { idToken, user } = result.credential
+	}
 }
 ```
 
@@ -26,13 +28,46 @@ Each provider object reports `supported` — Apple is `false` on Android —
 and exposes `configure`, `signIn`, and provider extras
 (`appleAuth.getCredentialState`, `googleAuth.signOut`). `SignInResult`
 distinguishes `success` / `cancelled` / `error`; a dismissed sheet is
-`cancelled`, not a throw. The sign-in buttons are platform-authentic
-components, so render them from platform-suffixed files or accept each
+`cancelled`, not a throw. Apple uses the official ASAuthorizationAppleIDButton on AppKit; Google
+uses a text trigger for the hosted flow there. The other sign-in buttons are
+platform-authentic components, so render them from platform-suffixed files or accept each
 target's native styling.
 
+The following component belongs in an `.ios.tsx` file.
+
+```tsx
+import { AppleSignInButton, appleAuth, googleAuth } from '@octane-xplat/auth'
+
+export function SignIn() {
+	return (
+		<AppleSignInButton
+			onResult={(result) => {
+				if (result.status === 'success') {
+					void appleAuth.getCredentialState(result.credential.user.id)
+				}
+			}}
+		/>
+	)
+}
+// When ending a Google session:
+await googleAuth.signOut()
+```
+
 Web needs registered client IDs; iOS needs the `applesignin` entitlement
 and Google's `GoogleService-Info.plist`/reversed-client-id URL scheme;
 Android needs `google-services.json` and a `serverClientId` for
 `serverAuthCode`. Guide: [Using device
-features](../../docs/platform-services.md). Exercised by
+features](../../docs/platform/platform-services.md). Exercised by
 [`AuthDemo`](../demos/src/AuthDemo.tsrx).
+
+On macOS, `supported` reports AuthenticationServices availability, not completed
+provider registration. Apple needs a signed app ID with Sign in with Apple
+enabled and a matching provisioning profile and entitlement. Google needs
+`googleAuth.configure({ hostedFlow })`, where `createRequest` starts a fresh
+backend attempt and `complete` validates/redeems the captured callback on that
+backend, returning `AuthCredential`. A client ID alone is insufficient on
+AppKit. The adapter receives the configured client IDs, scopes, hosted domain,
+and per-attempt nonce; the backend must apply and verify them.
+
+See [macOS provider setup](../../docs/platform/platform-services.md#macos-provider-sign-in)
+and the [maintained hosted adapter](../../examples/auth/google-hosted.macos.ts).

package/dist/native/octane-client-build.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "buildId": "2924c745-ebe0-4012-9aea-c8c26eeb7458",
+  "buildId": "fc764ad7-51bc-48e0-b465-8a53d74ea14e",
   "mode": "production",
   "capabilities": {
     "independentHydration": false

package/dist/web/octane-client-build.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "buildId": "dc0dd9f6-f1fb-4b15-a5c3-95ddbe1709aa",
+  "buildId": "500fb75c-1e7a-46fe-8b9a-4a439f2dfd7e",
   "mode": "production",
   "capabilities": {
     "independentHydration": false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@octane-xplat/auth",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Sign in with Apple + Google Sign-In for Octane xplat — native SDKs on iOS/Android, platform web SDKs in the browser",
   "keywords": [
     "android",
@@ -52,15 +52,17 @@
   },
   "dependencies": {
     "@nativescript/apple-sign-in": "2.0.0",
-    "@nativescript/google-signin": "2.1.1"
+    "@nativescript/google-signin": "2.1.1",
+    "@octane-xplat/platform": "0.10.0"
   },
   "devDependencies": {
     "@nativescript-community/octane": "0.2.4",
     "@nativescript/core": "9.1.2",
+    "@octane-xplat/macos-renderer": "0.10.0",
     "@octanejs/vite-plugin": "0.1.61",
     "@tsrx/typescript-plugin": "0.4.11",
     "octane": "0.6.3",
-    "tsrx-typegen": "0.2.1",
+    "tsrx-typegen": "0.2.2",
     "typescript": "5.9.3",
     "vite": "8.3.0"
   },
@@ -81,6 +83,8 @@
     "build": "vite build && vite build --mode native && pnpm typegen && node ../../scripts/check-native-dist.mjs",
