react-native-intune 0.1.1 → 1.0.0-rc.1

package/scripts/lib/checks.mjs

@@ -24,8 +24,26 @@
 
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import {
+  entitlementsWithKeychainGroups,
+  pbxprojAddConfiguratorPhase,
+  pbxprojSetDeploymentTarget,
+  pbxprojSetEntitlements,
+  plistEnsureStrings,
+  plistEnsureUrlScheme,
+  plistRemoveKeys,
+} from './edits.mjs';
 import { read, rel } from './project.mjs';
 
+/**
+ * The Expo plugin's transforms, used here for the same edits in a bare project. One
+ * implementation of each, already tested and already run against real builds, rather
+ * than a second one that drifts.
+ */
+const transforms = createRequire(import.meta.url)('../../plugin/transforms.js');
+
 const MARKER = 'react-native-intune: managed block';
 
 export const BROKER_PACKAGES = [
@@ -115,6 +133,12 @@ const androidChecks = [
         verify = true       // catches plugin-induced runtime failures
         incremental = true  // the default is false
     }`,
+    apply(project) {
+      const file = project.android.appBuildGradle;
+      const src = read(file);
+      // The Kotlin DSL is not edited — reported instead, like it is inspected.
+      return src ? { file, contents: transforms.withMamPluginApplied(src) } : null;
+    },
   },
 
   {
@@ -140,6 +164,57 @@ const androidChecks = [
   And javassist, whose version must match the SDK exactly:
 
     classpath "org.javassist:javassist:3.29.2-GA"`,
+    apply(project) {
+      const file = project.android.rootBuildGradle;
+      const src = read(file);
+      const contents = src && transforms.withMamClasspath(src);
+      return contents ? { file, contents } : null;
+    },
+  },
+
+  {
+    id: 'android-min-sdk',
+    platform: 'android',
+    title: 'minSdk 24 or later',
+    severity: 'loud',
+    /**
+     * MSAL requires 24 and React Native 0.74's template ships 23. Loud rather than silent
+     * — the manifest merger fails and names MSAL — but it is the first thing a 0.74
+     * project hits, and cheaper found here than after a Gradle run.
+     */
+    inspect(project) {
+      const root = read(project.android.rootBuildGradle);
+      const properties = read(path.join(project.android.dir, 'gradle.properties'));
+      const value =
+        firstMatch(root, /minSdkVersion\s*=\s*(\d+)/) ??
+        firstMatch(properties, /^android\.minSdkVersion\s*=\s*(\d+)/m) ??
+        firstMatch(read(project.android.appBuildGradle), /minSdk(?:Version)?\s*=?\s*(\d+)/);
+      if (!value) {
+        return { state: 'unknown', detail: 'no literal minSdkVersion in the build files' };
+      }
+      return Number(value) >= 24
+        ? { state: 'ok', detail: value }
+        : { state: 'wrong', detail: `minSdkVersion ${value}` };
+    },
+    why:
+      'MSAL declares minSdk 24. Below it the manifest merger refuses the build, and the ' +
+      'fix is one number.',
+    instruction: () =>
+      `In android/build.gradle:
+
+    buildscript {
+      ext {
+        minSdkVersion = 24
+      }
+    }`,
+    apply(project) {
+      const file = project.android.rootBuildGradle;
+      const src = read(file);
+      const m = src && src.match(/(minSdkVersion\s*=\s*)(\d+)/);
+      return m && Number(m[2]) < 24
+        ? { file, contents: src.replace(m[0], `${m[1]}24`) }
+        : null;
+    },
   },
 
   {
@@ -329,6 +404,23 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
     RNIntuneAuthCallback.register(this)
 
