react-native-intune 0.1.0-alpha.1

package/lib/module/internal/errors.js

@@ -0,0 +1,32 @@
+"use strict";
+
+/**
+ * Rejections. Every one carries a stable code from SPEC §13.6 — never a raw platform
+ * error, because a code is something a consumer can branch on and a platform message is
+ * not.
+ */
+
+export class IntuneError extends Error {
+  constructor(code, message, native) {
+    super(message);
+    this.name = 'IntuneError';
+    this.code = code;
+    this.nativeCode = native?.nativeCode;
+    this.nativeMessage = native?.nativeMessage;
+  }
+}
+
+/** Entra object ID. Deliberately strict — see below. */
+const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+
+/**
+ * The UPN-based SDK APIs are deprecated, so the module identifies accounts by object ID
+ * only (SPEC §13.2). Catching a UPN here gives a named error at the call site instead of
+ * an opaque SDK failure minutes later, in a tenant you cannot reach.
+ */
+export function assertAccountId(accountId) {
+  if (!GUID.test(accountId)) {
+    throw new IntuneError('E_INVALID_ACCOUNT_ID', `accountId must be an Entra object ID (GUID), got "${accountId}". ` + `If this looks like an email address, you passed a UPN — use the object ID.`);
+  }
+}
+//# sourceMappingURL=errors.js.map

package/lib/module/internal/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["IntuneError","Error","constructor","code","message","native","name","nativeCode","nativeMessage","GUID","assertAccountId","accountId","test"],"sourceRoot":"../../../src","sources":["internal/errors.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;;AAIA,OAAO,MAAMA,WAAW,SAASC,KAAK,CAAC;EAKrCC,WAAWA,CACTC,IAAqB,EACrBC,OAAe,EACfC,MAAwD,EACxD;IACA,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,aAAa;IACzB,IAAI,CAACH,IAAI,GAAGA,IAAI;IAChB,IAAI,CAACI,UAAU,GAAGF,MAAM,EAAEE,UAAU;IACpC,IAAI,CAACC,aAAa,GAAGH,MAAM,EAAEG,aAAa;EAC5C;AACF;;AAEA;AACA,MAAMC,IAAI,GAAG,iEAAiE;;AAE9E;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,eAAeA,CAACC,SAAiB,EAAQ;EACvD,IAAI,CAACF,IAAI,CAACG,IAAI,CAACD,SAAS,CAAC,EAAE;IACzB,MAAM,IAAIX,WAAW,CACnB,sBAAsB,EACtB,qDAAqDW,SAAS,KAAK,GACjE,4EACJ,CAAC;EACH;AACF","ignoreList":[]}

package/lib/module/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/module/types.js

