react-native-intune 0.1.0-alpha.1

package/scripts/lib/project.mjs

@@ -0,0 +1,196 @@
+/**
+ * Locates the consumer's project files.
+ *
+ * `doctor` and `setup` run from the consumer's project root — `npx react-native-intune
+ * doctor` — so everything here resolves from `process.cwd()`, never from this package's
+ * own directory. Getting that backwards would have the tool inspect itself and report
+ * a perfectly configured project every time.
+ *
+ * Every accessor returns `null` rather than throwing when a file is absent. A React
+ * Native project missing its Android folder is a normal state (iOS-only app), not an
+ * error, and a tool that crashes on it is a tool people stop running.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function findProject(cwd = process.cwd()) {
+  const root = findProjectRoot(cwd);
+  return {
+    root,
+    isThisPackage: isThisPackage(root),
+    android: findAndroid(root),
+    ios: findIos(root),
+  };
+}
+
+/**
+ * True when the "project" found is this library's own repository.
+ *
+ * It qualifies on the surface — a package.json beside an `android/` directory — and
+ * configuring it would be the exact mistake these tools exist to prevent: the MAM plugin
+ * applied to the library rewrites only the library, builds cleanly, and protects
+ * nothing. Refusing here is cheaper than explaining it later.
+ */
+function isThisPackage(root) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+    return pkg.name === 'react-native-intune';
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Walks up looking for a `package.json` next to an `android/` or `ios/` directory.
+ *
+ * Not just the nearest `package.json`: in a monorepo that is often a workspace package
+ * with no native project in it, and the app lives a level up or across. Requiring the
+ * native folder alongside is what distinguishes "the app" from "a package".
+ */
+function findProjectRoot(cwd) {
+  let dir = path.resolve(cwd);
+  for (;;) {
+    const hasManifest = fs.existsSync(path.join(dir, 'package.json'));
+    const hasNative =
+      fs.existsSync(path.join(dir, 'android')) ||
+      fs.existsSync(path.join(dir, 'ios'));
+    if (hasManifest && hasNative) {
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) {
+      // No native project above us. Return the starting point so the caller reports
+      // "nothing to inspect" against a path the user recognises.
+      return path.resolve(cwd);
+    }
+    dir = parent;
+  }
+}
+
+function findAndroid(root) {
+  const dir = path.join(root, 'android');
+  if (!fs.existsSync(dir)) {
+    return null;
+  }
+  return {
+    dir,
+    appBuildGradle: existing(path.join(dir, 'app', 'build.gradle')),
+    // Kotlin DSL is not handled by `setup`'s text insertion, but `doctor` still needs to
+    // see it so it can say so instead of reporting a missing plugin.
+    appBuildGradleKts: existing(path.join(dir, 'app', 'build.gradle.kts')),
+    rootBuildGradle: existing(path.join(dir, 'build.gradle')),
+    rootBuildGradleKts: existing(path.join(dir, 'build.gradle.kts')),
+    manifest: existing(path.join(dir, 'app', 'src', 'main', 'AndroidManifest.xml')),
+    gradleProperties: existing(path.join(dir, 'gradle.properties')),
+    debugKeystore: existing(path.join(dir, 'app', 'debug.keystore')),
+    // The Application subclass, if there is one to inspect. Both languages, both of the
+    // conventional source roots.
+    applicationSources: findApplicationSources(dir),
+  };
+}
+
+function findIos(root) {
+  const dir = path.join(root, 'ios');
+  if (!fs.existsSync(dir)) {
+    return null;
+  }
+  const xcodeproj = firstMatching(dir, (name) => name.endsWith('.xcodeproj'));
+  const appName = xcodeproj ? path.basename(xcodeproj, '.xcodeproj') : null;
+  const appDir = appName ? existing(path.join(dir, appName)) : null;
+
+  return {
+    dir,
+    appName,
+    xcodeproj,
+    pbxproj: xcodeproj ? existing(path.join(xcodeproj, 'project.pbxproj')) : null,
+    infoPlist: appDir ? existing(path.join(appDir, 'Info.plist')) : null,
+    // Xcode's default name, which is what the template produces. A custom name is
+    // reported as "not found" rather than guessed at — a wrong entitlements file edited
+    // silently is worse than an honest miss.
