react-native-intune 0.1.2 → 1.0.0-rc.1

package/plugin/transforms.js

@@ -27,9 +27,20 @@ intunemam {
 }
 `;
 
-/** Applies the MAM plugin to android/app/build.gradle. */
+/**
+ * Applies the MAM plugin to android/app/build.gradle.
+ *
+ * The guard looks for an actual application at the start of a line, not the plugin id
+ * anywhere: commenting the apply out is the first thing anyone does when the bytecode
+ * rewrite breaks a library, and a guard that read the comment as applied would leave
+ * the app unprotected while `setup` reported success.
+ */
 function withMamPluginApplied(contents) {
-  if (contents.includes('com.microsoft.intune.mam')) {
+  if (
+    /^[ \t]*(?:apply\s+plugin\s*:\s*|id\s*\(?\s*)["']com\.microsoft\.intune\.mam["']/m.test(
+      contents
+    )
+  ) {
     return contents;
   }
   return `${contents.trimEnd()}\n${MAM_PLUGIN_BLOCK}`;
@@ -212,7 +223,7 @@ function withMsalResponseHandler(contents, language) {
     ? /(func\s+application\s*\(\s*_\s+\w+\s*:\s*UIApplication\s*,\s*open\s+url\s*:\s*URL\s*,\s*options\s*:[^)]*\)\s*->\s*Bool\s*\{\s*\n(\s*)return\s+)/
     : /(-\s*\(BOOL\)\s*application\s*:\s*\(UIApplication\s*\*\)\s*\w+\s+openURL\s*:\s*\(NSURL\s*\*\)\s*url\s+options\s*:[^{]*\{\s*\n(\s*)return\s+)/;
   if (!handler.test(contents)) {
-    return null;
+    return withNewMsalResponseHandler(contents, isSwift);
   }
   const forward = isSwift
     ? 'MSALPublicClientApplication.handleMSALResponse(url, sourceApplication: options[.sourceApplication] as? String) || '
@@ -232,6 +243,102 @@ function withMsalResponseHandler(contents, language) {
   return next;
 }
 