     "test:packed": "node tests/packed-consumer.mjs",
     "typegen": "tsrx-typegen --target octane",
-    "pack:check": "tsrx-typegen --pack-check"
+    "pack:check": "tsrx-typegen --pack-check",
+    "test": "node --test tests/*.test.mjs",
+    "typecheck:macos": "tsrx-tsc --noEmit -p tsconfig.macos.json"
   }
 }

package/src/AppleSignInButton.macos.tsrx

@@ -1,36 +1,34 @@
-/** @jsxImportSource @xplat/macos/renderer */
+/** @jsxImportSource @octane-xplat/macos-renderer */
+import { useEffect, useRef } from 'octane'
 import { appleAuth } from './apple.macos'
-import type { AppleSignInButtonProps, SignInResult } from './types'
+import { attachAppleButton } from './apple-button.macos'
+import type { AppleSignInButtonProps } from './types'
 
-const LABELS = {
-	default: 'Sign in with Apple',
-	signUp: 'Sign up with Apple',
-	continue: 'Continue with Apple',
-} as const
-
-/** Sign in with Apple button — macOS leaf. The AppKit renderer has no
- *  ASAuthorizationAppleIDButton in its vocabulary, so this is a flexbox row
- *  with a click-gesture tap (the same shape as Pressable/controls.macos)
- *  that runs the AuthenticationServices flow and reports through `onResult`.
- *  onPress on the intrinsic <button> is not used — the universal compile
- *  emits DOM-only delegateEvents for it. */
+/** Official ASAuthorizationAppleIDButton, embedded in the leaf's host view. */
 export function AppleSignInButton(props: AppleSignInButtonProps) @{
+	const anchor = useRef<any>(null)
+	const handle = useRef<ReturnType<typeof attachAppleButton> | null>(null)
+	const current = useRef(props)
+	current.current = props
+
+	useEffect(() => {
+		if (!anchor.current) return
+		handle.current = attachAppleButton(anchor.current, current.current, () => {
+			const latest = current.current
+			if (latest.disabled) return
+			latest.onPress?.()
+			void appleAuth.signIn().then((result) => current.current.onResult?.(result))
+		})
+
+		return () => { handle.current?.detach(); handle.current = null }
+	}, [props.type, props.theme])
+
+	useEffect(() => { handle.current?.update(!!props.disabled) })
+
 	<flexboxlayout
+		ref={(view: any) => { anchor.current = view }}
 		id={props.id}
-		className={['vx-button', props.className]}
-		style={props.style}
-		accessibilityLabel={LABELS[props.type ?? 'default']}
-		onTap={
-			props.disabled === true
-				? undefined
-				: () => {
-						props.onPress?.()
-						if (props.onResult) {
-							void appleAuth.signIn().then((result: SignInResult) => props.onResult?.(result))
-						}
-					}
-		}
-	>
-		<label text={LABELS[props.type ?? 'default']} />
-	</flexboxlayout>
+		className={props.className}
+		style={{ width: 240, height: 44, ...props.style }}
+	/>;
 }

package/src/GoogleSignInButton.macos.tsrx

@@ -1,7 +1,21 @@
-/** @jsxImportSource @xplat/macos/renderer */
+/** @jsxImportSource @octane-xplat/macos-renderer */
+import { googleAuth } from './google.macos'
 import type { GoogleSignInButtonProps } from './types'
 
-/** Explicit placeholder — the AppKit host has no Google sign-in button. */
-export function GoogleSignInButton(_props: GoogleSignInButtonProps) @{
-	<label className="vx-unsupported">Google Sign-In is unsupported by the AppKit host</label>
+/** Hosted Google sign-in trigger; Google does not provide an AppKit button. */
+export function GoogleSignInButton(props: GoogleSignInButtonProps) @{
+	<flexboxlayout
+		id={props.id}
+		className={['vx-button', props.className]}
+		style={props.style}
+		accessibilityRole="button"
+		accessibilityLabel="Sign in with Google"
+		accessibilityState={{ disabled: !!props.disabled }}
+		onTap={props.disabled ? undefined : () => {
+			props.onPress?.()
+			void googleAuth.signIn().then((result) => props.onResult?.(result))
+		}}
+	>
+		<label text="Sign in with Google" />
+	</flexboxlayout>;
 }

package/src/apple-button.macos.ts

@@ -0,0 +1,75 @@
+// Leaf-owned attachment: no renderer vocabulary or shared host change needed.