+    entitlements: appDir
+      ? existing(path.join(appDir, `${appName}.entitlements`))
+      : null,
+    appDelegate: appDir ? findAppDelegate(appDir) : null,
+    podfile: existing(path.join(dir, 'Podfile')),
+  };
+}
+
+function findApplicationSources(androidDir) {
+  const roots = [
+    path.join(androidDir, 'app', 'src', 'main', 'java'),
+    path.join(androidDir, 'app', 'src', 'main', 'kotlin'),
+  ].filter((p) => fs.existsSync(p));
+
+  const found = [];
+  for (const r of roots) {
+    walk(r, (file) => {
+      if (/(Application)\.(kt|java)$/.test(path.basename(file))) {
+        found.push(file);
+      }
+    });
+  }
+  return found;
+}
+
+function findAppDelegate(appDir) {
+  for (const name of ['AppDelegate.swift', 'AppDelegate.mm', 'AppDelegate.m']) {
+    const p = path.join(appDir, name);
+    if (fs.existsSync(p)) {
+      return p;
+    }
+  }
+  return null;
+}
+
+// ---------------------------------------------------------------- small helpers
+
+function existing(p) {
+  return fs.existsSync(p) ? p : null;
+}
+
+function firstMatching(dir, predicate) {
+  const entries = fs.readdirSync(dir, { withFileTypes: true });
+  for (const e of entries) {
+    if (predicate(e.name)) {
+      return path.join(dir, e.name);
+    }
+  }
+  return null;
+}
+
+function walk(dir, onFile, depth = 0) {
+  // Bounded: a source tree deeper than this is not holding an Application class, and an
+  // unbounded walk over node_modules in a misconfigured project is a hang.
+  if (depth > 12) {
+    return;
+  }
+  for (const e of fs.readdirSync(dir, { withFileTypes: true })) {
+    const p = path.join(dir, e.name);
+    if (e.isDirectory()) {
+      if (e.name === 'node_modules' || e.name === 'build' || e.name.startsWith('.')) {
+        continue;
+      }
+      walk(p, onFile, depth + 1);
+    } else {
+      onFile(p);
+    }
+  }
+}
+
+/** Reads a file, or returns an empty string. Callers treat absent and empty alike. */
+export function read(file) {
+  if (!file) {
+    return '';
+  }
+  try {
+    return fs.readFileSync(file, 'utf8');
+  } catch {
+    return '';
+  }
+}
+
+/** Path relative to the project root, for output a user can act on. */
+export function rel(project, file) {
+  return file ? path.relative(project.root, file) : '(not found)';
+}

package/scripts/setup.mjs

@@ -0,0 +1,233 @@
+#!/usr/bin/env node
+/**
+ * Applies the changes `doctor` reports, on command and never automatically.
+ *
+ * These files live in the consumer's git. A script that edits them at install time
+ * fights the developer's own changes, re-applies on every version bump, and produces
+ * "why did my project change" reports — which is why mature libraries abandoned
+ * install-time patching (SPEC §12.7).
+ *
+ * Usage:
+ *   npx react-native-intune setup
+ *   npx react-native-intune setup --yes       # no prompt, for CI
+ *   npx react-native-intune setup --dry-run   # same as doctor
+ *   npx react-native-intune setup --force     # allow a dirty git tree
+ *
+ * Exit code: non-zero while manual steps remain, so a partial setup cannot be mistaken
+ * for a complete one. That is deliberate — the steps it cannot do are the ones that
+ * leave the app unprotected.
