react-native-oauth-essentials 1.0.12 → 1.2.0

package/lib/typescript/src/index.d.ts

@@ -1,78 +1,273 @@
-import { type AppleIdCredentialResult, type CancelledCredentialResult, type GoogleIdCredentialResult, type GoogleSignInOptions, type PassKeyCredentialResult, type PasskeyOptions, type PasswordCredentialResult, type WebAppleIdCredentialResult } from './types';
+import { type EventSubscription } from 'react-native';
+import { type AppleIdCredentialResult, AppleIdCredentialState, type AppleSignInOptions, type CancelledCredentialResult, type CredentialFailureEvent, type CredentialSuccessEvent, type GoogleClientId, type GoogleIdCredentialResult, type GoogleSignInOptions, type HybridSignInOptions, type OAuthCredentialResult, type OAuthSignInOptions, type PassKeyCredentialResult, type PasskeyOptions, type PasswordCredentialResult, type WebAppleIdCredentialResult } from './types';
 export * from './types';
+export { isCredentialError } from './errors';
 /**
- * Performs the google sign in.
- * @param webClientId
- * @param options
+ * Shows the Google sign in UI and resolves with the signed in account.
  *
- * You should rely on GOOGLE_ID_SUPPORTED constant to check if you can use this method.
- * [Available on Android and IOS].
+ * iOS: configures GoogleSignIn with the iOS client id (+ `serverClientId`, `hostedDomain`) and
+ * presents it from the top most view controller, passing `hint`, `scopes` and `nonce`. If the app is
+ * not active it waits up to 2 seconds for it to become active. The client id falls back to
+ * `GIDClientID` and `serverClientId` to `webClientId`, then to `GIDServerClientID` (Info.plist).
+ * Android: shows the Credential Manager bottom sheet (`mode: 'bottomSheet'`, falls back to the
+ * "Sign in with Google" flow when there is no credential and `authorizedAccounts` is not set) or
+ * the "Sign in with Google" flow (`mode: 'button'`). When `scopes` or `offlineAccess` are set it
+ * then asks for authorization, which may show a consent screen.
+ *
+ * Resolves `GOOGLE_ID`, or `CANCELLED` when the user dismisses the UI (or declines the consent
+ * screen on Android).
+ * Rejects with `CONFIGURATION_ERROR` (no client id; iOS: the reversed client id URL scheme is not in
+ * Info.plist, the message has the exact scheme), `NOT_SUPPORTED_ERROR` (Android, no Play Services),
+ * `NO_ACTIVITY_ERROR`,
+ * `NO_SIGN_IN_AVAILABLE` (Android), `BROWSER_UNAVAILABLE` (iOS: app not active, its window not in
+ * the foreground, Guided Access or Safari could not be opened), `SIMULTANEOUS_CALL_ERROR` (iOS: a Google sign in is pending) or
+ * `INVALID_RESULT_ERROR`.
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
+ *
+ * @param clientId - `{ iosClientId, webClientId }` (see {@link GoogleClientIds}), or one client id
+ * string used as is (the iOS client id on iOS, the web client id on Android). Optional: without it
+ * the ids are read from the app config (`googleSignIn()` or `googleSignIn(options)`), see
+ * {@link GoogleClientIds}.
+ * @param options - See {@link GoogleSignInOptions}.
  */
-export declare function googleSignIn(webClientId: string, options?: GoogleSignInOptions): Promise<GoogleIdCredentialResult | CancelledCredentialResult>;
+export declare function googleSignIn(options?: GoogleSignInOptions): Promise<GoogleIdCredentialResult | CancelledCredentialResult>;
+export declare function googleSignIn(clientId: GoogleClientId | null | undefined, options?: GoogleSignInOptions): Promise<GoogleIdCredentialResult | CancelledCredentialResult>;
 /**
- * Gets the stored password.
- * If does not have an stored password, returns false.
+ * Restores a previous Google sign in.
+ *
+ * iOS: calls GoogleSignIn `restorePreviousSignIn`, which never shows UI and refreshes the tokens.
+ * `hint`, `scopes`, `nonce` and `offlineAccess` are ignored and `serverAuthCode` is always null.
+ * Android: shows the Credential Manager bottom sheet filtered to accounts that already signed in to
+ * the app with auto select on, so it signs in without UI when there is a single one. `mode` and
+ * `hint` are ignored. When `scopes`/`offlineAccess` are set, authorization is only requested without UI:
+ * if consent is needed the result has `accessToken: null`.
  *
- * You should rely on PASSWORD_SUPPORTED constant to check if you can use this method.
- * [Available on Android and IOS].
+ * Resolves `GOOGLE_ID`, or `CANCELLED` when the user dismisses the Android sheet.
+ * Rejects with `NO_SIGN_IN_AVAILABLE` when there is nothing to restore, plus the same errors as
+ * {@link googleSignIn} (it shares the iOS simultaneous call lock with it). Takes the same
+ * `clientId` as {@link googleSignIn} (also optional).
