react-native-intune 0.1.0-alpha.1

package/ios/RNIntuneDelegates.m

@@ -0,0 +1,268 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntuneDelegates.h"
+#import "RNIntuneCore.h"
+
+/// Unified status strings. Must match `EnrollmentStatus` in src/types.ts.
+static NSString *const kSucceeded = @"succeeded";
+static NSString *const kNotLicensed = @"notLicensed";
+static NSString *const kNotTargeted = @"notTargeted";
+static NSString *const kFailed = @"failed";
+static NSString *const kAuthorizationNeeded = @"authorizationNeeded";
+static NSString *const kWrongUser = @"wrongUser";
+static NSString *const kUnenrolled = @"unenrolled";
+static NSString *const kUnenrollmentFailed = @"unenrollmentFailed";
+static NSString *const kUnknown = @"unknown";
+
+@implementation RNIntuneDelegates {
+  RNIntuneEventSink _sink;
+  RNIntuneTokenRequestHandler _tokenHandler;
+}
+
+- (instancetype)initWithEventSink:(RNIntuneEventSink)sink
+              tokenRequestHandler:(RNIntuneTokenRequestHandler)tokenHandler
+{
+  if ((self = [super init])) {
+    _sink = [sink copy];
+    _tokenHandler = [tokenHandler copy];
+    _restartHandledByApp = NO;
+    _suppliesTokens = NO;
+  }
+  return self;
+}
+
+/**
+ * The SDK asks before calling, and @optional means "not implemented" is a real answer.
+ * In `builtin` mode we want the SDK to use the app's MSAL itself, so we must not appear
+ * to offer tokens.
+ */
+- (BOOL)respondsToSelector:(SEL)aSelector
+{
+  if (aSelector == @selector(getAccessTokenForAccountId:resource:completion:)) {
+    return _suppliesTokens;
+  }
+  return [super respondsToSelector:aSelector];
+}
+
+#pragma mark - Status mapping
+
++ (NSString *)unifiedStatusForCode:(IntuneMAMEnrollmentStatusCode)code
+{
+  // The full table, with its reasoning, is SPEC §4.1. Read it before changing a row:
+  // several of these are decisions rather than transcription, and getting NotLicensed
+  // versus Failed backwards has opposite consequences for the user (SPEC §8).
+  switch (code) {
+    // ---- 1xx success ----
+    case IntuneMAMEnrollmentStatusNewPoliciesReceived:
+    case IntuneMAMEnrollmentStatusPoliciesHaveNotChanged:
+      return kSucceeded;
+
+    // Policy request succeeded, but no policy targets the user. Not a licence problem,
+    // and must not block.
+    case IntuneMAMEnrollmentStatusNoPolicyReceived:
+    case IntuneMAMEnrollmentStatusLicensedNotTargeted:
+      return kNotTargeted;
+
+    // A service-initiated wipe. The account's data is gone, so the state is unenrolled —
+    // reporting "succeeded" here is how a wipe ends up ignored.
+    case IntuneMAMEnrollmentStatusWipeReceived:
+    case IntuneMAMEnrollmentStatusUnenrollmentSuccess:
+    case IntuneMAMEnrollmentStatusAppNotEnrolled:
+      return kUnenrolled;
+
+    // ---- 2xx failure ----
+    // The call failed; the state is enrolled. enroll() has to be idempotent.
+    case IntuneMAMEnrollmentStatusAlreadyEnrolled:
+      return kSucceeded;
+
+    // Microsoft's own comment bundles two meanings into TenantMigration: "the tenant is
+    // either undergoing a migration, or the user is not licensed for MAM". Blocking
+    // every user of a tenant mid-migration would be a self-inflicted outage, so the
+    // non-blocking reading wins.
+    case IntuneMAMEnrollmentStatusAccountNotLicensed:
+    case IntuneMAMEnrollmentStatusTenantMigration:
+      return kNotLicensed;
+
+    // The user cancelled the prompt, so the true state is "credentials still needed",
+    // which is retryable. Mapping it to failed would block a user for pressing Cancel.
+    case IntuneMAMEnrollmentStatusAuthRequired:
+    case IntuneMAMEnrollmentStatusADALInternalError:
+    case IntuneMAMEnrollmentStatusLoginCanceled:
+      return kAuthorizationNeeded;
+
+    // Wrong account, in its several forms. Three of these are documented as requiring
+    // the app to remove the account.
