react-native-intune 0.1.0-alpha.1

package/ios/RNIntunePlistGuard.m

@@ -0,0 +1,147 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntunePlistGuard.h"
+#import "RNIntuneCore.h"
+
+/// The `IntuneMAMSettings` dictionary in the host app's Info.plist, and the keys inside
+/// it that the SDK reads at launch. Verified against the strings in the 21.8.0 binary.
+static NSString *const kSettingsKey = @"IntuneMAMSettings";
+static NSString *const kClientId = @"ADALClientId";
+static NSString *const kAuthority = @"ADALAuthority";
+static NSString *const kRedirectUri = @"ADALRedirectUri";
+static NSString *const kKeychainGroup = @"ADALCacheKeychainGroupOverride";
+static NSString *const kMaxFileProtection = @"MaxFileProtectionLevel";
+
+@implementation RNIntunePlistGuard
+
++ (NSDictionary *)settings
+{
+  id settings = NSBundle.mainBundle.infoDictionary[kSettingsKey];
+  return [settings isKindOfClass:NSDictionary.class] ? settings : @{};
+}
+
++ (BOOL)hasIdentityKeys
+{
+  NSDictionary *plist = [self settings];
+  return plist[kClientId] != nil || plist[kAuthority] != nil ||
+         plist[kRedirectUri] != nil;
+}
+
++ (NSString *)maxFileProtectionLevel
+{
+  return [self settings][kMaxFileProtection] ?: @"";
+}
+
++ (NSString *)keychainGroupOverride
+{
+  NSString *value = [self settings][kKeychainGroup];
+  return [value isKindOfClass:NSString.class] ? value : @"";
+}
+
++ (BOOL)check:(RNIntuneConfig *)config error:(NSError *_Nullable *_Nullable)error
+{
+  return [self checkIdentityKeys:error] && [self checkKeychainGroup:config error:error] &&
+         [self checkFileProtection:config error:error];
+}
+
+#pragma mark - 1. Hardcoded identity next to a runtime override
+
+/**
+ * GitHub issue #405: the plist value and the runtime override disagree, and enrollment
+ * fails with no indication which one won. CLAUDE.md rule 4 forbids these keys outright
+ * for exactly this reason.
+ */
++ (BOOL)checkIdentityKeys:(NSError *_Nullable *_Nullable)error
+{
+  NSDictionary *plist = [self settings];
+  NSMutableArray<NSString *> *present = [NSMutableArray new];
+  for (NSString *key in @[ kClientId, kAuthority, kRedirectUri ]) {
+    if (plist[key] != nil) {
+      [present addObject:key];
+    }
+  }
+  if (present.count == 0) {
+    return YES;
+  }
+
+  if (error) {
+    *error = [RNIntuneCore
+        errorWithCode:RNIntuneErrorPlistConflict
+              message:[NSString
+                          stringWithFormat:
+                              @"Info.plist -> IntuneMAMSettings contains %@, which "
+                              @"conflicts with the values passed to configure(). This "
+                              @"module configures identity at runtime only. Remove these "
+                              @"keys — a conflicting plist key alongside a runtime "
+                              @"override is a known cause of enrollment failing with "
+                              @"AuthRequired.",
+                              [present componentsJoinedByString:@", "]]];
+  }
+  return NO;
+}
+
+#pragma mark - 2. Keychain group, which has no runtime setter
+
+/**
+ * `ADALCacheKeychainGroupOverride` is read from the plist at launch, so the module cannot
+ * "set it to match" as SPEC §5.1.2 originally described. The best it can do is refuse to
+ * let the two disagree — MSAL's cache and the SDK's must never diverge.
+ */
++ (BOOL)checkKeychainGroup:(RNIntuneConfig *)config
+                     error:(NSError *_Nullable *_Nullable)error
+{
+  NSString *wanted =
+      config.keychainGroupOverride.length > 0 ? config.keychainGroupOverride : nil;
+  if (wanted == nil) {
+    return YES;
+  }
+
+  NSString *inPlist = [self settings][kKeychainGroup];
+  if ([inPlist isEqualToString:wanted]) {
+    return YES;
+  }
+
+  if (error) {
+    *error = [RNIntuneCore
+        errorWithCode:RNIntuneErrorPlistConflict
+              message:[NSString stringWithFormat:
+                                    @"configure() asked for keychain group \"%@\" but "
+                                    @"Info.plist -> IntuneMAMSettings -> %@ is \"%@\". "
+                                    @"This key has no runtime equivalent, so it must be "
+                                    @"set in the plist.",
+                                    wanted, kKeychainGroup, inPlist ?: @"(absent)"]];
+  }
+  return NO;
+}
+
+#pragma mark - 3. MaxFileProtectionLevel, likewise plist-only
+
+/**
+ * Silently ignoring a requested value is how an app ends up with a local database that
+ * becomes unreadable ten seconds after the device locks (SPEC §5.2, open question O-D).
+ */
++ (BOOL)checkFileProtection:(RNIntuneConfig *)config
+                      error:(NSError *_Nullable *_Nullable)error
+{
+  BOOL isDefault = [config.maxFileProtectionLevel isEqualToString:@"complete"];
+  if (isDefault || [self settings][kMaxFileProtection] != nil) {
+    return YES;
+  }
+
+  if (error) {
+    *error = [RNIntuneCore
+        errorWithCode:RNIntuneErrorPlistConflict
+              message:[NSString
+                          stringWithFormat:
+                              @"configure() asked for maxFileProtectionLevel \"%@\", but "
+                              @"%@ has no runtime equivalent and is absent from "
+                              @"Info.plist -> IntuneMAMSettings. Set it there (the SDK "
+                              @"reads it at launch) or drop the option.",
+                              config.maxFileProtectionLevel, kMaxFileProtection]];
+  }
+  return NO;
+}
+
+@end