+ */
+
+import fs from 'node:fs';
+import readline from 'node:readline';
+import { findProject, rel } from './lib/project.mjs';
+import { gitIsClean, runChecks, summarise } from './doctor.mjs';
+
+const args = process.argv.slice(2);
+const flags = {
+  yes: args.includes('--yes') || args.includes('-y'),
+  dryRun: args.includes('--dry-run'),
+  force: args.includes('--force'),
+};
+
+async function main() {
+  if (flags.dryRun) {
+    // Documented as equivalent to doctor, so it runs the same checks rather than a
+    // second implementation that can drift out of agreement with it.
+    const project = findProject();
+    const s = summarise(runChecks(project));
+    report(project, s);
+    process.exit(s.blocking.length > 0 ? 1 : 0);
+  }
+
+  const project = findProject();
+
+  if (project.isThisPackage) {
+    fail(
+      `This is react-native-intune's own repository, not a project that consumes it.\n\n` +
+        `Applying the MAM Gradle plugin here is the mistake these commands exist to\n` +
+        `catch: it rewrites only the library, builds cleanly, and protects nothing.\n` +
+        `Run this from your app's project root instead.`
+    );
+  }
+
+  if (!project.android && !project.ios) {
+    fail(
+      `No native project found under ${project.root}.\n` +
+        `Run this from a React Native project root — the folder holding android/ or ios/.`
+    );
+  }
+
+  const clean = gitIsClean(project.root);
+  if (clean === false && !flags.force) {
+    fail(
+      `Your git tree has uncommitted changes.\n\n` +
+        `This command edits files in your repository. Commit or stash first, so a\n` +
+        `revert is one command away — or pass --force if you know what you are doing.`
+    );
+  }
+  if (clean === null) {
+    process.stdout.write(
+      `Note: not a git repository, so there is no clean revert. Continuing.\n\n`
+    );
+  }
+
+  const results = runChecks(project);
+  const s = summarise(results);
+
+  const edits = [];
+  for (const r of s.failing) {
+    if (typeof r.check.apply !== 'function') {
+      continue;
+    }
+    const edit = r.check.apply(project);
+    if (edit) {
+      edits.push({ ...edit, check: r.check, before: fs.readFileSync(edit.file, 'utf8') });
+    }
+  }
+
+  if (edits.length === 0) {
+    process.stdout.write(
+      s.failing.length === 0
+        ? `Nothing to change — everything this tool can apply is already in place.\n\n`
+        : `Nothing here can be applied automatically.\n\n`
+    );
+  } else {
+    process.stdout.write(`\nThese files will change:\n\n`);
+    for (const e of edits) {
+      process.stdout.write(`  ${rel(project, e.file)}  — ${e.check.title}\n`);
+      process.stdout.write(diff(e.before, e.contents));
+    }
+
+    if (!flags.yes && !(await confirm())) {
+      process.stdout.write(`\nNothing written.\n\n`);
+      process.exit(1);
+    }
+
+    for (const e of edits) {
+      fs.writeFileSync(e.file, e.contents);
+      process.stdout.write(`  wrote ${rel(project, e.file)}\n`);
+    }
+    process.stdout.write('\n');
+  }
+
+  // Re-inspect rather than assume the edits worked. A check that still fails after its
+  // own apply is a bug worth surfacing here instead of at the next build.
