react-native-intune 0.1.0-alpha.1

package/android/src/main/java/com/reactnativeintune/RNIntuneModule.kt

@@ -0,0 +1,752 @@
+package com.reactnativeintune
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.Promise
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.ReadableMap
+import com.facebook.react.bridge.WritableMap
+import android.content.Intent
+import android.net.Uri
+import android.os.Handler
+import android.os.Looper
+import android.util.Log
+import com.microsoft.intune.mam.client.app.MAMComponents
+import com.microsoft.intune.mam.client.strict.MAMStrictMode
+import com.microsoft.intune.mam.policy.MAMEnrollmentManager
+import com.microsoft.intune.mam.policy.MAMUserInfo
+
+/**
+ * TurboModule implementation. `NativeIntuneSpec` is generated by Codegen from
+ * `src/NativeIntune.ts` into this same package (`codegenConfig.android.javaPackageName`),
+ * so there is nothing to import.
+ *
+ * Every spec parameter arrives as a [ReadableMap] because Codegen maps inline object
+ * types that way on Android — unlike iOS, where they become typed C++ structs. Read keys
+ * through the constants in [Keys] rather than inline strings: a typo in a key is silent.
+ */
+class RNIntuneModule(private val reactContext: ReactApplicationContext) :
+  NativeIntuneSpec(reactContext) {
+
+  private val events = RNIntuneEventQueue(reactContext)
+
+  private var config: RNIntuneConfig? = null
+
+  /** MSAL. Built at configure time in `builtin` mode only (SPEC §3.2). */
+  private val auth = RNIntuneAuth(reactContext)
+
+  /** Held so they can be unregistered; also proves the plugin processed the app. */
+  private var registrations: List<RNIntuneNotifications.Registration> = emptyList()
+
+  /**
+   * The account this process registered. Android cannot enumerate registered accounts,
+   * so there is nothing to read it back from after a restart.
+   */
+  private var registeredAccountId: String? = null
+
+  /** The UPN the account was registered with. `unregisterAccountForMAM` needs it too. */
+  private var registeredUpn: String? = null
+
+  /** accountId -> completion, settled from the notification receiver. */
+  private val pendingEnrollments = mutableMapOf<String, (WritableMap) -> Unit>()
+
+  private val timeoutHandler = Handler(Looper.getMainLooper())
+
+  // ------------------------------------------------------------------ lifecycle
+
+  init {
+    // The callback object outlives any single React context — it is registered from
+    // Application.onMAMCreate — so it is pointed at whichever module instance is live.
+    RNIntuneAuthCallback.attach(this)
+  }
+
+  override fun invalidate() {
+    RNIntuneAuthCallback.detach(this)
+    timeoutHandler.removeCallbacksAndMessages(null)
+    RNIntuneNotifications.unregister(registrations)
+    registrations = emptyList()
+    super.invalidate()
+  }
+
+  override fun configure(config: ReadableMap, promise: Promise) {
+    if (!sdkAvailable) {
+      promise.reject(
+        ERR_SDK_UNAVAILABLE,
+        "The Intune MAM SDK is not on the classpath. Check that vendor/android was " +
+          "fetched and that the MAM Gradle plugin is applied in the app module.",
+      )
+      return
+    }
+
+    val incoming = RNIntuneConfig.from(config)
+
+    // Switching tenants requires an explicit reset: reconfiguring in place would leave
+    // the previous tenant registered (SPEC §13.1).
+    val active = this.config
+    if (active != null && active.tenantId != incoming.tenantId) {
+      promise.reject(
+        ERR_RESET_REQUIRED,
+        "configure() was called with a different tenantId than the active one. " +
+          "Call reset() before switching tenants.",
+      )
+      return
+    }
+
+    // No branding here. The three iOS runtime colour properties have no Android
+    // counterpart — the SDK's own screens follow the app's theme instead — so the
+    // branding fields are silently unused on this platform rather than faked.