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
  */
-export declare function getPassword(): Promise<false | PasswordCredentialResult>;
+export declare function googleSilentSignIn(options?: GoogleSignInOptions): Promise<GoogleIdCredentialResult | CancelledCredentialResult>;
+export declare function googleSilentSignIn(clientId: GoogleClientId | null | undefined, options?: GoogleSignInOptions): Promise<GoogleIdCredentialResult | CancelledCredentialResult>;
 /**
- * Performs the password sign in.
- * Cannot be a already stored password.
- * @param {string} username
- * @param {string} password
+ * Clears the stored sign in state.
  *
- * You should rely on PASSWORD_SUPPORTED constant to check if you can use this method.
- * [Available on Android and IOS].
+ * iOS: calls GoogleSignIn `signOut` (removes the Google session from the keychain, so
+ * {@link googleSilentSignIn} rejects afterwards). It does not affect Apple ID or passwords.
+ * Android: calls Credential Manager `clearCredentialState`, which turns off auto select for every
+ * provider until the user picks an account again.
+ *
+ * Resolves `true`. Rejects with `INVALID_RESULT_ERROR` (Android only) when clearing fails.
+ * Does not emit events.
+ */
+export declare function signOut(): Promise<boolean>;
+/**
+ * Shows the saved passwords of the app and resolves with the one the user picks.
+ *
+ * iOS: `ASAuthorizationPasswordProvider` request (iOS 16+ only offers credentials already saved on
+ * the device). Resolves `PASSWORD`, or the `CANCELLED` result when the user dismisses it or there
+ * is no saved password. Rejects with `INVALID_RESULT_ERROR` on other errors and
+ * `SIMULTANEOUS_CALL_ERROR` while a previous call is pending.
+ * Android: Credential Manager `GetPasswordOption`. Resolves `PASSWORD`, or `CANCELLED` when the user
+ * dismisses it or there is no saved password. Rejects with `NOT_SUPPORTED_ERROR` without Play
+ * Services, `NO_ACTIVITY_ERROR` and `INVALID_RESULT_ERROR` on other errors.
+ *
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
+ */
+export declare function getPassword(): Promise<PasswordCredentialResult | CancelledCredentialResult>;
+/**
+ * Saves a username and password in the platform password manager. It does not authenticate the
+ * user against anything.
+ *
+ * iOS: does nothing and resolves `false` (iOS has no API to save a password without an associated
+ * domain; use the `textContentType` props of your inputs so iOS offers to save it).
+ * Android: Credential Manager `createCredential(CreatePasswordRequest)`, which shows the save
+ * prompt. Resolves `true` when saved, `false` on any error (including the user declining).
+ * Rejects with `NOT_SUPPORTED_ERROR` without Play Services and `NO_ACTIVITY_ERROR`.
+ *
+ * Does not emit events, except `onCredentialFailure` for the Android rejections.
  */
 export declare function passwordSignIn(username: string, password: string): Promise<boolean>;
 /**
- * Initiates the Apple Sign-In process.
- * On IOS devices it handles it smoothly using the latest UI workflow.
- * On Android it dispatches the androidWebUrl to device default browser for handling it.
- * you need to implement on your backend the redirect logic and validation accordingly to the link below
- * @see [Apple Sign In REST API Documentation](https://developer.apple.com/documentation/signinwithapplerestapi)
+ * Signs in with Apple.
+ *
+ * iOS: native Sign in with Apple sheet requesting `fullName` and `email`, with `options.nonce` and
+ * `options.state`. Resolves `APPLE_ID`, or `CANCELLED` when the user dismisses it. Rejects with
+ * `INVALID_RESULT_ERROR` on other errors and `SIMULTANEOUS_CALL_ERROR` while a previous call is
+ * pending. Apple only sends `email`/`fullName` on the first authorization: this function keeps the
+ * first result of each `user` in memory (until the app is killed) and fills empty `email`/`fullName`
+ * with it.
+ * Android: opens `androidWebUrl` in a Custom Tab; `options` is ignored (put the nonce in your url).
+ * Your backend must run the Apple web flow and redirect to `<applicationId>://oauth/callback`.
+ * Resolves `WEB_APPLE_ID` with the redirect url, or `CANCELLED` when the user closes the tab or
+ * another browser session (`appleSignIn`/`oauthSignIn`) starts. Rejects with `INVALID_RESULT_ERROR`
+ * (invalid url), `NO_ACTIVITY_ERROR` or `BROWSER_UNAVAILABLE` (no browser installed).
  *
- * @param {string} androidWebUrl - The web URL on Android where the user will complete the OAuth flow. **[Android only]**
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
+ * @see [Sign in with Apple REST API](https://developer.apple.com/documentation/signinwithapplerestapi)
  *
- * @returns {AppleIdCredentialResult|WebAppleIdCredentialResult} Returns AppleIdCredentialResult on IOS devices and WebAppleIdCredentialResult on android.
+ * @param androidWebUrl - Web url that starts the Apple flow. Required on Android, ignored on iOS.
+ * @param options - See {@link AppleSignInOptions}. iOS only.
  */
-export declare function appleSignIn(androidWebUrl?: string): Promise<AppleIdCredentialResult | WebAppleIdCredentialResult>;
+export declare function appleSignIn(androidWebUrl?: string, options?: AppleSignInOptions): Promise<AppleIdCredentialResult | WebAppleIdCredentialResult | CancelledCredentialResult>;
 /**
- * Performs all sign in methods available on the platform at once.
