react-native-intune 0.1.0-alpha.1

package/android/src/main/java/com/reactnativeintune/RNIntuneMsalConfig.kt

@@ -0,0 +1,78 @@
+package com.reactnativeintune
+
+import android.content.Context
+import org.json.JSONArray
+import org.json.JSONObject
+import java.io.File
+
+/**
+ * The per-tenant MSAL configuration, written to a file at `configure()` time (SPEC §3.3).
+ *
+ * MSAL on Android normally reads this from a raw resource, which is a build-time artifact
+ * and therefore fixed at compile time. This module configures a tenant at runtime, so the
+ * JSON is generated and handed to the `File` overload of the factory instead. That is the
+ * whole reason this file exists.
+ *
+ * Every key here was read out of MSAL 8.4.2 rather than from documentation: the shape came
+ * from `res/raw/msal_default_config.json` inside the AAR, and `authority_url` / `type` /
+ * `default` were confirmed as the serialized names on
+ * `com.microsoft.identity.common.java.authorities.Authority`. A key MSAL does not
+ * recognise is ignored silently, which is exactly the kind of failure that costs a day.
+ */
+internal object RNIntuneMsalConfig {
+
+  private const val FILE_NAME = "rn-intune-msal-config.json"
+
+  /**
+   * Writes the config and returns the file.
+   *
+   * Rewritten on every `configure()` rather than cached: the tenant can change between
+   * launches, and a stale file would point MSAL at the previous customer.
+   */
+  fun write(
+    context: Context,
+    clientId: String,
+    authority: String,
+    redirectUri: String,
+  ): File {
+    val file = File(context.filesDir, FILE_NAME)
+    file.writeText(build(clientId, authority, redirectUri).toString(2))
+    return file
+  }
+
+  /** Exposed for tests and for `getDiagnostics`; contains no secrets. */
+  fun build(clientId: String, authority: String, redirectUri: String): JSONObject =
+    JSONObject().apply {
+      put("client_id", clientId)
+      put("redirect_uri", redirectUri)
+
+      // `authority_url` rather than an `audience` block: the URL is what `configure()`
+      // already carries, and it sidesteps having to map a tenant onto one of MSAL's
+      // audience type strings.
+      put(
+        "authorities",
+        JSONArray().put(
+          JSONObject().apply {
+            put("type", "AAD")
+            put("authority_url", authority)
+            put("default", true)
+          },
+        ),
+      )
+
+      // Single identity is a decided constraint, not a default we are accepting
+      // (SPEC §9, CLAUDE.md rule 10). SINGLE also gives us
+      // ISingleAccountPublicClientApplication, whose API cannot express two signed-in
+      // accounts — the constraint is enforced by the type, not by our discipline.
+      put("account_mode", "SINGLE")
+
+      // Both required for brokered auth, which MAM enrollment depends on. Without the
+      // first, MSAL will not hand the request to Company Portal at all.
+      put("broker_redirect_uri_registered", true)
+      put("authorization_user_agent", "DEFAULT")
+
+      // Sovereign clouds. Harmless for the public cloud and the difference between
+      // working and not for a customer in one (SPEC §3.3).
+      put("multiple_clouds_supported", true)
+    }
+}