+/**
+ * React Native's own templates have no open-URL handler at all — only Expo's does — so
+ * for them the forward is a whole method. It goes at the end of the AppDelegate class,
+ * found by matching braces from the class declaration; string literals and comments are
+ * skipped so a brace in either cannot end the class early.
+ *
+ * No `override`: in these templates the class is a UIResponder conforming to
+ * UIApplicationDelegate, and the method is the protocol's, not a superclass's.
+ */
+function withNewMsalResponseHandler(contents, isSwift) {
+  const importLine = isSwift ? 'import MSAL' : '#import <MSAL/MSAL.h>';
+  let next = contents;
+
+  if (isSwift) {
+    const declaration = /class\s+AppDelegate\b[^{]*\{/.exec(next);
+    if (!declaration) {
+      return null;
+    }
+    const end = matchingBrace(
+      next,
+      declaration.index + declaration[0].length - 1
+    );
+    if (end === null) {
+      return null;
+    }
+    const method = `
+  /// Hands the sign-in result back to MSAL. Without it the broker's reply reaches the app
+  /// and is dropped, and sign-in never completes. Added by react-native-intune setup.
+  func application(
+    _ app: UIApplication,
+    open url: URL,
+    options: [UIApplication.OpenURLOptionsKey: Any] = [:]
+  ) -> Bool {
+    MSALPublicClientApplication.handleMSALResponse(
+      url,
+      sourceApplication: options[.sourceApplication] as? String
+    )
+  }
+`;
+    next = `${next.slice(0, end).replace(/\s*$/, '\n')}${method}${next.slice(end)}`;
+  } else {
+    const implementation = /@implementation\s+AppDelegate\b[^\n]*\n/.exec(next);
+    if (!implementation) {
+      return null;
+    }
+    const at = implementation.index + implementation[0].length;
+    const method = `
+// Hands the sign-in result back to MSAL. Without it the broker's reply reaches the app and
+// is dropped, and sign-in never completes. Added by react-native-intune setup.
+- (BOOL)application:(UIApplication *)application
+            openURL:(NSURL *)url
+            options:(NSDictionary<UIApplicationOpenURLOptionsKey, id> *)options
+{
+  return [MSALPublicClientApplication handleMSALResponse:url
+                                       sourceApplication:options[UIApplicationOpenURLOptionsSourceApplicationKey]];
+}
+`;
+    next = `${next.slice(0, at)}${method}${next.slice(at)}`;
+  }
+
+  const imports = isSwift
+    ? /^(?:\w+\s+)?import\s+\w+.*$/gm
+    : /^#import\s+.*$/gm;
+  const lastImport = [...next.matchAll(imports)].pop();
+  if (!lastImport) {
+    return null;
+  }
+  const at = lastImport.index + lastImport[0].length;
+  return `${next.slice(0, at)}\n${importLine}${next.slice(at)}`;
+}
+
+/** The index of the brace closing the one at `open`, skipping strings and comments. */
+function matchingBrace(src, open) {
+  let depth = 0;
+  for (let i = open; i < src.length; i += 1) {
+    const c = src[i];
+    if (c === '/' && src[i + 1] === '/') {
+      i = src.indexOf('\n', i);
+      if (i === -1) return null;
+    } else if (c === '/' && src[i + 1] === '*') {
+      i = src.indexOf('*/', i + 2) + 1;
+      if (i === 0) return null;
+    } else if (c === '"') {
+      for (i += 1; i < src.length && src[i] !== '"'; i += 1) {
+        if (src[i] === '\\') i += 1;
+      }
+    } else if (c === '{') {
+      depth += 1;
+    } else if (c === '}') {
+      depth -= 1;
+      if (depth === 0) return i;
+    }
+  }
+  return null;
+}
+
 module.exports = {
   MARKER,
   withMamPluginApplied,

package/scripts/doctor.mjs

@@ -116,7 +116,8 @@ function main() {
         2
       ) + '\n'
     );
-    process.exit(s.blocking.length > 0 ? 1 : 0);
+    process.exitCode = s.blocking.length > 0 ? 1 : 0;
+    return;
   }
 
   process.stdout.write(`\nreact-native-intune doctor\n${project.root}\n`);
@@ -141,7 +142,7 @@ function main() {
         `licensed for Intune, that an App Protection Policy targets this app, and that\n` +
         `a broker is installed on the device. Enrollment needs all three.\n\n`
     );
-    process.exit(0);
+    return;
   }
 
   if (s.silent.length > 0) {
@@ -182,7 +183,10 @@ function main() {
   }
 
   process.stdout.write('\n');
-  process.exit(s.blocking.length > 0 ? 1 : 0);
+  // An exit code, not process.exit(): on macOS a write to a pipe is asynchronous, and
+  // exiting straight after a long report cut it off mid-way whenever doctor's output was
+  // piped — into a CI log, a file, or `| less`.
+  process.exitCode = s.blocking.length > 0 ? 1 : 0;
 }
 
 /**

package/scripts/lib/checks.mjs

@@ -25,8 +25,25 @@
 import { execFileSync } from 'node:child_process';
 import fs from 'node:fs';
 import path from 'node:path';
+import { createRequire } from 'node:module';
+import {
+  entitlementsWithKeychainGroups,
+  pbxprojAddConfiguratorPhase,
+  pbxprojSetDeploymentTarget,
+  pbxprojSetEntitlements,
+  plistEnsureStrings,
+  plistEnsureUrlScheme,
+  plistRemoveKeys,
+} from './edits.mjs';
 import { read, rel } from './project.mjs';
 