- * This is supposed to be used on app start to get any existing sign in.
+ * Asks Apple whether the user is still signed in to the app with Apple ID, without UI
+ * (`ASAuthorizationAppleIDProvider.getCredentialState`).
+ * Call it on app start and sign the user out when it is not `AUTHORIZED`.
+ *
+ * Resolves `AUTHORIZED`, `REVOKED`, `TRANSFERRED` or `NOT_FOUND`. Rejects with
+ * `INVALID_RESULT_ERROR` when the check fails, and always with `NOT_SUPPORTED_ERROR` on Android.
+ * Does not emit events.
+ *
+ * @param userId - The `user` field of the AppleIdCredentialResult.
  */
-export declare function hybridSignIn(googleClientId: string, options?: GoogleSignInOptions): Promise<AppleIdCredentialResult | GoogleIdCredentialResult | PasswordCredentialResult | CancelledCredentialResult>;
+export declare function getAppleIdCredentialState(userId: string): Promise<AppleIdCredentialState>;
 /**
- * Creates a passkey.
- * @param options
+ * Shows a single picker with the credentials the user already has, meant for app start.
+ *
+ * iOS: Apple ID + saved passwords (`clientId` is ignored, Google is not included; only
+ * `options.nonce` is used, for Apple ID). On iOS 16+ only credentials already on the device are
+ * offered. Resolves `APPLE_ID` or `PASSWORD`, or `CANCELLED` when the user dismisses it or nothing
+ * is available. Rejects with `INVALID_RESULT_ERROR` or `SIMULTANEOUS_CALL_ERROR`.
+ * Android: Credential Manager with Google ID (bottom sheet option with the web client id,
+ * `authorizedAccounts`, `autoSelectEnabled` and `nonce`) + saved passwords. Apple is not included
+ * and `mode`, `hint`, `scopes`, `offlineAccess`, `hostedDomain` and `serverClientId` are ignored.
+ * Resolves `GOOGLE_ID` or `PASSWORD`, or `CANCELLED`. Rejects with `CONFIGURATION_ERROR` (no web
+ * client id), `NOT_SUPPORTED_ERROR` (no Play Services), `NO_ACTIVITY_ERROR`,
+ * `NO_SIGN_IN_AVAILABLE` or `INVALID_RESULT_ERROR`.
+ *
+ * Ignored options produce a warning in development.
+ * `clientId` is optional like in {@link googleSignIn}: without it the web client id is read from
+ * the app config.
+ *
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
  */
-export declare function createPassKey(options: PasskeyOptions): Promise<PassKeyCredentialResult>;
+export declare function hybridSignIn(options?: HybridSignInOptions): Promise<HybridSignInResult>;
+export declare function hybridSignIn(clientId: GoogleClientId | null | undefined, options?: HybridSignInOptions): Promise<HybridSignInResult>;
+/** Result of {@link hybridSignIn}: Apple ID only on iOS, Google ID only on Android. */
+export type HybridSignInResult = AppleIdCredentialResult | GoogleIdCredentialResult | PasswordCredentialResult | CancelledCredentialResult;
 /**
- * Google Play are supported.
- * It always false on IOS, cause IOS does not use Google Play Services.
+ * Creates a passkey from a WebAuthn `PublicKeyCredentialCreationOptions` JSON (`requestJson`).
+ *
+ * iOS 16+: platform passkey registration. Reads `challenge`, `rp.id`, `user.id`, `user.name`,
+ * `authenticatorSelection.userVerification`, `attestation` and, on iOS 17.4+,
+ * `excludeCredentials`; other fields are ignored. `data` is a JSON string with `id`, `rawId`,
+ * `type` and `response.clientDataJSON`/`attestationObject` (base64url). Rejects with
+ * `NOT_SUPPORTED_ERROR` below iOS 16 and `SIMULTANEOUS_CALL_ERROR` while a passkey call is pending.
+ * Android 9+: Credential Manager `CreatePublicKeyCredentialRequest` with the whole JSON and
+ * `preferImmediatelyAvailableCredentials`. `data` is the registration response JSON returned by
+ * Credential Manager. Rejects with `NOT_SUPPORTED_ERROR` below Android 9 and `NO_ACTIVITY_ERROR`.
+ *
+ * Resolves `PASSKEY`, or `CANCELLED` when the user dismisses it. Rejects with
+ * `INVALID_RESULT_ERROR` for an invalid/missing `requestJson` and other errors.
+ * Emits `onCredentialSuccess` / `onCredentialFailure`. Send `data` to your server to verify it.
+ */
+export declare function createPassKey(options: PasskeyOptions): Promise<PassKeyCredentialResult | CancelledCredentialResult>;
+/**
+ * Signs in with a passkey from a WebAuthn `PublicKeyCredentialRequestOptions` JSON (`requestJson`).