package/android/src/main/java/com/reactnativeintune/RNIntuneNotifications.kt

@@ -0,0 +1,187 @@
+package com.reactnativeintune
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.WritableMap
+import com.microsoft.intune.mam.client.app.MAMComponents
+import com.microsoft.intune.mam.client.notification.MAMNotificationReceiver
+import com.microsoft.intune.mam.client.notification.MAMNotificationReceiverRegistry
+import com.microsoft.intune.mam.policy.MAMEnrollmentManager
+import com.microsoft.intune.mam.policy.notification.MAMEnrollmentNotification
+import com.microsoft.intune.mam.policy.notification.MAMNotification
+import com.microsoft.intune.mam.policy.notification.MAMNotificationType
+import com.microsoft.intune.mam.policy.notification.MAMUserNotification
+
+/**
+ * The Android counterpart of the iOS delegates: the SDK reports enrollment, policy and
+ * wipe through notifications rather than a delegate protocol.
+ *
+ * These arrive without the app having asked for anything — the SDK has its own
+ * enrollment retry schedule, and a wipe is service-initiated. So nothing here resolves a
+ * promise; it publishes events and whoever is waiting correlates (SPEC §6.4, §12.5).
+ */
+internal object RNIntuneNotifications {
+
+  /** Unified status strings. Must match `EnrollmentStatus` in src/types.ts. */
+  private const val SUCCEEDED = "succeeded"
+  private const val NOT_LICENSED = "notLicensed"
+  private const val FAILED = "failed"
+  private const val PENDING = "pending"
+  private const val AUTHORIZATION_NEEDED = "authorizationNeeded"
+  private const val COMPANY_PORTAL_REQUIRED = "companyPortalRequired"
+  private const val WRONG_USER = "wrongUser"
+  private const val UNENROLLED = "unenrolled"
+  private const val UNENROLLMENT_FAILED = "unenrollmentFailed"
+  private const val UNKNOWN = "unknown"
+
+  /**
+   * Maps the SDK's ten-value result onto the unified vocabulary. The reasoning for each
+   * row is SPEC §4.1 — read it before changing one. Getting `notLicensed` and `failed`
+   * the wrong way round has opposite consequences for the user (SPEC §8).
+   *
+   * `Result` is an enum, so `when` is exhaustive without an `else`: a value added by a
+   * future SDK becomes a compile error here rather than silence. Anything that does slip
+   * through still degrades to `unknown` instead of throwing.
+   */
+  fun unifiedStatus(result: MAMEnrollmentManager.Result?): String =
+    when (result) {
+      MAMEnrollmentManager.Result.ENROLLMENT_SUCCEEDED,
+      // The account is managed through the MDM channel rather than MAM-WE. A managed,
+      // non-blocking state — nativeCode keeps the distinction for support logs.
+      MAMEnrollmentManager.Result.MDM_ENROLLED -> SUCCEEDED
+      MAMEnrollmentManager.Result.NOT_LICENSED -> NOT_LICENSED
+      MAMEnrollmentManager.Result.ENROLLMENT_FAILED -> FAILED
+      MAMEnrollmentManager.Result.PENDING -> PENDING
+      MAMEnrollmentManager.Result.AUTHORIZATION_NEEDED -> AUTHORIZATION_NEEDED
+      MAMEnrollmentManager.Result.COMPANY_PORTAL_REQUIRED -> COMPANY_PORTAL_REQUIRED
+      MAMEnrollmentManager.Result.WRONG_USER -> WRONG_USER
+      MAMEnrollmentManager.Result.UNENROLLMENT_SUCCEEDED -> UNENROLLED
+      MAMEnrollmentManager.Result.UNENROLLMENT_FAILED -> UNENROLLMENT_FAILED
+      // Android has no equivalent of iOS's LicensedNotTargeted: the service reports
+      // NOT_LICENSED for an untargeted account too, so `notTargeted` never appears from
+      // this platform. Recorded in SPEC §4.1 rather than faked here.
+      null -> UNKNOWN
+    }
+
+  /**
+   * An `EnrollmentResult` built from a status the SDK already holds, rather than from a
+   * notification.
+   *
+   * Needed because `registerAccountForMAM` on an already-registered account is a silent
+   * no-op: no notification is ever posted, so `enroll()` has to answer from the registry
+   * or wait for a result that is not coming.
+   */
+  fun resultFrom(status: MAMEnrollmentManager.Result, accountId: String? = null): WritableMap =
+    result(
+      status = unifiedStatus(status),
+      accountId = accountId,
+      nativeCode = status.name,
+      nativeMessage = "Read from the registry; the account was already registered.",
+    )
+
+  /** Shapes an `EnrollmentResult` (SPEC §4.1). */
+  private fun result(
+    status: String,
+    accountId: String?,
+    nativeCode: String,
+    nativeMessage: String,
+  ): WritableMap =
+    Arguments.createMap().apply {
+      putString("status", status)
+      putString("accountId", accountId)
+      putString("nativeCode", nativeCode)
+      putString("nativeMessage", nativeMessage)
+      // Android does not surface a restart requirement; iOS does, via its policy
+      // delegate. Kept in the shape so one branch in JS serves both platforms.
+      putBoolean("restartRequired", false)
+    }
+
+  /**
+   * Registers one receiver per notification type we act on, and returns them so they can
+   * be unregistered.
+   *
+   * `emit` is expected to queue when JS is not listening yet — a wipe notification lost
+   * during startup means the reset machine never runs (SPEC §4.4).
+   */
+  fun register(emit: (event: String, payload: WritableMap) -> Unit): List<Registration> {
+    val registry =
+      MAMComponents.get(MAMNotificationReceiverRegistry::class.java) ?: return emptyList()
+
+    val registrations =
+      listOf(
+        // Enrollment, unenrollment and the SDK's own background retries all arrive here.
+        Registration(MAMNotificationType.MAM_ENROLLMENT_RESULT) { notification ->
+          val enrollment = notification as? MAMEnrollmentNotification ?: return@Registration true
+          val status = unifiedStatus(enrollment.enrollmentResult)
+          val payload =
+            result(
+              status = status,
+              // The Entra object ID. getUserIdentity() is the UPN and is deliberately
+              // not read (CLAUDE.md rule 3).
+              accountId = enrollment.userOid,
+              nativeCode = enrollment.enrollmentResult?.name.orEmpty(),
+              nativeMessage = enrollment.error?.toString().orEmpty(),
+            )
+
+          val event =
+            if (status == UNENROLLED || status == UNENROLLMENT_FAILED) {
+              "unenrollmentResult"
+            } else {
+              "enrollmentResult"
+            }
+          emit(event, payload)
+          true
+        },
+
+        // An administrator changed policy. The app has to re-read whatever UI it gates.
+        Registration(MAMNotificationType.REFRESH_POLICY) {
+          emit("policyChanged", Arguments.createMap())
+          true
+        },
+
+        // Service-initiated. Can arrive with no prior app call at all, which is the whole
+        // reason the emitter is live from construction.
+        Registration(MAMNotificationType.WIPE_USER_DATA) { notification ->
+          emit(
+            "wipeRequested",
+            Arguments.createMap().apply {
+              putString("accountId", (notification as? MAMUserNotification)?.userOid)
+            },
+          )
+          // Returning true tells the SDK the app handled the wipe. The app's own data is
+          // cleared through the reset journal, because the process may not survive long
+          // enough to do it inline (SPEC §7).
+          true
+        },
+
+        // The account is no longer managed — policy has been removed rather than wiped.
+        Registration(MAMNotificationType.MANAGEMENT_REMOVED) { notification ->
+          emit(
+            "unenrollmentResult",
+            result(
+              status = UNENROLLED,
+              accountId = (notification as? MAMUserNotification)?.userOid,
+              nativeCode = "MANAGEMENT_REMOVED",
+              nativeMessage = "",
+            ),
+          )
+          true
+        },
+      )
+
+    registrations.forEach { registry.registerReceiver(it.receiver, it.type) }
+    return registrations
+  }
+
+  fun unregister(registrations: List<Registration>) {
+    val registry =
+      MAMComponents.get(MAMNotificationReceiverRegistry::class.java) ?: return
+    registrations.forEach { registry.unregisterReceiver(it.receiver, it.type) }
+  }
+
+  internal class Registration(
+    val type: MAMNotificationType,
+    handle: (MAMNotification) -> Boolean,
+  ) {
+    val receiver = MAMNotificationReceiver { notification -> handle(notification) }
+  }
+}