+
+    // Strict Mode throws on integration bugs that would otherwise silently leave
+    // corporate data unprotected. It is not meant for production, which is why the
+    // public default is __DEV__ and not `true` (SPEC §6.1).
+    if (incoming.strictMode) {
+      runCatching { MAMStrictMode.enable() }
+        .onFailure { Log.w(TAG, "MAM Strict Mode could not be enabled: ${it.message}") }
+    }
+
+    // Registered once and kept for the process lifetime: the SDK notifies unprompted,
+    // including on its own enrollment retry schedule and for service-initiated wipes.
+    if (registrations.isEmpty()) {
+      registrations = RNIntuneNotifications.register(::emit)
+      if (registrations.isEmpty()) {
+        // MAMComponents returns null when the app was not processed by the MAM Gradle
+        // plugin. Everything would then appear to work while nothing was protected, so
+        // this is the one integration mistake worth refusing to start on.
+        promise.reject(
+          ERR_SDK_UNAVAILABLE,
+          "The MAM notification registry is unavailable. This app was almost certainly " +
+            "built without the MAM Gradle plugin applied to its app module — see the " +
+            "README integration checklist. Without it the SDK is present but inert.",
+        )
+        return
+      }
+    }
+
+    this.config = incoming
+
+    // Unlike iOS there is no runtime override to set: these values are held here and
+    // passed per-call to registerAccountForMAM (SPEC §13.1). The MAM service auth
+    // callback is not registered here either — it has to be in place from
+    // Application.onMAMCreate, long before this method can run, so it is the consumer's
+    // wiring and we only supply the class (SPEC §6.1.2).
+
+    if (!incoming.builtinAuth) {
+      // `external`: the host app owns MSAL. Building a second client here would put two
+      // caches in one binary, which is the thing that mode exists to avoid (SPEC §3.2).
+      promise.resolve(null)
+      return
+    }
+
+    // Off the main thread: creating the MSAL client writes the config file and does
+    // network setup, and the blocking factory is the one that reports failure usefully.
+    Thread {
+      try {
+        auth.configure(incoming.clientId, incoming.authority, incoming.redirectUri)
+        promise.resolve(null)
+      } catch (e: Throwable) {
+        // Loud here rather than at the first sign-in, where the cause is much harder to
+        // see. A redirect URI whose signature hash does not match the registration is
+        // the common one.
+        this.config = null
+        promise.reject(
+          ERR_NATIVE,
+          "MSAL could not be initialised: ${e.message ?: "unknown reason"}",
+        )
+      }
+    }.start()
+  }
+
+  override fun isSupported(promise: Promise) {
+    promise.resolve(sdkAvailable)
+  }
+
+  override fun getBrokerStatus(promise: Promise) {
+    val companyPortal = isCompanyPortalInstalled()
+
+    promise.resolve(
+      Arguments.createMap().apply {
+        putBoolean("brokerAvailable", companyPortal)
+        putBoolean("companyPortalInstalled", companyPortal)
+        // Authenticator is not a broker for MAM on Android.
+        putBoolean("authenticatorInstalled", false)
+        // Company Portal is mandatory here — enrollment is impossible without it.
+        putBoolean("required", true)
+      }
+    )
+  }
+
+  override fun openBrokerInstall(promise: Promise) {
+    if (isPackageInstalled(COMPANY_PORTAL_PACKAGE)) {
+      promise.reject(ERR_NOT_NEEDED, "Company Portal is already installed.")
+      return
+    }
+
+    // market:// with the verified package name, falling back to the web Play Store for
+    // devices without the Play app.
+    val intents =
+      listOf(
+        Intent(Intent.ACTION_VIEW, Uri.parse("market://details?id=$COMPANY_PORTAL_PACKAGE")),
+        Intent(
+          Intent.ACTION_VIEW,
+          Uri.parse("https://play.google.com/store/apps/details?id=$COMPANY_PORTAL_PACKAGE"),
+        ),
+      )
+
+    for (intent in intents) {
+      intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+      if (runCatching { reactContext.startActivity(intent) }.isSuccess) {
+        promise.resolve(null)
+        return
+      }
+    }
+    promise.reject(ERR_NATIVE, "Could not open the Play Store for Company Portal.")