   Code inside your own class, so setup reports it rather than editing it.`,
+    /**
+     * An edit to the developer's own source, which setup otherwise avoids — but the change
+     * is one line after `super.onCreate()`, it is shown as a diff before anything is
+     * written, and the tree has to be clean so it is one revert away. Leaving it manual
+     * leaves the one silent omission here that nothing else would catch.
+     */
+    apply(project) {
+      const [file] = project.android.applicationSources;
+      if (!file) {
+        return null;
+      }
+      const contents = transforms.withMamApplication(
+        read(file),
+        file.endsWith('.kt') ? 'kt' : 'java'
+      );
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -380,12 +472,51 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
       | openssl sha1 -binary | openssl base64`
   }`;
     },
+    /**
+     * Written with the hash of android/app/debug.keystore, computed here — the key a
+     * debug build is signed with, and the one most apps are first run with. A release
+     * signed with another key needs that key's hash as a second <data> entry, which
+     * setup cannot know; the comment it writes says so.
+     */
+    apply(project) {
+      const file = project.android.manifest;
+      const src = read(file);
+      const hash = signatureHash(project);
+      const applicationId = read(project.android.appBuildGradle).match(
+        /applicationId\s*=?\s*["']([\w.]+)["']/
+      )?.[1];
+      if (!src || !hash || !applicationId || !/<\/application>/.test(src)) {
+        return null;
+      }
+      const activity = `
+        <!-- ${MARKER}: the MSAL redirect. The path is the hash of the debug keystore;
+             a release build signed with another key needs that key's hash as a second
+             <data> element, and the matching redirect URI registered in Entra. -->
+        <activity
+            android:name="com.microsoft.identity.client.BrowserTabActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data
+                    android:scheme="msauth"
+                    android:host="${applicationId}"
+                    android:path="/${hash}" />
+            </intent-filter>
+        </activity>
+`;
+      return {
+        file,
+        contents: src.replace(/(\n?)([ \t]*)<\/application>/, `${activity}$2</application>`),
+      };
+    },
   },
 
   {
     id: 'android-toolchain',
     platform: 'android',
-    title: 'App toolchain on the MAM compatibility matrix row',
+    title: 'App toolchain is a tested combination',
     /**
      * Advisory, and deliberately so. Mixing matrix rows is *untested* by Microsoft, not
      * known-broken — plenty of combinations work. But when one does not, the failure lands
@@ -420,26 +551,63 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
           firstMatch(src, /kotlinVersion["' ]*[:=]["' ]*([\d.]+)/),
         gradle: gradleWrapperVersion(project),
       };
+      // React Native's templates leave AGP and Kotlin to React Native's own version
+      // catalog — `classpath("com.android.tools.build:gradle")` with no version, which
+      // the React Native Gradle plugin resolves from it. So that catalog is where the
+      // versions the app actually builds with are written.
+      const catalog = read(
+        path.join(project.root, 'node_modules/react-native/gradle/libs.versions.toml')
+      );
+      found.agp ||= firstMatch(catalog, /^agp\s*=\s*"([\d.]+)"/m);
+      found.kotlin ||= firstMatch(catalog, /^kotlin\s*=\s*"([\d.]+)"/m);
+      const rn = (() => {
+        try {
+          return JSON.parse(
+            read(path.join(project.root, 'node_modules/react-native/package.json')) || '{}'
+          ).version;
+        } catch {
+          return undefined;
+        }
+      })();
 
-      const mismatched = Object.entries(REQUIRED_TOOLCHAIN)
-        .filter(([k]) => found[k])
-        .filter(([k, want]) => found[k] !== want)
-        .map(([k, want]) => `${k} ${found[k]} vs ${want}`);
-
-      const unseen = Object.keys(REQUIRED_TOOLCHAIN).filter((k) => !found[k]);
-
-      if (mismatched.length > 0) {
-        return { state: 'wrong', detail: mismatched.join(', ') };
-      }
-      if (unseen.length === Object.keys(REQUIRED_TOOLCHAIN).length) {
+      const seen = Object.keys(REQUIRED_TOOLCHAIN).filter((k) => found[k]);
+      if (seen.length === 0) {
         return {
           state: 'unknown',
           detail: 'could not read any version from the build files',
         };
       }
+      const unread = Object.keys(REQUIRED_TOOLCHAIN).filter((k) => !found[k]);
+      const partly = unread.length > 0 ? `; ${unread.join(', ')} not read` : '';
+      const agrees = (row) =>
+        seen.every((k) => row[k] === undefined || row[k] === found[k]) &&
+        seen.some((k) => row[k] !== undefined);
+
+      if (agrees(REQUIRED_TOOLCHAIN)) {
+        return { state: 'ok', detail: `on Microsoft's tested row${partly}` };
+      }
+      // Off Microsoft's row, but a combination this project has built and run — which is
+      // worth saying so, and worth saying whose claim it is.
+      // The row for this project's own React Native version first, so a report names the
+      // combination that was actually built rather than one that happens to share a
+      // Gradle version.
+      const candidates = VERIFIED_TOOLCHAINS.filter(agrees);
+      const ours =
+        candidates.find((v) => rn && String(v.reactNative).includes(rn)) ?? candidates[0];
+      if (ours) {
+        return {
+          state: 'ok',
+          detail:
+            `${seen.map((k) => `${k} ${found[k]}`).join(', ')} — verified by this project ` +
+            `on ${ours.date} (React Native ${ours.reactNative}), not by Microsoft${partly}`,
+        };
+      }
       return {
-        state: 'ok',
-        detail: unseen.length > 0 ? `${unseen.join(', ')} not read` : undefined,
+        state: 'wrong',
+        detail:
+          seen.map((k) => `${k} ${found[k]}`).join(', ') +
+          ' — neither Microsoft\u2019s row nor a combination verified here' +
+          partly,
       };
     },
     why:
@@ -448,21 +616,223 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
       'rewrites bytecode in your app module, so when a mixed row does fail it fails ' +
       'inside javassist and the error names one of your classes, never a version.',
     instruction: () =>
-      `The row this library is pinned to:
+      `Microsoft's tested row for the pinned MAM SDK:
+
+    Gradle ${REQUIRED_TOOLCHAIN.gradle}   AGP ${REQUIRED_TOOLCHAIN.agp}   Kotlin ${REQUIRED_TOOLCHAIN.kotlin}   Java 17
 