package/ios/RNIntunePolicy.h

@@ -0,0 +1,25 @@
+//
+//  PolicySnapshot (SPEC §4.3).
+//
+//  For adapting the host app's own UI — nothing here is enforcement. PIN prompts,
+//  screenshot blocking and encryption all happen inside the SDK and are not driven by
+//  these values.
+//
+//  There is no clipboard field and there cannot be one: neither platform exposes a
+//  clipboard policy getter. `canSaveToPersonal` and `canOpenFromUnmanaged` serve the same
+//  purpose using values the SDK will actually answer.
+//
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface RNIntunePolicy : NSObject
+
+/// Nil only when the SDK is not linked. An unmanaged app reports permissive values
+/// rather than `false` — reporting `false` would hide controls nothing is restricting.
++ (nullable NSDictionary<NSString *, id> *)snapshot;
+
+@end
+
+NS_ASSUME_NONNULL_END

package/ios/RNIntunePolicy.m

@@ -0,0 +1,112 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntunePolicy.h"
+#import "RNIntuneCore.h"
+
+#import <IntuneMAMSwift/IntuneMAMSwift.h>
+
+/// Names the policy channel. An SDK update that adds a source must not produce a crash
+/// or an empty string, so anything unrecognised keeps its number.
+static NSString *RNIntunePolicySourceName(IntuneMAMPolicySource source)
+{
+  switch (source) {
+    case IntuneMAMPolicySource_MDM:
+      return @"MDM";
+    case IntuneMAMPolicySource_MAM:
+      return @"MAM";
+    case IntuneMAMPolicySource_Other:
+      return @"Other";
+  }
+  return [NSString stringWithFormat:@"Unknown(%ld)", (long)source];
+}
+
+@implementation RNIntunePolicy
+
++ (nullable NSDictionary<NSString *, id> *)snapshot
+{
+  if (!RNIntuneCore.shared.sdkAvailable) {
+    return nil;
+  }
+
+  IntuneMAMPolicyManager *manager = IntuneMAMPolicyManager.instance;
+
+  // Ask for the *primary account's* policy, not `manager.policy`.
+  //
+  // `manager.policy` returns the policy for the current thread's identity, and no
+  // identity is set on the React Native JS thread — so the SDK answers with a default
+  // permissive policy object. It is not nil, which is what makes this so quiet: every
+  // field reads as "allowed" and the snapshot looks like a tenant with no restrictions.
+  // Found on device: an App Protection Policy with `Screen capture: Block` and Edge
+  // required still reported screenshots allowed and no managed browser.
+  //
+  // `primaryAccountId` is the single-identity accessor — the header says it is for
+  // applications that do not support multiple managed accounts, which is us by decision
+  // (SPEC §9). This is a read; it is not `setCurrentThreadAccountId`, and CLAUDE.md
+  // rule 10 still holds.
+  NSString *primaryAccountId = manager.primaryAccountId;
+  BOOL haveIdentity = primaryAccountId.length > 0;
+
+  id<IntuneMAMPolicy> policy = haveIdentity
+      ? [manager policyForAccountId:primaryAccountId]
+      : manager.policy;