+  }
+
+  // ------------------------------------------------------------------ auth
+
+  /** Returns false and rejects when the caller may not use the built-in MSAL. */
+  private fun authReady(method: String, promise: Promise): Boolean {
+    if (config == null) {
+      notConfigured(method, promise)
+      return false
+    }
+    if (config?.builtinAuth != true) {
+      promise.reject(
+        ERR_EXTERNAL_AUTH_MODE,
+        "$method is unavailable in authMode 'external'. The host app owns MSAL there; " +
+          "supply the account id to enroll() and answer tokenRequest via " +
+          "setTokenProvider.",
+      )
+      return false
+    }
+    return true
+  }
+
+  private fun scopesOf(params: ReadableMap): List<String> {
+    val array = runCatching { params.getArray("scopes") }.getOrNull() ?: return emptyList()
+    return (0 until array.size()).mapNotNull { array.getString(it) }
+  }
+
+  override fun signIn(params: ReadableMap, promise: Promise) {
+    if (!authReady("signIn", promise)) return
+    val scopes = scopesOf(params)
+    val loginHint = params.getString("loginHint")
+    val prompt = params.getString("prompt")
+
+    // Off the JS thread: with an account already signed in this tries the cache first,
+    // and that call blocks. MSAL puts its own UI on the main thread itself.
+    Thread {
+      auth.signIn(
+        scopes = scopes,
+        loginHint = loginHint,
+        prompt = prompt,
+        onResult = { promise.resolve(it) },
+        onError = { code, message -> promise.reject(code, message) },
+      )
+    }.start()
+  }
+
+  override fun signInSilent(params: ReadableMap, promise: Promise) {
+    if (!authReady("signInSilent", promise)) return
+    Thread {
+      auth.acquireTokenSilent(
+        scopes = scopesOf(params),
+        forceRefresh = false,
+        onResult = { promise.resolve(it) },
+        onError = { code, message -> promise.reject(code, message) },
+      )
+    }.start()
+  }
+
+  override fun acquireToken(params: ReadableMap, promise: Promise) {
+    if (!authReady("acquireToken", promise)) return
+    val forceRefresh =
+      runCatching { params.getBoolean("forceRefresh") }.getOrDefault(false)
+    Thread {
+      auth.acquireTokenSilent(
+        scopes = scopesOf(params),
+        forceRefresh = forceRefresh,
+        onResult = { promise.resolve(it) },
+        onError = { code, message -> promise.reject(code, message) },
+      )
+    }.start()
+  }
+
+  override fun getAccounts(promise: Promise) {
+    if (!authReady("getAccounts", promise)) return
+    Thread {
+      val out = Arguments.createArray()
+      auth.accounts().forEach { out.pushMap(it) }
+      promise.resolve(out)
+    }.start()
+  }
+
+  override fun signOut(params: ReadableMap, promise: Promise) {
+    if (!authReady("signOut", promise)) return
+    val wipeIntune = runCatching { params.getBoolean("wipeIntune") }.getOrDefault(false)
+
+    // Off the main thread: with a wipe this runs the whole reset sequence, whose
+    // unregister blocks (SPEC §5.3, §12.5).
+    Thread {
+      if (wipeIntune) {
+        // Order matters and is the reason this lives in one place: unregister first,
+        // then clear MSAL. Reversed, the unregister loses the token it needs.
+        doReset(wipe = true, reason = "logout")
+      } else {
+        auth.signOutQuietly()
+      }
+      promise.resolve(null)
+    }.start()
+  }
+
+  // ------------------------------------------------------------------ enrollment
+
+  override fun enroll(params: ReadableMap, promise: Promise) {
+    val config = this.config
+    if (config == null) {
+      notConfigured("enroll", promise)
+      return
+    }
+
+    val accountId = params.getString("accountId").orEmpty()
+    if (accountId.isEmpty()) {
+      promise.reject(ERR_INVALID_ACCOUNT_ID, "enroll() requires an Entra object ID.")