-    Gradle  ${REQUIRED_TOOLCHAIN.gradle}
-    AGP     ${REQUIRED_TOOLCHAIN.agp}
-    Kotlin  ${REQUIRED_TOOLCHAIN.kotlin}
-    Java    17
+  Built and run by this project, off that row:
 
-Matching it exactly is the tested path. If your app cannot move, the alternative is
-pinning an older MAM SDK whose row you do match — see sdk-versions.json.`,
+${VERIFIED_TOOLCHAINS.map(
+  (v) =>
+    `    Gradle ${v.gradle}${v.agp ? `   AGP ${v.agp}` : ''}   Kotlin ${v.kotlin}   ` +
+    `(React Native ${v.reactNative}, ${v.date})`
+).join('\n')}
+
+  Anything else is untested rather than broken. If a build fails inside the MAM plugin
+  with an error naming one of your classes, move to one of these first.`,
   },
 ];
 
 // ---------------------------------------------------------------- ios
 
+/**
+ * The lowest iOS the vendored MAM SDK runs on. Read from the binary (`otool -l` on
+ * IntuneMAMSwift.framework reports `minos 17.0` in both 21.8.0 and 21.9.0), not from
+ * Microsoft's release notes — the SDK should move this, not a guess.
+ */
+const MIN_IOS = [17, 0];
+
+const versionAtLeast = (value, [major, minor]) => {
+  const [a = 0, b = 0] = String(value).split('.').map(Number);
+  return a > major || (a === major && b >= minor);
+};
+
+/**
+ * The deployment target each configuration of each application target actually builds
+ * with: the target's own setting, or the project-level one it inherits when it sets
+ * none. A value elsewhere in the file — a project-level default the target overrides,
+ * another target — says nothing about what the app is built for, and counting those is
+ * how an Expo project, whose project level reads 16.4 while the app target reads 17.0,
+ * was reported as wrong.
+ */
+function appDeploymentTargets(pbxproj) {
+  const object = (isa) =>
+    new RegExp(
+      `(\\w{24})\\s*(?:/\\*[^*]*\\*/)?\\s*=\\s*\\{\\s*isa\\s*=\\s*${isa};([\\s\\S]*?)\\n\\t\\t\\};`,
+      'g'
+    );
+  const configs = new Map();
+  for (const [, id, body] of pbxproj.matchAll(object('XCBuildConfiguration'))) {
+    configs.set(id, {
+      name: body.match(/\bname\s*=\s*"?([^";]+)"?;/)?.[1],
+      value: body.match(/IPHONEOS_DEPLOYMENT_TARGET\s*=\s*"?([\d.]+)"?;/)?.[1],
+    });
+  }
+  const lists = new Map();
+  for (const [, id, body] of pbxproj.matchAll(object('XCConfigurationList'))) {
+    const ids = body.match(/buildConfigurations\s*=\s*\(([^)]*)\)/)?.[1] ?? '';
+    lists.set(id, [...ids.matchAll(/\w{24}/g)].map((m) => m[0]));
+  }
+  const listOf = (body) => body.match(/buildConfigurationList\s*=\s*(\w{24})/)?.[1];
+
+  const [, , projectBody = ''] = [...pbxproj.matchAll(object('PBXProject'))][0] ?? [];
+  const inherited = new Map(
+    (lists.get(listOf(projectBody)) ?? []).map((id) => [
+      configs.get(id)?.name,
+      configs.get(id)?.value,
+    ])
+  );
+
+  const effective = [];
+  for (const [, , body] of pbxproj.matchAll(object('PBXNativeTarget'))) {
+    if (!/productType\s*=\s*"com\.apple\.product-type\.application"/.test(body)) {
+      continue;
+    }
+    for (const id of lists.get(listOf(body)) ?? []) {
+      const c = configs.get(id) ?? {};
+      effective.push({ name: c.name, value: c.value ?? inherited.get(c.name) ?? null });
+    }
+  }
+  return effective;
+}
+
+/** Ruby comments — whole-line or trailing — so a commented-out platform line is ignored. */
+const stripRubyComments = (src) => src.replace(/(^|\s)#.*$/gm, '$1');
+
+/**
+ * The Run Script phase setup adds. It fails the build when the tool is missing rather
+ * than skipping it, because a skipped run leaves a plist without the schemes the SDK