+/**
+ * The Expo plugin's transforms, used here for the same edits in a bare project. One
+ * implementation of each, already tested and already run against real builds, rather
+ * than a second one that drifts.
+ */
+const transforms = createRequire(import.meta.url)('../../plugin/transforms.js');
+
 const MARKER = 'react-native-intune: managed block';
 
 export const BROKER_PACKAGES = [
@@ -116,6 +133,12 @@ const androidChecks = [
         verify = true       // catches plugin-induced runtime failures
         incremental = true  // the default is false
     }`,
+    apply(project) {
+      const file = project.android.appBuildGradle;
+      const src = read(file);
+      // The Kotlin DSL is not edited — reported instead, like it is inspected.
+      return src ? { file, contents: transforms.withMamPluginApplied(src) } : null;
+    },
   },
 
   {
@@ -141,6 +164,57 @@ const androidChecks = [
   And javassist, whose version must match the SDK exactly:
 
     classpath "org.javassist:javassist:3.29.2-GA"`,
+    apply(project) {
+      const file = project.android.rootBuildGradle;
+      const src = read(file);
+      const contents = src && transforms.withMamClasspath(src);
+      return contents ? { file, contents } : null;
+    },
+  },
+
+  {
+    id: 'android-min-sdk',
+    platform: 'android',
+    title: 'minSdk 24 or later',
+    severity: 'loud',
+    /**
+     * MSAL requires 24 and React Native 0.74's template ships 23. Loud rather than silent
+     * — the manifest merger fails and names MSAL — but it is the first thing a 0.74
+     * project hits, and cheaper found here than after a Gradle run.
+     */
+    inspect(project) {
+      const root = read(project.android.rootBuildGradle);
+      const properties = read(path.join(project.android.dir, 'gradle.properties'));
+      const value =
+        firstMatch(root, /minSdkVersion\s*=\s*(\d+)/) ??
+        firstMatch(properties, /^android\.minSdkVersion\s*=\s*(\d+)/m) ??
+        firstMatch(read(project.android.appBuildGradle), /minSdk(?:Version)?\s*=?\s*(\d+)/);
+      if (!value) {
+        return { state: 'unknown', detail: 'no literal minSdkVersion in the build files' };
+      }
+      return Number(value) >= 24
+        ? { state: 'ok', detail: value }
+        : { state: 'wrong', detail: `minSdkVersion ${value}` };
+    },
+    why:
+      'MSAL declares minSdk 24. Below it the manifest merger refuses the build, and the ' +
+      'fix is one number.',
+    instruction: () =>
+      `In android/build.gradle:
+
+    buildscript {
+      ext {
+        minSdkVersion = 24
+      }
+    }`,
+    apply(project) {
+      const file = project.android.rootBuildGradle;
+      const src = read(file);
+      const m = src && src.match(/(minSdkVersion\s*=\s*)(\d+)/);
+      return m && Number(m[2]) < 24
+        ? { file, contents: src.replace(m[0], `${m[1]}24`) }
+        : null;
+    },
   },
 
   {
@@ -330,6 +404,23 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
     RNIntuneAuthCallback.register(this)
 
