expo-native-google-signin 0.1.0-beta.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Eleftheriou Apostolos
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,300 @@
+# expo-native-google-signin
+
+Native Google sign-in for Expo apps on **Android** (Credential Manager) and **iOS** (the
+`GoogleSignIn` SDK). It returns a Google ID token that any backend can verify — Supabase, Firebase,
+or your own server.
+
+**Why:** "Google Sign-In for Android" (`GoogleSignInClient` in `play-services-auth`) is deprecated
+in favour of Credential Manager, and `play-services-auth` 22.0.0 already removed those classes from
+the SDK. This module talks only to Google's first-party SDKs — no dependency on
+`@react-native-google-signin/google-signin` or any other community wrapper. MIT-licensed.
+
+## Status and requirements
+
+- **Pre-1.0 — not published yet.** The first release will be `0.1.0-beta.0`, on the npm `next` tag
+  (see [CHANGELOG.md](./CHANGELOG.md)); the install commands below work once it is out. Per
+  semver-pre-1.0, a minor bump may break the API — **pin an exact version**:
+
+  ```sh
+  npm install expo-native-google-signin@0.1.0-beta.0 --save-exact
+  ```
+
+- **Expo SDK 57.**
+- **A development build** — this module is not available in **Expo Go**.
+- **Android:** `minSdk` 24.
+- **iOS:** 15.1+, and **Xcode 26+** (Expo SDK 57 itself requires it — `expo-modules-jsi` needs
+  Swift tools 6.2).
+- **`GoogleSignIn-iOS` ~> 9.2** (pinned; see `docs/ARCHITECTURE.md` for why).
+
+## Install
+
+```sh
+npx expo install expo-native-google-signin
+# or, pinned exactly:
+npm install expo-native-google-signin@0.1.0-beta.0 --save-exact
+```
+
+Add the config plugin in `app.json` / `app.config.*`:
+
+```json
+{
+  "expo": {
+    "plugins": [
+      [
+        "expo-native-google-signin",
+        { "iosUrlScheme": "com.googleusercontent.apps.YOUR_IOS_CLIENT_ID" }
+      ]
+    ]
+  }
+}
+```
+
+Then rebuild the native projects:
+
+```sh
+npx expo prebuild
+npx expo run:android
+npx expo run:ios
+```
+
+(or an EAS build). `iosUrlScheme` is required for the sign-in sheet to hand control back to your
+app on iOS — without it, the plugin only logs a warning.
+
+## Google Cloud setup
+
+Create OAuth 2.0 client IDs in [Google Cloud Console](https://console.cloud.google.com/apis/credentials):
+
+1. **Web client** — its ID is `webClientId`. It becomes the `aud` claim of the ID token this module
+   returns, on **both** platforms.
+2. **iOS client** — its ID is `iosClientId`. Its reversed ID is `iosUrlScheme`
+   (`com.googleusercontent.apps.…`, shown as "URL scheme" on the client's page in the console).
+3. **Android client** — registered with your app's **package name** and **signing SHA-1**. There is
+   no `iosClientId`-equivalent to pass at runtime for Android: Google identifies the calling app by
+   package name + SHA-1 on this client, and the ID token's audience is the **web** client ID passed
+   as `webClientId`. See `docs/ARCHITECTURE.md` → "Platform mechanics" for the full rationale.
+
+> [!WARNING]
+> **Play App Signing re-signs your app**, so the Android OAuth client needs **both** the
+> upload-key SHA-1 **and** the Play app-signing SHA-1. If you only register the upload-key SHA-1,
+> sign-in fails only for builds installed from Google Play — usually surfacing as
+> `NO_GOOGLE_ACCOUNT` even though the device has one. Also register your debug keystore's and any
+> EAS build profile's SHA-1s, or sign-in won't work in development builds either.
+
+Use placeholders like `YOUR_WEB_CLIENT_ID.apps.googleusercontent.com` when configuring — never
+commit a real client ID, SHA-1 or keystore (this repo is public).
+
+## Usage
+
+```ts
+import { isErrorWithCode, signIn, signOut } from "expo-native-google-signin";
+
+async function handleSignIn() {
+  try {
+    const result = await signIn({
+      webClientId: "YOUR_WEB_CLIENT_ID.apps.googleusercontent.com",
+      iosClientId: "YOUR_IOS_CLIENT_ID.apps.googleusercontent.com", // required on iOS only
+    });
+
+    if (result.type === "cancelled") {
+      return;
+    }
+
+    // result.type === "success"
+    console.log(result.user.email, result.idToken);
+    // There is no `result.user.id` -- decode `result.idToken` (a JWT) and read its `sub`
+    // claim if you need the stable Google account identifier.
+  } catch (error) {
+    if (isErrorWithCode(error)) {
+      console.warn(error.code, error.message);
+    } else {
+      throw error;
+    }
+  }
+}
+
+async function handleSignOut() {
+  await signOut();
+}
+```
+
+## API reference
+
+### `signIn(options): Promise<SignInResult>`
+