+ *
+ * iOS 16+: platform passkey assertion. Reads `challenge`, `rpId`, `allowCredentials` and
+ * `userVerification`. With `mediation: 'autofill'` it does not show a sheet: it waits until the user
+ * picks a passkey in the QuickType bar of a `textContentType="username"` field, and any other
+ * passkey call (or {@link cancelPassKeyAutoFill}) resolves it as `CANCELLED`. Otherwise it shows a
+ * sheet that only offers passkeys available on the device (no "other device" QR option), so it
+ * resolves `CANCELLED` when there is none. `data` is a JSON string with `id`, `rawId`, `type` and
+ * `response.clientDataJSON`/`authenticatorData`/`signature`/`userHandle` (base64url).
+ * Rejects with `NOT_SUPPORTED_ERROR` below iOS 16 and `SIMULTANEOUS_CALL_ERROR` while a modal
+ * passkey call is pending.
+ * Android 9+: Credential Manager `GetPublicKeyCredentialOption` with the whole JSON and
+ * `preferImmediatelyAvailableCredentials`; `mediation` is ignored. `data` is the authentication
+ * response JSON returned by Credential Manager. Rejects with `NOT_SUPPORTED_ERROR` below Android 9,
+ * `NO_ACTIVITY_ERROR` and `NO_SIGN_IN_AVAILABLE` (no passkey).
+ *
+ * Resolves `PASSKEY`, or `CANCELLED` when the user dismisses it. Rejects with
+ * `INVALID_RESULT_ERROR` for an invalid/missing `requestJson` and other errors.
+ * Emits `onCredentialSuccess` / `onCredentialFailure`. Send `data` to your server to verify it.
+ */
+export declare function getPassKey(options: PasskeyOptions): Promise<PassKeyCredentialResult | CancelledCredentialResult>;
+/**
+ * Cancels a pending `getPassKey({ mediation: 'autofill' })` request, for example when the sign in
+ * screen unmounts. The cancelled `getPassKey` resolves `CANCELLED` (and emits it).
+ *
+ * Resolves `true` when a pending AutoFill request was cancelled, `false` when there was none.
+ * Always resolves `false` on Android and below iOS 16.
+ */
+export declare function cancelPassKeyAutoFill(): Promise<boolean>;
+/**
+ * Signs in with any OAuth 2.0 / OpenID Connect provider using the authorization code flow.
+ *
+ * 1. Generates a random `state` and a PKCE S256 verifier/challenge on the native side.
+ * 2. Builds `authorizationEndpoint?response_type=code&client_id&redirect_uri&state[&scope]
+ *    [&code_challenge&code_challenge_method=S256]` + `additionalParameters` (which may override
+ *    `scope`; the other parameters above are reserved and ignored there, with a dev warning).
+ * 3. Opens it in `ASWebAuthenticationSession` (iOS, `prefersEphemeralSession`, waits up to 2 seconds
+ *    for the app to be active) or a Custom Tab (Android) and waits for the redirect to `redirectUri`.
+ *    On Android the redirect must reach `CustomTabsActivity`: use `OAUTH_REDIRECT_URI` or add an
+ *    intent filter for your uri.
+ * 4. Checks that the returned `state` matches, then reads `code` (query or fragment).
+ * 5. When `tokenEndpoint` is set, POSTs `grant_type=authorization_code`, `code`, `client_id`,
+ *    `redirect_uri` and `code_verifier` as a form and returns the JSON response in `tokens`
+ *    (no client secret is sent, the id_token is not validated).
+ *
+ * Resolves `OAUTH`, or `CANCELLED` when the user closes the browser, the provider returns
+ * `error=access_denied` or (Android) another browser session starts.
+ * Rejects with `INVALID_RESULT_ERROR` (state mismatch, provider error, no code, token endpoint
+ * returned non 2xx or non JSON), `NETWORK_ERROR` (token request failed), `CONFIGURATION_ERROR`
+ * (invalid `redirectUri`), `BROWSER_UNAVAILABLE` (iOS: Guided Access, app not active or its window
+ * not in the foreground; Android: no browser), `NO_ACTIVITY_ERROR` or `SIMULTANEOUS_CALL_ERROR` (iOS).
+ * Does not emit events.
+ */
+export declare function oauthSignIn(options: OAuthSignInOptions): Promise<OAuthCredentialResult | CancelledCredentialResult>;
+/**
+ * Called with the same `{ type, data }` the promise resolves with (including `CANCELLED`), for
+ * `googleSignIn`, `googleSilentSignIn`, `getPassword`, `appleSignIn`, `hybridSignIn`,
+ * `createPassKey` and `getPassKey`. Not called by `signOut`, `passwordSignIn`,
+ * `getAppleIdCredentialState`, `cancelPassKeyAutoFill` and `oauthSignIn`.
+ */
+export declare function addCredentialSuccessListener(listener: (event: CredentialSuccessEvent) => void): EventSubscription;
+/**
+ * Called with `{ code, message }` when one of the methods listed in
+ * {@link addCredentialSuccessListener} rejects. `SIMULTANEOUS_CALL_ERROR`, the iOS
+ * `NOT_SUPPORTED_ERROR` below iOS 16 and the iOS missing `requestJson` error are not emitted.