@@ -0,0 +1,143 @@
+"use strict";
+
+/**
+ * Public types and enums. Hand-written, unlike `NativeIntune.ts` which Codegen reads.
+ *
+ * The split exists because Codegen accepts only `boolean | number | string | Object |
+ * Array | Promise | void` and no literal unions, so the bridge spec has to stay loose.
+ * Everything strict lives here and in `index.ts`. Nothing in the public API is `any`.
+ *
+ * This file is the semver contract described in SPEC §13. Adding to it is a minor;
+ * changing or removing anything is a major. `PolicySnapshot.raw` is explicitly excluded.
+ */
+
+// ---------------------------------------------------------------- enums
+
+/**
+ * Normalized enrollment outcome. The two platforms report different enums — iOS 28
+ * codes, Android 10 — and both are mapped onto this set natively. See SPEC §4.1 for the
+ * full table; `EnrollmentResult.nativeCode` always carries the raw platform constant.
+ *
+ * The blocking distinction in SPEC §8 is load-bearing and easy to get backwards:
+ * `NotLicensed` and `NotTargeted` must NOT block the user, `Failed` must.
+ */
+export let EnrollmentStatus = /*#__PURE__*/function (EnrollmentStatus) {
+  EnrollmentStatus["Succeeded"] = "succeeded";
+  /** Tenant is MAM-enabled but the user has no Intune licence. Must NOT block. */
+  EnrollmentStatus["NotLicensed"] = "notLicensed";
+  /** Licensed, but no App Protection Policy targets the user. Must NOT block. */
+  EnrollmentStatus["NotTargeted"] = "notTargeted";
+  /** Licensed and targeted, but enrollment failed. This one DOES block. */
+  EnrollmentStatus["Failed"] = "failed";
+  /** Android reports this itself; on iOS it is our own state while the delegate is pending. */
+  EnrollmentStatus["Pending"] = "pending";
+  EnrollmentStatus["AuthorizationNeeded"] = "authorizationNeeded";
+  /** Android only. iOS uses Authenticator as a broker and has no equivalent code. */
+  EnrollmentStatus["CompanyPortalRequired"] = "companyPortalRequired";
+  EnrollmentStatus["WrongUser"] = "wrongUser";
+  EnrollmentStatus["Unenrolled"] = "unenrolled";
+  EnrollmentStatus["UnenrollmentFailed"] = "unenrollmentFailed";
+  /**
+   * Any native value the mapping does not cover. Unknown values map here rather than
+   * throwing, so an SDK update that adds a status cannot crash a shipped app.
+   */
+  EnrollmentStatus["Unknown"] = "unknown";
+  return EnrollmentStatus;
+}({});
+
+/** Journal stage of an unfinished reset. See SPEC §7. */
+export let ResetStage = /*#__PURE__*/function (ResetStage) {
+  ResetStage["Unregistering"] = "unregistering";
+  ResetStage["CleaningAuth"] = "cleaningAuth";
+  ResetStage["CleaningLocal"] = "cleaningLocal";
+  return ResetStage;
+}({});
+
+/**
+ * iOS `MaxFileProtectionLevel`. The default makes protected files unreadable roughly ten
+ * seconds after the device locks, which breaks local databases; an app with lock-screen
+ * UI wants `CompleteUntilFirstUserAuthentication`. See SPEC §5.2.
+ */
+export let FileProtectionLevel = /*#__PURE__*/function (FileProtectionLevel) {
+  FileProtectionLevel["Complete"] = "complete";
+  FileProtectionLevel["CompleteUnlessOpen"] = "completeUnlessOpen";
+  FileProtectionLevel["CompleteUntilFirstUserAuthentication"] = "completeUntilFirstUserAuthentication";
+  FileProtectionLevel["None"] = "none";
+  return FileProtectionLevel;
+}({});
+
+/** Why a reset was started. Recorded in the journal and surfaced in `getDiagnostics`. */
+
+/**
+ * Who owns MSAL. `builtin` is the module (SPEC §3.1) and the default. `external` is for
+ * apps that already have their own MSAL and supply MAM tokens via `setTokenProvider`;
+ * it is a supported mode, not a documentation fallback.
+ */
+
+// ---------------------------------------------------------------- config
+
+/** Hex strings, e.g. `#1B5E20`. */
+
+// ---------------------------------------------------------------- auth
+
+// ---------------------------------------------------------------- state
+
+/**
+ * The reconciliation primitive, and the intended way to drive this module. Read it at
+ * launch, compare against what your backend says the state should be, act on the
+ * difference. Do not drive enrollment from lifecycle hooks: the process can die
+ * mid-operation and only a state comparison recovers from that. See SPEC §13.2.
+ */
+
+// ---------------------------------------------------------------- policy
+
+/**
+ * Only what an app needs to adapt its own UI — hiding an export button, disabling a
+ * share sheet. **PIN prompts, screenshot blocking and encryption are enforced inside the
+ * SDK and never surface here.** Do not try to implement enforcement from these booleans.
+ *
+ * Deliberately short: every field is a support obligation.
+ *
+ * There is no clipboard field, and there cannot be one. Neither platform exposes a
+ * clipboard policy getter — the restriction is enforced inside the SDK and is not
+ * queryable — so `canSaveToPersonal` and `canOpenFromUnmanaged` serve the same
+ * "adapt your UI" purpose using values both platforms can actually answer (SPEC §4.3).
+ *
+ * When no policy applies, every field is permissive rather than `false`: reporting
+ * `false` would hide functionality that nothing is restricting.
+ */
+
+/** Opaque key/value for support bundles. Contains no tokens and no UPNs. */
+
+// ---------------------------------------------------------------- events
+
+/** Payload of a native-initiated MAM service token request. See SPEC §13.4. */
+
+/**
+ * Return the access token, or `null` to signal "cannot get a token right now". Runs on a
+ * background thread's behalf, and the SDK may ask with no JS call in flight.
+ */
+
+/** Clear the app's own local data. If it throws, the journal stays open and retries. */
+
+/**
+ * Why the SDK wants the app restarted.
+ *
+ * One value today, because that is the only case the SDK reports: policy arrived for the
+ * first time. Typed as a union rather than `string` so a consumer can switch on it, with
+ * `unknown` for a value a future SDK adds — an unrecognised reason must not break a
+ * shipped app, and a restart is still a restart.
+ */
+
+/** Event names and their payloads, used to type the emitter in `index.ts`. */
+
+// ---------------------------------------------------------------- errors
+
+/**
+ * Stable rejection codes. A non-success enrollment *status* is data and resolves; these
+ * mean the caller did something wrong or the environment is broken. See SPEC §13.6.
+ *
+ * `E_NATIVE` appearing in logs is a signal to extend the native mapping table, not an
+ * acceptable steady state.
+ */
+//# sourceMappingURL=types.js.map