+    case IntuneMAMEnrollmentStatusNotEmmAccount:
+    case IntuneMAMEnrollmentStatusMdmEnrolledDifferentUser:
+    case IntuneMAMEnrollmentStatusNotDeviceAccount:
+    case IntuneMAMEnrollmentStatusNotEnrolledAccount:
+    case IntuneMAMEnrollmentStatusSwitchExistingAccount:
+    case IntuneMAMEnrollmentStatusSingleManagedAccountMode:
+      return kWrongUser;
+
+    case IntuneMAMEnrollmentStatusFailedToClearMamData:
+      return kUnenrollmentFailed;
+
+    case IntuneMAMEnrollmentStatusInternalError:
+    case IntuneMAMEnrollmentStatusMamServiceDisabled:
+    case IntuneMAMEnrollmentStatusLocationServiceFailure:
+    case IntuneMAMEnrollmentStatusEnrollmentEndPointNetworkFailure:
+    case IntuneMAMEnrollmentStatusParsingFailure:
+    case IntuneMAMEnrollmentStatusNilAccount:
+    case IntuneMAMEnrollmentStatusPolicyEndPointNetworkFailure:
+    case IntuneMAMEnrollmentStatusTimeout:
+    case IntuneMAMEnrollmentStatusPolicyRecordGone:
+    case IntuneMAMEnrollmentStatusReEnrollForUnenrolledUser:
+    case IntuneMAMEnrollmentStatusUnsupportedAPI:
+    case IntuneMAMEnrollmentStatusADALMethodUnsupported:
+    case IntuneMAMEnrollmentStatusDeviceBlockedEnrollment:
+      return kFailed;
+  }
+
+  // No `default:` above, so adding an SDK constant produces a compiler warning here
+  // rather than silence. Anything unmapped still degrades to `unknown` instead of
+  // throwing, so an SDK update cannot crash a shipped app.
+  return kUnknown;
+}
+
++ (NSString *)nativeCodeNameForCode:(IntuneMAMEnrollmentStatusCode)code
+{
+#define RNIntuneCaseName(name)                     \
+  case IntuneMAMEnrollmentStatus##name:            \
+    return @ #name;
+
+  switch (code) {
+    RNIntuneCaseName(NewPoliciesReceived)
+    RNIntuneCaseName(PoliciesHaveNotChanged)
+    RNIntuneCaseName(WipeReceived)
+    RNIntuneCaseName(NoPolicyReceived)
+    RNIntuneCaseName(UnenrollmentSuccess)
+    RNIntuneCaseName(AccountNotLicensed)
+    RNIntuneCaseName(InternalError)
+    RNIntuneCaseName(MamServiceDisabled)
+    RNIntuneCaseName(AuthRequired)
+    RNIntuneCaseName(LocationServiceFailure)
+    RNIntuneCaseName(EnrollmentEndPointNetworkFailure)
+    RNIntuneCaseName(ParsingFailure)
+    RNIntuneCaseName(NilAccount)
+    RNIntuneCaseName(AlreadyEnrolled)
+    RNIntuneCaseName(NotEmmAccount)
+    RNIntuneCaseName(MdmEnrolledDifferentUser)
+    RNIntuneCaseName(NotDeviceAccount)
+    RNIntuneCaseName(PolicyEndPointNetworkFailure)
+    RNIntuneCaseName(AppNotEnrolled)
+    RNIntuneCaseName(NotEnrolledAccount)
+    RNIntuneCaseName(FailedToClearMamData)
+    RNIntuneCaseName(Timeout)
+    RNIntuneCaseName(ADALInternalError)
+    RNIntuneCaseName(SwitchExistingAccount)
+    RNIntuneCaseName(LoginCanceled)
+    RNIntuneCaseName(PolicyRecordGone)
+    RNIntuneCaseName(ReEnrollForUnenrolledUser)
+    RNIntuneCaseName(TenantMigration)
+    RNIntuneCaseName(UnsupportedAPI)
+    RNIntuneCaseName(ADALMethodUnsupported)
+    RNIntuneCaseName(LicensedNotTargeted)
+    RNIntuneCaseName(DeviceBlockedEnrollment)
+    RNIntuneCaseName(SingleManagedAccountMode)
+  }
+
+#undef RNIntuneCaseName
+
+  return [NSString stringWithFormat:@"Unmapped(%lu)", (unsigned long)code];
+}
+
++ (NSDictionary<NSString *, id> *)resultFromStatus:(IntuneMAMEnrollmentStatus *)status
+{
+  // status.errorString is the SDK's own debug text. It carries no token — but it is not
+  // the place to add the UPN either, and status.identity is deliberately not read here
+  // (CLAUDE.md rule 3). accountId is the Entra object ID, which is what JS asked with.