+  const after = summarise(runChecks(findProject()));
+  report(project, after, { afterApply: true });
+  process.exit(after.blocking.length > 0 ? 1 : 0);
+}
+
+function report(project, s, { afterApply = false } = {}) {
+  if (s.failing.length === 0) {
+    process.stdout.write(
+      afterApply
+        ? `Done. Everything this tool can check is in place.\n\n`
+        : `Everything this tool can check is in place.\n\n`
+    );
+    return;
+  }
+
+  const manual = s.failing.filter((r) => typeof r.check.apply !== 'function');
+  const stillBroken = s.failing.filter((r) => typeof r.check.apply === 'function');
+
+  if (stillBroken.length > 0) {
+    process.stdout.write(
+      `Still failing after being applied — please report this:\n` +
+        stillBroken.map((r) => `  - ${r.check.id}`).join('\n') +
+        '\n\n'
+    );
+  }
+
+  if (manual.length > 0) {
+    process.stdout.write(
+      `${manual.length} step${manual.length === 1 ? '' : 's'} left for you. ` +
+        `They change your own source or need a value only you have:\n\n`
+    );
+    for (const r of manual) {
+      const danger =
+        r.check.severity === 'silent'
+          ? '  This one builds and runs while leaving the app unprotected.\n'
+          : '';
+      process.stdout.write(
+        `${r.check.title}\n${danger}\n` +
+          r.check
+            .instruction(project)
+            .split('\n')
+            .map((l) => (l.length > 0 ? `  ${l}` : l))
+            .join('\n') +
+          '\n\n'
+      );
+    }
+    process.stdout.write(
+      `Exiting non-zero while these remain, so a partial setup is not mistaken for a\n` +
+        `complete one. Run \`npx react-native-intune doctor\` to re-check.\n\n`
+    );
+  }
+}
+
+/**
+ * A unified-ish diff, good enough to read before agreeing to it.
+ *
+ * Deliberately not a dependency: this package ships to consumers, and a diff renderer
+ * is not worth a supply-chain entry.
+ */
+function diff(before, after) {
+  const a = before.split('\n');
+  const b = after.split('\n');
+  const out = [];
+  let i = 0;
+  let j = 0;
+  while (i < a.length || j < b.length) {
+    if (a[i] === b[j]) {
+      i += 1;
+      j += 1;
+      continue;
+    }
+    // Find where the streams line up again, looking a bounded distance ahead. Enough
+    // for inserted blocks, which is all these edits are.
+    let resync = -1;
+    for (let k = j; k < Math.min(b.length, j + 200); k += 1) {
+      if (a[i] !== undefined && b[k] === a[i]) {
+        resync = k;
+        break;
+      }
+    }
+    if (resync === -1) {
+      if (a[i] !== undefined) {
+        out.push(`      - ${a[i]}`);
+        i += 1;
+      }
+      if (b[j] !== undefined) {
+        out.push(`      + ${b[j]}`);
+        j += 1;
+      }
+    } else {
+      for (let k = j; k < resync; k += 1) {
+        out.push(`      + ${b[k]}`);
+      }
+      j = resync;
+    }
+  }
+  return out.length > 0 ? `${out.join('\n')}\n\n` : '      (no textual change)\n\n';
+}
+
+function confirm() {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  });
+  return new Promise((resolve) => {
+    rl.question('Apply these changes? [y/N] ', (answer) => {
+      rl.close();
+      resolve(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
+
+function fail(message) {
+  process.stderr.write(`\n${message}\n\n`);
+  process.exit(1);
+}
+
+main().catch((e) => fail(e.stack ?? String(e)));

package/sdk-lock.json

@@ -0,0 +1,27 @@
+{
+  "ios": {
+    "repo": "microsoftconnect/ms-intune-app-sdk-ios",
+    "tag": "21.8.0",
+    "fetchedAt": "2026-09-03T10:39:33.572Z",
+    "files": {