package/lib/module/types.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["EnrollmentStatus","ResetStage","FileProtectionLevel"],"sourceRoot":"../../src","sources":["types.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,WAAYA,gBAAgB,0BAAhBA,gBAAgB;EAAhBA,gBAAgB;EAE1B;EAFUA,gBAAgB;EAI1B;EAJUA,gBAAgB;EAM1B;EANUA,gBAAgB;EAQ1B;EARUA,gBAAgB;EAAhBA,gBAAgB;EAW1B;EAXUA,gBAAgB;EAAhBA,gBAAgB;EAAhBA,gBAAgB;EAAhBA,gBAAgB;EAgB1B;AACF;AACA;AACA;EAnBYA,gBAAgB;EAAA,OAAhBA,gBAAgB;AAAA;;AAuB5B;AACA,WAAYC,UAAU,0BAAVA,UAAU;EAAVA,UAAU;EAAVA,UAAU;EAAVA,UAAU;EAAA,OAAVA,UAAU;AAAA;;AAMtB;AACA;AACA;AACA;AACA;AACA,WAAYC,mBAAmB,0BAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAnBA,mBAAmB;EAAA,OAAnBA,mBAAmB;AAAA;;AAO/B;;AAUA;AACA;AACA;AACA;AACA;;AAGA;;AAuCA;;AASA;;AAmEA;;AAsBA;AACA;AACA;AACA;AACA;AACA;;AA2BA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAoBA;;AAGA;;AAEA;;AAQA;AACA;AACA;AACA;;AAUA;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAKA;;AAWA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA","ignoreList":[]}