+      return
+    }
+
+    // registerAccountForMAM(upn, aadId, tenantId, authority) — parameter order verified
+    // from bytecode, not documentation: the offline implementation forwards them to
+    // MAMIdentityManager.insertOrUpdate(aadId, upn, tenantId, authority), which in turn
+    // builds MAMIdentity(upn, aadId, authority, tenantId).
+    //
+    // The UPN is required and NonNull, and this module's public API deliberately takes
+    // only the Entra object ID (SPEC §13.2). Nothing can supply the UPN yet: in
+    // authMode 'builtin' it comes from the module's own MSAL sign-in, which is spike
+    // S-3. Rejecting here with a named code beats calling the SDK with a fabricated
+    // identity, which would register the wrong account.
+    val upn = params.getString("upn").orEmpty().ifEmpty { knownUpnFor(accountId) }
+    if (upn.isNullOrEmpty()) {
+      promise.reject(
+        ERR_UPN_REQUIRED,
+        "Android enrollment needs the account's UPN as well as its object ID — " +
+          "registerAccountForMAM takes both and will not accept null for the UPN. In " +
+          "authMode 'builtin' the module reads it from its own MSAL account (spike " +
+          "S-3, not yet landed); in 'external' pass it as enroll({ accountId, upn }). " +
+          "iOS is unaffected: registerAndEnrollAccountId takes the object ID alone and " +
+          "the SDK resolves the UPN itself.",
+      )
+      return
+    }
+
+    val manager = MAMComponents.get(MAMEnrollmentManager::class.java)
+    if (manager == null) {
+      promise.reject(
+        ERR_SDK_UNAVAILABLE,
+        "MAMEnrollmentManager is unavailable — the MAM Gradle plugin is almost " +
+          "certainly not applied to this app module.",
+      )
+      return
+    }
+
+    // Already registered? Answer now.
+    //
+    // `registerAccountForMAM` for a known account is a no-op that fires **no**
+    // notification — the SDK logs "skipping already registered account" and returns. The
+    // promise below would then wait for a result that is never coming and settle as
+    // `pending` at the timeout, which is both slow and untrue. Observed on device.
+    val known = runCatching { manager.getRegisteredAccountStatus(upn, accountId) }.getOrNull()
+    if (known != null) {
+      registeredAccountId = accountId
+      registeredUpn = upn
+      promise.resolve(RNIntuneNotifications.resultFrom(known, accountId))
+      return
+    }
+
+    // Held against the account ID and settled from the notification receiver. The call
+    // below returns immediately and says nothing about the outcome (SPEC §12.5).
+    synchronized(pendingEnrollments) {
+      val existing = pendingEnrollments[accountId]
+      pendingEnrollments[accountId] = { result ->
+        existing?.invoke(result)
+        promise.resolve(result)
+      }
+    }
+
+    scheduleEnrollTimeout(accountId)
+
+    registeredAccountId = accountId
+    // Kept because unregisterAccountForMAM needs the UPN too, and by then the process
+    // may have restarted — so it also goes into the journal (SPEC §7).
+    registeredUpn = upn
+    manager.registerAccountForMAM(upn, accountId, config.tenantId, config.authority)
+  }
+
+  /**
+   * The UPN for an object ID, from the module's own MSAL account cache.
+   *
+   * Always null today — it becomes the MSAL lookup in the auth slice (S-3). Keeping the
+   * seam here means `enroll` does not change shape when that lands, and it is the reason
+   * the `upn` parameter is documented as `external`-mode only rather than as the normal
+   * way to call this.
+   */
+  /**
+   * The UPN for an account id, from the module's own MSAL sign-in.