+  return @{
+    @"status" : [self unifiedStatusForCode:status.statusCode],
+    @"accountId" : status.accountId ?: NSNull.null,
+    @"nativeCode" : [self nativeCodeNameForCode:status.statusCode],
+    @"nativeMessage" : status.errorString ?: @"",
+    // Set by the policy delegate's restartApplication callback, not by the status.
+    @"restartRequired" : @NO,
+  };
+}
+
+#pragma mark - IntuneMAMEnrollmentDelegate
+
+- (void)enrollmentRequestWithStatus:(IntuneMAMEnrollmentStatus *)status
+{
+  _sink(RNIntuneEventEnrollmentResult, [RNIntuneDelegates resultFromStatus:status]);
+}
+
+- (void)policyRequestWithStatus:(IntuneMAMEnrollmentStatus *)status
+{
+  // A wipe arrives here, not through a dedicated callback, and it can arrive with the app
+  // having asked for nothing at all. Publish both: the reset machine listens for the
+  // wipe, and anything waiting on a policy refresh listens for the result (SPEC §4.4).
+  if (status.statusCode == IntuneMAMEnrollmentStatusWipeReceived) {
+    _sink(RNIntuneEventWipeRequested, @{@"accountId" : status.accountId ?: NSNull.null});
+  }
+  _sink(RNIntuneEventEnrollmentResult, [RNIntuneDelegates resultFromStatus:status]);
+}
+
+- (void)unenrollRequestWithStatus:(IntuneMAMEnrollmentStatus *)status
+{
+  _sink(RNIntuneEventUnenrollmentResult, [RNIntuneDelegates resultFromStatus:status]);
+}
+
+/**
+ * The SDK asking for a MAM service token. This is the iOS counterpart of Android's
+ * MAMServiceAuthenticationCallback.
+ *
+ * Unlike Android's, this one is asynchronous — the SDK hands us a completion block — so
+ * nothing here blocks a thread while JS thinks. The token goes straight back to the SDK
+ * and is never returned to JS or logged (CLAUDE.md rule 9).
+ */
+- (void)getAccessTokenForAccountId:(NSString *)oid
+                          resource:(NSString *)resource
+                        completion:(void (^)(IntuneMAMEnrollmentToken *))completion
+{
+  _tokenHandler(oid, resource, ^(NSString *_Nullable token, NSString *_Nullable reason) {
+    IntuneMAMEnrollmentToken *result = [IntuneMAMEnrollmentToken new];
+    if (token.length > 0) {
+      result.accessToken = token;
+      result.oid = oid;
+    } else {
+      // The header is explicit that `error` is required when no token is returned.
+      // Without it the SDK cannot distinguish "no token" from a malformed reply.
+      result.error = [RNIntuneCore
+          errorWithCode:RNIntuneErrorTokenProviderFailed
+                message:reason.length > 0 ? reason : @"No MAM service token was provided"];
+    }
+    completion(result);
+  });
+}
+
+#pragma mark - IntuneMAMPolicyDelegate
+
+- (BOOL)restartApplication
+{
+  // Called on a background thread when policy is applied for the first time. Returning
+  // TRUE promises that the *host app* restarts itself; FALSE hands the restart to the
+  // SDK. We publish the event either way so the app can show something first.
+  _sink(RNIntuneEventRestartRequired, @{@"reason" : @"policyAppliedFirstTime"});
+  return _restartHandledByApp;
+}
+
+- (BOOL)wipeDataForAccountId:(NSString *)accountId
+{
+  // Returning NO leaves the SDK's own wipe in place and keeps the app's data untouched
+  // here. The app's local data is cleared through the reset journal instead, because the
+  // process may not survive long enough to do it inline (SPEC §7).
+  _sink(RNIntuneEventWipeRequested, @{@"accountId" : accountId ?: NSNull.null});
+  return NO;
+}
+
+// identitySwitchRequiredForAccountId:, blockAccountId: and addAccountId: are deliberately
+// not implemented. They exist for multi-identity apps, and single identity is a decided
+// constraint (SPEC §9, CLAUDE.md rule 10): two accounts are never signed in at once, so
+// there is no switch to arbitrate. The SDK's own defaults apply for all three.