+  BOOL managed = haveIdentity ? [manager isAccountIdManaged:primaryAccountId]
+                              : manager.isManagementEnabled;
+
+  if (policy == nil) {
+    // Unmanaged is not an error: an app with no policy is fully permissive, and
+    // reporting `false` everywhere would hide functionality nothing is restricting.
+    return @{
+      @"isManaged" : @NO,
+      @"canSaveToLocal" : @YES,
+      @"canSaveToPersonal" : @YES,
+      @"canOpenFromUnmanaged" : @YES,
+      @"screenshotAllowed" : @YES,
+      @"raw" : @{
+        @"hasPrimaryAccount" : haveIdentity ? @"true" : @"false",
+        @"policySource" : RNIntunePolicySourceName(manager.mamPolicySource),
+      },
+    };
+  }
+
+  // `withAccountId:nil` means the current identity. Single identity is decided, so there
+  // is never another one to ask about (SPEC §9, CLAUDE.md rule 10).
+  BOOL saveLocal = [policy isSaveToAllowedForLocation:IntuneMAMSaveLocationLocalDrive
+                                        withAccountId:nil];
+  BOOL savePersonal = [policy isSaveToAllowedForLocation:IntuneMAMSaveLocationOther
+                                           withAccountId:nil];
+  BOOL openUnmanaged = [policy isOpenFromAllowedForLocation:IntuneMAMOpenLocationOther
+                                              withAccountId:nil];
+
+  // Everything else the SDK reports, as strings. Explicitly outside semver: anything
+  // depended on here has to be promoted to a typed field first (SPEC §4.3).
+  NSDictionary<NSString *, NSString *> *raw = @{
+    @"isPINRequired" : policy.isPINRequired ? @"true" : @"false",
+    @"isManagedBrowserRequired" : policy.isManagedBrowserRequired ? @"true" : @"false",
+    @"isContactSyncAllowed" : policy.isContactSyncAllowed ? @"true" : @"false",
+    @"isSpotlightIndexingAllowed" : policy.isSpotlightIndexingAllowed ? @"true" : @"false",
+    @"areSiriIntentsAllowed" : policy.areSiriIntentsAllowed ? @"true" : @"false",
+    @"isAppSharingAllowed" : policy.isAppSharingAllowed ? @"true" : @"false",
+    @"isFileEncryptionRequired" : policy.isFileEncryptionRequired ? @"true" : @"false",
+    @"notificationPolicy" :
+        [NSString stringWithFormat:@"%ld", (long)policy.notificationPolicy],
+    // Diagnostic, not policy. An all-permissive snapshot means one of two things, and
+    // these two values say which: no identity resolved, or a policy that came from
+    // somewhere other than the MAM channel. Boolean only — the account ID itself must
+    // not travel here (CLAUDE.md rule 3).
+    @"hasPrimaryAccount" : haveIdentity ? @"true" : @"false",
+    @"policySource" : RNIntunePolicySourceName(manager.mamPolicySource),
+  };
+
+  return @{
+    @"isManaged" : @(managed),
+    @"canSaveToLocal" : @(saveLocal),
+    @"canSaveToPersonal" : @(savePersonal),
+    @"canOpenFromUnmanaged" : @(openUnmanaged),
+    @"screenshotAllowed" : @(policy.isScreenCaptureAllowed),
+    @"raw" : raw,
+  };
+}
+
+@end