   Code inside your own class, so setup reports it rather than editing it.`,
+    /**
+     * An edit to the developer's own source, which setup otherwise avoids — but the change
+     * is one line after `super.onCreate()`, it is shown as a diff before anything is
+     * written, and the tree has to be clean so it is one revert away. Leaving it manual
+     * leaves the one silent omission here that nothing else would catch.
+     */
+    apply(project) {
+      const [file] = project.android.applicationSources;
+      if (!file) {
+        return null;
+      }
+      const contents = transforms.withMamApplication(
+        read(file),
+        file.endsWith('.kt') ? 'kt' : 'java'
+      );
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -381,12 +472,51 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
       | openssl sha1 -binary | openssl base64`
   }`;
     },
+    /**
+     * Written with the hash of android/app/debug.keystore, computed here — the key a
+     * debug build is signed with, and the one most apps are first run with. A release
+     * signed with another key needs that key's hash as a second <data> entry, which
+     * setup cannot know; the comment it writes says so.
+     */
+    apply(project) {
+      const file = project.android.manifest;
+      const src = read(file);
+      const hash = signatureHash(project);
+      const applicationId = read(project.android.appBuildGradle).match(
+        /applicationId\s*=?\s*["']([\w.]+)["']/
+      )?.[1];
+      if (!src || !hash || !applicationId || !/<\/application>/.test(src)) {
+        return null;
+      }
+      const activity = `
+        <!-- ${MARKER}: the MSAL redirect. The path is the hash of the debug keystore;
+             a release build signed with another key needs that key's hash as a second
+             <data> element, and the matching redirect URI registered in Entra. -->
+        <activity
+            android:name="com.microsoft.identity.client.BrowserTabActivity"
+            android:exported="true">
+            <intent-filter>
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data
+                    android:scheme="msauth"
+                    android:host="${applicationId}"
+                    android:path="/${hash}" />
+            </intent-filter>
+        </activity>
+`;
+      return {
+        file,
+        contents: src.replace(/(\n?)([ \t]*)<\/application>/, `${activity}$2</application>`),
+      };
+    },
   },
 
   {
     id: 'android-toolchain',
     platform: 'android',
-    title: 'App toolchain on the MAM compatibility matrix row',
+    title: 'App toolchain is a tested combination',
     /**
      * Advisory, and deliberately so. Mixing matrix rows is *untested* by Microsoft, not
      * known-broken — plenty of combinations work. But when one does not, the failure lands
@@ -421,26 +551,63 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
           firstMatch(src, /kotlinVersion["' ]*[:=]["' ]*([\d.]+)/),
         gradle: gradleWrapperVersion(project),
       };
+      // React Native's templates leave AGP and Kotlin to React Native's own version
+      // catalog — `classpath("com.android.tools.build:gradle")` with no version, which
+      // the React Native Gradle plugin resolves from it. So that catalog is where the
+      // versions the app actually builds with are written.
+      const catalog = read(
+        path.join(project.root, 'node_modules/react-native/gradle/libs.versions.toml')
+      );
+      found.agp ||= firstMatch(catalog, /^agp\s*=\s*"([\d.]+)"/m);
+      found.kotlin ||= firstMatch(catalog, /^kotlin\s*=\s*"([\d.]+)"/m);
+      const rn = (() => {
+        try {
+          return JSON.parse(
+            read(path.join(project.root, 'node_modules/react-native/package.json')) || '{}'
+          ).version;
+        } catch {
+          return undefined;
+        }
+      })();
 
