antinvestor_auth_runtime

Changed

• Browser leg now uses flutter_web_auth_2 instead of flutter_appauth. Adds web, Windows, and Linux to the supported platforms (previously iOS/Android/macOS only) and removes the AppAuth iOS pod, eliminating the long-standing pod conflict with google_sign_in_ios (AppAuth ~> 2.0). PKCE/state/nonce are now generated by TokenWorker.prepareAuth exclusively — the previous double-generation (worker + flutter_appauth) is gone, and the OAuth state parameter is now actually verified end-to-end.

Breaking

• The internal OAuthFlow.authorize now takes an AuthorizeRequest argument and OAuthResult no longer carries verifier/nonce. OAuthFlow is package:antinvestor_auth_runtime/src/... (not exported), so consumers that only depend on createAuthRuntime are unaffected. Tests that subclass OAuthFlow need to update the override signature.

Platform setup (consumers)

• iOS / macOS: declare your redirectScheme (e.g. com.example.app) under CFBundleURLTypes in Info.plist. Universal Links also work — set redirectUri to the https://... URL and flutter_web_auth_2 will use ASWebAuthenticationSession.
• Android: add flutter_web_auth_2's CallbackActivity to AndroidManifest.xml with an intent filter for the redirect scheme. See flutter_web_auth_2 README.
• Web: host auth.html at the redirect URI's path (flutter_web_auth_2 posts the callback URL via window.opener.postMessage).
• Windows / Linux: uses an embedded desktop_webview_window by default; pass an http://localhost:{port} redirectUri if you want the loopback fallback.

FedCM

• The runtime is FedCM-transparent: flutter_web_auth_2 opens the IdP login page in the system browser, and FedCM (navigator.credentials.get({ identity })) is invoked by the IdP page itself when the IdP supports it. No client-side wiring is required.

Dependencies

• flutter_secure_storage 9 → 10. Migrates Android off the deprecated Jetpack Crypto package and unifies iOS/macOS into flutter_secure_storage_darwin. Consumer apps must raise platform mins: Android minSdkVersion >= 23 (was 19), iOS >= 12.0, macOS >= 10.14.
• pointycastle 3.9 → 4.0. Pure additive: new ciphers (Blowfish, Camellia, Twofish), generics on generateKeyPair. No usage changes required.
• sign_in_with_apple 6.1 → 7.0. Extended AuthorizationErrorCode cases (our switch already has a default: fall-through, so no code changes).