antinvestor_auth_runtime

Added

• NativeCredentialConfig, a high-level factory configuration for Apple and Google native credential providers. Android apps can now enable the Google Sign-In v7 Credential Manager / One Tap path with createAuthRuntime(nativeCredentialConfig: NativeCredentialConfig(...)).
• preferSilent support for native credentials. Apps can now explicitly disable the app-start no-UI credential attempt while keeping the interactive native sheet on sign-in tap.

Changed

• createAuthRuntime rejects simultaneous nativeCredentialConfig and nativeProviders inputs to prevent ambiguous native credential setup.
• Documentation now presents NativeCredentialConfig as the preferred app integration path and keeps nativeProviders for tests and custom provider stacks.

Changed

• Browser leg now uses flutter_web_auth_2 instead of flutter_appauth. Adds web, Windows, and Linux to the supported platforms (previously iOS/Android/macOS only) and removes the AppAuth iOS pod, eliminating the long-standing pod conflict with google_sign_in_ios (AppAuth ~> 2.0). PKCE/state/nonce are now generated by TokenWorker.prepareAuth exclusively — the previous double-generation (worker + flutter_appauth) is gone, and the OAuth state parameter is now actually verified end-to-end.

Breaking

• The internal OAuthFlow.authorize now takes an AuthorizeRequest argument and OAuthResult no longer carries verifier/nonce. OAuthFlow is package:antinvestor_auth_runtime/src/... (not exported), so consumers that only depend on createAuthRuntime are unaffected. Tests that subclass OAuthFlow need to update the override signature.

Platform setup (consumers)

• iOS / macOS: declare your redirectScheme (e.g. com.example.app) under CFBundleURLTypes in Info.plist. Universal Links also work — set redirectUri to the https://... URL and flutter_web_auth_2 will use ASWebAuthenticationSession.
• Android: add flutter_web_auth_2's CallbackActivity to AndroidManifest.xml with an intent filter for the redirect scheme. See flutter_web_auth_2 README.
• Web: host auth.html at the redirect URI's path (flutter_web_auth_2 posts the callback URL via window.opener.postMessage).
• Windows / Linux: uses an embedded desktop_webview_window by default; pass an http://localhost:{port} redirectUri if you want the loopback fallback.

FedCM

• The runtime is FedCM-transparent: flutter_web_auth_2 opens the IdP login page in the system browser, and FedCM (navigator.credentials.get({ identity })) is invoked by the IdP page itself when the IdP supports it. No client-side wiring is required.

Dependencies

• flutter_secure_storage 9 → 10. Migrates Android off the deprecated Jetpack Crypto package and unifies iOS/macOS into flutter_secure_storage_darwin. Consumer apps must raise platform mins: Android minSdkVersion >= 23 (was 19), iOS >= 12.0, macOS >= 10.14.
• pointycastle 3.9 → 4.0. Pure additive: new ciphers (Blowfish, Camellia, Twofish), generics on generateKeyPair. No usage changes required.
• sign_in_with_apple 6.1 → 7.0. Extended AuthorizationErrorCode cases (our switch already has a default: fall-through, so no code changes).

Added

• runtime.fetch / runtime.upload accept fully-qualified https://... URLs; when the path starts with http:// or https://, the runtime uses it directly and skips apiBaseUrl prepending. Unblocks consumers that talk to multiple service domains with a single OAuth client.