+
+@end

package/ios/RNIntunePendingRequests.h

@@ -0,0 +1,57 @@
+//
+//  Everything waiting for the SDK to call back.
+//
+//  Two kinds of wait, one set of rules:
+//
+//    - **enroll** — `registerAndEnrollAccountId:` returns immediately and says nothing;
+//      the outcome arrives later on the delegate. The caller's completion waits here,
+//      keyed by account ID.
+//    - **token** — the SDK asks for a MAM service token and waits on a completion block
+//      while JS answers. Keyed by a generated request ID.
+//
+//  Both are settled from SDK-chosen threads, so both are behind one lock. Both time out
+//  rather than waiting forever, and both are *taken* rather than read when settled — a
+//  late answer after a timeout must not be applied twice.
+//
+
+#import <Foundation/Foundation.h>
+
+#import "RNIntuneDelegates.h"
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface RNIntunePendingRequests : NSObject
+
+- (instancetype)initWithEventSink:(RNIntuneEventSink)sink NS_DESIGNATED_INITIALIZER;
+- (instancetype)init NS_UNAVAILABLE;
+
+/// Registers `completion`, starts the timeout, then makes the SDK call — in that order,
+/// because `registerAndEnrollAccountId:` can report through the delegate before it
+/// returns.
+- (void)awaitEnrollment:(NSString *)accountId
+             completion:(void (^)(NSDictionary<NSString *, id> *result))completion;
+
+/**
+ * Interactive enrollment, which cannot be keyed by account ID — the caller only has a
+ * UPN, and the SDK reports the object ID. Only one can be in flight because the SDK is
+ * showing a modal sign-in screen, so a single slot is enough.
+ */
+- (void)awaitInteractiveEnrollmentWithUpn:(nullable NSString *)upn
+                               completion:(void (^)(NSDictionary<NSString *, id> *result))completion;
+
+/// Called for every delegate event; settles a waiting caller when one matches.
+- (void)settleForEvent:(NSString *)event body:(NSDictionary *)body;
+
+/// Publishes a `tokenRequest` and holds the SDK's completion until JS answers.
+- (void)handleTokenRequestForAccountId:(NSString *)accountId
+                              resource:(NSString *)resource
+                              tenantId:(nullable NSString *)tenantId
+                             authority:(nullable NSString *)authority
+                            completion:(RNIntuneTokenCompletion)completion;
+
+- (void)resolveTokenRequest:(NSString *)requestId token:(NSString *)token;
+- (void)rejectTokenRequest:(NSString *)requestId reason:(NSString *)reason;
+
+@end
+
+NS_ASSUME_NONNULL_END

package/ios/RNIntunePendingRequests.m

@@ -0,0 +1,230 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntunePendingRequests.h"
+#import "RNIntuneCore.h"
+
+#import <IntuneMAMSwift/IntuneMAMSwift.h>
+
+/**
+ * How long to wait for the SDK to say something before completing an enroll as `pending`.
+ * Generous on purpose: enrollment involves a token acquisition and a service round trip,
+ * and returning early would report a failure the SDK has not actually reached.
+ */
+static const NSTimeInterval RNIntuneEnrollTimeout = 90.0;
+
+/// How long JS gets to answer a token request before the SDK is told we cannot supply one.
+static const NSTimeInterval RNIntuneTokenTimeout = 45.0;
+
+@implementation RNIntunePendingRequests {
+  RNIntuneEventSink _emit;
+  /// accountId -> completion, waiting on the enrollment delegate.
+  NSMutableDictionary<NSString *, void (^)(NSDictionary *)> *_pendingEnrollments;
+  /// requestId -> the SDK's own completion, waiting on JS.
+  NSMutableDictionary<NSString *, RNIntuneTokenCompletion> *_pendingTokenRequests;
+  /// Guards both: callbacks arrive on threads the SDK chooses.
+  NSLock *_lock;
+  NSUInteger _requestCounter;
+  /// Single slot: the SDK's sign-in screen is modal, so only one can be waiting.
+  void (^_Nullable _pendingInteractive)(NSDictionary *);
+}
+
+- (instancetype)initWithEventSink:(RNIntuneEventSink)sink
+{
+  if ((self = [super init])) {
+    _emit = [sink copy];
+    _pendingEnrollments = [NSMutableDictionary new];
+    _pendingTokenRequests = [NSMutableDictionary new];
+    _lock = [NSLock new];
+    _requestCounter = 0;
+  }
+  return self;
+}
+
+#pragma mark - Enrollment
+
+- (void)awaitEnrollment:(NSString *)accountId
+             completion:(void (^)(NSDictionary<NSString *, id> *))completion
+{
+  [_lock lock];
+  // A second enroll() for the same account while one is in flight is not an error — the
+  // SDK is already working on it. Both callers get the one result the delegate reports.