+import type { AppleSignInButtonProps } from './types'
+
+declare const objc: any
+declare const NSObject: any
+declare const interop: any
+declare const ASAuthorizationAppleIDButton: any
+
+let ActionTarget: any
+
+export function attachAppleButton(view: any, props: AppleSignInButtonProps, press: () => void) {
+	try {
+		objc.import('AuthenticationServices')
+	} catch {}
+
+	if (typeof ASAuthorizationAppleIDButton === 'undefined') {
+		throw new Error('The official Sign in with Apple button is unavailable on this host')
+	}
+
+	if (!ActionTarget) {
+		ActionTarget = NSObject.extend(
+			{
+				press(this: any, _sender: any) {
+					this.callback?.()
+				},
+			},
+			{ exposedMethods: { 'press:': { params: [interop.types.id], returns: interop.types.void } } },
+		)
+	}
+
+	const target = ActionTarget.new()
+	target.callback = press
+	// Values from ASAuthorizationAppleIDButton.h (macOS 10.15+).
+	const type = props.type === 'continue' ? 1 : props.type === 'signUp' ? 2 : 0
+	const theme = props.theme === 'white' ? 0 : props.theme === 'whiteOutline' ? 1 : 2
+	const button =
+		ASAuthorizationAppleIDButton.alloc().initWithAuthorizationButtonTypeAuthorizationButtonStyle(
+			type,
+			theme,
+		)
+
+	button.target = target
+	button.action = 'press:'
+	button.enabled = !props.disabled
+	button.translatesAutoresizingMaskIntoConstraints = false
+	view.addSubview(button)
+	const constraints = [
+		button.leadingAnchor.constraintEqualToAnchor(view.leadingAnchor),
+		button.trailingAnchor.constraintEqualToAnchor(view.trailingAnchor),
+		button.topAnchor.constraintEqualToAnchor(view.topAnchor),
+		button.bottomAnchor.constraintEqualToAnchor(view.bottomAnchor),
+	]
+
+	for (const constraint of constraints) {
+		constraint.active = true
+	}
+
+	return {
+		// Target is weak in AppKit: retain its wrapper with the attachment handle.
+		target,
+		button,
+		update(disabled: boolean) {
+			button.enabled = !disabled
+		},
+		detach() {
+			target.callback = null
+			button.target = null
+			for (const constraint of constraints) {
+				constraint.active = false
+			}
+
+			button.removeFromSuperview()
+		},
+	}
+}

package/src/apple.macos.ts

@@ -41,8 +41,8 @@ const SCOPE_MAP: Record<string, () => any> = {
 function isCancel(error: unknown): boolean {
 	// ASAuthorizationError.canceled = 1001 (NSError.code).