+   *
+   * `registerAccountForMAM` needs both and will not take a null UPN, while the public API
+   * deliberately carries only the object ID (SPEC §6.3). In `external` mode there is no
+   * MSAL here to ask, and the caller passes `upn` explicitly.
+   */
+  private fun knownUpnFor(accountId: String): String? =
+    if (config?.builtinAuth == true) auth.upnFor(accountId) else null
+
+  private fun scheduleEnrollTimeout(accountId: String) {
+    timeoutHandler.postDelayed({
+      // Truthful rather than convenient: the SDK has not failed, it has not answered.
+      // It keeps retrying on its own schedule and the result still arrives as an event.
+      settleEnrollment(
+        accountId,
+        Arguments.createMap().apply {
+          putString("status", "pending")
+          putString("accountId", accountId)
+          putString("nativeCode", "RNIntuneTimeout")
+          putString(
+            "nativeMessage",
+            "The SDK did not report a result within the timeout. Enrollment continues " +
+              "in the background; watch onEnrollmentResult.",
+          )
+          putBoolean("restartRequired", false)
+        },
+      )
+    }, ENROLL_TIMEOUT_MS)
+  }
+
+  private fun settleEnrollment(accountId: String, result: WritableMap) {
+    val completion = synchronized(pendingEnrollments) { pendingEnrollments.remove(accountId) }
+    completion?.invoke(result)
+  }
+
+  /**
+   * iOS-only. `loginAndEnrollAccount:` has no Android counterpart —
+   * `registerAccountForMAM` always needs a token supplied by the app, so there is
+   * nothing here that can run a sign-in on the SDK's behalf.
+   */
+  override fun enrollInteractive(params: ReadableMap, promise: Promise) {
+    promise.reject(
+      ERR_SDK_UNAVAILABLE,
+      "enrollInteractive() is iOS-only. On Android the SDK cannot run the sign-in " +
+        "itself: registerAccountForMAM needs a token from the app, so use enroll() with " +
+        "a token provider.",
+    )
+  }
+
+  override fun getState(promise: Promise) {
+    // Deliberately never rejects: reporting `configured: false` is what makes this the
+    // reconciliation primitive (SPEC §13.2).
+    //
+    // Android has no "list registered accounts" API — getRegisteredAccountStatus takes
+    // an account ID and answers for that one. So the registered set is whatever this
+    // process registered, and after a restart it is empty until the app reconciles.
+    // That asymmetry with iOS (which has registeredAccountIds) is why the host app
+    // compares against its own backend rather than trusting this list alone.
+    val registered = registeredAccountId
+    val status = registered?.let { readStatus(it) }
+
+    promise.resolve(
+      Arguments.createMap().apply {
+        putBoolean("configured", config != null)
+        putString("configuredTenantId", config?.tenantId)
+        putArray(
+          "registeredAccountIds",
+          Arguments.createArray().apply { registered?.let { pushString(it) } },
+        )
+        putString(
+          "enrolledAccountId",
+          if (RNIntuneNotifications.unifiedStatus(status) == "succeeded") registered else null,
+        )
+        putString("status", status?.let { RNIntuneNotifications.unifiedStatus(it) })
+        putString("pendingReset", RNIntuneResetJournal.stage(reactContext))
+        putString("pendingResetReason", RNIntuneResetJournal.read(reactContext)?.reason)
+      }
+    )
+  }
+
+  /**
+   * **The process is expected to terminate during this call** (SPEC §7). Everything
+   * after `unregisterAccountForMAM` is best-effort; the journal is what carries the
+   * sequence across the death.
+   */
+  override fun reset(params: ReadableMap, promise: Promise) {
+    doReset(params.getBoolean("wipe"), params.getString("reason").orEmpty())
+    promise.resolve(null)
+  }
+
+  /** Shared by `reset` and `signOut({ wipeIntune: true })`, so the order cannot diverge. */
+  private fun doReset(wipe: Boolean, reason: String) {
+    RNIntuneReset.run(
+      context = reactContext,
+      accountId = registeredAccountId,
+      upn = registeredUpn,
+      tenantId = config?.tenantId,
+      wipe = wipe,
+      reason = reason,
+    )
+
+    // MSAL cache cleanup, after the unregister above and never before it: that call needs
+    // an Intune token which comes from this cache, so clearing it first would strand a
+    // registered account (SPEC §7 step 4). Skipped in `external`, where the cache is the
+    // host app's.