+ * needs, and that fails at sign-in with an empty log instead of here with a reason.
+ */
+const CONFIGURATOR_SCRIPT = `# ${MARKER}: Microsoft's IntuneMAMConfigurator, run on this app's Info.plist and
+# entitlements. A build phase rather than a manual step, because what it writes is not a
+# fixed list and changes between SDK versions. It is idempotent.
+set -euo pipefail
+
+CONFIGURATOR="$SRCROOT/../node_modules/react-native-intune/vendor/ios/IntuneMAMConfigurator"
+
+if [ ! -x "$CONFIGURATOR" ]; then
+  echo "error: IntuneMAMConfigurator is missing — run: node node_modules/react-native-intune/scripts/fetch-sdks.mjs"
+  exit 1
+fi
+
+"$CONFIGURATOR" -i "$SRCROOT/$INFOPLIST_FILE" -e "$SRCROOT/$CODE_SIGN_ENTITLEMENTS"
+`;
+
 const iosChecks = [
+  {
+    id: 'ios-deployment-target',
+    platform: 'ios',
+    title: `Deployment target is iOS ${MIN_IOS.join('.')} or later`,
+    severity: 'loud',
+    /**
+     * React Native's template targets `min_ios_version_supported` — 15.1 — and the SDK
+     * is built for 17.0, so a new project fails at `pod install` before anything else
+     * here can be tried. The Podfile and the Xcode target are read separately because
+     * they disagree independently: a raised Podfile with a 15.1 app target installs the
+     * pod and builds, then crashes at launch on any iOS 16 device it was allowed onto.
+     */
+    inspect(project) {
+      const podfile = stripRubyComments(read(project.ios.podfile));
+      if (!podfile) {
+        return { state: 'unknown', detail: 'ios/Podfile not found' };
+      }
+      const line = podfile.match(/^\s*platform\s+:ios\s*,\s*(.+)$/m)?.[1]?.trim();
+      if (!line) {
+        return { state: 'unknown', detail: 'no `platform :ios` line in the Podfile' };
+      }
+
+      let target = line.match(/^['"]([\d.]+)['"]$/)?.[1];
+      let source = 'Podfile';
+      if (!target && /ios\.deploymentTarget/.test(line)) {
+        // Expo's generated Podfile reads Podfile.properties.json first, which is what
+        // expo-build-properties writes, and falls back to the template minimum.
+        const props = path.join(path.dirname(project.ios.podfile), 'Podfile.properties.json');
+        try {
+          target = JSON.parse(read(props) || '{}')['ios.deploymentTarget'];
+          source = 'Podfile.properties.json';
+        } catch {
+          return { state: 'unknown', detail: 'Podfile.properties.json is not valid JSON' };
+        }
+        if (!target) {
+          return {
+            state: 'wrong',
+            detail:
+              'ios.deploymentTarget is not set, so the Podfile falls back to ' +
+              'min_ios_version_supported',
+          };
+        }
+      }
+      if (!target) {
+        return /min_ios_version_supported/.test(line)
+          ? {
+              state: 'wrong',
+              detail: 'the Podfile uses min_ios_version_supported, which is below 17.0',
+            }
+          : { state: 'unknown', detail: `cannot read a version from: ${line}` };
+      }
+      if (!versionAtLeast(target, MIN_IOS)) {
+        return { state: 'wrong', detail: `${source} targets ${target}` };
+      }
+
+      const effective = appDeploymentTargets(read(project.ios.pbxproj));
+      if (effective.length === 0) {
+        return {
+          state: 'unknown',
+          detail: `${source} targets ${target}; no application target found in the Xcode project`,
+        };
+      }
+      // A configuration that sets it nowhere builds for the SDK's own default, which is