 	return (
-		(error as any)?.code === 1001 ||
-		/cancel/i.test(String((error as any)?.localizedDescription ?? error))
+		(error as any)?.domain === 'com.apple.AuthenticationServices.AuthorizationError' &&
+		Number((error as any)?.code) === 1001
 	)
 }
 
@@ -189,15 +189,24 @@ function ensureClasses() {
 
 	AppleAuthDelegate = NSObject.extend(
 		{
-			authorizationControllerDidCompleteWithAuthorization(_controller: any, authorization: any) {
-				const finish = activeFinish
-				activeFinish = null
-				finish?.({ status: 'success', credential: toCredential(authorization.credential) })
+			authorizationControllerDidCompleteWithAuthorization(
+				this: any,
+				_controller: any,
+				authorization: any,
+			) {
+				try {
+					const credential = toCredential(authorization.credential)
+					if (!credential.user.id || !credential.idToken) {
+						throw new Error('Sign in with Apple returned an incomplete credential')
+					}
+
+					this.finish?.({ status: 'success', credential })
+				} catch (error) {
+					this.finish?.({ status: 'error', message: String((error as any)?.message ?? error) })
+				}
 			},
-			authorizationControllerDidCompleteWithError(_controller: any, error: any) {
-				const finish = activeFinish
-				activeFinish = null
-				finish?.(
+			authorizationControllerDidCompleteWithError(this: any, _controller: any, error: any) {
+				this.finish?.(
 					isCancel(error)
 						? { status: 'cancelled' }
 						: { status: 'error', message: String((error as any)?.localizedDescription ?? error) },
@@ -243,7 +252,7 @@ function ensureClasses() {
 let activeController: any = null
 let activeDelegate: any = null
 let activeAnchor: any = null
-let activeFinish: ((result: SignInResult) => void) | null = null
+let active = false
 
 export const appleAuth: AppleAuth = {
 	get supported() {
@@ -257,37 +266,59 @@ export const appleAuth: AppleAuth = {
 			return { status: 'error', message: 'AuthenticationServices is unavailable on this host' }
 		}
 
-		if (activeController) {
+		if (active) {
 			return { status: 'error', message: 'a Sign in with Apple flow is already active' }
 		}
 
+		active = true
 		return new Promise<SignInResult>((resolve) => {
+			let settled = false
 			const finish = (result: SignInResult) => {
+				if (settled) {
+					return
+				}
+
+				settled = true
+				active = false
 				activeController = null
 				activeDelegate = null
 				activeAnchor = null
-				activeFinish = null
 				resolve(result)
 			}
 
-			ensureClasses()
-			activeDelegate = AppleAuthDelegate.new()
-			activeFinish = finish
-			const provider = ASAuthorizationAppleIDProvider.new()
-			const request = provider.createRequest()
-			if (options?.scopes?.length) {
-				request.requestedScopes = options.scopes.map((s) => SCOPE_MAP[s]?.()).filter(Boolean)
-			}
-
-			if (options?.nonce !== undefined) {
-				request.nonce = sha256Hex(options.nonce)
+			try {
+				const app = NSApplication.sharedApplication
+				if (!(app.keyWindow ?? app.mainWindow ?? app.windows?.firstObject)) {
+					throw new Error('Sign in with Apple requires an AppKit presentation window')
+				}
+
+				ensureClasses()
+				activeDelegate = AppleAuthDelegate.new()
+				activeDelegate.finish = finish
+				const provider = ASAuthorizationAppleIDProvider.new()
+				const request = provider.createRequest()
+				if (options?.scopes?.length) {
+					request.requestedScopes = options.scopes.map((s) => SCOPE_MAP[s]?.()).filter(Boolean)
+				}
+
+				if (options?.nonce !== undefined) {
+					request.nonce = sha256Hex(options.nonce)
+				}
+
+				activeAnchor = AppleAuthAnchor.new()
+				activeController = ASAuthorizationController.alloc().initWithAuthorizationRequests([
+					request,
+				])
+
+				activeController.delegate = activeDelegate