+| Option        | Type     | Required          | Notes                                                        |
+| ------------- | -------- | ------------------ | -------------------------------------------------------------|
+| `webClientId` | `string` | Yes (both platforms) | OAuth **web** client ID; becomes the token's `aud` claim.  |
+| `iosClientId` | `string` | iOS only           | OAuth **iOS** client ID; ignored on Android.                 |
+| `nonce`       | `string` | No                 | Forwarded to the native SDK and embedded in the ID token.    |
+
+```ts
+type SignInResult =
+  | { type: "success"; idToken: string; user: GoogleUser }
+  | { type: "cancelled" };
+
+type GoogleUser = {
+  email: string;
+  name?: string;
+  givenName?: string;
+  familyName?: string;
+  photoUrl?: string;
+};
+```
+
+There is deliberately no `user.id`: Android's `GoogleIdTokenCredential.id` is the account's email
+address, not the Google subject. Decode `idToken` and read its `sub` claim instead.
+
+A user-initiated cancel **resolves** `{ type: "cancelled" }` — it does not reject.
+
+### `signOut(): Promise<void>`
+
+Clears the locally cached Google credential state on both platforms.
+
+### `isErrorWithCode(error): error is Error & { code: ErrorCode }`
+
+Narrows a caught `error` to one with a known `code` from `ERROR_CODES` below.
+
+### `ERROR_CODES`
+
+`signIn`/`signOut` reject with an `Error` whose `code` is one of these. The native error message is
+always preserved on `error.message` for logging.
+
+| Code                    | When                                                                                                                                       | Platform(s) |
+| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------| ----------- |
+| `CONFIGURATION_ERROR`   | Missing/blank `webClientId`; missing/blank `iosClientId` on iOS; an invalid `nonce` type; or the module is unavailable (e.g. running in **Expo Go** instead of a development build) | Both |
+| `NO_GOOGLE_ACCOUNT`     | No Google account is available to choose from (Credential Manager's `NoCredentialException`)                                               | Android only |
+| `PROVIDER_UNAVAILABLE`  | The credential provider isn't configured or supported on the device (e.g. no Play services, or an emulator without a Play Store image)     | Android only |
+| `NO_PRESENTER`          | No current Activity (Android) / view controller (iOS) to present the sign-in UI from — e.g. the app was backgrounded mid-tap               | Both |
+| `UNEXPECTED_CREDENTIAL` | The returned credential isn't a parseable Google ID token credential, or is missing a required field (e.g. no email/profile on iOS)         | Both |
+| `SIGN_IN_FAILED`        | Any other failure. **On iOS, every non-cancel failure uses this one code** — `GoogleSignIn` has a single flat error domain that doesn't distinguish "no account" or "provider unavailable" the way Android's Credential Manager does. The native domain, code and message are always kept in `error.message`. **On Android, `[16] Account reauth failed` (an unregistered package + signing SHA-1) rejects with `SIGN_IN_FAILED` rather than resolving as cancelled.** | Both |
+
+## Backends
+
+### Supabase — `signInWithIdToken` with a nonce
+
+Verifying the nonce ties the ID token to this specific sign-in attempt. Generate a raw nonce,
+SHA-256-hash it, pass the **hashed** nonce into `signIn`, and pass the **raw** nonce to Supabase (it
+hashes it again internally to compare against the token's `nonce` claim):
+
+```ts
+import * as Crypto from "expo-crypto";
+import { signIn } from "expo-native-google-signin";
+import { createClient } from "@supabase/supabase-js";
+
+const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
+
+async function signInWithGoogle() {
+  const rawNonce = Crypto.randomUUID();
+  const hashedNonce = await Crypto.digestStringAsync(
+    Crypto.CryptoDigestAlgorithm.SHA256,
+    rawNonce,
+  );
+
+  const result = await signIn({
+    webClientId: "YOUR_WEB_CLIENT_ID.apps.googleusercontent.com",
+    iosClientId: "YOUR_IOS_CLIENT_ID.apps.googleusercontent.com",
+    nonce: hashedNonce,
+  });
+
+  if (result.type === "cancelled") {
+    return;
+  }
+
+  const { data, error } = await supabase.auth.signInWithIdToken({
+    provider: "google",
+    token: result.idToken,
+    nonce: rawNonce,
+  });
+}
+```
+
+(`expo-crypto` and `@supabase/supabase-js` are not dependencies of this module — install them
+yourself if you use this pattern.)
+
+### Firebase
+
+```ts
+import { getAuth, GoogleAuthProvider, signInWithCredential } from "firebase/auth";
+
+const credential = GoogleAuthProvider.credential(result.idToken);