+ */
+export declare function addCredentialFailureListener(listener: (event: CredentialFailureEvent) => void): EventSubscription;
+/**
+ * Called when iOS posts `credentialRevokedNotification`, i.e. the user stopped using Apple ID with
+ * the app while it is running. Sign the user out when it fires. Never called on Android.
+ */
+export declare function addAppleIdCredentialRevokedListener(listener: () => void): EventSubscription;
+/**
+ * Android: Google Play Services are installed and up to date (read once, when the module loads).
+ * iOS: always false.
  */
 export declare const GOOGLE_PLAY_SERVICES_SUPPORTED: boolean;
 /**
- * The password method is supported.
+ * iOS: always true. Android: same as `GOOGLE_PLAY_SERVICES_SUPPORTED` (`getPassword` and
+ * `passwordSignIn` reject with `NOT_SUPPORTED_ERROR` without Play Services).
  */
 export declare const PASSWORD_SUPPORTED: boolean;
 /**
- * Google Play id sign in is supported.
- * You should mainly rely on this constant to check if you can use google sign in.
+ * iOS: always true. Android: same as `GOOGLE_PLAY_SERVICES_SUPPORTED`.
  */
 export declare const GOOGLE_ID_SUPPORTED: boolean;
 /**
- * Gets if Apple id sign in is supported.
+ * Always true (native on iOS, web flow in a Custom Tab on Android).
  */
 export declare const APPLE_ID_SUPPORTED: boolean;
 /**
- * Gets if "hybrid" is supported in this platform.
+ * iOS: always true. Android: same as `GOOGLE_PLAY_SERVICES_SUPPORTED` (`hybridSignIn` rejects with
+ * `NOT_SUPPORTED_ERROR` without Play Services).
  */
 export declare const HYBRID_SUPPORTED: boolean;
 /**
- * Gets if passkeys are supported.
+ * iOS 16+ / Android 9+ (API 28).
  */
 export declare const PASSKEYS_SUPPORTED: boolean;
+/**
+ * Default redirect uri of `oauthSignIn`: `<bundle id, lowercased>://oauth/callback` on iOS and
+ * `<applicationId>://oauth/callback` on Android (the uri the library's `CustomTabsActivity`
+ * intent filter handles).
+ */
+export declare const OAUTH_REDIRECT_URI: string;
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/src/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,yBAAyB,EAE9B,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,SAAS,CAAC;AAEjB,cAAc,SAAS,CAAC;AAMxB;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAK/D;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,KAAK,GAAG,wBAAwB,CAAC,CAG7E;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAElB;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,WAAW,CAC/B,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,uBAAuB,GAAG,0BAA0B,CAAC,CA4B/D;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,cAAc,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CACN,uBAAuB,GACvB,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,CAC5B,CAQA;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,uBAAuB,CAAC,CAIlC;AA0BD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,SACD,CAAC;AAE3C;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAA+B,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,mBAAmB,SAAgC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAA+B,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,gBAAgB,SAA6B,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAA+B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,iBAAiB,EAAY,MAAM,cAAc,CAAC;AAChE,OAAO,EACL,KAAK,uBAAuB,EAC5B,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC9B,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAG3B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,kBAAkB,EACvB,KAAK,uBAAuB,EAC5B,KAAK,cAAc,EACnB,KAAK,wBAAwB,EAC7B,KAAK,0BAA0B,EAChC,MAAM,SAAS,CAAC;AAgBjB,cAAc,SAAS,CAAC;AACxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAM7C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,YAAY,CAChC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;AACjE,wBAAsB,YAAY,CAChC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;AA+BjE;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;AACjE,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,wBAAwB,GAAG,yBAAyB,CAAC,CAAC;AA0BjE;;;;;;;;;;GAUG;AACH,wBAAsB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,CAEhD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAC1C,wBAAwB,GAAG,yBAAyB,CACrD,CAIA;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CASlB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,WAAW,CAC/B,aAAa,CAAC,EAAE,MAAM,EACtB,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CACN,uBAAuB,GACvB,0BAA0B,GAC1B,yBAAyB,CAC5B,CAiCA;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,sBAAsB,CAAC,CAIjC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,YAAY,CAChC,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAC/B,wBAAsB,YAAY,CAChC,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,OAAO,CAAC,EAAE,mBAAmB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,CAAC;AA2C/B,uFAAuF;AACvF,MAAM,MAAM,kBAAkB,GAC1B,uBAAuB,GACvB,wBAAwB,GACxB,wBAAwB,GACxB,yBAAyB,CAAC;AAE9B;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,uBAAuB,GAAG,yBAAyB,CAAC,CAK9D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,uBAAuB,GAAG,yBAAyB,CAAC,CAK9D;AAoBD;;;;;;GAMG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9D;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,GAC1B,OAAO,CAAC,qBAAqB,GAAG,yBAAyB,CAAC,CA+F5D;AAMD;;;;;GAKG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,GAChD,iBAAiB,CAEnB;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,CAAC,KAAK,EAAE,sBAAsB,KAAK,IAAI,GAChD,iBAAiB,CAInB;AAED;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,MAAM,IAAI,GACnB,iBAAiB,CAEnB;AA6CD;;;GAGG;AACH,eAAO,MAAM,8BAA8B,SACD,CAAC;AAE3C;;;GAGG;AACH,eAAO,MAAM,kBAAkB,SAA+B,CAAC;AAE/D;;GAEG;AACH,eAAO,MAAM,mBAAmB,SAAgC,CAAC;AAEjE;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAA+B,CAAC;AAE/D;;;GAGG;AACH,eAAO,MAAM,gBAAgB,SAA6B,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,kBAAkB,SAA+B,CAAC;AAE/D;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,QAA+B,CAAC"}

package/lib/typescript/src/oauth.d.ts

@@ -0,0 +1,32 @@
+export type PkcePair = {
+    codeVerifier: string;
+    codeChallenge: string;
+    state: string;
+};
+export type AuthorizationUrlParams = {
+    authorizationEndpoint: string;
+    clientId: string;
+    redirectUri: string;
+    scopes?: string[];
+    additionalParameters?: Record<string, string>;
+    state: string;
+    codeChallenge?: string;
+};
+/**
+ * Set by the library and checked or reused later (state, PKCE, token exchange), so
+ * `additionalParameters` cannot override them.