+				activeController.presentationContextProvider = activeAnchor
+				activeController.performRequests()
+			} catch (error) {
+				finish({
+					status: 'error',
+					message: String((error as any)?.localizedDescription ?? (error as any)?.message ?? error),
+				})
 			}
-
-			activeAnchor = AppleAuthAnchor.new()
-			activeController = ASAuthorizationController.alloc().initWithAuthorizationRequests([request])
-			activeController.delegate = activeDelegate
-			activeController.presentationContextProvider = activeAnchor
-			activeController.performRequests()
 		})
 	},
 	async getCredentialState(userId: string): Promise<AppleCredentialState> {
@@ -296,25 +327,31 @@ export const appleAuth: AppleAuth = {
 		}
 
 		return new Promise<AppleCredentialState>((resolve) => {
-			ASAuthorizationAppleIDProvider.new().getCredentialStateForUserIDCompletion(
-				userId,
-				(state: number, error: any) => {
-					if (error) {
-						resolve('unknown')
-						return
-					}
-
-					resolve(
-						state === 1
-							? 'authorized'
-							: state === 0
-								? 'revoked'
-								: state === 3
-									? 'transferred'
-									: 'notFound',
-					)
-				},
-			)
+			try {
+				ASAuthorizationAppleIDProvider.new().getCredentialStateForUserIDCompletion(
+					userId,
+					(state: number, error: any) => {
+						if (error) {
+							resolve('unknown')
+							return
+						}
+
+						resolve(
+							state === 1
+								? 'authorized'
+								: state === 0
+									? 'revoked'
+									: state === 3
+										? 'transferred'
+										: state === 2
+											? 'notFound'
+											: 'unknown',
+						)
+					},
+				)
+			} catch {
+				resolve('unknown')
+			}
 		})
 	},
 }

package/src/google.macos.ts

@@ -1,18 +1,85 @@
-// Google Sign-In — macOS leaf. The AppKit host has no NativeScript plugin
-// runtime; apps that need Google sign-in on macOS run the hosted ceremony
-// through `@octane-xplat/platform`'s `authSession` instead.
-import type { GoogleAuth, SignInResult } from './types'
-
-const UNSUPPORTED: SignInResult = {
-	status: 'error',
-	message: 'Google Sign-In is unsupported by the AppKit host — use a hosted authSession flow',
-}
+// Google credentials on AppKit come from the app's hosted OAuth backend.
+// The shared methods/result stay identical to the SDK leaves.
+import { authSession } from '@octane-xplat/platform'
+import type { GoogleAuth, GoogleAuthConfig, SignInResult } from './types'
+
+let configuration: GoogleAuthConfig | undefined
+let active = false
 
 export const googleAuth: GoogleAuth = {
-	supported: false,
-	async configure() {},
-	async signIn(): Promise<SignInResult> {
-		return UNSUPPORTED
+	get supported() {
+		return authSession.supported
+	},
+	async configure(config) {
+		configuration = config ? { ...config, scopes: config.scopes?.slice() } : undefined
+	},
+	async signIn(options = {}): Promise<SignInResult> {
+		const config = configuration
+		const flow = config?.hostedFlow
+		const session = authSession.impl
+		if (!session) {
+			return { status: 'error', message: 'AuthenticationServices is unavailable on this host' }
+		}
+
+		if (!flow) {
+			return {
+				status: 'error',
+				message: 'Google Sign-In on macOS requires configure({ hostedFlow })',
+			}
+		}
+
+		if (active) {
+			return { status: 'error', message: 'a Google Sign-In flow is already active' }
+		}
+
+		active = true
+		try {
+			const request = await flow.createRequest({
+				...options,
+				clientId: config?.clientId,
+				serverClientId: config?.serverClientId,
+				scopes: config?.scopes?.slice(),
+				hostedDomain: config?.hostedDomain,
+			})
+
+			// Backend URLs must use TLS; the backend owns Google registration,
+			// state/nonce binding and single-use callback-code redemption.