package/android/src/main/java/com/reactnativeintune/RNIntunePackage.kt

@@ -0,0 +1,33 @@
+package com.reactnativeintune
+
+import com.facebook.react.BaseReactPackage
+import com.facebook.react.bridge.NativeModule
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.module.model.ReactModuleInfo
+import com.facebook.react.module.model.ReactModuleInfoProvider
+
+class RNIntunePackage : BaseReactPackage() {
+  override fun getModule(name: String, reactContext: ReactApplicationContext): NativeModule? {
+    return if (name == RNIntuneModule.NAME) {
+      RNIntuneModule(reactContext)
+    } else {
+      null
+    }
+  }
+
+  override fun getReactModuleInfoProvider() = ReactModuleInfoProvider {
+    mapOf(
+      RNIntuneModule.NAME to ReactModuleInfo(
+        name = RNIntuneModule.NAME,
+        className = RNIntuneModule.NAME,
+        canOverrideExistingModule = false,
+        // The event emitter must be live from construction, not from the first
+        // enroll() — a service-initiated wipe can arrive before JS calls anything
+        // (SPEC §4.4, §12.4). Revisit this flag when the emitter lands.
+        needsEagerInit = false,
+        isCxxModule = false,
+        isTurboModule = true
+      )
+    )
+  }
+}