+ */
+export declare const RESERVED_AUTHORIZATION_PARAMS: readonly ["response_type", "client_id", "redirect_uri", "state", "code_challenge", "code_challenge_method"];
+export declare function buildAuthorizationUrl(p: AuthorizationUrlParams): string;
+/**
+ * Reads the query and fragment parameters of a redirect url.
+ */
+export declare function parseRedirectParams(url: string): Record<string, string>;
+export declare function getUrlScheme(url: string): string;
+export declare function buildTokenRequestBody(p: {
+    code: string;
+    clientId: string;
+    redirectUri: string;
+    codeVerifier: string | null;
+}): string;
+//# sourceMappingURL=oauth.d.ts.map

package/lib/typescript/src/oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../../../src/oauth.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,QAAQ,GAAG;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAuBF;;;GAGG;AACH,eAAO,MAAM,6BAA6B,6GAOhC,CAAC;AAEX,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,sBAAsB,GAAG,MAAM,CA6BvE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBvE;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAShD;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EAAE;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B,GAAG,MAAM,CAWT"}

package/lib/typescript/src/platform.d.ts

@@ -0,0 +1,39 @@
+import type { GoogleClientId, GoogleSignInOptions } from './types';
+type OS = 'ios' | 'android' | string;
+/**
+ * Picks the client id the native module of `os` expects.
+ *
+ * A string is passed as is. With `{ iosClientId, webClientId }`, iOS gets `iosClientId` (or '' so
+ * the native side reads `GIDClientID` from Info.plist) and `webClientId` as the default
+ * `serverClientId`; Android gets `webClientId` (or '', which rejects with `CONFIGURATION_ERROR`).
+ */
+export declare function resolveGoogleClientId<T extends GoogleSignInOptions>(os: OS, clientId: GoogleClientId | null | undefined, options: T): {
+    clientId: string;
+    options: T;
+};
+/**
+ * Splits the `(clientId?, options?)` arguments of the Google methods, which also accept
+ * `(options)`: an object with `iosClientId` or `webClientId` is the client id, any other object is
+ * the options. Without a client id the native side reads it from the app config (Info.plist,
+ * AndroidManifest meta-data or the Firebase files).
+ */
+export declare function splitGoogleArgs<T extends object>(first: GoogleClientId | T | null | undefined, second: T | undefined): {
+    clientId: GoogleClientId | undefined;
+    options: T | undefined;
+};
+/**
+ * Message thrown when the native module is not in the binary: Expo Go (which only ships the Expo
+ * SDK native modules) or an app that was not rebuilt after installing the library.
+ */
+export declare function missingNativeModuleMessage(): string;
+/**
+ * In development, warns once per method and option that an option set by the app has no effect on
+ * the current platform. `options` must be the options as passed by the app (before defaults).
+ */
+export declare function warnIgnored(method: string, platform: string, options: object | null | undefined, keys: readonly string[]): void;
+/**
+ * In development, logs `message` once per method and key.
+ */
+export declare function warnOnce(method: string, key: string, message: string): void;
+export {};
+//# sourceMappingURL=platform.d.ts.map

package/lib/typescript/src/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../../src/platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAEnE,KAAK,EAAE,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,CAAC;AAErC;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,CAAC,SAAS,mBAAmB,EACjE,EAAE,EAAE,EAAE,EACN,QAAQ,EAAE,cAAc,GAAG,IAAI,GAAG,SAAS,EAC3C,OAAO,EAAE,CAAC,GACT;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,CAAC,CAAA;CAAE,CAalC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,MAAM,EAC9C,KAAK,EAAE,cAAc,GAAG,CAAC,GAAG,IAAI,GAAG,SAAS,EAC5C,MAAM,EAAE,CAAC,GAAG,SAAS,GACpB;IAAE,QAAQ,EAAE,cAAc,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,CAAC,GAAG,SAAS,CAAA;CAAE,CAYlE;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAgBnD;AAID;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,IAAI,CAaN;AAQD;;GAEG;AACH,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAU3E"}

package/lib/typescript/src/types.d.ts

@@ -1,10 +1,136 @@
 export type GoogleSignInOptions = {
+    /**
+     * Only show accounts that already signed in to the app. [Android only]
+     */
     authorizedAccounts?: boolean;
+    /**
+     * Automatically sign in when a single authorized account is available. [Android only]
+     */
     autoSelectEnabled?: boolean;
+    /**
+     * Android UI flow. `bottomSheet` (default) shows the Credential Manager sheet and, unless
+     * `authorizedAccounts` is set, falls back to `button` when no credential is available
+     * (no account on the device or the sheet is in cooldown after being dismissed).