package/lib/typescript/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/typescript/src/NativeIntune.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Codegen spec — the ONLY file Codegen reads, and the only `Native*.ts` allowed in
+ * `jsSrcsDir`. An extra one is picked up and fails confusingly.
+ *
+ * This file is deliberately loose (CLAUDE.md rule 11). Codegen accepts only
+ * `boolean | number | string | Object | Array | Promise | void`: no literal unions, no
+ * optional parameters, no enums. So every union and every optional is normalized in
+ * `index.ts` before it crosses the bridge, and every aggregate return is `Object` here
+ * and a real type there. Nothing in the public API is `Object`.
+ *
+ * Editing this file means Codegen must re-run — `pod install` on iOS,
+ * `generateCodegenArtifactsFromSchema` on Android. A native build that breaks right
+ * after a change here is a stale Codegen artifact until proven otherwise.
+ */
+import { type TurboModule } from 'react-native';
+export interface Spec extends TurboModule {
+    /**
+     * Every field is required here even though most are optional in the public API:
+     * `index.ts` applies the defaults, so the native side never has to guess one.
+     * Empty string means "unset" for `keychainGroupOverride`.
+     */
+    configure(config: {
+        clientId: string;
+        tenantId: string;
+        authority: string;
+        redirectUri: string;
+        authMode: string;
+        verboseLogging: boolean;
+        restartHandledByApp: boolean;
+        maxFileProtectionLevel: string;
+        strictMode: boolean;
+        keychainGroupOverride: string;
+        telemetryEnabled: boolean;
+        brandingBackground: string;
+        brandingForeground: string;
+        brandingAccent: string;
+        brandingSecondaryBackground: string;
+        brandingSecondaryForeground: string;
+    }): Promise<void>;
+    /** SDK linked and platform prerequisites met. Gate the whole Intune path on this. */
+    isSupported(): Promise<boolean>;
+    /** BrokerStatus. */
+    getBrokerStatus(): Promise<Object>;
+    openBrokerInstall(): Promise<void>;
+    /** SignInParams in, AuthResult out. */
+    signIn(params: Object): Promise<Object>;
+    /** SignInParams in, AuthResult out. Rejects E_INTERACTION_REQUIRED. */
+    signInSilent(params: Object): Promise<Object>;
+    /** AcquireTokenParams in, AuthResult out. For the app's own scopes only. */
+    acquireToken(params: Object): Promise<Object>;
+    /** AuthAccount[]. */
+    getAccounts(): Promise<Object[]>;
+    signOut(params: {
+        accountId: string;
+        wipeIntune: boolean;
+    }): Promise<void>;
+    /**
+     * EnrollmentResult. Resolves for every outcome including failures — a non-success
+     * status is data, not an exception. Resolved from the SDK's delegate or notification,
+     * never from the underlying call returning (SPEC §12.5).
+     */
+    enroll(params: {
+        accountId: string;
+        upn: string;
+    }): Promise<Object>;
+    /**
+     * EnrollmentResult. **iOS only** — `loginAndEnrollAccount:` makes the SDK run the
+     * sign-in itself and show its own UI, so no MSAL is needed on our side. Android has no
+     * counterpart: `registerAccountForMAM` always needs a token from the app.
+     *
+     * Pass '' for `upn` to let the SDK prompt for the address as well.
+     */
+    enrollInteractive(params: {
+        upn: string;
+    }): Promise<Object>;
+    /** IntuneState — the reconciliation primitive. */
+    getState(): Promise<Object>;
+    /**
+     * Writes the journal and unregisters. The process is expected to terminate during this
+     * call on Android (SPEC §7), so nothing after it is guaranteed to run.
+     */
+    reset(params: {
+        wipe: boolean;
+        reason: string;
+    }): Promise<void>;
+    /**
+     * NOT public API. Verifies the account really is gone, then closes the journal —
+     * `reset()` in index.ts calls it after the consumer's reset handler has cleared local
+     * data. Separate from `reset` because the steps between them may straddle a process
+     * death, and the journal is what carries the sequence across it (SPEC §7).
+     */
+    completeReset(): Promise<void>;
+    /** PolicySnapshot. */
+    getPolicy(): Promise<Object>;
+    /** Opaque key/value for support bundles. No tokens, no UPNs. */
+    getDiagnostics(): Promise<Object>;
+    /**
+     * NOT public API. `setTokenProvider` in `index.ts` wraps these; the SDK asks for a MAM
+     * service token on a background thread, including on its own retry schedule with no JS
+     * call in flight, so it cannot be a callback parameter on `enroll` (SPEC §13.4).
+     */
+    resolveToken(params: {
+        requestId: string;
+        token: string;
+    }): void;
+    rejectToken(params: {
+        requestId: string;
+        reason: string;
+    }): void;
+    /**
+     * Present only to satisfy `NativeEventEmitter`; ref-counting, no logic. The emitter
+     * itself is live from module construction and queues events fired before JS
+     * subscribes — a wipe lost during startup means the reset never runs (SPEC §4.4).
+     */
+    addListener(eventName: string): void;
+    removeListeners(count: number): void;
+}
+declare const _default: Spec;
+export default _default;
+//# sourceMappingURL=NativeIntune.d.ts.map

package/lib/typescript/src/NativeIntune.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NativeIntune.d.ts","sourceRoot":"","sources":["../../../src/NativeIntune.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAuB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAErE,MAAM,WAAW,IAAK,SAAQ,WAAW;IAGvC;;;;OAIG;IACH,SAAS,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;QACjB,cAAc,EAAE,OAAO,CAAC;QACxB,mBAAmB,EAAE,OAAO,CAAC;QAC7B,sBAAsB,EAAE,MAAM,CAAC;QAC/B,UAAU,EAAE,OAAO,CAAC;QACpB,qBAAqB,EAAE,MAAM,CAAC;QAC9B,gBAAgB,EAAE,OAAO,CAAC;QAE1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,2BAA2B,EAAE,MAAM,CAAC;QACpC,2BAA2B,EAAE,MAAM,CAAC;KACrC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAElB,qFAAqF;IACrF,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAEhC,oBAAoB;IACpB,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAInC,uCAAuC;IACvC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,uEAAuE;IACvE,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,4EAA4E;IAC5E,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,qBAAqB;IACrB,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAEjC,OAAO,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAI3E;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpE;;;;;;OAMG;IACH,iBAAiB,CAAC,MAAM,EAAE;QAAE,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5D,kDAAkD;IAClD,QAAQ,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5B;;;OAGG;IACH,KAAK,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;;;;OAKG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAI/B,sBAAsB;IACtB,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,gEAAgE;IAChE,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;IAIlC;;;;OAIG;IACH,YAAY,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjE,WAAW,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAIjE;;;;OAIG;IACH,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;;AAED,wBAAkE"}