package/android/src/main/java/com/reactnativeintune/RNIntunePolicy.kt

@@ -0,0 +1,108 @@
+package com.reactnativeintune
+
+import com.facebook.react.bridge.Arguments
+import com.facebook.react.bridge.ReactApplicationContext
+import com.facebook.react.bridge.WritableMap
+import com.microsoft.intune.mam.client.app.MAMComponents
+import com.microsoft.intune.mam.client.identity.MAMPolicyManager
+import com.microsoft.intune.mam.policy.MAMUserInfo
+import com.microsoft.intune.mam.policy.OpenLocation
+import com.microsoft.intune.mam.policy.SaveLocation
+
+/**
+ * PolicySnapshot (SPEC §4.3).
+ *
+ * For adapting the host app's own UI — nothing here is enforcement. PIN prompts,
+ * screenshot blocking and encryption all happen inside the SDK and are not driven by
+ * these values.
+ *
+ * There is no clipboard field and there cannot be one: neither platform exposes a
+ * clipboard policy getter. `canSaveToPersonal` and `canOpenFromUnmanaged` serve the same
+ * purpose using values the SDK will actually answer.
+ *
+ * Note the class package: `MAMPolicyManager` is in `client.identity`, not `policy`.
+ */
+internal object RNIntunePolicy {
+
+  fun snapshot(context: ReactApplicationContext, accountId: String?): WritableMap {
+    // Ask the SDK who the primary user is rather than relying only on the account id the
+    // caller happens to be holding: that one lives in memory and is gone after a restart,
+    // while the SDK's survives — and a policy read that silently loses its identity is
+    // exactly the failure fixed on iOS.
+    val primaryOid = runCatching { MAMComponents.get(MAMUserInfo::class.java)?.primaryUserOID }
+      .getOrNull()
+      ?.takeIf { it.isNotEmpty() }
+    val oid = accountId ?: primaryOid
+
+    // `getPolicy(context)` never returns null — with no identity it answers with a
+    // default *permissive* policy. So it cannot be used to decide whether the app is
+    // managed, and `isManaged` must not be hardcoded from it being non-null. Observed on
+    // device: a fresh install that had never enrolled reported `isManaged: true`.
+    val policy = runCatching {
+      if (oid != null) MAMPolicyManager.getPolicyForIdentityOID(oid)
+      else MAMPolicyManager.getPolicy(context)
+    }.getOrNull() ?: return unmanaged(primaryOid != null)
+
+    val managed = oid != null &&
+      runCatching { MAMPolicyManager.getIsIdentityOIDManaged(oid) }.getOrDefault(false)
+
+    return Arguments.createMap().apply {
+      putBoolean("isManaged", managed)
+      putBoolean(
+        "canSaveToLocal",
+        policy.getIsSaveToLocationAllowedForOID(SaveLocation.LOCAL, oid),
+      )
+      // Not getIsSaveToPersonalAllowed(), which is deprecated — and the location form is
+      // what iOS uses too (isSaveToAllowedForLocation:Other), so both platforms answer
+      // the same question.
+      putBoolean(
+        "canSaveToPersonal",
+        policy.getIsSaveToLocationAllowedForOID(SaveLocation.OTHER, oid),
+      )
+      putBoolean(
+        "canOpenFromUnmanaged",
+        policy.getIsOpenFromLocationAllowedForOID(OpenLocation.OTHER, oid),
+      )
+      putBoolean("screenshotAllowed", policy.isScreenCaptureAllowed)
+      // Everything else the SDK reports. Explicitly outside semver: anything depended on
+      // here has to be promoted to a typed field first (SPEC §4.3).
+      putMap(
+        "raw",
+        Arguments.createMap().apply {
+          putString("isPinRequired", policy.isPinRequired.toString())
+          putString("isManagedBrowserRequired", policy.isManagedBrowserRequired.toString())
+          putString("isContactSyncAllowed", policy.isContactSyncAllowed.toString())
+          putString("hasSaveRestriction", policy.diagnosticHasSaveRestriction().toString())
+          putString("hasOpenRestriction", policy.diagnosticHasOpenRestriction().toString())
+          putString(
+            "fileEncryptionInUse",
+            policy.diagnosticIsFileEncryptionInUse().toString(),
+          )
+          // Diagnostic, not policy: an all-permissive snapshot means either no identity
+          // resolved or a genuinely unrestricted tenant, and this says which. Boolean
+          // only — the account id itself must not travel here (CLAUDE.md rule 3).
+          putString("hasPrimaryAccount", (primaryOid != null).toString())
+        },
+      )
+    }
+  }
+
+  /**
+   * An app with no policy is fully permissive. Reporting `false` everywhere would hide
+   * functionality that nothing is restricting.
+   */
+  private fun unmanaged(hasPrimaryAccount: Boolean = false): WritableMap =
+    Arguments.createMap().apply {
+      putBoolean("isManaged", false)
+      putBoolean("canSaveToLocal", true)
+      putBoolean("canSaveToPersonal", true)
+      putBoolean("canOpenFromUnmanaged", true)
+      putBoolean("screenshotAllowed", true)
+      putMap(
+        "raw",
+        Arguments.createMap().apply {
+          putString("hasPrimaryAccount", hasPrimaryAccount.toString())
+        },
+      )
+    }
+}