+    if (config?.builtinAuth == true) {
+      auth.signOutQuietly()
+      auth.invalidate()
+    }
+
+    config = null
+    registeredAccountId = null
+    registeredUpn = null
+  }
+
+  override fun completeReset(promise: Promise) {
+    // Verify rather than assume (SPEC §7 step 5). A reset that did not take stays open
+    // and is retried: the SDK resumes enrollment retries on its own schedule, and a
+    // half-finished reset is worse than none.
+    if (RNIntuneReset.complete(reactContext, ::readStatus)) {
+      promise.resolve(null)
+      return
+    }
+    promise.reject(
+      ERR_RESET_IN_PROGRESS,
+      "The account is still registered after reset, so the journal was left open. " +
+        "It will be retried on the next launch.",
+    )
+  }
+
+  // ------------------------------------------------------------------ policy
+
+  override fun getPolicy(promise: Promise) {
+    if (!sdkAvailable) {
+      promise.reject(ERR_SDK_UNAVAILABLE, "The Intune MAM SDK is not on the classpath.")
+      return
+    }
+    promise.resolve(RNIntunePolicy.snapshot(reactContext, registeredAccountId))
+  }
+
+  override fun getDiagnostics(promise: Promise) {
+    // Account IDs may appear here but must never be logged or persisted (CLAUDE.md
+    // rule 3). Nothing below is a token or a UPN.
+    promise.resolve(
+      Arguments.createMap().apply {
+        putString("platform", "android")
+        putString("sdkLinked", sdkAvailable.toString())
+        putString("configured", (config != null).toString())
+        putString("configuredTenantId", config?.tenantId.orEmpty())
+        putString("authMode", config?.authMode.orEmpty())
+        putString("companyPortalInstalled", isPackageInstalled(COMPANY_PORTAL_PACKAGE).toString())
+        putString("strictMode", (config?.strictMode ?: false).toString())
+        putString("notificationReceiversRegistered", registrations.size.toString())
+        if (sdkAvailable) {
+          // MAMComponents answers these without an enrolled account, and neither is a
+          // token, a UPN or an account ID (CLAUDE.md rule 3).
+          putString(
+            "managedApp",
+            runCatching { MAMComponents.isManagedApp(reactContext).toString() }
+              .getOrDefault("unknown"),
+          )
+          putString(
+            "wipeInProgress",
+            runCatching { MAMComponents.isWipeInProgress(reactContext).toString() }
+              .getOrDefault("unknown"),
+          )
+        }
+      }
+    )
+  }
+
+  // ------------------------------------------------------------------ token provider
+
+  /**
+   * Not public API — `setTokenProvider` in `index.ts` wraps these. The MAM service token
+   * never crosses back out to JS and is never logged (CLAUDE.md rule 9).
+   *
+   * Wiring lands with the auth callback (SPEC §13.4): the SDK asks on a background
+   * thread, including on its own retry schedule with no JS call in flight, so the
+   * request has to be correlated by `requestId` rather than awaited inline.
+   */
+  override fun resolveToken(params: ReadableMap) {
+    val requestId = params.getString("requestId") ?: return
+    RNIntuneAuthCallback.resolve(requestId, params.getString("token").orEmpty())
+  }
+
+  override fun rejectToken(params: ReadableMap) {
+    val requestId = params.getString("requestId") ?: return
+    RNIntuneAuthCallback.reject(requestId, params.getString("reason").orEmpty())
+  }
+
+  // ------------------------------------------------------------------ events
+
+  override fun addListener(eventName: String) = events.addListener()
+
+  override fun removeListeners(count: Double) = events.removeListeners(count.toInt())
+
+  /**
+   * A MAM service token from the module's own MSAL, or null when this is not our job.