+  void (^existing)(NSDictionary *) = _pendingEnrollments[accountId];
+  _pendingEnrollments[accountId] = ^(NSDictionary *result) {
+    if (existing) {
+      existing(result);
+    }
+    completion(result);
+  };
+  [_lock unlock];
+
+  __weak __typeof(self) weakSelf = self;
+  dispatch_after(
+      dispatch_time(DISPATCH_TIME_NOW, (int64_t)(RNIntuneEnrollTimeout * NSEC_PER_SEC)),
+      dispatch_get_global_queue(QOS_CLASS_UTILITY, 0), ^{
+        // Truthful rather than convenient: the SDK has not failed, it has not answered.
+        // It keeps retrying on its own schedule and the result still arrives as an event.
+        [weakSelf completeEnrollment:accountId
+                                 withResult:@{
+                                   @"status" : @"pending",
+                                   @"accountId" : accountId,
+                                   @"nativeCode" : @"RNIntuneTimeout",
+                                   @"nativeMessage" :
+                                       @"The SDK did not report a result within the "
+                                       @"timeout. Enrollment continues in the background; "
+                                       @"watch onEnrollmentResult.",
+                                   @"restartRequired" : @NO,
+                                 }];
+      });
+
+  // Returns immediately and reports nothing. Everything meaningful happens above.
+  [IntuneMAMEnrollmentManager.instance registerAndEnrollAccountId:accountId];
+}
+
+- (void)awaitInteractiveEnrollmentWithUpn:(NSString *)upn
+                               completion:(void (^)(NSDictionary<NSString *, id> *))completion
+{
+  [_lock lock];
+  void (^existing)(NSDictionary *) = _pendingInteractive;
+  _pendingInteractive = completion;
+  [_lock unlock];
+
+  // A previous interactive attempt that never reported is abandoned rather than left
+  // hanging: the user has started a new one, so the old screen is gone.
+  if (existing) {
+    existing(@{
+      @"status" : @"unknown",
+      @"accountId" : NSNull.null,
+      @"nativeCode" : @"RNIntuneSuperseded",
+      @"nativeMessage" : @"A newer interactive enrollment replaced this one.",
+      @"restartRequired" : @NO,
+    });
+  }
+
+  __weak __typeof(self) weakSelf = self;
+  dispatch_after(
+      dispatch_time(DISPATCH_TIME_NOW, (int64_t)(RNIntuneEnrollTimeout * NSEC_PER_SEC)),
+      dispatch_get_global_queue(QOS_CLASS_UTILITY, 0), ^{
+        [weakSelf completeInteractiveWithResult:@{
+          @"status" : @"pending",
+          @"accountId" : NSNull.null,
+          @"nativeCode" : @"RNIntuneTimeout",
+          @"nativeMessage" : @"The SDK did not report a result within the timeout. The "
+                             @"sign-in may still be on screen; watch onEnrollmentResult.",
+          @"restartRequired" : @NO,
+        }];
+      });
+
+  // nil is legal and documented: the SDK then asks for the address itself.
+  dispatch_async(dispatch_get_main_queue(), ^{
+    [IntuneMAMEnrollmentManager.instance
+        loginAndEnrollAccount:upn.length > 0 ? upn : nil];
+  });
+}
+
+- (void)completeInteractiveWithResult:(NSDictionary *)result
+{
+  [_lock lock];
+  void (^completion)(NSDictionary *) = _pendingInteractive;
+  _pendingInteractive = nil;
+  [_lock unlock];
+
+  if (completion) {
+    completion(result);
+  }
+}
+
+- (void)settleForEvent:(NSString *)event body:(NSDictionary *)body
+{
+  if (![event isEqualToString:RNIntuneEventEnrollmentResult]) {
+    return;
+  }
+  // An interactive caller is waiting on a UPN and has no account ID to match, so any
+  // enrollment result settles it. The SDK's sign-in screen is modal, so the only thing
+  // that could race here is one of its own background retries — an early result, not a
+  // wrong one.