+			if (!/^https:\/\//i.test(request.url)) {
+				throw new Error('Google hosted sign-in requires an HTTPS URL')
+			}
+
+			const result = await session.open(request.url, {
+				callbackScheme: request.callbackScheme,
+				prefersEphemeralSession: true,
+			})
+
+			if (result.type === 'cancel') {
+				return { status: 'cancelled' }
+			}
+
+			if (result.type === 'error') {
+				return { status: 'error', message: result.message }
+			}
+
+			const credential = await flow.complete(result.url)
+			if (
+				credential?.provider !== 'google' ||
+				typeof credential.user?.id !== 'string' ||
+				!credential.user.id ||
+				!Array.isArray(credential.scopes) ||
+				credential.scopes.some((scope) => typeof scope !== 'string')
+			) {
+				throw new Error('Google hosted sign-in returned an invalid credential')
+			}
+
+			return { status: 'success', credential }
+		} catch (error) {
+			return { status: 'error', message: String((error as any)?.message ?? error) }
+		} finally {
+			active = false
+		}
+	},
+	async signOut() {
+		await configuration?.hostedFlow?.signOut?.()
 	},
-	async signOut() {},
 }

package/src/index.macos.ts

@@ -13,6 +13,7 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,

package/src/index.ts

@@ -15,6 +15,7 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,

package/src/index.web.ts

@@ -15,6 +15,7 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,

package/src/types.ts

@@ -87,6 +87,19 @@ export interface AppleAuth {
 	getCredentialState(userId: string): Promise<AppleCredentialState>
 }
 
+/** App-owned Google OAuth ceremony for the macOS system browser. */
+export interface GoogleHostedAuthFlow {
+	/** Issue a fresh backend attempt, binding state, nonce, scopes and callback destination. */
+	createRequest(
+		options: GoogleSignInOptions &
+			Pick<GoogleAuthConfig, 'clientId' | 'serverClientId' | 'scopes' | 'hostedDomain'>,
+	): Promise<{ url: string; callbackScheme: string }>
+	/** Validate/redeem the callback against that attempt on your backend; return its Google credential. */
+	complete(callbackURL: string): Promise<AuthCredential>
+	/** Optional backend logout. macOS requests ephemeral browser sessions. */
+	signOut?(): Promise<void>
+}
+
 export interface GoogleAuthConfig {
 	/**
 	 * OAuth client id — the web client id on web (required there). On iOS it
@@ -99,11 +112,13 @@ export interface GoogleAuthConfig {
 	scopes?: string[]
 	/** Restrict to a Google Workspace domain. */
 	hostedDomain?: string
+	/** macOS only — hosted OAuth adapter; other targets keep using their provider SDK. */
+	hostedFlow?: GoogleHostedAuthFlow
 }
 
 export interface GoogleSignInOptions {
 	/**
-	 * Web only — nonce bound into the id token. Scope requests go through
+	 * Web/macOS — nonce bound into the id token. Scope requests go through
 	 * `GoogleAuthConfig.scopes`; neither provider SDK takes per-call scopes.
 	 */
 	nonce?: string
@@ -111,14 +126,14 @@ export interface GoogleSignInOptions {
 
 export interface GoogleAuth {
 	/**
-	 * Whether the provider SDK can run here — iOS/Android + browsers. False on
-	 * macOS (use a hosted `authSession` flow instead). Android devices without
+	 * Whether the provider can run here — iOS/Android + browsers, or macOS
+	 * AuthenticationServices (requires `configure({ hostedFlow })`). Android devices without
 	 * Play services still report true — the sign-in call surfaces the failure.