+      // the newest iOS — not a problem, so only explicit low values count.
+      const low = effective.filter((e) => e.value && !versionAtLeast(e.value, MIN_IOS));
+      if (low.length > 0) {
+        return {
+          state: 'wrong',
+          detail:
+            `${source} targets ${target}, but the app target builds for ` +
+            low.map((e) => `${e.value} (${e.name})`).join(', '),
+        };
+      }
+      return { state: 'ok', detail: `${source}: ${target}` };
+    },
+    why:
+      'MAM SDK 21.x is built for iOS 17.0. Below it CocoaPods refuses the pod; with only ' +
+      'the Podfile raised, the app builds and then crashes at launch on older devices it ' +
+      'still claims to support.',
+    instruction: () =>
+      `In ios/Podfile:
+
+    platform :ios, '17.0'
+
+  and set Minimum Deployments to 17.0 on your app target in Xcode
+  (IPHONEOS_DEPLOYMENT_TARGET), then run pod install again.
+
+  Expo: set it with expo-build-properties — { "ios": { "deploymentTarget": "17.0" } }.`,
+    /**
+     * The Podfile and the app target together — raising one without the other is the case
+     * this check exists to catch. An Expo Podfile is left alone: prebuild regenerates it,
+     * and the value belongs in expo-build-properties.
+     */
+    apply(project) {
+      const podfile = project.ios.podfile;
+      const src = read(podfile);
+      const line = src.match(/^(\s*platform\s+:ios\s*,\s*)(.+)$/m);
+      if (!line || /ios\.deploymentTarget/.test(line[2])) {
+        return null;
+      }
+      const version = MIN_IOS.join('.');
+      const edits = [{ file: podfile, contents: src.replace(line[0], `${line[1]}'${version}'`) }];
+      const pbxproj = read(project.ios.pbxproj);
+      const next =
+        pbxproj &&
+        pbxprojSetDeploymentTarget(pbxproj, version, (v) => versionAtLeast(v, MIN_IOS));
+      if (next) {
+        edits.push({ file: project.ios.pbxproj, contents: next });
+      }
+      return edits;
+    },
+  },
+
   {
     id: 'ios-keychain-groups',
     platform: 'ios',
@@ -524,6 +894,40 @@ ${KEYCHAIN_GROUPS.map((g) => `        <string>${g}</string>`).join('\n')}
   The app's own group first, then the SDK's, then MSAL's cache. The first entry may be
   written as the literal bundle id or as $(PRODUCT_BUNDLE_IDENTIFIER) — both work.`;
     },
+    /**
+     * React Native's template has no entitlements file, so this usually creates one and
+     * points the app target at it. An app target that already names a differently-called
+     * entitlements file is left to be edited by hand: creating a second file it never
+     * reads would look fixed and change nothing.
+     */
+    apply(project) {
+      const ios = project.ios;
+      const pbxproj = read(ios.pbxproj);
+      if (!ios.appName || !pbxproj) {
+        return null;
+      }
+      if (!ios.entitlements && /CODE_SIGN_ENTITLEMENTS\s*=/.test(pbxproj)) {
+        return null;
+      }
+      const file =
+        ios.entitlements ?? path.join(ios.dir, ios.appName, `${ios.appName}.entitlements`);
+      const contents = entitlementsWithKeychainGroups(read(file), [
+        '$(AppIdentifierPrefix)$(PRODUCT_BUNDLE_IDENTIFIER)',
+        ...KEYCHAIN_GROUPS,
+      ]);
+      if (!contents) {
+        return null;
+      }
+      const edits = [{ file, contents }];
+      const next = pbxprojSetEntitlements(
+        pbxproj,
+        `${ios.appName}/${ios.appName}.entitlements`
+      );
+      if (next) {
+        edits.push({ file: ios.pbxproj, contents: next });
+      }
+      return edits;
+    },
   },
 
