[botinc-agent]

Prepares @didit-protocol/auth-react-native as a separate, private React Native workspace. Importing it without native code is safe; signIn, currentSession, getToken, signOut and stepUp reject with ERR_DIDIT_AUTH_UNAVAILABLE. The native implementations also reject every operation, and an unexpected native resolution cannot report authentication success.

The package includes independent exports, TurboModule registration, Android/iOS autolinking, build and packaging checks, and integration into the existing example's native CI builds. Android registration uses the existing verification wrapper's constructor-reflection pattern: it handles the seven-argument ReactModuleInfo constructor used by React Native 0.77/0.78 and the six-argument shape available in newer versions. The declared React Native range is unchanged.

NOT-READY for authentication or publication. The reviewed native DiditAuth contract and distribution are still pending. Publishing remains disabled with private: true. The matching Flutter didit_auth requires its own package in sdk-flutter; this PR contains only the React Native package.

Local validation rerun at e80e41b8e15afc54b5518e5f5d0ae6f60b04f88e, all commands exited 0:

yarn typecheck
yarn tsc -p packages/auth-react-native/tsconfig.json --noEmit
yarn lint
yarn test --runInBand
yarn prepare
yarn build:auth
yarn workspace @didit-protocol/auth-react-native pack --dry-run
git diff --check

Test Suites: 15 passed, 15 total
Tests:       119 passed, 119 total
Snapshots:   0 total
Ran all test suites.

Codegen checks cover React Native 0.77 and 0.83; packaging checks cover native sources, autolinking and separation from the verification release. CommonJS, ESM and TypeScript declarations build successfully. Existing peer-dependency and Browserslist warnings remain.

The constructor fix is published at e80e41b8e15afc54b5518e5f5d0ae6f60b04f88e. CI for this revision passed all five jobs: lint/typecheck, tests, both library builds and packaging, Android example build, and iOS example build plus the existing bridge tests. The Android log confirms a cache miss and compilation of the authentication package's Kotlin and generated Java sources. The examples use React Native 0.83. Both review findings still require fresh review approval. main remains at 78ce13a3b3876af77cc480b962d55c75d4a67707, so no base merge was needed.

Remaining acceptance and release checks:

• Native compilation and existing iOS bridge tests were verified through the CI jobs above, not locally. React Native 0.77/0.78 native builds and on-device module registration/unavailable rejection checks remain unverified. Compile and exercise the package in those versions and the current version before declaring that runtime support matrix validated. JavaScript tests and codegen alone do not establish it.
• The example's committed Podfile.lock has not been regenerated for the new pod. Regenerate it on macOS with cd example/ios && bundle exec pod install --repo-update, review the resulting lock change, and build/test the example. The podspec's auth-react-native-v0.0.0 source tag is a placeholder and must be replaced with a real release tag before publication; current workspace consumption uses a local path.
• After connecting the reviewed native dependency, verify real hosted login/cancel, callback replay rejection, passkeys, session restore/expiry/revocation, concurrent refresh, logout, step-up, signals and application isolation. Native credentials and refresh tokens must remain native-owned. These flows are not implemented or proven by this package.
• No screens or visible states change in this PR or revision, so there are no before/after screenshots. Future real hosted/native flows require their own runtime tests and visual captures; visual evidence cannot establish authentication readiness.

[arosasg]

💡 Code review

Reviewed commit: e80e41b

No blocking findings in commit e80e41b.

Verdict: APPROVE

No blocking source findings. One clean source-review round is closed without source edits or unchanged-head rereview.

Clean-context retrospective independent source audit completed 2026-10-12T10:44:26.661491+00:00 on exact e80e41b.
Actual original merge first parent 78ce13a, three-dot merge base 78ce13a, 27 files.
The reviewer received only the PR title and standard output contract.
This completed after the external 2026-10-12T10:29:55Z merge and is postmerge evidence, not premerge approval.
This is the private unavailable-only authentication boundary. Native implementation dependencies, real RN0.77/RN0.78 device and provider flows, full authentication acceptance and any package publication remain separate and unfulfilled by source approval or compile checks.
Deployment and postmerge automated checks remain separate.