+      "ios/IntuneMAMSwift.xcframework": "f38f0f130bd2adf0dd936acb26958f6c6ebc0b2d5a4bf886d4c8c7d4ae0870ab",
+      "ios/IntuneMAMSwiftStub.xcframework": "a03e563feec36f719bfca34b061e590e1c54a03650a3855a8298988e49b9ea9c",
+      "ios/IntuneMAMTelemetry.xcframework": "d4582c8ffa014611cb1c10b5717cf13cdbeeb50e34b67624dc884e194636b3de",
+      "ios/IntuneMAMResources.bundle": "51d6f666efb80eddb6d35467c9d6491b746405a72c8ebe6cde5de5c68e7181f3",
+      "ios/IntuneMAMConfigurator.dmg": "4fc4fbcd6211e62fa355ef1976970e230d806855703f75788727d5dbcb454b61",
+      "ios/REDIST.txt": "31c5b0e0c3ee48b60c6f12e56d5a8b6d47754f127750f27627800d2b44b79e56",
+      "ios/Microsoft License Terms Intune App SDK for iOS.pdf": "5b12b9a6ee3671a138b67884ff69c5bda17b6cb7bec0646f108cf072930c7394",
+      "ios/ThirdPartyNotices.txt": "aa0bbc665cfd7b7549b05c3bd747faa5d383c1ea4a297fb4dc33184180e3663f"
+    }
+  },
+  "android": {
+    "repo": "microsoftconnect/ms-intune-app-sdk-android",
+    "tag": "12.4.0",
+    "fetchedAt": "2026-09-03T10:39:50.835Z",
+    "files": {
+      "android/Microsoft.Intune.MAM.SDK.aar": "b7e5d0bb86d18f054d8901f168f82e64c79a57334fbb6227136b108b0514e998",
+      "android/GradlePlugin/com.microsoft.intune.mam.build.jar": "04ae1e0fbb6b5dfcbf8bd42e8d4f41ad758332ee6c238780a764a9ab1b67446d",
+      "android/Microsoft License Terms Intune App SDK for Android.pdf": "5f1000c547c38f94cd6791dcd6e1c032ab2c55e2c28f9c5cf75e6e039f0267a2"
+    }
+  }
+}

package/sdk-versions.json

@@ -0,0 +1,70 @@
+{
+  "_comment": [
+    "Pinned Microsoft SDK versions. Single source of truth for which SDK builds this",
+    "library is tested against. Bump deliberately, never automatically: Microsoft requires",
+    "apps to stay on recent SDK versions and has previously blocked launches for apps that",
+    "fell behind, so a bump is a release-worthy change.",
+    "",
+    "iOS 21.x requires iOS 17+ and Xcode 26. If a consumer must support iOS 16, they need",
+    "SDK 20.x, which Microsoft supports for high-priority security fixes only. See SPEC.md."
+  ],
+
+  "ios": {
+    "repo": "microsoftconnect/ms-intune-app-sdk-ios",
+    "tag": "21.8.0",
+    "requires": { "ios": "17.0", "xcode": "26" },
+    "expect": [
+      { "glob": "IntuneMAMSwift.xcframework",     "as": "ios/IntuneMAMSwift.xcframework",     "required": true },
+      { "glob": "IntuneMAMSwiftStub.xcframework", "as": "ios/IntuneMAMSwiftStub.xcframework", "required": true },
+      { "glob": "IntuneMAMTelemetry.xcframework", "as": "ios/IntuneMAMTelemetry.xcframework", "required": true },
+      { "glob": "IntuneMAMResources.bundle",      "as": "ios/IntuneMAMResources.bundle",      "required": true },
+      { "glob": "IntuneMAMConfigurator.dmg",      "as": "ios/IntuneMAMConfigurator.dmg",      "required": true, "extractDmg": "IntuneMAMConfigurator", "extractAs": "ios/IntuneMAMConfigurator" },
+      { "glob": "REDIST.txt",                     "as": "ios/REDIST.txt",                     "required": false },
+      { "glob": "Microsoft License Terms*.pdf",   "as": "ios/",                               "required": false },
+      { "glob": "ThirdPartyNotices.txt",          "as": "ios/ThirdPartyNotices.txt",          "required": false }
+    ],
+    "_notes": [
+      "IntuneMAMStatic.xcframework is the static variant — not used; the dynamic one keeps",
+      "bundle size down when extensions are involved.",
+      "libIntuneMAMSwiftFileProvider.xcframework is only for File Provider extensions.",
+      "IntuneMAMResources.bundle carries every SDK screen (PIN, blur, diagnostics, MTD",
+      "compliance) and 28 localizations. Without it the SDK's UI cannot render."
