# Apple clients · 2026-09-12

The `RastrilloApple` product adds browser approval, ephemeral same-origin HTTP,
Keychain sessions and a SwiftUI sign-in view for macOS 14+ and iOS 17+.
The platform-independent RastrilloNative product remains separate.
Calendar and Memoria use these components in their first native clients.

`server/` is a separate Go module, `amadan.net/rastrillo/native/server`.
Applications supply their existing session and admission middleware. Browser
approval binds a five-minute, single-use request to a 256-bit verifier hash.
The app and browser display the same code. Exchange authenticates the approved
browser cookie from a fresh context and rechecks admission before minting a
separate ordinary session. Resource authorization stays in each application.
There is no cross-origin cookie jar, HTTP cache or external redirect following.

`tools/bundle-mac.py <native-directory> <Name>` builds a SwiftPM executable
`<Name>Mac`, derives a padded rounded Mac icon from the iOS master, bundles the
Lucide notice when the app has `LICENSE.lucide` (and refuses to bundle an app
whose Swift sources or SVGs name Lucide without it), and signs the development
app ad hoc. It does not notarize it.

Run `make ci` for Swift unit tests, the existing Mac/iOS companion builds,
and Go authentication tests with the race detector.

Independent review: `/root/native_review`, dispatched by this Codex session,
found an inherited-session-context vulnerability in exchange. Fixed using a
fresh cancelable context. Its regression presents Bob's session while exchanging
Alice's approval after Alice loses membership. Independently selected mutations
removing proof checking, expiration, one-time consumption, approval admission,
exchange admission and fresh-context handling all failed the regression suite
on 2026-09-12; all mutations were reverted. Review did not approve a merge.