 	 */
 	readonly supported: boolean
 	configure(config?: GoogleAuthConfig): Promise<void>
 	signIn(options?: GoogleSignInOptions): Promise<SignInResult>
-	/** Clear the SDK's account selection so the next `signIn` re-prompts. */
+	/** Clear SDK account selection; macOS calls hostedFlow.signOut and requests ephemeral sessions. */
 	signOut(): Promise<void>
 }
 

package/types/generated/index.d.ts

@@ -2,4 +2,4 @@ export { appleAuth } from './apple.js';
 export { googleAuth } from './google.js';
 export { AppleSignInButton } from './AppleSignInButton.js';
 export { GoogleSignInButton } from './GoogleSignInButton.js';
-export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';
+export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleHostedAuthFlow, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';

package/types/generated/index.web.d.ts

@@ -2,4 +2,4 @@ export { appleAuth } from './apple.web.js';
 export { googleAuth } from './google.web.js';
 export { AppleSignInButton } from './AppleSignInButton.web.js';
 export { GoogleSignInButton } from './GoogleSignInButton.web.js';
-export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';
+export type { AppleAuth, AppleAuthConfig, AppleCredentialState, AppleScope, AppleSignInButtonProps, AppleSignInOptions, AuthCredential, AuthUser, GoogleAuth, GoogleAuthConfig, GoogleHostedAuthFlow, GoogleSignInButtonProps, GoogleSignInOptions, SignInResult, } from './types.js';

package/types/generated/types.d.ts

@@ -77,6 +77,18 @@ export interface AppleAuth {
     /** iOS and macOS — credential state for a prior `user.id`. */
     getCredentialState(userId: string): Promise<AppleCredentialState>;
 }
+/** App-owned Google OAuth ceremony for the macOS system browser. */
+export interface GoogleHostedAuthFlow {
+    /** Issue a fresh backend attempt, binding state, nonce, scopes and callback destination. */
+    createRequest(options: GoogleSignInOptions & Pick<GoogleAuthConfig, 'clientId' | 'serverClientId' | 'scopes' | 'hostedDomain'>): Promise<{
+        url: string;
+        callbackScheme: string;
+    }>;
+    /** Validate/redeem the callback against that attempt on your backend; return its Google credential. */
+    complete(callbackURL: string): Promise<AuthCredential>;
+    /** Optional backend logout. macOS requests ephemeral browser sessions. */
+    signOut?(): Promise<void>;
+}
 export interface GoogleAuthConfig {
     /**
      * OAuth client id — the web client id on web (required there). On iOS it
@@ -89,24 +101,26 @@ export interface GoogleAuthConfig {
     scopes?: string[];
     /** Restrict to a Google Workspace domain. */
     hostedDomain?: string;
+    /** macOS only — hosted OAuth adapter; other targets keep using their provider SDK. */
+    hostedFlow?: GoogleHostedAuthFlow;
 }
 export interface GoogleSignInOptions {
     /**
-     * Web only — nonce bound into the id token. Scope requests go through
+     * Web/macOS — nonce bound into the id token. Scope requests go through
      * `GoogleAuthConfig.scopes`; neither provider SDK takes per-call scopes.
      */
     nonce?: string;
 }
 export interface GoogleAuth {
     /**
-     * Whether the provider SDK can run here — iOS/Android + browsers. False on
-     * macOS (use a hosted `authSession` flow instead). Android devices without
+     * Whether the provider can run here — iOS/Android + browsers, or macOS
+     * AuthenticationServices (requires `configure({ hostedFlow })`). Android devices without
      * Play services still report true — the sign-in call surfaces the failure.
      */
     readonly supported: boolean;
     configure(config?: GoogleAuthConfig): Promise<void>;
     signIn(options?: GoogleSignInOptions): Promise<SignInResult>;
-    /** Clear the SDK's account selection so the next `signIn` re-prompts. */
+    /** Clear SDK account selection; macOS calls hostedFlow.signOut and requests ephemeral sessions. */
     signOut(): Promise<void>;
 }
 interface SignInButtonBaseProps {

package/types/index.macos.d.ts

@@ -9,6 +9,7 @@ import type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,
@@ -25,6 +26,7 @@ export type {
 	AuthUser,
 	GoogleAuth,
 	GoogleAuthConfig,
+	GoogleHostedAuthFlow,
 	GoogleSignInButtonProps,
 	GoogleSignInOptions,
 	SignInResult,