package/android/src/main/java/com/reactnativeintune/RNIntuneReset.kt

@@ -0,0 +1,85 @@
+package com.reactnativeintune
+
+import android.content.Context
+import android.util.Log
+import com.microsoft.intune.mam.client.app.MAMComponents
+import com.microsoft.intune.mam.policy.MAMEnrollmentManager
+
+/**
+ * The reset sequence (SPEC §7).
+ *
+ * Separate from [RNIntuneResetJournal] on purpose: the journal is storage, this is the
+ * order of operations. The order is the part that is easy to get wrong — the unregister
+ * has to precede any token purge, and the process is not guaranteed to survive it.
+ */
+internal object RNIntuneReset {
+
+  private const val TAG = "RNIntuneReset"
+
+  /**
+   * Opens the journal, then unregisters. Every step is written down *before* it is
+   * attempted, because after `unregisterAccountForMAM` there may be no process left to
+   * write anything.
+   */
+  fun run(
+    context: Context,
+    accountId: String?,
+    upn: String?,
+    tenantId: String?,
+    wipe: Boolean,
+    reason: String,
+  ) {
+    RNIntuneResetJournal.open(
+      context = context,
+      accountId = accountId,
+      upn = upn,
+      tenantId = tenantId,
+      wipe = wipe,
+      reason = reason,
+    )
+
+    if (upn != null) {
+      val manager = MAMComponents.get(MAMEnrollmentManager::class.java)
+      // `unregisterAccountForMAM(upn, oid)`. The second parameter is the object ID —
+      // identified from bytecode, not documentation: the offline implementation checks
+      // its second argument and warns "called without valid OID; identity may be
+      // ambiguous", then calls `MAMIdentityManager.create(arg1, arg2)`.
+      //
+      // The single-argument form is not merely deprecated, it is worse: it leaves the
+      // identity ambiguous, and that warning was visible in logcat on a real device
+      // before this was fixed. `getRegisteredAccountStatus` has the same shape.
+      runCatching { manager?.unregisterAccountForMAM(upn, accountId.orEmpty()) }
+        .onFailure { Log.w(TAG, "unregisterAccountForMAM failed: ${it.message}") }
+    }
+
+    // Reached only if the process survived.
+    RNIntuneResetJournal.advance(context, RNIntuneResetJournal.STAGE_CLEANING_AUTH)
+
+    // MSAL cache cleanup happens in RNIntuneModule.doReset, immediately after this
+    // returns, and not here: this object has no MSAL client and should not grow a
+    // dependency on one — it owns the order of operations, not the pieces. What matters
+    // is that it comes *after* the unregister above, because that call needs an Intune
+    // token which comes from the very cache being cleared (SPEC §7 step 4).
+
+    RNIntuneResetJournal.advance(context, RNIntuneResetJournal.STAGE_CLEANING_LOCAL)
+  }
+
+  /**
+   * Closes the journal, but only once the account is verified gone.
+   *
+   * @param statusOf reads the SDK's registration status for an account ID.
+   * @return false when the reset did not take, leaving the journal open for a retry.
+   */
+  fun complete(
+    context: Context,
+    statusOf: (String) -> MAMEnrollmentManager.Result?,
+  ): Boolean {
+    val entry = RNIntuneResetJournal.read(context) ?: return true
+
+    val stillRegistered = entry.accountId?.let { statusOf(it) != null } ?: false
+    if (stillRegistered) return false
+
+    RNIntuneResetJournal.close(context)
+    return true
+  }
+}