-      const mismatched = Object.entries(REQUIRED_TOOLCHAIN)
-        .filter(([k]) => found[k])
-        .filter(([k, want]) => found[k] !== want)
-        .map(([k, want]) => `${k} ${found[k]} vs ${want}`);
-
-      const unseen = Object.keys(REQUIRED_TOOLCHAIN).filter((k) => !found[k]);
-
-      if (mismatched.length > 0) {
-        return { state: 'wrong', detail: mismatched.join(', ') };
-      }
-      if (unseen.length === Object.keys(REQUIRED_TOOLCHAIN).length) {
+      const seen = Object.keys(REQUIRED_TOOLCHAIN).filter((k) => found[k]);
+      if (seen.length === 0) {
         return {
           state: 'unknown',
           detail: 'could not read any version from the build files',
         };
       }
+      const unread = Object.keys(REQUIRED_TOOLCHAIN).filter((k) => !found[k]);
+      const partly = unread.length > 0 ? `; ${unread.join(', ')} not read` : '';
+      const agrees = (row) =>
+        seen.every((k) => row[k] === undefined || row[k] === found[k]) &&
+        seen.some((k) => row[k] !== undefined);
+
+      if (agrees(REQUIRED_TOOLCHAIN)) {
+        return { state: 'ok', detail: `on Microsoft's tested row${partly}` };
+      }
+      // Off Microsoft's row, but a combination this project has built and run — which is
+      // worth saying so, and worth saying whose claim it is.
+      // The row for this project's own React Native version first, so a report names the
+      // combination that was actually built rather than one that happens to share a
+      // Gradle version.
+      const candidates = VERIFIED_TOOLCHAINS.filter(agrees);
+      const ours =
+        candidates.find((v) => rn && String(v.reactNative).includes(rn)) ?? candidates[0];
+      if (ours) {
+        return {
+          state: 'ok',
+          detail:
+            `${seen.map((k) => `${k} ${found[k]}`).join(', ')} — verified by this project ` +
+            `on ${ours.date} (React Native ${ours.reactNative}), not by Microsoft${partly}`,
+        };
+      }
       return {
-        state: 'ok',
-        detail: unseen.length > 0 ? `${unseen.join(', ')} not read` : undefined,
+        state: 'wrong',
+        detail:
+          seen.map((k) => `${k} ${found[k]}`).join(', ') +
+          ' — neither Microsoft\u2019s row nor a combination verified here' +
+          partly,
       };
     },
     why:
@@ -449,15 +616,20 @@ ${BROKER_PACKAGES.map((p) => `        <package android:name="${p}" />`).join('\n
       'rewrites bytecode in your app module, so when a mixed row does fail it fails ' +
       'inside javassist and the error names one of your classes, never a version.',
     instruction: () =>
-      `The row this library is pinned to:
+      `Microsoft's tested row for the pinned MAM SDK:
+
+    Gradle ${REQUIRED_TOOLCHAIN.gradle}   AGP ${REQUIRED_TOOLCHAIN.agp}   Kotlin ${REQUIRED_TOOLCHAIN.kotlin}   Java 17
+
+  Built and run by this project, off that row:
 
-    Gradle  ${REQUIRED_TOOLCHAIN.gradle}
-    AGP     ${REQUIRED_TOOLCHAIN.agp}
-    Kotlin  ${REQUIRED_TOOLCHAIN.kotlin}
-    Java    17
+${VERIFIED_TOOLCHAINS.map(
+  (v) =>
+    `    Gradle ${v.gradle}${v.agp ? `   AGP ${v.agp}` : ''}   Kotlin ${v.kotlin}   ` +
+    `(React Native ${v.reactNative}, ${v.date})`
+).join('\n')}
 
-Matching it exactly is the tested path. If your app cannot move, the alternative is
-pinning an older MAM SDK whose row you do match — see sdk-versions.json.`,
+  Anything else is untested rather than broken. If a build fails inside the MAM plugin
+  with an error naming one of your classes, move to one of these first.`,
   },
 ];
 
@@ -465,7 +637,7 @@ pinning an older MAM SDK whose row you do match — see sdk-versions.json.`,
 
 /**
  * The lowest iOS the vendored MAM SDK runs on. Read from the binary (`otool -l` on
- * IntuneMAMSwift.framework in the 21.8.0 drop reports `minos 17.0`), not from
+ * IntuneMAMSwift.framework reports `minos 17.0` in both 21.8.0 and 21.9.0), not from
  * Microsoft's release notes — the SDK should move this, not a guess.
  */
 const MIN_IOS = [17, 0];
@@ -527,6 +699,26 @@ function appDeploymentTargets(pbxproj) {
 /** Ruby comments — whole-line or trailing — so a commented-out platform line is ignored. */
 const stripRubyComments = (src) => src.replace(/(^|\s)#.*$/gm, '$1');
 