+await signInWithCredential(getAuth(), credential);
+```
+
+### A custom server
+
+Verify, on the server: the ID token's signature (against Google's published JWKS), `aud` (must
+equal your **web** client ID), `iss` (`accounts.google.com` / `https://accounts.google.com`),
+`exp`, and — if you passed one to `signIn` — the (hashed) `nonce` claim.
+
+## Migrating from `@react-native-google-signin/google-signin`
+
+| `@react-native-google-signin/google-signin`                          | `expo-native-google-signin`                                                                 |
+| ---------------------------------------------------------------------| ----------------------------------------------------------------------------------------------|
+| `GoogleSignin.configure({ webClientId, iosClientId })` then `GoogleSignin.signIn()` | One call: `signIn({ webClientId, iosClientId, nonce? })` — no separate configure step |
+| Result `{ type: "success" \| "cancelled", ... }`                     | Same `type` values and meaning — a cancel resolves, it doesn't throw                        |
+| `user.id` (Google subject)                                           | No `id` — decode `idToken` and read its `sub` claim instead                                 |
+| `androidClientId` config option                                      | Removed — not needed; Google matches by package name + SHA-1, and `webClientId` is the token audience on both platforms |
+| `GoogleSignin.signOut()`                                              | `signOut()`                                                                                  |
+| Config plugin option `iosUrlScheme`                                   | Same option name, same purpose                                                              |
+
+This module exists because the free version of `@react-native-google-signin/google-signin` stays on
+the legacy, deprecated Android sign-in API — its Credential Manager support is part of a paid
+product (see `docs/ARCHITECTURE.md` → "Why this project exists").
+
+## Troubleshooting
+
+- **`NO_GOOGLE_ACCOUNT` only on builds installed from Google Play:** the Android OAuth client is
+  missing the Play app-signing SHA-1 (see the warning above) — register both SHA-1s.
+- **`SIGN_IN_FAILED` with `[16] Account reauth failed` on Android:** the Android OAuth client is
+  missing this build's signing SHA-1 (debug, upload or Play app-signing). An Android OAuth client
+  holds one SHA-1, so register one client per key, with the same package name, in the same Google
+  Cloud project as `webClientId`.
+- **No accounts on an emulator:** use an emulator image that includes the Play Store, and sign into
+  a Google account on it first.
+- **`CONFIGURATION_ERROR` in Expo Go:** this module requires a development build; Expo Go can't load
+  it.
+- **iOS never returns to the app after choosing an account:** the config plugin's `iosUrlScheme` is
+  missing or wrong — check `Info.plist`'s `CFBundleURLTypes` after `expo prebuild`.
+- **iOS build fails to resolve packages / Xcode errors:** this module (via Expo SDK 57) requires
+  **Xcode 26+**.
+
+## Example app
+
+```sh
+cd example
+cp .env.example .env
+# fill in EXPO_PUBLIC_WEB_CLIENT_ID, EXPO_PUBLIC_IOS_CLIENT_ID, EXPO_PUBLIC_IOS_URL_SCHEME
+npm install
+npx expo run:android   # or: npx expo run:ios
+```
+
+## Contributing / releasing (maintainers)
+
+See `CLAUDE.md` for the full command reference (`npm run build`, `lint`, `typecheck`, `test`,
+`build:plugin`, `test:plugin`, etc.).
+
+**Release:**
+
+1. Bump the version in `package.json` (and `android/build.gradle`'s `version`/`versionName`, which
+   is not read from `package.json`), and add a `CHANGELOG.md` entry.
+2. Merge to `main`.
+3. Tag `vX.Y.Z` from `main` and push the tag — `release.yml` publishes to npm with provenance
+   (prereleases go to the `next` dist-tag, stable versions to `latest`), but only if the tag matches
+   `package.json`'s version and the tagged commit is on `main`.
+
+**First publish:** npm trusted publishing needs the package to already exist, so the very first
+version is published manually (`npm publish --access public --tag next`), or via an `NPM_TOKEN`
+repository secret.
+
+**After that**, configure npm trusted publishing so `release.yml` doesn't need a token: on
+npmjs.com, package settings → **Trusted Publisher** → GitHub Actions, repo
+`ele-ap/expo-native-google-signin`, workflow `release.yml`, environment `npm`. Then delete the
+`NPM_TOKEN` secret.
+
+## Disclaimer
+
+This project is not affiliated with or endorsed by Google.
+
+## License
+
+[MIT](./LICENSE)