+   *
+   * Null in `external` mode, where the host app owns MSAL and answers the JS
+   * `tokenRequest` instead. Called on the SDK's background thread and blocks it.
+   */
+  internal fun mamServiceToken(resourceId: String): String? =
+    if (config?.builtinAuth == true) auth.mamServiceToken(resourceId) else null
+
+  /** Called by the auth callback from the SDK's own background thread. */
+  internal fun emitTokenRequest(
+    requestId: String,
+    resourceId: String,
+    accountId: String,
+    tenantId: String,
+    authority: String,
+  ) {
+    emit(
+      "tokenRequest",
+      Arguments.createMap().apply {
+        putString("requestId", requestId)
+        putString("resourceId", resourceId)
+        putString("accountId", accountId)
+        putString("tenantId", tenantId)
+        putString("authority", authority)
+      },
+    )
+  }
+
+  /**
+   * Settle first, publish second. The same notification serves a caller waiting on
+   * `enroll()` and every subscriber — including the SDK's own background retries, which
+   * have no caller at all (SPEC §13.5).
+   */
+  internal fun emit(event: String, payload: WritableMap) {
+    if (event == "enrollmentResult" || event == "unenrollmentResult") {
+      payload.getString("accountId")?.let { settleEnrollment(it, payload.copy()) }
+    }
+
+    // A service-initiated wipe opens the journal before anyone hears about it.
+    //
+    // Intercepted here because every notification passes through, and this is where the
+    // tenant id is in scope. The SDK terminates the process after a wipe, so a
+    // subscriber's cleanup may not finish — and with no journal entry there is no
+    // `pendingReset`, so the next launch has no idea anything happened and the app's own
+    // data and backend session are never dealt with. §7 already lists remote wipe as one
+    // of the callers of the single reset path; this makes that true (SPEC §7.4).
+    if (event == "wipeRequested") {
+      RNIntuneResetJournal.openForServiceWipe(
+        context = reactContext,
+        accountId = payload.getString("accountId"),
+        tenantId = config?.tenantId,
+      )
+    }
+
+    events.emit(event, payload)
+  }
+
+  // ------------------------------------------------------------------ helpers
+
+  /**
+   * The SDK's view of an account's enrollment.
+   *
+   * `getRegisteredAccountStatus(upn, oid)` — the order verified from bytecode, not
+   * documentation: the offline implementation checks its *second* argument and warns
+   * "called without valid OID", then calls `MAMIdentityManager.create(arg1, arg2)`.
+   * Passing the object ID alone lands it in the UPN slot and the registry answers "not
+   * registered" for an account that is — observed on device as
+   * `getAccountInfo() called for account that is not registered: <oid>;<null>`.
+   *
+   * The UPN comes from the SDK rather than from this object's fields, because those are
+   * in memory and a status read after a restart would otherwise silently miss.
+   */
+  private fun readStatus(accountId: String): MAMEnrollmentManager.Result? =
+    runCatching {
+      val manager = MAMComponents.get(MAMEnrollmentManager::class.java) ?: return@runCatching null
+      val upn = registeredUpn
+        ?: MAMComponents.get(MAMUserInfo::class.java)?.primaryUser
+        ?: return@runCatching null
+      manager.getRegisteredAccountStatus(upn, accountId)
+    }
+      .getOrNull()
+
+  /**
+   * True when the MAM SDK is on the classpath. Resolved by name so this file needs no
+   * SDK import to answer it, and so a misbuilt app degrades instead of crashing.
+   */
+  private val sdkAvailable: Boolean by lazy {
+    runCatching { Class.forName("com.microsoft.intune.mam.policy.MAMEnrollmentManager") }
+      .isSuccess
+  }
+
+  /**
+   * Requires a `<queries>` entry for the package in the consumer's manifest on Android
+   * 11+. Without it this returns false even when Company Portal is installed — the same
+   * omission that makes MSAL fall back to a browser and lose the broker (SPEC §6.2).