package/ios/RNIntuneReset.h

@@ -0,0 +1,34 @@
+//
+//  The reset sequence (SPEC §7).
+//
+//  Separate from RNIntuneResetJournal on purpose: the journal is storage, this is the
+//  order of operations. The order is the part that is easy to get wrong — the unregister
+//  has to precede any token purge, and the process is not guaranteed to survive it.
+//
+
+#import <Foundation/Foundation.h>
+
+@class RNIntuneAuth;
+
+NS_ASSUME_NONNULL_BEGIN
+
+@interface RNIntuneReset : NSObject
+
+/**
+ * Opens the journal, then unregisters and unenrolls every registered account.
+ *
+ * **Blocks** while the SDK acquires the Intune AAD token, so it must not run on the main
+ * thread. The caller is responsible for that.
+ */
++ (void)runWithWipe:(BOOL)wipe
+             reason:(NSString *)reason
+           tenantId:(nullable NSString *)tenantId
+               auth:(nullable RNIntuneAuth *)auth;
+
+/// Verifies the account is really gone and closes the journal. NO leaves it open, so the
+/// next launch retries rather than declaring a reset that did not happen.
++ (BOOL)complete;
+
+@end
+
+NS_ASSUME_NONNULL_END

package/ios/RNIntuneReset.m

@@ -0,0 +1,93 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntuneReset.h"
+#import "RNIntuneCore.h"
+#import "RNIntuneResetJournal.h"
+
+#import <IntuneMAMSwift/IntuneMAMSwift.h>
+
+@implementation RNIntuneReset
+
++ (void)runWithWipe:(BOOL)wipe
+             reason:(NSString *)reason
+           tenantId:(NSString *)tenantId
+               auth:(RNIntuneAuth *)auth
+{
+  IntuneMAMEnrollmentManager *manager =
+      RNIntuneCore.shared.sdkAvailable ? IntuneMAMEnrollmentManager.instance : nil;
+
+  // Every *registered* account, not just the enrolled one. An account whose enrollment
+  // failed is still registered, and the SDK keeps retrying it on a 24-hour schedule
+  // until it is unregistered — so leaving those behind is precisely the "incomplete
+  // reset is actively harmful" case in SPEC §7. Found by a runtime test that left a
+  // failed registration behind and then could not close the journal.
+  NSArray<NSString *> *accountIds = [manager.registeredAccountIds copy] ?: @[];
+  NSString *enrolled = manager.enrolledAccountId;
+
+  // Written first, and forced to disk, because the next call may end the process.
+  [RNIntuneResetJournal.shared openWithAccountId:enrolled ?: accountIds.firstObject
+                                        tenantId:tenantId
+                                            wipe:wipe
+                                          reason:reason];
+
+  for (NSString *accountId in accountIds) {
+    if (accountId.length == 0) {
+      continue;
+    }
+    // Blocks while acquiring the Intune AAD token (SPEC §5.3). The caller runs this off
+    // the main thread.
+    [manager deRegisterAndUnenrollAccountId:accountId withWipe:wipe];
+  }
+
+  // Reached only if the process survived. Clearing the overrides is what makes a tenant
+  // switch possible afterwards — they persist across restarts otherwise (SPEC §5.2).
+  [RNIntuneResetJournal.shared advanceToStage:RNIntuneResetStageCleaningAuth];
+  IntuneMAMSettings.aadClientIdOverride = nil;
+  IntuneMAMSettings.aadAuthorityUriOverride = nil;
+  IntuneMAMSettings.aadRedirectUriOverride = nil;
+
+  // MSAL cache cleanup, and it is not cosmetic: issue #539 reports
+  // `deRegisterAndUnenrollAccountId` leaving keychain state behind, and #464 a fresh
+  // install where the SDK reports no enrolled account yet the sign-in webview autofills a
+  // previously enrolled address and then fails on account mismatch. Both are residual
+  // MSAL state rather than MAM state.
+  //
+  // After the unregister, deliberately: that call blocks while it acquires the Intune AAD
+  // token, and the token comes from this very cache. Clearing it first would make the
+  // unregister fail and strand a registered account (SPEC §5.3).
+  //
+  // Every account rather than one, for the same reason the loop above unregisters them
+  // all — by this point there is no single account id left to be selective with.
+  //
+  // nil in `external` mode, where the cache is the host app's (SPEC §3.2).
+  [auth removeAllAccounts];
+  [auth invalidate];
+
+  [RNIntuneResetJournal.shared advanceToStage:RNIntuneResetStageCleaningLocal];
+}
+
++ (BOOL)complete
+{
+  if (RNIntuneResetJournal.shared.entry == nil) {
+    return YES;
+  }
+
+  // Verify rather than assume (SPEC §7 step 5). A reset that did not take must stay open
+  // and be retried, because the SDK resumes enrollment retries on its own schedule and a
+  // half-finished reset is worse than none.
+  if (RNIntuneCore.shared.sdkAvailable) {
+    IntuneMAMEnrollmentManager *manager = IntuneMAMEnrollmentManager.instance;
+    NSString *stillEnrolled = manager.enrolledAccountId;
+    NSArray *stillRegistered = manager.registeredAccountIds;
+    if (stillEnrolled.length > 0 || stillRegistered.count > 0) {
+      return NO;
+    }
+  }
+
+  [RNIntuneResetJournal.shared close];
+  return YES;
+}
+
+@end