+     * `button` always shows the "Sign in with Google" flow, which is what a sign-in button tap
+     * should use. [Android only]
+     */
+    mode?: 'bottomSheet' | 'button';
+    /**
+     * Nonce embedded as-is in the returned idToken, so your backend can prevent replay attacks.
+     * Ignored by `googleSilentSignIn` on iOS.
+     */
+    nonce?: string;
+    /**
+     * Email to preselect in the Google page. [iOS only]
+     */
+    hint?: string;
+    /**
+     * Restricts sign in to a Google Workspace domain. On Android it only applies to the
+     * "Sign in with Google" (`button`) flow and to the authorization step, not to the bottom sheet.
+     */
+    hostedDomain?: string;
+    /**
+     * Additional OAuth scopes the user must grant.
+     * iOS: requested during sign in; `accessToken` and `grantedScopes` are always returned.
+     * Android: requested in a second step (Authorization API, may show a consent screen); without
+     * `scopes`/`offlineAccess`, `accessToken` and `grantedScopes` are null.
+     */
+    scopes?: string[];
+    /**
+     * Android: requests a `serverAuthCode` (for `serverClientId`, or the main client id) your backend
+     * can exchange for refresh tokens. iOS: no effect, `serverAuthCode` is returned whenever
+     * `serverClientId` is set.
+     */
+    offlineAccess?: boolean;
+    /**
+     * iOS: web (server) client id. Makes it the idToken audience and returns a `serverAuthCode`.
+     * Android: client id the `serverAuthCode` is issued for (defaults to the main client id).
+     */
+    serverClientId?: string;
 };
+/**
+ * Google OAuth client ids per platform, all from the same Google Cloud project.
+ *
+ * Both are optional: a missing id is read from the app config, which the Expo plugin writes (from
+ * its options or the Firebase files).
+ */
+export type GoogleClientIds = {
+    /**
+     * iOS client id (created with the iOS bundle id). Used on iOS only. When missing, the `GIDClientID`
+     * key of Info.plist is used, then `CLIENT_ID` of GoogleService-Info.plist.
+     */
+    iosClientId?: string;
+    /**
+     * Web client id. Android: the client id passed to Credential Manager; when missing, the
+     * `com.oauthessentials.GOOGLE_WEB_CLIENT_ID` meta-data of AndroidManifest is used, then the
+     * `default_web_client_id` string generated by the Firebase `google-services` Gradle plugin.
+     * iOS: the default `serverClientId` (idToken audience); when missing, the `GIDServerClientID` key
+     * of Info.plist is used.
+     */
+    webClientId?: string;
+};
+/**
+ * A {@link GoogleClientIds} object, or a single client id string, used as is on both platforms
+ * (it must be the iOS client id on iOS and the web client id on Android).
+ */
+export type GoogleClientId = string | GoogleClientIds;
+export type AppleSignInOptions = {
+    /**
+     * Nonce passed as-is to Apple and embedded in the idToken. Firebase and Supabase expect the
+     * SHA-256 of the raw nonce here. [iOS only, on Android put it in your `androidWebUrl`]
+     */
+    nonce?: string;
+    /**
+     * Opaque value returned in the credential. [iOS only]
+     */
+    state?: string;
+};
+export type HybridSignInOptions = GoogleSignInOptions;
 export type PasskeyOptions = {
+    /**
+     * WebAuthn options JSON from your server: `PublicKeyCredentialCreationOptions` for
+     * `createPassKey`, `PublicKeyCredentialRequestOptions` for `getPassKey`.
+     */
     requestJson: string;
+    /**
+     * Only offer credentials already available on the device. [Android only, iOS modal requests
+     * always behave this way]
+     */
     preferImmediatelyAvailableCredentials?: boolean;
+    /**
+     * `autofill` shows passkeys in the QuickType bar of a text field with
+     * `textContentType="username"` instead of a modal sheet. [iOS 16+ only]
+     */
+    mediation?: 'modal' | 'autofill';
+};
+export type OAuthSignInOptions = {
+    authorizationEndpoint: string;
+    clientId: string;
+    /**
+     * Defaults to `OAUTH_REDIRECT_URI` (`<bundle or application id>://oauth/callback`).
+     */
+    redirectUri?: string;
+    scopes?: string[];
+    /**
+     * Extra authorization request parameters (e.g. `prompt`, `login_hint`, `nonce`). They may
+     * override `scope`, but `response_type`, `client_id`, `redirect_uri`, `state`, `code_challenge`
+     * and `code_challenge_method` are set by the library and ignored here (with a warning in
+     * development).