   {
@@ -558,6 +962,12 @@ ${KEYCHAIN_GROUPS.map((g) => `        <string>${g}</string>`).join('\n')}
         </array>
       </dict>
     </array>`,
+    apply(project) {
+      const file = project.ios.infoPlist;
+      const src = read(file);
+      const contents = src && plistEnsureUrlScheme(src, 'msauth.$(PRODUCT_BUNDLE_IDENTIFIER)');
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -587,6 +997,13 @@ ${KEYCHAIN_GROUPS.map((g) => `        <string>${g}</string>`).join('\n')}
 ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
         <string>companyportal</string>
     </array>`,
+    apply(project) {
+      const file = project.ios.infoPlist;
+      const src = read(file);
+      const contents =
+        src && plistEnsureStrings(src, 'LSApplicationQueriesSchemes', MSAL_QUERY_SCHEMES);
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -617,6 +1034,16 @@ ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
 
   Note: ADALCacheKeychainGroupOverride is a different key and is NOT removed — it has
   no runtime equivalent and is the only way to set the keychain group.`,
+    apply(project) {
+      const file = project.ios.infoPlist;
+      const src = read(file);
+      return src
+        ? {
+            file,
+            contents: plistRemoveKeys(src, ['ADALClientId', 'ADALAuthority', 'ADALRedirectUri']),
+          }
+        : null;
+    },
   },
 
   {
@@ -649,6 +1076,18 @@ ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
     }
 
   Code in your own AppDelegate, so setup reports it rather than editing it.`,
+    /** The Expo plugin's transform, which adds the method when a template has none. */
+    apply(project) {
+      const file = project.ios.appDelegate;
+      if (!file) {
+        return null;
+      }
+      const contents = transforms.withMsalResponseHandler(
+        read(file),
+        file.endsWith('.swift') ? 'swift' : 'objcpp'
+      );
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -707,8 +1146,14 @@ ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
       -i "$SRCROOT/$INFOPLIST_FILE" \\
       -e "$SRCROOT/${'$'}{CODE_SIGN_ENTITLEMENTS}"
 
-  Not wrapped by setup: it is Microsoft's tool, and wrapping it means owning what it
-  does. The line above is what to paste.`,
+  setup adds it for you. It runs Microsoft's tool as it is — setup writes the phase,
+  not a wrapper around what the tool does.`,
+    apply(project) {
+      const file = project.ios.pbxproj;
+      const src = read(file);
+      const contents = src && pbxprojAddConfiguratorPhase(src, CONFIGURATOR_SCRIPT);
+      return contents ? { file, contents } : null;
+    },
   },
 ];
 
@@ -785,16 +1230,27 @@ export function signatureHash(project) {
  * there is one copy. Duplicating it here is how the two drift and the check starts
  * reporting a row nobody targets.
  */
-const REQUIRED_TOOLCHAIN = (() => {
+const TOOLCHAIN = (() => {
   try {
     const url = new URL('../../sdk-versions.json', import.meta.url);
-    const { toolchain } = JSON.parse(fs.readFileSync(url, 'utf8'));
-    const { requires } = toolchain;
-    return { gradle: requires.gradle, agp: requires.agp, kotlin: requires.kotlin };
+    return JSON.parse(fs.readFileSync(url, 'utf8')).toolchain ?? {};
   } catch {
     return {};
   }
 })();
+const REQUIRED_TOOLCHAIN = TOOLCHAIN.requires
+  ? {
+      gradle: TOOLCHAIN.requires.gradle,
+      agp: TOOLCHAIN.requires.agp,
+      kotlin: TOOLCHAIN.requires.kotlin,
+    }
+  : {};
+
+/**
+ * Combinations this project has built and run itself, off Microsoft's row — see the
+ * comment in sdk-versions.json for what qualifies one.
+ */
+const VERIFIED_TOOLCHAINS = TOOLCHAIN.verified ?? [];
 
 function firstMatch(src, re) {
   const m = src.match(re);