package/android/build.gradle

@@ -0,0 +1,30 @@
+plugins {
+  id 'com.android.library'
+  id 'expo-module-gradle-plugin'
+}
+
+group = 'expo.modules.nativegooglesignin'
+version = '0.1.0-beta.0'
+
+android {
+  namespace "expo.modules.nativegooglesignin"
+  defaultConfig {
+    versionCode 1
+    versionName "0.1.0-beta.0"
+    consumerProguardFiles 'consumer-rules.pro'
+  }
+  lintOptions {
+    abortOnError false
+  }
+  testOptions {
+    unitTests.returnDefaultValues = true
+  }
+}
+
+dependencies {
+  implementation 'androidx.credentials:credentials:1.6.0'
+  implementation 'androidx.credentials:credentials-play-services-auth:1.6.0'
+  implementation 'com.google.android.libraries.identity.googleid:googleid:1.2.0'
+
+  testImplementation 'junit:junit:4.13.2'
+}

package/android/consumer-rules.pro

@@ -0,0 +1,4 @@
+-if class androidx.credentials.CredentialManager
+-keep class androidx.credentials.playservices.** {
+  *;
+}

package/android/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<manifest>
+</manifest>

package/android/src/main/java/expo/modules/nativegooglesignin/ErrorMapping.kt

@@ -0,0 +1,83 @@
+package expo.modules.nativegooglesignin
+
+import androidx.credentials.exceptions.GetCredentialCancellationException
+import androidx.credentials.exceptions.GetCredentialException
+import androidx.credentials.exceptions.GetCredentialProviderConfigurationException
+import androidx.credentials.exceptions.GetCredentialUnsupportedException
+import androidx.credentials.exceptions.NoCredentialException
+
+/**
+ * Error codes `signIn`/`signOut` reject with. Must match `ERROR_CODES` in `src/types.ts` exactly
+ * -- see docs/ARCHITECTURE.md -> "Public API shape".
+ */
+object ErrorCodes {
+  const val CONFIGURATION_ERROR = "CONFIGURATION_ERROR"
+  const val NO_GOOGLE_ACCOUNT = "NO_GOOGLE_ACCOUNT"
+  const val PROVIDER_UNAVAILABLE = "PROVIDER_UNAVAILABLE"
+  const val NO_PRESENTER = "NO_PRESENTER"
+  const val UNEXPECTED_CREDENTIAL = "UNEXPECTED_CREDENTIAL"
+  const val SIGN_IN_FAILED = "SIGN_IN_FAILED"
+}
+
+/**
+ * The outcome of mapping a Credential Manager [GetCredentialException] for `signIn`.
+ *
+ * Kept free of Android framework calls (pure logic over the exception's own properties) so it can
+ * be covered by a plain JVM unit test -- see `ErrorMappingTest`.
+ */
+sealed interface SignInFailure {
+  /**
+   * The user dismissed the account chooser; `signIn` should resolve `{ type: 'cancelled' }`.
+   * Not every [GetCredentialCancellationException] is a dismissal: `[16] Account reauth failed`
+   * (matched on `[16]` or "reauth failed") is a misconfiguration and maps to [Coded] -- see [mapGetCredentialException].
+   */
+  object Cancelled : SignInFailure
+
+  /** `signIn` should reject with this coded error. */
+  data class Coded(val code: String, val message: String) : SignInFailure
+}
+
+private const val REAUTH_FAILED_HINT =
+  " -- this usually means the app's package name + signing SHA-1 aren't registered on an " +
+    "Android OAuth client in the same Google Cloud project as webClientId (register debug, " +
+    "upload and Play app-signing SHA-1s; see README Troubleshooting)."
+
+private fun isReauthFailed(msg: String): Boolean =
+  msg.contains("[16]") || msg.contains("reauth failed", ignoreCase = true)
+
+/**
+ * Maps a [GetCredentialException] thrown by `CredentialManager.getCredentialAsync` to a
+ * [SignInFailure] -- see docs/ARCHITECTURE.md -> "Public API shape" and the plan's "Native
+ * behaviour -> Android -> Error mapping" for the rationale behind each mapping.
+ *
+ * Exception: Google Play services reports `[16] Account reauth failed` -- usually an unregistered
+ * package name + signing SHA-1 -- as a [GetCredentialCancellationException]. That is a real
+ * failure, not a user dismissal, so a cancellation whose message contains `[16]` or "reauth
+ * failed" (case-insensitive, in case a Play services version formats the code differently) maps
+ * to `SIGN_IN_FAILED` (with a hint) instead of [SignInFailure.Cancelled]. Any other cancellation
+ * stays [SignInFailure.Cancelled].
+ */
+fun mapGetCredentialException(e: GetCredentialException): SignInFailure = when (e) {
+  is GetCredentialCancellationException ->
+    if (isReauthFailed(e.message.orEmpty())) {
+      SignInFailure.Coded(ErrorCodes.SIGN_IN_FAILED, nativeMessage(e) + REAUTH_FAILED_HINT)
+    } else {
+      SignInFailure.Cancelled
+    }
+  is NoCredentialException -> SignInFailure.Coded(ErrorCodes.NO_GOOGLE_ACCOUNT, nativeMessage(e))
+  is GetCredentialProviderConfigurationException,
+  is GetCredentialUnsupportedException ->
+    SignInFailure.Coded(ErrorCodes.PROVIDER_UNAVAILABLE, nativeMessage(e))
+  else -> SignInFailure.Coded(ErrorCodes.SIGN_IN_FAILED, nativeMessage(e))
+}
+
+/**
+ * The native message: [Throwable.message] (which androidx sets from the exception's error
+ * message; `errorMessage` itself is a restricted API), falling back to
+ * [GetCredentialException.type]. Prefixed with the exception's simple class name, since several
+ * exception types share a single error code above.
+ */
+private fun nativeMessage(e: GetCredentialException): String {
+  val message = e.message ?: e.type
+  return "${e.javaClass.simpleName}: $message"
+}

package/android/src/main/java/expo/modules/nativegooglesignin/ExpoNativeGoogleSignInModule.kt

