fix(expo): make native callback configuration reliable and repeatable

[OskarEichler]

Fixes

Write callback schemes through Info.plist modResults, deduplicate them, and skip missing schemes. Use the standard Android Gradle mod, preserve unrelated placeholders, and update one generated assignment at the end of defaultConfig. Resolve each app target build configuration’s actual bridging header instead of recursively editing an arbitrary .h file; configure a new header for both Debug and Release when needed. Support final Swift AppDelegate declarations and missing factory properties, fail clearly on unsupported entry points, and detect installed Expo versions for workspace dependencies.

Breaking / observable changes

Repeated prebuilds no longer fail on existing manifest placeholders or duplicate scheme/import declarations. Invalid Android schemes and unrecognized Swift entry points fail with an actionable error. Existing configured headers/imports are preserved; missing configured headers are not silently replaced. Only the first redirect URL scheme is configured, as before, now documented explicitly. Generated plugin internals are consolidated; no app-auth JS API changes.

Verification

16 isolated actual-plugin diagnostics pass; all 16 fail on the baseline. Fixtures use real Expo config utilities and a parsed Xcode project, checking unrelated files/placeholders, Debug/Release settings, repeated prebuilds, custom headers, final Swift classes, malformed input and installed workspace Expo versions. TypeScript plugin build and existing plugin Jest suites pass. No full Expo native app/device build is claimed.

Each patch was applied independently to upstream commit 6f9090ce1b991c0acc2a6f5dc8bea838deaf4f7a and passed its targeted external actual-source diagnostics or standalone type/lockfile check. The combined fixes pass 75 focused diagnostics. These use synthetic values, controlled native/bridge doubles and disposable filesystem projects, not real credentials.

Combined branch checks:

• Existing Jest suite: 3 suites, 81 tests pass.
• Root lint, demo lint, targeted App.tsx lint, demo TypeScript and standalone public-type checks pass.
• Expo plugin TypeScript build passes. The optional lint:plugin command has a baseline tooling limitation: ESLint 6 does not find its TypeScript-only input.
• Android Debug demo build passes with RN 0.79.2.
• Unsigned iOS Simulator Debug demo build passes with RN 0.79.2.
• Android and iOS production Metro demo bundles pass.
• git diff --check passes.

No checked-in test/spec files were added, changed or disabled. The source changes are supported by external reproducible diagnostics because this audit's repository policy prohibits checked-in test edits. Live OAuth providers, physical-device/browser authentication and a full Expo native build were not exercised. React Doctor reports two warnings: the discovery response is explicitly guarded by response.ok === false, and the demo pending reset is inside finally; both paths are exercised by focused checks. No rules were suppressed.

Scope

• packages/react-native-app-auth/plugin/src/android/app-build-gradle.ts
• packages/react-native-app-auth/plugin/src/expo-version.ts
• packages/react-native-app-auth/plugin/src/index.ts
• packages/react-native-app-auth/plugin/src/ios/app-delegate.ts
• packages/react-native-app-auth/plugin/src/ios/bridging-header.ts
• packages/react-native-app-auth/plugin/src/ios/index.ts
• packages/react-native-app-auth/plugin/src/ios/info-plist.ts
• docs/docs/usage/expo-setup.md
• .changeset/appauth-expo-native-configuration.md

Unrelated audit fixes are submitted separately. The separate iOS process-global OIDURLSessionProvider request-isolation issue is not claimed fixed by these changes.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.