+    ]
+  },
+
+  "android": {
+    "repo": "microsoftconnect/ms-intune-app-sdk-android",
+    "tag": "12.4.0",
+    "expect": [
+      { "glob": "**/Microsoft.Intune.MAM.SDK.aar",         "as": "android/Microsoft.Intune.MAM.SDK.aar",                    "required": true },
+      { "glob": "**/com.microsoft.intune.mam.build.jar",   "as": "android/GradlePlugin/com.microsoft.intune.mam.build.jar", "required": true },
+      { "glob": "**/Microsoft.Intune.MAM.SDK.Support*.jar","as": "android/support/",                                        "required": false },
+      { "glob": "**/*License*.pdf",                        "as": "android/",                                                "required": false }
+    ]
+  },
+
+  "toolchain": {
+    "_comment": [
+      "A version bump forces a conscious check against the MAM compatibility matrix and the",
+      "host app's toolchain (SPEC.md O-E).",
+      "",
+      "msal_android has no requirement from Microsoft to satisfy. The Android SDK guide says",
+    "only \"integrate MSAL\" and links the MSAL repository, unlike iOS where the coupling is",
+    "hard. So this is our choice, pinned for reproducibility rather than compatibility:",
+    "8.4.2, the current stable, released 2026-08-21.",
+    "",
+    "msal_ios is exact, not a range: the Intune SDK does not carry its own MSAL, it drives",
+      "the app's. Two consumers on different MSALs is the same hazard pinning the Intune SDK",
+      "exists to prevent. Resolved by CocoaPods on 2026-09-04, not guessed.",
+      "",
+      "`requires` is the compatibility-matrix row for the pinned Android tag above (12.4.0 ->",
+      "the 12.0.0 row). Microsoft tests these combinations; mixing rows is untested. These are",
+      "the library's own defaults in android/build.gradle. The consumer's app module, where the",
+      "MAM Gradle plugin actually runs, must land on the same row -- that is O-E, still open."
+    ],
+    "javassist": "3.29.2-GA",
+    "msal_ios": "2.15.0",
+    "msal_android": "8.4.2",
+    "requires": { "android": "16", "gradle": "8.11.1", "agp": "8.9.1", "kotlin": "2.1.21", "java": "17" }
+  }
+}

package/src/NativeIntune.ts

@@ -0,0 +1,130 @@
+/**
+ * Codegen spec — the ONLY file Codegen reads, and the only `Native*.ts` allowed in
+ * `jsSrcsDir`. An extra one is picked up and fails confusingly.
+ *
+ * This file is deliberately loose (CLAUDE.md rule 11). Codegen accepts only
+ * `boolean | number | string | Object | Array | Promise | void`: no literal unions, no
+ * optional parameters, no enums. So every union and every optional is normalized in
+ * `index.ts` before it crosses the bridge, and every aggregate return is `Object` here
+ * and a real type there. Nothing in the public API is `Object`.
+ *
+ * Editing this file means Codegen must re-run — `pod install` on iOS,
+ * `generateCodegenArtifactsFromSchema` on Android. A native build that breaks right
+ * after a change here is a stale Codegen artifact until proven otherwise.
+ */
+
+import { TurboModuleRegistry, type TurboModule } from 'react-native';
+
+export interface Spec extends TurboModule {
+  // ---- lifecycle ----
+
+  /**
+   * Every field is required here even though most are optional in the public API:
+   * `index.ts` applies the defaults, so the native side never has to guess one.
+   * Empty string means "unset" for `keychainGroupOverride`.
+   */
+  configure(config: {
+    clientId: string;
+    tenantId: string;
+    authority: string;
+    redirectUri: string;
+    authMode: string; // 'builtin' | 'external'
+    verboseLogging: boolean;
+    restartHandledByApp: boolean;
+    maxFileProtectionLevel: string; // FileProtectionLevel
+    strictMode: boolean;
+    keychainGroupOverride: string; // '' = platform default
+    telemetryEnabled: boolean;
+    // SDK screen branding (SPEC §15 P4). '' leaves the SDK's own default in place.