@@ -0,0 +1,187 @@
+package expo.modules.nativegooglesignin
+
+import android.os.CancellationSignal
+import androidx.core.content.ContextCompat
+import androidx.credentials.ClearCredentialStateRequest
+import androidx.credentials.CredentialManager
+import androidx.credentials.CredentialManagerCallback
+import androidx.credentials.CustomCredential
+import androidx.credentials.GetCredentialRequest
+import androidx.credentials.GetCredentialResponse
+import androidx.credentials.exceptions.ClearCredentialException
+import androidx.credentials.exceptions.GetCredentialException
+import com.google.android.libraries.identity.googleid.GetSignInWithGoogleOption
+import com.google.android.libraries.identity.googleid.GoogleIdTokenCredential
+import com.google.android.libraries.identity.googleid.GoogleIdTokenParsingException
+import expo.modules.kotlin.Promise
+import expo.modules.kotlin.exception.CodedException
+import expo.modules.kotlin.modules.Module
+import expo.modules.kotlin.modules.ModuleDefinition
+
+class ExpoNativeGoogleSignInModule : Module() {
+  override fun definition() = ModuleDefinition {
+    Name("ExpoNativeGoogleSignIn")
+
+    // Promise-based overloads: a lambda that only throws has type `Nothing`, which Expo's reified
+    // AsyncFunction can't accept (see CLAUDE.md -> Conventions).
+    AsyncFunction("signIn") { options: SignInOptions, promise: Promise ->
+      signIn(options, promise)
+    }
+
+    AsyncFunction("signOut") { promise: Promise ->
+      signOut(promise)
+    }
+  }
+
+  private fun signIn(options: SignInOptions, promise: Promise) {
+    val webClientId = options.webClientId.trim()
+    if (webClientId.isEmpty()) {
+      promise.reject(
+        CodedException(
+          ErrorCodes.CONFIGURATION_ERROR,
+          "expo-native-google-signin: `webClientId` is required on Android (pass the OAuth " +
+            "web client ID as `serverClientId` -- see docs/ARCHITECTURE.md).",
+          null
+        )
+      )
+      return
+    }
+
+    val activity = appContext.currentActivity
+    if (activity == null) {
+      promise.reject(
+        CodedException(
+          ErrorCodes.NO_PRESENTER,
+          "expo-native-google-signin: no current Activity to present the sign-in UI from.",
+          null
+        )
+      )
+      return
+    }
+
+    try {
+      // Treat a blank nonce as absent.
+      val nonce = options.nonce?.trim()?.takeUnless { it.isEmpty() }
+      val signInOption = GetSignInWithGoogleOption.Builder(serverClientId = webClientId)
+        .apply { nonce?.let { setNonce(it) } }
+        .build()
+      val request = GetCredentialRequest.Builder()
+        .addCredentialOption(signInOption)
+        .build()
+
+      CredentialManager.create(activity).getCredentialAsync(
+        activity,
+        request,
+        CancellationSignal(),
+        ContextCompat.getMainExecutor(activity),
+        object : CredentialManagerCallback<GetCredentialResponse, GetCredentialException> {
+          override fun onResult(result: GetCredentialResponse) = resolveSignIn(result, promise)
+
+          override fun onError(e: GetCredentialException) = rejectSignIn(e, promise)
+        }
+      )
+    } catch (t: Throwable) {
+      promise.reject(CodedException(ErrorCodes.SIGN_IN_FAILED, t.message ?: t.toString(), t))
+    }
+  }
+
+  private fun resolveSignIn(response: GetCredentialResponse, promise: Promise) {
+    try {