+     */
+    additionalParameters?: Record<string, string>;
+    /**
+     * When set, the authorization code is exchanged for tokens on the device.
+     * Leave it out to exchange the code on your backend (recommended for confidential clients).
+     */
+    tokenEndpoint?: string;
+    /**
+     * Defaults to true.
+     */
+    usePKCE?: boolean;
+    /**
+     * Do not share cookies with the browser. [iOS only]
+     */
+    prefersEphemeralSession?: boolean;
 };
 export type PassKeyCredentialResult = {
     type: CredentialsType.PASSKEY;
@@ -20,13 +146,20 @@ export type PasswordCredentialResult = {
 export type GoogleIdCredentialResult = {
     type: CredentialsType.GOOGLE_ID;
     data: {
+        /** iOS: Google user id (the idToken `sub`). Android: the account email. */
         id: string;
         idToken: string;
         displayName: string;
         givenName: string;
         familyName: string;
+        email?: string;
+        /** iOS: 200px picture url or "". */
         profilePictureUri?: string | null;
+        /** Android only. */
         phoneNumber?: string | null;
+        accessToken?: string | null;
+        serverAuthCode?: string | null;
+        grantedScopes?: string[] | null;
     };
 };
 export type CancelledCredentialResult = {
@@ -42,6 +175,7 @@ export type AppleIdCredentialResult = {
         email: string;
         fullName: string;
         likelyReal: boolean;
+        state?: string | null;
     };
 };
 export type WebAppleIdCredentialResult = {
@@ -54,17 +188,71 @@ export type WebAppleIdCredentialResult = {
         query: string | null;
     };
 };
+export type OAuthCredentialResult = {
+    type: CredentialsType.OAUTH;
+    data: {
+        code: string;
+        state: string;
+        redirectUri: string;
+        codeVerifier: string | null;
+        /** All parameters received in the redirect url. */
+        params: Record<string, string>;
+        /** Token endpoint response, only when `tokenEndpoint` is set. */
+        tokens: Record<string, unknown> | null;
+    };
+};
+export type CredentialSuccessEvent = {
+    type: string;
+    data: Object;
+};
+export type CredentialFailureEvent = {
+    code: CredentialErrorCode;
+    message: string;
+};
 export declare enum CredentialsType {
     GOOGLE_ID = "GOOGLE_ID",// GoogleId credentials type
     PASSWORD = "PASSWORD",// Password credentials type
     APPLE_ID = "APPLE_ID",// IOS AppleId credentials type
     WEB_APPLE_ID = "WEB_APPLE_ID",// Android AppleId credentials type
     CANCELLED = "CANCELLED",// type when the user cancels it
-    PASSKEY = "PASSKEY"
+    PASSKEY = "PASSKEY",// Passkey credential type
+    OAUTH = "OAUTH"
+}
+export declare enum AppleIdCredentialState {
+    AUTHORIZED = "AUTHORIZED",
+    REVOKED = "REVOKED",
+    NOT_FOUND = "NOT_FOUND",
+    TRANSFERRED = "TRANSFERRED"
 }
 export declare enum CredentialError {
+    /**
+     * @deprecated Never thrown: missing Play Services rejects with `NOT_SUPPORTED_ERROR`.
+     */
     NO_PLAY_SERVICES_ERROR = "NO_PLAY_SERVICES_ERROR",
+    /** No Android activity, or no iOS view controller attached to a window, to present the UI. */
     NO_ACTIVITY_ERROR = "NO_ACTIVITY_ERROR",
-    INVALID_RESULT_ERROR = "INVALID_RESULT_ERROR"
+    /** The provider failed or returned something unexpected; `message` has the native error. */
+    INVALID_RESULT_ERROR = "INVALID_RESULT_ERROR",
+    /** There is no credential to return (no account / passkey / previous sign in). */
+    NO_SIGN_IN_AVAILABLE = "NO_SIGN_IN_AVAILABLE",
+    /** iOS: the same method (or method group) is still waiting for the previous call. */
+    SIMULTANEOUS_CALL_ERROR = "SIMULTANEOUS_CALL_ERROR",
+    /** The OS version, missing Play Services or the platform does not support the method. */
+    NOT_SUPPORTED_ERROR = "NOT_SUPPORTED_ERROR",
+    /** The browser session could not be opened (app in background, Guided Access, no browser). */
+    BROWSER_UNAVAILABLE = "BROWSER_UNAVAILABLE",
+    /**
+     * The app is misconfigured: missing Google client id, missing iOS URL scheme (the message has
+     * the exact scheme to add) or an invalid `redirectUri`.
+     */
+    CONFIGURATION_ERROR = "CONFIGURATION_ERROR",
+    /** `oauthSignIn`: the token endpoint request failed (offline, DNS, TLS...). */
+    NETWORK_ERROR = "NETWORK_ERROR"
 }
+/** A {@link CredentialError} value, as an enum member or its string. */
+export type CredentialErrorCode = `${CredentialError}`;
+/** Every promise of the library rejects with an `Error` that has one of these codes. */
+export type OauthEssentialsError<C extends CredentialErrorCode = CredentialErrorCode> = Error & {
+    code: C;
+};
 //# sourceMappingURL=types.d.ts.map