package/lib/typescript/src/api/auth.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Sign-in, for `authMode: 'builtin'` — the module owns MSAL (SPEC §3).
+ *
+ * Two tokens exist and only one of them appears here: the MAM service token is acquired
+ * internally and never crosses the bridge. Everything returned by these calls is for
+ * *your* API's scopes (SPEC §3.5).
+ */
+import type { AcquireTokenParams, AuthAccount, AuthResult, EnrollmentResult, SignInParams, SignOutParams } from '../types.js';
+/**
+ * Uses the broker when one is present, which also gives device-wide SSO: a user already
+ * signed into Outlook usually gets a token with no prompt at all.
+ */
+export declare function signIn(params?: SignInParams): Promise<AuthResult>;
+/**
+ * Cache-first. Rejects with `E_INTERACTION_REQUIRED` when a prompt is needed — the normal
+ * pattern is `signInSilent` first, `signIn` on that rejection.
+ */
+export declare function signInSilent(params?: SignInParams): Promise<AuthResult>;
+/** For your own API's scopes, after sign-in. */
+export declare function acquireToken(params: AcquireTokenParams): Promise<AuthResult>;
+/**
+ * Accounts with cached refresh tokens. Under single identity (SPEC §9) this holds at
+ * most one; more than one means state a reset should have cleared.
+ */
+export declare function getAccounts(): Promise<AuthAccount[]>;
+/**
+ * Removes the account from the MSAL cache. With `wipeIntune: true` it also runs the full
+ * reset sequence, which is what you want on logout — and which means **the process may
+ * terminate during this call on Android.**
+ */
+export declare function signOut(params: SignOutParams): Promise<void>;
+/** The common path in one call. Use the primitives when you need a step in between. */
+export declare function signInAndEnroll(params?: SignInParams): Promise<{
+    auth: AuthResult;
+    enrollment: EnrollmentResult;
+}>;
+//# sourceMappingURL=auth.d.ts.map

package/lib/typescript/src/api/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/api/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EACX,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACd,MAAM,aAAU,CAAC;AAElB;;;GAGG;AACH,wBAAsB,MAAM,CAAC,MAAM,GAAE,YAAiB,GAAG,OAAO,CAAC,UAAU,CAAC,CAE3E;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,MAAM,GAAE,YAAiB,GACxB,OAAO,CAAC,UAAU,CAAC,CAErB;AAED,gDAAgD;AAChD,wBAAsB,YAAY,CAChC,MAAM,EAAE,kBAAkB,GACzB,OAAO,CAAC,UAAU,CAAC,CAErB;AAED;;;GAGG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAG1D;AAED;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAG5D;AAED,uFAAuF;AACvF,wBAAsB,eAAe,CACnC,MAAM,GAAE,YAAiB,GACxB,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,UAAU,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAI7D"}

package/lib/typescript/src/api/enrollment.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Enrollment, state, and the reset sequence.
+ *
+ * The theme running through all three: **the SDK reports asynchronously and the process
+ * may not survive**. Nothing here resolves from a call returning, and nothing assumes
+ * the next line will run.
+ */
+import type { EnrollInteractiveParams, EnrollmentResult, EnrollParams, IntuneState, ResetHandler, ResetParams } from '../types.js';
+/**
+ * Clears the app's own local data during a reset. The module cannot do this for you — it
+ * does not know what you store or where.
+ *
+ * Registered rather than passed to `reset` because a reset can be *resumed* at launch
+ * from the journal, with no `reset` call in flight (SPEC §7).
+ */
+export declare function setResetHandler(handler: ResetHandler | null): void;
+/**
+ * Resolves with a result for every outcome including failures — a non-success status is
+ * data, not an exception. It only rejects for programming errors.
+ *
+ * Expect seconds, and a spinner: the promise settles when the SDK reports through its
+ * delegate or notification, not when the underlying call returns.
+ *
+ * Read SPEC §8 before branching on `status`. `NotLicensed` and `NotTargeted` must not
+ * block the user; `Failed` must.
+ */
+export declare function enroll(params: EnrollParams): Promise<EnrollmentResult>;
+/**
+ * **iOS only.** Hands the whole sign-in to the SDK: it shows its own credential screen,
+ * signs the user in, and enrolls them. No MSAL on our side, which is why this works
+ * before the built-in auth layer exists.
+ *
+ * Rejects with `E_SDK_UNAVAILABLE` on Android — `registerAccountForMAM` there always
+ * needs a token supplied by the app, so there is nothing equivalent to call.
+ *
+ * Like `enroll`, it resolves with a result for every outcome including failures.
+ */
+export declare function enrollInteractive(params?: EnrollInteractiveParams): Promise<EnrollmentResult>;
+/**
+ * The reconciliation primitive, and the intended way to drive this module. Call it at
+ * launch, compare against what your backend says the state should be, act on the
+ * difference. It never rejects.
+ */
+export declare function getState(): Promise<IntuneState>;
+/**
+ * Unregisters, unenrolls, optionally wipes corporate data, and clears the runtime
+ * configuration.
+ *
+ * **The process is expected to terminate during this call on Android** (SPEC §7). Do not
+ * write code after `await reset(...)` that must run — put the continuation in the
+ * launch-time reconciliation and let the journal resume it.
+ */
+export declare function reset(params: ResetParams): Promise<void>;
+//# sourceMappingURL=enrollment.d.ts.map