+      // 1.6.0 exposes only `credential` (singular); the `credentials` list arrived in 1.7.0-alpha03.
+      val credential = response.credential
+      if (
+        credential !is CustomCredential ||
+        credential.type != GoogleIdTokenCredential.TYPE_GOOGLE_ID_TOKEN_CREDENTIAL
+      ) {
+        promise.reject(
+          CodedException(
+            ErrorCodes.UNEXPECTED_CREDENTIAL,
+            "expo-native-google-signin: received an unexpected credential of type " +
+              "'${credential.type}'.",
+            null
+          )
+        )
+        return
+      }
+
+      val googleIdTokenCredential = GoogleIdTokenCredential.createFrom(credential.data)
+
+      // Omit null user fields rather than sending null, since the TS types are optional.
+      val user = mutableMapOf<String, Any?>("email" to googleIdTokenCredential.id)
+      googleIdTokenCredential.displayName?.let { user["name"] = it }
+      googleIdTokenCredential.givenName?.let { user["givenName"] = it }
+      googleIdTokenCredential.familyName?.let { user["familyName"] = it }
+      googleIdTokenCredential.profilePictureUri?.let { user["photoUrl"] = it.toString() }
+
+      promise.resolve(
+        mapOf(
+          "type" to "success",
+          "idToken" to googleIdTokenCredential.idToken,
+          "user" to user
+        )
+      )
+    } catch (e: GoogleIdTokenParsingException) {
+      promise.reject(
+        CodedException(
+          ErrorCodes.UNEXPECTED_CREDENTIAL,
+          "expo-native-google-signin: failed to parse the Google ID token credential " +
+            "(${e.message ?: e.toString()}).",
+          e
+        )
+      )
+    } catch (t: Throwable) {
+      promise.reject(CodedException(ErrorCodes.SIGN_IN_FAILED, t.message ?: t.toString(), t))
+    }
+  }
+
+  private fun rejectSignIn(e: GetCredentialException, promise: Promise) {
+    try {
+      when (val failure = mapGetCredentialException(e)) {
+        is SignInFailure.Cancelled -> promise.resolve(mapOf("type" to "cancelled"))
+        is SignInFailure.Coded ->
+          promise.reject(CodedException(failure.code, failure.message, e))
+      }
+    } catch (t: Throwable) {
+      promise.reject(CodedException(ErrorCodes.SIGN_IN_FAILED, t.message ?: t.toString(), t))
+    }
+  }
+
+  private fun signOut(promise: Promise) {
+    val context = appContext.reactContext
+    if (context == null) {
+      promise.reject(
+        CodedException(
+          ErrorCodes.SIGN_IN_FAILED,
+          "expo-native-google-signin: no application context available to sign out.",
+          null
+        )
+      )
+      return
+    }
+
+    try {
+      CredentialManager.create(context).clearCredentialStateAsync(
+        ClearCredentialStateRequest(),
+        CancellationSignal(),
+        ContextCompat.getMainExecutor(context),
+        object : CredentialManagerCallback<Void?, ClearCredentialException> {
+          override fun onResult(result: Void?) {
+            promise.resolve(null)
+          }
+
+          override fun onError(e: ClearCredentialException) {
+            promise.reject(
+              CodedException(
+                ErrorCodes.SIGN_IN_FAILED,
+                e.message ?: e.type,
+                e
+              )
+            )
+          }
+        }
+      )
+    } catch (t: Throwable) {
+      promise.reject(CodedException(ErrorCodes.SIGN_IN_FAILED, t.message ?: t.toString(), t))
+    }
+  }
+}