+/**
+ * The Run Script phase setup adds. It fails the build when the tool is missing rather
+ * than skipping it, because a skipped run leaves a plist without the schemes the SDK
+ * needs, and that fails at sign-in with an empty log instead of here with a reason.
+ */
+const CONFIGURATOR_SCRIPT = `# ${MARKER}: Microsoft's IntuneMAMConfigurator, run on this app's Info.plist and
+# entitlements. A build phase rather than a manual step, because what it writes is not a
+# fixed list and changes between SDK versions. It is idempotent.
+set -euo pipefail
+
+CONFIGURATOR="$SRCROOT/../node_modules/react-native-intune/vendor/ios/IntuneMAMConfigurator"
+
+if [ ! -x "$CONFIGURATOR" ]; then
+  echo "error: IntuneMAMConfigurator is missing — run: node node_modules/react-native-intune/scripts/fetch-sdks.mjs"
+  exit 1
+fi
+
+"$CONFIGURATOR" -i "$SRCROOT/$INFOPLIST_FILE" -e "$SRCROOT/$CODE_SIGN_ENTITLEMENTS"
+`;
+
 const iosChecks = [
   {
     id: 'ios-deployment-target',
@@ -616,6 +808,29 @@ const iosChecks = [
   (IPHONEOS_DEPLOYMENT_TARGET), then run pod install again.
 
   Expo: set it with expo-build-properties — { "ios": { "deploymentTarget": "17.0" } }.`,
+    /**
+     * The Podfile and the app target together — raising one without the other is the case
+     * this check exists to catch. An Expo Podfile is left alone: prebuild regenerates it,
+     * and the value belongs in expo-build-properties.
+     */
+    apply(project) {
+      const podfile = project.ios.podfile;
+      const src = read(podfile);
+      const line = src.match(/^(\s*platform\s+:ios\s*,\s*)(.+)$/m);
+      if (!line || /ios\.deploymentTarget/.test(line[2])) {
+        return null;
+      }
+      const version = MIN_IOS.join('.');
+      const edits = [{ file: podfile, contents: src.replace(line[0], `${line[1]}'${version}'`) }];
+      const pbxproj = read(project.ios.pbxproj);
+      const next =
+        pbxproj &&
+        pbxprojSetDeploymentTarget(pbxproj, version, (v) => versionAtLeast(v, MIN_IOS));
+      if (next) {
+        edits.push({ file: project.ios.pbxproj, contents: next });
+      }
+      return edits;
+    },
   },
 
   {
@@ -679,6 +894,40 @@ ${KEYCHAIN_GROUPS.map((g) => `        <string>${g}</string>`).join('\n')}
   The app's own group first, then the SDK's, then MSAL's cache. The first entry may be
   written as the literal bundle id or as $(PRODUCT_BUNDLE_IDENTIFIER) — both work.`;
     },
+    /**
+     * React Native's template has no entitlements file, so this usually creates one and
+     * points the app target at it. An app target that already names a differently-called
+     * entitlements file is left to be edited by hand: creating a second file it never
+     * reads would look fixed and change nothing.
+     */
+    apply(project) {
+      const ios = project.ios;
+      const pbxproj = read(ios.pbxproj);
+      if (!ios.appName || !pbxproj) {
+        return null;
+      }
+      if (!ios.entitlements && /CODE_SIGN_ENTITLEMENTS\s*=/.test(pbxproj)) {
+        return null;
+      }
+      const file =
+        ios.entitlements ?? path.join(ios.dir, ios.appName, `${ios.appName}.entitlements`);
+      const contents = entitlementsWithKeychainGroups(read(file), [
+        '$(AppIdentifierPrefix)$(PRODUCT_BUNDLE_IDENTIFIER)',
+        ...KEYCHAIN_GROUPS,
+      ]);
+      if (!contents) {
+        return null;
+      }
+      const edits = [{ file, contents }];
+      const next = pbxprojSetEntitlements(
+        pbxproj,
+        `${ios.appName}/${ios.appName}.entitlements`
+      );
+      if (next) {
+        edits.push({ file: ios.pbxproj, contents: next });
+      }
+      return edits;
+    },
   },
 