package/android/src/main/java/com/reactnativeintune/RNIntuneResetJournal.kt

@@ -0,0 +1,140 @@
+package com.reactnativeintune
+
+import android.content.Context
+import android.content.SharedPreferences
+
+/**
+ * The reset journal (SPEC §7).
+ *
+ * Unregistering an account that had policy enforced makes the SDK wipe that account's
+ * data, and **the process terminating is expected behaviour, not a crash**. Code after
+ * the unregister call does not run. So the sequence is not held in memory: each stage is
+ * written down before it is attempted, and the next launch reads what was in flight.
+ *
+ *     IDLE -> UNREGISTERING -> CLEANING_AUTH -> CLEANING_LOCAL -> IDLE
+ *
+ * No SDK dependency: the journal has to be readable at launch, before anything is
+ * configured.
+ *
+ * **On the storage choice.** SPEC §7 requires this to survive the wipe, which on Android
+ * means it must carry no identity tag — a tagged file is deleted with the account's data
+ * and the app restarts with no knowledge that a reset was in flight. These preferences
+ * are written without ever setting a thread or process identity (the module never calls
+ * `setCurrentThreadAccountId`, per CLAUDE.md rule 10), so the MAM plugin's rewritten file
+ * layer sees them as unmanaged.
+ *
+ * [verify] against a real wipe once a tenant exists. Survival across process death is
+ * exercised and works; survival across a wipe cannot be tested without a policy-targeted
+ * account, and it is the half that matters more.
+ */
+internal object RNIntuneResetJournal {
+
+  /** Stage strings. Must match `ResetStage` in src/types.ts. */
+  const val STAGE_UNREGISTERING = "unregistering"
+  const val STAGE_CLEANING_AUTH = "cleaningAuth"
+  const val STAGE_CLEANING_LOCAL = "cleaningLocal"
+
+  private const val PREFS = "com.reactnativeintune.resetJournal"
+  private const val KEY_STAGE = "stage"
+  private const val KEY_ACCOUNT_ID = "accountId"
+  private const val KEY_UPN = "upn"
+  private const val KEY_TENANT_ID = "tenantId"
+  private const val KEY_WIPE = "wipe"
+  private const val KEY_REASON = "reason"
+  private const val KEY_STARTED_AT = "startedAt"
+
+  data class Entry(
+    val stage: String,
+    val accountId: String?,
+    val upn: String?,
+    val tenantId: String?,
+    val wipe: Boolean,
+    val reason: String,
+    val startedAt: Long,
+  )
+
+  private fun prefs(context: Context): SharedPreferences =
+    context.getSharedPreferences(PREFS, Context.MODE_PRIVATE)
+
+  fun read(context: Context): Entry? {
+    val p = prefs(context)
+    val stage = p.getString(KEY_STAGE, null) ?: return null
+    return Entry(
+      stage = stage,
+      accountId = p.getString(KEY_ACCOUNT_ID, null),
+      upn = p.getString(KEY_UPN, null),
+      tenantId = p.getString(KEY_TENANT_ID, null),
+      wipe = p.getBoolean(KEY_WIPE, false),
+      reason = p.getString(KEY_REASON, "").orEmpty(),
+      startedAt = p.getLong(KEY_STARTED_AT, 0L),
+    )
+  }
+
+  fun stage(context: Context): String? = prefs(context).getString(KEY_STAGE, null)
+
+  /**
+   * Writes the entry at [STAGE_UNREGISTERING]. Uses `commit()` rather than `apply()`
+   * deliberately: the caller is about to make a call that may end the process, and an
+   * entry still queued for a background write is an entry that never existed.
+   */
+  fun open(
+    context: Context,
+    accountId: String?,
+    upn: String?,
+    tenantId: String?,
+    wipe: Boolean,
+    reason: String,
+  ) {
+    prefs(context)
+      .edit()
+      .putString(KEY_STAGE, STAGE_UNREGISTERING)
+      .putString(KEY_ACCOUNT_ID, accountId)
+      .putString(KEY_UPN, upn)
+      .putString(KEY_TENANT_ID, tenantId)
+      .putBoolean(KEY_WIPE, wipe)
+      .putString(KEY_REASON, reason)
+      .putLong(KEY_STARTED_AT, System.currentTimeMillis())
+      .commit()
+  }
+
+  /**
+   * Opens the journal for a wipe the *service* started, unless one is already open.
+   *
+   * A service-initiated wipe is one of the callers of the reset path (SPEC §7, "one code
+   * path, many callers"), and it needs the journal for the same reason `reset()` does: the
+   * SDK terminates the process, so the consumer's cleanup may not finish and nothing else
+   * will come back for it. With no entry there is no `pendingReset`, so the next launch
+   * has no idea anything happened.
+   *
+   * Returns false when an entry already exists — a reset in flight must not be
+   * overwritten, since its `reason` and `accountId` are what the resumed sequence acts on.
+   */
+  fun openForServiceWipe(context: Context, accountId: String?, tenantId: String?): Boolean {
+    if (read(context) != null) return false
+    // `wipe = true` records what happened rather than requesting it: the SDK is already
+    // wiping. `reason` is what lets the consumer's handler tell an administrator revoking
+    // access from a user logging out (SPEC §7.4).
+    open(
+      context = context,
+      accountId = accountId,
+      upn = null,
+      tenantId = tenantId,
+      wipe = true,
+      reason = "remote_wipe",
+    )
+    return true
+  }
+
+  fun advance(context: Context, stage: String) {
+    if (prefs(context).getString(KEY_STAGE, null) == null) return
+    prefs(context).edit().putString(KEY_STAGE, stage).commit()
+  }
+
+  /**
+   * Only after the account is verified gone. An unverified reset stays open and is
+   * retried on the next launch rather than being marked done (SPEC §7 step 5).
+   */
+  fun close(context: Context) {
+    prefs(context).edit().clear().commit()
+  }
+}