package/android/src/main/java/expo/modules/nativegooglesignin/SignInOptions.kt

@@ -0,0 +1,22 @@
+package expo.modules.nativegooglesignin
+
+import expo.modules.kotlin.records.Field
+import expo.modules.kotlin.records.Record
+import expo.modules.kotlin.types.OptimizedRecord
+
+/**
+ * Options for `signIn`. Field names and types must match `SignInOptions` in `src/types.ts`
+ * exactly, since `src/index.ts` passes the JS object straight through.
+ *
+ * `iosClientId` is accepted (so the JS object doesn't need platform-specific stripping) but
+ * ignored on Android -- see docs/ARCHITECTURE.md -> "No `androidClientId` option".
+ */
+@OptimizedRecord
+data class SignInOptions(
+  @Field
+  val webClientId: String = "",
+  @Field
+  val iosClientId: String? = null,
+  @Field
+  val nonce: String? = null
+) : Record

package/app.plugin.js

@@ -0,0 +1 @@
+module.exports = require('./plugin/build');

package/build/CodedError.d.ts

@@ -0,0 +1,17 @@
+import type { ErrorCode } from "./types";
+/**
+ * A minimal stand-in for `expo-modules-core`'s `CodedError` -- same shape (an `Error` subclass
+ * with a `code` string) -- shared by `index.ts` and `index.web.ts` so `isErrorWithCode` treats
+ * JS-thrown errors (from either platform) and native-thrown errors identically.
+ *
+ * Deliberately not a dependency on `expo-modules-core` itself: this package only declares a peer
+ * dependency on `expo`, which doesn't re-export `CodedError`, and depending on
+ * `expo-modules-core` directly would break for consumers whose package manager doesn't hoist it
+ * (pnpm, Yarn PnP). Not exported from the package's public surface (`src/index.ts`) -- it's an
+ * internal implementation detail, not part of the public API.
+ */
+export declare class CodedError extends Error {
+    code: ErrorCode;
+    constructor(code: ErrorCode, message: string);
+}
+//# sourceMappingURL=CodedError.d.ts.map

package/build/CodedError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CodedError.d.ts","sourceRoot":"","sources":["../src/CodedError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,qBAAa,UAAW,SAAQ,KAAK;IACnC,IAAI,EAAE,SAAS,CAAC;gBAEJ,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM;CAK7C"}