package/ios/RNIntuneResetJournal.h

@@ -0,0 +1,69 @@
+//
+//  The reset journal (SPEC §7).
+//
+//  Unregistering an account that had policy enforced makes the SDK wipe that account's
+//  data, and **the process terminating is expected behaviour, not a crash**. Code after
+//  the unregister call does not run. So the sequence is not held in memory: each stage is
+//  written down before it is attempted, and the next launch reads what was in flight.
+//
+//      IDLE -> UNREGISTERING -> CLEANING_AUTH -> CLEANING_LOCAL -> IDLE
+//
+//  Pure Objective-C, no SDK dependency: the journal has to be readable at launch before
+//  anything else is configured.
+//
+
+#import <Foundation/Foundation.h>
+
+NS_ASSUME_NONNULL_BEGIN
+
+/// Stage strings. Must match `ResetStage` in src/types.ts.
+extern NSString *const RNIntuneResetStageUnregistering;
+extern NSString *const RNIntuneResetStageCleaningAuth;
+extern NSString *const RNIntuneResetStageCleaningLocal;
+
+@interface RNIntuneResetJournal : NSObject
+
++ (instancetype)shared;
+
+/// The open entry, or nil when no reset is in flight. Keys: stage, accountId, tenantId,
+/// wipe, reason, startedAt.
+@property (nonatomic, readonly, nullable) NSDictionary<NSString *, id> *entry;
+
+/// Current stage, or nil. This is what `getState().pendingReset` reports.
+@property (nonatomic, readonly, nullable) NSString *stage;
+
+/// Why the open reset started, or nil. Reported as `getState().pendingResetReason` so a
+/// resume can pass the original reason on rather than flattening it to `'resume'`.
+@property (nonatomic, readonly, nullable) NSString *reason;
+
+/// Writes the entry at `UNREGISTERING`. Must return before the unregister call is made —
+/// after it, there may be no process left to write anything.
+- (void)openWithAccountId:(nullable NSString *)accountId
+                 tenantId:(nullable NSString *)tenantId
+                     wipe:(BOOL)wipe
+                   reason:(NSString *)reason;
+
+/**
+ * Opens the journal for a wipe the *service* started, unless one is already open.
+ *
+ * A service-initiated wipe is one of the callers of the reset path (SPEC §7, "one code
+ * path, many callers"), and it needs the journal for the same reason `reset()` does: the
+ * SDK terminates the process, so the consumer's cleanup may not finish and nothing else
+ * will come back for it. Without an entry there is no `pendingReset`, so the next launch
+ * has no idea anything happened.
+ *
+ * Returns NO when an entry already exists. A reset already in flight must not be
+ * overwritten — its `reason` and `accountId` are what the resumed sequence acts on.
+ */
+- (BOOL)openForServiceWipeWithAccountId:(nullable NSString *)accountId
+                               tenantId:(nullable NSString *)tenantId;
+
+- (void)advanceToStage:(NSString *)stage;
+
+/// Only after the account is verified gone. An unverified reset stays open and is retried
+/// on the next launch rather than being marked done (SPEC §7 step 5).
+- (void)close;
+
+@end
+
+NS_ASSUME_NONNULL_END