+    brandingBackground: string;
+    brandingForeground: string;
+    brandingAccent: string;
+    brandingSecondaryBackground: string;
+    brandingSecondaryForeground: string;
+  }): Promise<void>;
+
+  /** SDK linked and platform prerequisites met. Gate the whole Intune path on this. */
+  isSupported(): Promise<boolean>;
+
+  /** BrokerStatus. */
+  getBrokerStatus(): Promise<Object>;
+
+  openBrokerInstall(): Promise<void>;
+
+  // ---- auth (builtin mode) ----
+
+  /** SignInParams in, AuthResult out. */
+  signIn(params: Object): Promise<Object>;
+  /** SignInParams in, AuthResult out. Rejects E_INTERACTION_REQUIRED. */
+  signInSilent(params: Object): Promise<Object>;
+  /** AcquireTokenParams in, AuthResult out. For the app's own scopes only. */
+  acquireToken(params: Object): Promise<Object>;
+  /** AuthAccount[]. */
+  getAccounts(): Promise<Object[]>;
+
+  signOut(params: { accountId: string; wipeIntune: boolean }): Promise<void>;
+
+  // ---- enrollment ----
+
+  /**
+   * EnrollmentResult. Resolves for every outcome including failures — a non-success
+   * status is data, not an exception. Resolved from the SDK's delegate or notification,
+   * never from the underlying call returning (SPEC §12.5).
+   */
+  enroll(params: { accountId: string; upn: string }): Promise<Object>;
+
+  /**
+   * EnrollmentResult. **iOS only** — `loginAndEnrollAccount:` makes the SDK run the
+   * sign-in itself and show its own UI, so no MSAL is needed on our side. Android has no
+   * counterpart: `registerAccountForMAM` always needs a token from the app.
+   *
+   * Pass '' for `upn` to let the SDK prompt for the address as well.
+   */
+  enrollInteractive(params: { upn: string }): Promise<Object>;
+
+  /** IntuneState — the reconciliation primitive. */
+  getState(): Promise<Object>;
+
+  /**
+   * Writes the journal and unregisters. The process is expected to terminate during this
+   * call on Android (SPEC §7), so nothing after it is guaranteed to run.
+   */
+  reset(params: { wipe: boolean; reason: string }): Promise<void>;
+
+  /**
+   * NOT public API. Verifies the account really is gone, then closes the journal —
+   * `reset()` in index.ts calls it after the consumer's reset handler has cleared local
+   * data. Separate from `reset` because the steps between them may straddle a process
+   * death, and the journal is what carries the sequence across it (SPEC §7).
+   */
+  completeReset(): Promise<void>;
+
+  // ---- policy ----
+
+  /** PolicySnapshot. */
+  getPolicy(): Promise<Object>;
+  /** Opaque key/value for support bundles. No tokens, no UPNs. */
+  getDiagnostics(): Promise<Object>;
+
+  // ---- token provider plumbing ----
+
+  /**
+   * NOT public API. `setTokenProvider` in `index.ts` wraps these; the SDK asks for a MAM
+   * service token on a background thread, including on its own retry schedule with no JS
+   * call in flight, so it cannot be a callback parameter on `enroll` (SPEC §13.4).
+   */
+  resolveToken(params: { requestId: string; token: string }): void;
+  rejectToken(params: { requestId: string; reason: string }): void;
+
+  // ---- events ----
+
+  /**
+   * Present only to satisfy `NativeEventEmitter`; ref-counting, no logic. The emitter
+   * itself is live from module construction and queues events fired before JS
+   * subscribes — a wipe lost during startup means the reset never runs (SPEC §4.4).
+   */
+  addListener(eventName: string): void;
+  removeListeners(count: number): void;
+}
+
+export default TurboModuleRegistry.getEnforcing<Spec>('RNIntune');