   {
@@ -713,6 +962,12 @@ ${KEYCHAIN_GROUPS.map((g) => `        <string>${g}</string>`).join('\n')}
         </array>
       </dict>
     </array>`,
+    apply(project) {
+      const file = project.ios.infoPlist;
+      const src = read(file);
+      const contents = src && plistEnsureUrlScheme(src, 'msauth.$(PRODUCT_BUNDLE_IDENTIFIER)');
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -742,6 +997,13 @@ ${KEYCHAIN_GROUPS.map((g) => `        <string>${g}</string>`).join('\n')}
 ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
         <string>companyportal</string>
     </array>`,
+    apply(project) {
+      const file = project.ios.infoPlist;
+      const src = read(file);
+      const contents =
+        src && plistEnsureStrings(src, 'LSApplicationQueriesSchemes', MSAL_QUERY_SCHEMES);
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -772,6 +1034,16 @@ ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
 
   Note: ADALCacheKeychainGroupOverride is a different key and is NOT removed — it has
   no runtime equivalent and is the only way to set the keychain group.`,
+    apply(project) {
+      const file = project.ios.infoPlist;
+      const src = read(file);
+      return src
+        ? {
+            file,
+            contents: plistRemoveKeys(src, ['ADALClientId', 'ADALAuthority', 'ADALRedirectUri']),
+          }
+        : null;
+    },
   },
 
   {
@@ -804,6 +1076,18 @@ ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
     }
 
   Code in your own AppDelegate, so setup reports it rather than editing it.`,
+    /** The Expo plugin's transform, which adds the method when a template has none. */
+    apply(project) {
+      const file = project.ios.appDelegate;
+      if (!file) {
+        return null;
+      }
+      const contents = transforms.withMsalResponseHandler(
+        read(file),
+        file.endsWith('.swift') ? 'swift' : 'objcpp'
+      );
+      return contents ? { file, contents } : null;
+    },
   },
 
   {
@@ -862,8 +1146,14 @@ ${MSAL_QUERY_SCHEMES.map((s) => `        <string>${s}</string>`).join('\n')}
       -i "$SRCROOT/$INFOPLIST_FILE" \\
       -e "$SRCROOT/${'$'}{CODE_SIGN_ENTITLEMENTS}"
 
-  Not wrapped by setup: it is Microsoft's tool, and wrapping it means owning what it
-  does. The line above is what to paste.`,
+  setup adds it for you. It runs Microsoft's tool as it is — setup writes the phase,
+  not a wrapper around what the tool does.`,
+    apply(project) {
+      const file = project.ios.pbxproj;
+      const src = read(file);
+      const contents = src && pbxprojAddConfiguratorPhase(src, CONFIGURATOR_SCRIPT);
+      return contents ? { file, contents } : null;
+    },
   },
 ];
 
@@ -940,16 +1230,27 @@ export function signatureHash(project) {
  * there is one copy. Duplicating it here is how the two drift and the check starts
  * reporting a row nobody targets.
  */
-const REQUIRED_TOOLCHAIN = (() => {
+const TOOLCHAIN = (() => {
   try {
     const url = new URL('../../sdk-versions.json', import.meta.url);
-    const { toolchain } = JSON.parse(fs.readFileSync(url, 'utf8'));
-    const { requires } = toolchain;
-    return { gradle: requires.gradle, agp: requires.agp, kotlin: requires.kotlin };
+    return JSON.parse(fs.readFileSync(url, 'utf8')).toolchain ?? {};
   } catch {
     return {};
   }
 })();
+const REQUIRED_TOOLCHAIN = TOOLCHAIN.requires
+  ? {
+      gradle: TOOLCHAIN.requires.gradle,
+      agp: TOOLCHAIN.requires.agp,
+      kotlin: TOOLCHAIN.requires.kotlin,
+    }
+  : {};
+
+/**
+ * Combinations this project has built and run itself, off Microsoft's row — see the
+ * comment in sdk-versions.json for what qualifies one.
+ */
+const VERIFIED_TOOLCHAINS = TOOLCHAIN.verified ?? [];
 
 function firstMatch(src, re) {
   const m = src.match(re);