package/ios/RNIntuneResetJournal.m

@@ -0,0 +1,106 @@
+//
+//  Copyright (c) 2026 react-native-intune contributors. MIT.
+//
+
+#import "RNIntuneResetJournal.h"
+
+NSString *const RNIntuneResetStageUnregistering = @"unregistering";
+NSString *const RNIntuneResetStageCleaningAuth = @"cleaningAuth";
+NSString *const RNIntuneResetStageCleaningLocal = @"cleaningLocal";
+
+/**
+ * NSUserDefaults rather than a file in the app container.
+ *
+ * SPEC §7 requires the journal to survive the wipe, and on iOS the SDK encrypts files in
+ * the container under policy. Defaults are written by the app's own process and are not
+ * part of the SDK's managed-file surface, so they survive both the wipe and the process
+ * death that follows it — which is the whole point.
+ *
+ * [verify] against a real wipe once a tenant exists. Process-death survival is exercised
+ * and works; wipe survival cannot be tested without a policy-targeted account, and it is
+ * the half that matters most.
+ */
+static NSString *const RNIntuneJournalKey = @"com.reactnativeintune.resetJournal";
+
+@implementation RNIntuneResetJournal
+
++ (instancetype)shared
+{
+  static RNIntuneResetJournal *shared = nil;
+  static dispatch_once_t onceToken;
+  dispatch_once(&onceToken, ^{
+    shared = [[self alloc] init];
+  });
+  return shared;
+}
+
+- (nullable NSDictionary<NSString *, id> *)entry
+{
+  id stored = [NSUserDefaults.standardUserDefaults objectForKey:RNIntuneJournalKey];
+  return [stored isKindOfClass:NSDictionary.class] ? stored : nil;
+}
+
+- (nullable NSString *)stage
+{
+  id stage = self.entry[@"stage"];
+  return [stage isKindOfClass:NSString.class] ? stage : nil;
+}
+
+- (nullable NSString *)reason
+{
+  id reason = self.entry[@"reason"];
+  // An empty string is not a reason; treat it as absent so callers get one nil to check.
+  return [reason isKindOfClass:NSString.class] && [reason length] > 0 ? reason : nil;
+}
+
+- (void)openWithAccountId:(nullable NSString *)accountId
+                 tenantId:(nullable NSString *)tenantId
+                     wipe:(BOOL)wipe
+                   reason:(NSString *)reason
+{
+  NSDictionary *entry = @{
+    @"stage" : RNIntuneResetStageUnregistering,
+    @"accountId" : accountId ?: @"",
+    @"tenantId" : tenantId ?: @"",
+    @"wipe" : @(wipe),
+    @"reason" : reason ?: @"",
+    @"startedAt" : @([NSDate.date timeIntervalSince1970]),
+  };
+  [NSUserDefaults.standardUserDefaults setObject:entry forKey:RNIntuneJournalKey];
+  // Forced to disk before returning: the caller is about to make a call that may end the
+  // process, and an entry still sitting in memory is an entry that never existed.
+  [NSUserDefaults.standardUserDefaults synchronize];
+}
+
+- (BOOL)openForServiceWipeWithAccountId:(NSString *)accountId
+                               tenantId:(NSString *)tenantId
+{
+  if (self.entry != nil) {
+    return NO;
+  }
+  // `wipe: YES` because the SDK is already wiping; the flag records what happened rather
+  // than requesting it. `reason` is what lets the consumer's handler tell an
+  // administrator revoking access from a user logging out (SPEC §7.4).
+  [self openWithAccountId:accountId tenantId:tenantId wipe:YES reason:@"remote_wipe"];
+  return YES;
+}
+
+- (void)advanceToStage:(NSString *)stage
+{
+  NSDictionary *current = self.entry;
+  if (current == nil) {
+    return;
+  }
+  NSMutableDictionary *next = [current mutableCopy];
+  next[@"stage"] = stage;
+  [NSUserDefaults.standardUserDefaults setObject:next forKey:RNIntuneJournalKey];
+  [NSUserDefaults.standardUserDefaults synchronize];
+}
+
+- (void)close
+{
+  [NSUserDefaults.standardUserDefaults removeObjectForKey:RNIntuneJournalKey];
+  [NSUserDefaults.standardUserDefaults synchronize];
+}
+
+@end