package/lib/typescript/src/api/enrollment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enrollment.d.ts","sourceRoot":"","sources":["../../../../src/api/enrollment.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,OAAO,KAAK,EACV,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,WAAW,EACZ,MAAM,aAAU,CAAC;AAIlB;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAElE;AAED;;;;;;;;;GASG;AACH,wBAAsB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAU5E;AAED;;;;;;;;;GASG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,GAAE,uBAA4B,GACnC,OAAO,CAAC,gBAAgB,CAAC,CAI3B;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,IAAI,OAAO,CAAC,WAAW,CAAC,CAErD;AAED;;;;;;;GAOG;AACH,wBAAsB,KAAK,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB9D"}

package/lib/typescript/src/api/events.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Typed subscriptions.
+ *
+ * Every one of these can fire without the app having called anything: the SDK enrolls on
+ * its own retry schedule, an administrator can change policy, and a wipe is
+ * service-initiated. Subscribe at startup, not when you happen to be waiting (SPEC §4.4).
+ */
+import type { EmitterSubscription } from 'react-native';
+import type { BrokerStatus, EnrollmentResult, PolicySnapshot, RestartRequest } from '../types.js';
+/** Also fires for the SDK's own background enrollment retries, which have no caller. */
+export declare function onEnrollmentResult(listener: (result: EnrollmentResult) => void): EmitterSubscription;
+/** The terminal state of a reset. */
+export declare function onUnenrollmentResult(listener: (result: EnrollmentResult) => void): EmitterSubscription;
+/** An administrator changed policy — re-read whatever UI you gate on it. */
+export declare function onPolicyChanged(listener: (policy: PolicySnapshot) => void): EmitterSubscription;
+/** The user installed or removed Company Portal. */
+export declare function onBrokerStatusChanged(listener: (status: BrokerStatus) => void): EmitterSubscription;
+/** **Service-initiated.** Can arrive with no prior app call at all. */
+export declare function onWipeRequested(listener: (request: {
+    accountId: string | null;
+}) => void): EmitterSubscription;
+/** iOS, on first policy application. See `configure({ restartHandledByApp })`. */
+export declare function onRestartRequired(listener: (request: RestartRequest) => void): EmitterSubscription;
+//# sourceMappingURL=events.d.ts.map

package/lib/typescript/src/api/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../../../../src/api/events.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAUxD,OAAO,KAAK,EACV,YAAY,EACZ,gBAAgB,EAEhB,cAAc,EACd,cAAc,EACf,MAAM,aAAU,CAAC;AAUlB,wFAAwF;AACxF,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAC3C,mBAAmB,CAErB;AAED,qCAAqC;AACrC,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,IAAI,GAC3C,mBAAmB,CAErB;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GACzC,mBAAmB,CAErB;AAED,oDAAoD;AACpD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,IAAI,GACvC,mBAAmB,CAErB;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,CAAC,OAAO,EAAE;IAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,KAAK,IAAI,GACxD,mBAAmB,CAQrB;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,IAAI,GAC1C,mBAAmB,CAQrB"}