package/app.plugin.js

@@ -0,0 +1,10 @@
+/**
+ * Expo's entry point for this package's config plugin.
+ *
+ * `app.plugin.js` at the package root is the convention Expo looks for, which is what
+ * lets a consumer write the package name alone in their `plugins` array rather than a
+ * path into it:
+ *
+ *   "plugins": [["react-native-intune", { "androidSignatureHash": "..." }]]
+ */
+module.exports = require('./plugin/withIntune');

package/ios/RNIntune.h

@@ -0,0 +1,20 @@
+//
+//  Codegen conformance and the JS bridge. ObjC++ because getTurboModule: returns a
+//  std::shared_ptr and the generated parameter structs are C++ — neither can be written
+//  in Objective-C or Swift (SPEC §5.1.1).
+//
+//  This class unpacks and forwards. It holds no SDK state and makes no SDK calls; that
+//  is RNIntuneCore's job, in plain .m (CLAUDE.md rule 7).
+//
+//  The umbrella header name comes from package.json -> codegenConfig.name; the protocol
+//  name from the spec file name (src/NativeIntune.ts -> NativeIntuneSpec).
+//
+#import <RNIntuneSpec/RNIntuneSpec.h>
+#import <React/RCTEventEmitter.h>
+
+/// RCTEventEmitter, not NSObject: the emitter has to be live from module construction
+/// because a service-initiated wipe can arrive before the app calls anything, and events
+/// fired before JS subscribes are queued rather than dropped (SPEC §4.4).
+@interface RNIntune : RCTEventEmitter <NativeIntuneSpec>
+
+@end