+  [self completeInteractiveWithResult:body];
+
+  id accountId = body[@"accountId"];
+  if (![accountId isKindOfClass:NSString.class]) {
+    return;
+  }
+  [self completeEnrollment:accountId withResult:body];
+}
+
+- (void)completeEnrollment:(NSString *)accountId withResult:(NSDictionary *)result
+{
+  [_lock lock];
+  void (^completion)(NSDictionary *) = _pendingEnrollments[accountId];
+  [_pendingEnrollments removeObjectForKey:accountId];
+  [_lock unlock];
+
+  if (completion) {
+    completion(result);
+  }
+}
+
+#pragma mark - Token bridge
+
+- (void)handleTokenRequestForAccountId:(NSString *)accountId
+                              resource:(NSString *)resource
+                              tenantId:(NSString *)tenantId
+                             authority:(NSString *)authority
+                            completion:(RNIntuneTokenCompletion)completion
+{
+  [_lock lock];
+  NSString *requestId =
+      [NSString stringWithFormat:@"tok-%lu", (unsigned long)(++_requestCounter)];
+  _pendingTokenRequests[requestId] = completion;
+  [_lock unlock];
+
+  // `resourceId` is what the provider turns into a scope; the token never comes back
+  // through JS to the SDK by any other route (SPEC §13.4).
+  _emit(RNIntuneEventTokenRequest,
+        @{
+          @"requestId" : requestId,
+          @"resourceId" : resource ?: @"",
+          @"accountId" : accountId ?: @"",
+          @"tenantId" : tenantId ?: @"",
+          @"authority" : authority ?: @"",
+        });
+
+  __weak __typeof(self) weakSelf = self;
+  dispatch_after(
+      dispatch_time(DISPATCH_TIME_NOW, (int64_t)(RNIntuneTokenTimeout * NSEC_PER_SEC)),
+      dispatch_get_global_queue(QOS_CLASS_UTILITY, 0), ^{
+        [weakSelf rejectTokenRequest:requestId
+                              reason:@"The token provider did not answer within the "
+                                     @"timeout."];
+      });
+}
+
+- (nullable RNIntuneTokenCompletion)takeTokenRequest:(NSString *)requestId
+{
+  [_lock lock];
+  RNIntuneTokenCompletion completion = _pendingTokenRequests[requestId];
+  [_pendingTokenRequests removeObjectForKey:requestId];
+  [_lock unlock];
+  return completion;
+}
+
+- (void)resolveTokenRequest:(NSString *)requestId token:(NSString *)token
+{
+  // Taken, not read: a late answer after the timeout already fired must not reach the
+  // SDK twice.
+  RNIntuneTokenCompletion completion = [self takeTokenRequest:requestId];
+  if (completion) {
+    completion(token, nil);
+  }
+}
+
+- (void)rejectTokenRequest:(NSString *)requestId reason:(NSString *)reason
+{
+  RNIntuneTokenCompletion completion = [self takeTokenRequest:requestId];
+  if (completion) {
+    completion(nil, reason);
+  }
+}
+
+@end

package/ios/RNIntunePlistGuard.h

@@ -0,0 +1,37 @@
+//
+//  The configure-time assertions (SPEC §12.7 S1).
+//
+//  Each one is a configuration mistake that otherwise surfaces days later as
+//  `MAMEnrollmentStatusAuthRequired`, in a tenant you cannot reach, with nothing in the
+//  logs pointing at the cause. Refusing to start is the kinder failure.
+//
+
+#import <Foundation/Foundation.h>
+
+@class RNIntuneConfig;
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface RNIntunePlistGuard : NSObject
+
+/// The host app's `IntuneMAMSettings` dictionary, or an empty one.
++ (NSDictionary *)settings;
+
+/// YES when `Info.plist` and `configure()` agree. Otherwise fills `error` with
+/// `E_PLIST_CONFLICT` and a message naming the offending key.
++ (BOOL)check:(RNIntuneConfig *)config error:(NSError *_Nullable *_Nullable)error;
+
+/// For `getDiagnostics` — whether any forbidden identity key is present.
++ (BOOL)hasIdentityKeys;
+
+/// For `getDiagnostics` — the plist's MaxFileProtectionLevel, or an empty string.
++ (NSString *)maxFileProtectionLevel;
+
+/// The plist's `ADALCacheKeychainGroupOverride`, or an empty string. This key has no
+/// runtime setter, so the plist is the only source and MSAL must be pointed at the same
+/// value (§5.1.4).
++ (NSString *)keychainGroupOverride;
+
+@end
+
+NS_ASSUME_NONNULL_END