package/lib/module/NativeIntune.js

@@ -0,0 +1,20 @@
+"use strict";
+
+/**
+ * Codegen spec — the ONLY file Codegen reads, and the only `Native*.ts` allowed in
+ * `jsSrcsDir`. An extra one is picked up and fails confusingly.
+ *
+ * This file is deliberately loose (CLAUDE.md rule 11). Codegen accepts only
+ * `boolean | number | string | Object | Array | Promise | void`: no literal unions, no
+ * optional parameters, no enums. So every union and every optional is normalized in
+ * `index.ts` before it crosses the bridge, and every aggregate return is `Object` here
+ * and a real type there. Nothing in the public API is `Object`.
+ *
+ * Editing this file means Codegen must re-run — `pod install` on iOS,
+ * `generateCodegenArtifactsFromSchema` on Android. A native build that breaks right
+ * after a change here is a stale Codegen artifact until proven otherwise.
+ */
+
+import { TurboModuleRegistry } from 'react-native';
+export default TurboModuleRegistry.getEnforcing('RNIntune');
+//# sourceMappingURL=NativeIntune.js.map

package/lib/module/NativeIntune.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["TurboModuleRegistry","getEnforcing"],"sourceRoot":"../../src","sources":["NativeIntune.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,mBAAmB,QAA0B,cAAc;AAkHpE,eAAeA,mBAAmB,CAACC,YAAY,CAAO,UAAU,CAAC","ignoreList":[]}

package/lib/module/api/auth.js

@@ -0,0 +1,66 @@
+"use strict";
+
+/**
+ * Sign-in, for `authMode: 'builtin'` — the module owns MSAL (SPEC §3).
+ *
+ * Two tokens exist and only one of them appears here: the MAM service token is acquired
+ * internally and never crosses the bridge. Everything returned by these calls is for
+ * *your* API's scopes (SPEC §3.5).
+ */
+
+import NativeIntune from "../NativeIntune.js";
+import { assertAccountId } from "../internal/errors.js";
+import { toAuthAccount, toAuthResult } from "../internal/decode.js";
+import { enroll } from "./enrollment.js";
+/**
+ * Uses the broker when one is present, which also gives device-wide SSO: a user already
+ * signed into Outlook usually gets a token with no prompt at all.
+ */
+export async function signIn(params = {}) {
+  return toAuthResult(await NativeIntune.signIn(params));
+}
+
+/**
+ * Cache-first. Rejects with `E_INTERACTION_REQUIRED` when a prompt is needed — the normal
+ * pattern is `signInSilent` first, `signIn` on that rejection.
+ */
+export async function signInSilent(params = {}) {
+  return toAuthResult(await NativeIntune.signInSilent(params));
+}
+
+/** For your own API's scopes, after sign-in. */
+export async function acquireToken(params) {
+  return toAuthResult(await NativeIntune.acquireToken(params));
+}
+
+/**
+ * Accounts with cached refresh tokens. Under single identity (SPEC §9) this holds at
+ * most one; more than one means state a reset should have cleared.
+ */
+export async function getAccounts() {
+  const accounts = await NativeIntune.getAccounts();
+  return accounts.map(toAuthAccount);
+}
+
+/**
+ * Removes the account from the MSAL cache. With `wipeIntune: true` it also runs the full
+ * reset sequence, which is what you want on logout — and which means **the process may
+ * terminate during this call on Android.**
+ */
+export function signOut(params) {
+  assertAccountId(params.accountId);
+  return NativeIntune.signOut(params);
+}
+
+/** The common path in one call. Use the primitives when you need a step in between. */
+export async function signInAndEnroll(params = {}) {
+  const auth = await signIn(params);
+  const enrollment = await enroll({
+    accountId: auth.accountId
+  });
+  return {
+    auth,
+    enrollment
+  };
+}
+//# sourceMappingURL=auth.js.map