package/lib/typescript/src/api/lifecycle.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Setup, and the two questions worth asking before it: is the SDK usable at all, and is
+ * a broker present.
+ */
+import { type BrokerStatus, type IntuneConfig } from '../types.js';
+/**
+ * Configures the SDK for one customer tenant. Every other method rejects with
+ * `E_NOT_CONFIGURED` until this resolves.
+ *
+ * Two things it will refuse rather than paper over:
+ *
+ *   - a different `tenantId` than the active one — `E_RESET_REQUIRED`, because silently
+ *     reconfiguring would leave the old tenant enrolled, and the iOS runtime overrides
+ *     persist across restarts so the mismatch would survive a relaunch;
+ *   - an `Info.plist` that disagrees with it — `E_PLIST_CONFLICT`, see SPEC §5.1.2.
+ */
+export declare function configure(config: IntuneConfig): Promise<void>;
+/**
+ * SDK linked and platform prerequisites met. Gate the whole Intune path on this so a
+ * misbuilt binary degrades instead of crashing.
+ */
+export declare function isSupported(): Promise<boolean>;
+/**
+ * Answerable before `configure`, on purpose — the app needs it to decide whether to
+ * prompt for a broker install.
+ *
+ * A false negative here usually means a missing manifest entry rather than a missing
+ * app: `LSApplicationQueriesSchemes` on iOS, `<queries>` on Android 11+.
+ */
+export declare function getBrokerStatus(): Promise<BrokerStatus>;
+/** Rejects with `E_NOT_NEEDED` when a broker is already present. */
+export declare function openBrokerInstall(): Promise<void>;
+//# sourceMappingURL=lifecycle.d.ts.map

package/lib/typescript/src/api/lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.d.ts","sourceRoot":"","sources":["../../../../src/api/lifecycle.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,YAAY,EAClB,MAAM,aAAU,CAAC;AAElB;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CA0B7D;AAED;;;GAGG;AACH,wBAAgB,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAE9C;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAE7D;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEjD"}

package/lib/typescript/src/api/policy.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Reading policy, and reading the module's own state for a support bundle.
+ */
+import type { Diagnostics, PolicySnapshot } from '../types.js';
+/**
+ * For adapting your own UI — hiding an export button, disabling a share sheet.
+ *
+ * **PIN prompts, screenshot blocking and encryption are enforced inside the SDK and
+ * never surface here.** Do not attempt to implement enforcement from these booleans.
+ */
+export declare function getPolicy(): Promise<PolicySnapshot>;
+/** Safe to attach to a support ticket: no tokens, no UPNs. */
+export declare function getDiagnostics(): Promise<Diagnostics>;
+//# sourceMappingURL=policy.d.ts.map

package/lib/typescript/src/api/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../../src/api/policy.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,aAAU,CAAC;AAE5D;;;;;GAKG;AACH,wBAAsB,SAAS,IAAI,OAAO,CAAC,cAAc,CAAC,CAEzD;AAED,8DAA8D;AAC9D,wBAAsB,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAE3D"}

package/lib/typescript/src/api/tokenProvider.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The MAM service token bridge (SPEC §13.4).
+ *
+ * The SDK asks for this token on a background thread, including on its own retry
+ * schedule when no JS call is in flight — which is why it is a registration rather than
+ * a callback parameter on `enroll`.
+ *
+ * The token never leaves the module: the provider's answer goes to native, native hands
+ * it to the SDK, and it is never logged or returned to JS (CLAUDE.md rule 9).
+ */
+import type { TokenProvider } from '../types.js';
+/**
+ * Registers the provider for `authMode: 'external'`. Return `null` from it to say
+ * "cannot get a token right now" — the SDK treats that as needing authorization rather
+ * than as a hard failure.
+ */
+export declare function setTokenProvider(provider: TokenProvider | null): void;
+//# sourceMappingURL=tokenProvider.d.ts.map

package/lib/typescript/src/api/tokenProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenProvider.d.ts","sourceRoot":"","sources":["../../../../src/api/tokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAgB,MAAM,aAAU,CAAC;AAI5D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI,CAErE"}