+   */
+  /**
+   * Whether Company Portal is present, preferring the SDK's own answer.
+   *
+   * `MAMComponents.isCompanyPortalInstalled` is first-party and, more importantly, does
+   * not depend on the consumer having declared the broker packages in `<queries>`. Our
+   * own `packageManager` lookup does: on Android 11+ an undeclared package is invisible,
+   * so a consumer who skips that manifest entry gets a confident `false` for a broker
+   * that is installed — and then tells the user to install what they already have.
+   *
+   * That exact failure happened on iOS for a different reason (the wrong URL form), and
+   * it is worth not leaving a second way to reach it.
+   *
+   * The package lookup stays as the fallback: it is the only thing that can answer before
+   * `configure`, and `getBrokerStatus` is deliberately answerable then, because the app
+   * needs it to decide whether to prompt for a broker install at all (SPEC §13.1).
+   */
+  private fun isCompanyPortalInstalled(): Boolean =
+    runCatching { MAMComponents.isCompanyPortalInstalled(reactContext) }
+      .getOrNull()
+      ?: isPackageInstalled(COMPANY_PORTAL_PACKAGE)
+
+  private fun isPackageInstalled(packageName: String): Boolean =
+    runCatching { reactContext.packageManager.getPackageInfo(packageName, 0) }.isSuccess
+
+  private fun notConfigured(method: String, promise: Promise) {
+    promise.reject(ERR_NOT_CONFIGURED, "$method was called before configure() resolved.")
+  }
+
+  companion object {
+    /** Resolves to "RNIntune" — the name in TurboModuleRegistry.getEnforcing (SPEC §2.2). */
+    const val NAME = NativeIntuneSpec.NAME
+
+    private const val TAG = "RNIntune"
+
+    private const val COMPANY_PORTAL_PACKAGE = "com.microsoft.windowsintune.companyportal"
+
+    // Stable rejection codes (SPEC §13.6). Never surface a raw platform error to JS.
+    // internal, not private: RNIntuneAuth rejects with the same vocabulary and there must
+    // be exactly one definition of each string (SPEC §13.6).
+    internal const val ERR_NOT_CONFIGURED = "E_NOT_CONFIGURED"
+    private const val ERR_RESET_REQUIRED = "E_RESET_REQUIRED"
+    private const val ERR_SDK_UNAVAILABLE = "E_SDK_UNAVAILABLE"
+    private const val ERR_INVALID_ACCOUNT_ID = "E_INVALID_ACCOUNT_ID"
+    private const val ERR_UPN_REQUIRED = "E_UPN_REQUIRED"
+    private const val ERR_RESET_IN_PROGRESS = "E_RESET_IN_PROGRESS"
+    private const val ERR_NOT_NEEDED = "E_NOT_NEEDED"
+    internal const val ERR_NATIVE = "E_NATIVE"
+
+    // MSAL outcomes that are ordinary control flow, not faults.
+    internal const val ERR_INTERACTION_REQUIRED = "E_INTERACTION_REQUIRED"
+    internal const val ERR_USER_CANCELLED = "E_USER_CANCELLED"
+    internal const val ERR_EXTERNAL_AUTH_MODE = "E_EXTERNAL_AUTH_MODE"
+
+    /**
+     * Android-only. React Native outlives its Activity, so an interactive sign-in can be
+     * asked for when there is no window to present it in — a real state, not a
+     * formality, and one the app can recover from by retrying from a mounted screen.
+     */
+    internal const val ERR_NO_ACTIVITY = "E_NO_ACTIVITY"
+
+    /**
+     * Generous on purpose: enrollment involves a token acquisition and a service round
+     * trip, and returning early would report a failure the SDK has not reached.
+     */
+    private const val ENROLL_TIMEOUT_MS = 90_000L
+  }
+}