zuraffa_auth_macos

macOS adapter for zuraffa_auth — local-authorization sign-in (LocalAuthentication-shaped) and data-protection Keychain session persistence over one injected channel seam.

Pure Dart: the native embedder is a documented method/error protocol, not a dependency.

final channel = MacosAuthChannel(invoke: myTransport.invoke);
final auth = AuthService(
  providers: [
    MacosCredentialAuthProvider(
      channel: channel,
      context: MacosAuthContext(bundleId: 'com.example.app', teamId: 'T34M'),
    ),
  ],
  sessions: MacosKeychainSessionStore(channel: channel, context: context),
);
// or:
registerMacosAuthDependencies(getIt, channel: channel);

Channel protocol

Method	Args	Result	Errors
`authorize`	`identifier`, `secret`, extras, `bundleId`, `teamId`, `dataProtection`	token payload + `subject`, `displayName?`, `email?`	see below
`refreshCredential`	token fields + context + flavor	token payload	see below
`revokeCredential`	`accessToken` + context + flavor	any (best-effort)	swallowed
`secureWrite`	`key`, `value` (JSON), `dataProtection`, `partitions`	any	typed
`secureRead`	`key`, `dataProtection`	`{value: String?}`	typed
`secureKeys`	`prefix`, `dataProtection`	`{keys: [String]}`	typed
`secureDelete`	`key`, `dataProtection`	`{deleted: bool}`	typed

Errors arrive as {'error': {'code', 'message'}} payloads (or thrown transport failures → channel_error). Taxonomy: no_credentials → typed invalid_credentials; user_cancelled / interaction_not_allowed / timeout → recoverable; keychain_unavailable / entitlement_missing and unknown codes → non-recoverable, preserved verbatim.

Keychain flavor

Every call carries the declared dataProtection flag (default true — the modern data-protection keychain, not the legacy file-based one) and every write is partition-scoped to the context's bundleId.

zuraffa_auth_macos

Channel protocol

Keychain flavor

Libraries

zuraffa_auth_macos package