package/lib/typescript/src/index.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Public API for react-native-intune. See SPEC §13 for the reference — a method that
+ * exists here but not there does not exist, and the two change in the same commit.
+ *
+ * This file is deliberately only a surface. The work is one directory down:
+ *
+ * ```
+ * src/
+ *   NativeIntune.ts        Codegen spec — the only file Codegen reads, deliberately loose
+ *   types.ts               every public type and enum
+ *   api/
+ *     lifecycle.ts         configure, isSupported, broker presence
+ *     auth.ts              sign-in, tokens for your own API   (authMode 'builtin')
+ *     enrollment.ts        enroll, getState, reset
+ *     policy.ts            getPolicy, getDiagnostics
+ *     events.ts            subscriptions
+ *     tokenProvider.ts     the MAM service token bridge       (authMode 'external')
+ *   internal/
+ *     decode.ts            bridge Object -> typed, with deliberate fallbacks
+ *     errors.ts            IntuneError and the accountId guard
+ *     emitter.ts           the single NativeEventEmitter
+ * ```
+ *
+ * Both import styles work and neither is preferred:
+ *
+ * ```ts
+ * import Intune from 'react-native-intune';          Intune.configure(...)
+ * import { configure } from 'react-native-intune';   configure(...)
+ * ```
+ */
+export * from './types.js';
+export { IntuneError } from './internal/errors.js';
+import { configure, getBrokerStatus, isSupported, openBrokerInstall } from './api/lifecycle.js';
+import { acquireToken, getAccounts, signIn, signInAndEnroll, signInSilent, signOut } from './api/auth.js';
+import { enroll, enrollInteractive, getState, reset, setResetHandler } from './api/enrollment.js';
+import { getDiagnostics, getPolicy } from './api/policy.js';
+import { onBrokerStatusChanged, onEnrollmentResult, onPolicyChanged, onRestartRequired, onUnenrollmentResult, onWipeRequested } from './api/events.js';
+import { setTokenProvider } from './api/tokenProvider.js';
+export { configure, isSupported, getBrokerStatus, openBrokerInstall, signIn, signInSilent, signInAndEnroll, acquireToken, getAccounts, signOut, enroll, enrollInteractive, getState, reset, setResetHandler, getPolicy, getDiagnostics, setTokenProvider, onEnrollmentResult, onUnenrollmentResult, onPolicyChanged, onWipeRequested, onRestartRequired, onBrokerStatusChanged, };
+declare const Intune: {
+    readonly configure: typeof configure;
+    readonly isSupported: typeof isSupported;
+    readonly getBrokerStatus: typeof getBrokerStatus;
+    readonly openBrokerInstall: typeof openBrokerInstall;
+    readonly signIn: typeof signIn;
+    readonly signInSilent: typeof signInSilent;
+    readonly signInAndEnroll: typeof signInAndEnroll;
+    readonly acquireToken: typeof acquireToken;
+    readonly getAccounts: typeof getAccounts;
+    readonly signOut: typeof signOut;
+    readonly enroll: typeof enroll;
+    readonly enrollInteractive: typeof enrollInteractive;
+    readonly getState: typeof getState;
+    readonly reset: typeof reset;
+    readonly setResetHandler: typeof setResetHandler;
+    readonly getPolicy: typeof getPolicy;
+    readonly getDiagnostics: typeof getDiagnostics;
+    readonly setTokenProvider: typeof setTokenProvider;
+    readonly onEnrollmentResult: typeof onEnrollmentResult;
+    readonly onUnenrollmentResult: typeof onUnenrollmentResult;
+    readonly onPolicyChanged: typeof onPolicyChanged;
+    readonly onWipeRequested: typeof onWipeRequested;
+    readonly onRestartRequired: typeof onRestartRequired;
+    readonly onBrokerStatusChanged: typeof onBrokerStatusChanged;
+};
+export default Intune;
+//# sourceMappingURL=index.d.ts.map

package/lib/typescript/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,cAAc,YAAS,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAmB,CAAC;AAEhD,OAAO,EACL,SAAS,EACT,eAAe,EACf,WAAW,EACX,iBAAiB,EAClB,MAAM,oBAAiB,CAAC;AACzB,OAAO,EACL,YAAY,EACZ,WAAW,EACX,MAAM,EACN,eAAe,EACf,YAAY,EACZ,OAAO,EACR,MAAM,eAAY,CAAC;AACpB,OAAO,EACL,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,eAAe,EAChB,MAAM,qBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,iBAAc,CAAC;AACzD,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EACjB,oBAAoB,EACpB,eAAe,EAChB,MAAM,iBAAc,CAAC;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAqB,CAAC;AAEvD,OAAO,EAEL,SAAS,EACT,WAAW,EACX,eAAe,EACf,iBAAiB,EAEjB,MAAM,EACN,YAAY,EACZ,eAAe,EACf,YAAY,EACZ,WAAW,EACX,OAAO,EAEP,MAAM,EACN,iBAAiB,EACjB,QAAQ,EACR,KAAK,EACL,eAAe,EAEf,SAAS,EACT,cAAc,EAEd,gBAAgB,EAEhB,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,qBAAqB,GACtB,CAAC;AAEF,QAAA,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;CAyBF,CAAC;AAEX,eAAe,MAAM,CAAC"}