react-native-intune 0.1.2 → 1.0.0-rc.1

package/sdk-versions.json

@@ -8,20 +8,56 @@
     "iOS 21.x requires iOS 17+ and Xcode 26. If a consumer must support iOS 16, they need",
     "SDK 20.x, which Microsoft supports for high-priority security fixes only. See SPEC.md."
   ],
-
   "ios": {
     "repo": "microsoftconnect/ms-intune-app-sdk-ios",
-    "tag": "21.8.0",
-    "requires": { "ios": "17.0", "xcode": "26" },
+    "tag": "21.9.0",
+    "requires": {
+      "ios": "17.0",
+      "xcode": "26"
+    },
     "expect": [
-      { "glob": "IntuneMAMSwift.xcframework",     "as": "ios/IntuneMAMSwift.xcframework",     "required": true },
-      { "glob": "IntuneMAMSwiftStub.xcframework", "as": "ios/IntuneMAMSwiftStub.xcframework", "required": true },
-      { "glob": "IntuneMAMTelemetry.xcframework", "as": "ios/IntuneMAMTelemetry.xcframework", "required": true },
-      { "glob": "IntuneMAMResources.bundle",      "as": "ios/IntuneMAMResources.bundle",      "required": true },
-      { "glob": "IntuneMAMConfigurator.dmg",      "as": "ios/IntuneMAMConfigurator.dmg",      "required": true, "extractDmg": "IntuneMAMConfigurator", "extractAs": "ios/IntuneMAMConfigurator" },
-      { "glob": "REDIST.txt",                     "as": "ios/REDIST.txt",                     "required": false },
-      { "glob": "Microsoft License Terms*.pdf",   "as": "ios/",                               "required": false },
-      { "glob": "ThirdPartyNotices.txt",          "as": "ios/ThirdPartyNotices.txt",          "required": false }
+      {
+        "glob": "IntuneMAMSwift.xcframework",
+        "as": "ios/IntuneMAMSwift.xcframework",
+        "required": true
+      },
+      {
+        "glob": "IntuneMAMSwiftStub.xcframework",
+        "as": "ios/IntuneMAMSwiftStub.xcframework",
+        "required": true
+      },
+      {
+        "glob": "IntuneMAMTelemetry.xcframework",
+        "as": "ios/IntuneMAMTelemetry.xcframework",
+        "required": true
+      },
+      {
+        "glob": "IntuneMAMResources.bundle",
+        "as": "ios/IntuneMAMResources.bundle",
+        "required": true
+      },
+      {
+        "glob": "IntuneMAMConfigurator.dmg",
+        "as": "ios/IntuneMAMConfigurator.dmg",
+        "required": true,
+        "extractDmg": "IntuneMAMConfigurator",
+        "extractAs": "ios/IntuneMAMConfigurator"
+      },
+      {
+        "glob": "REDIST.txt",
+        "as": "ios/REDIST.txt",
+        "required": false
+      },
+      {
+        "glob": "Microsoft License Terms*.pdf",
+        "as": "ios/",
+        "required": false
+      },
+      {
+        "glob": "ThirdPartyNotices.txt",
+        "as": "ios/ThirdPartyNotices.txt",
+        "required": false
+      }
     ],
     "_notes": [
       "IntuneMAMStatic.xcframework is the static variant — not used; the dynamic one keeps",
@@ -31,40 +67,101 @@
       "compliance) and 28 localizations. Without it the SDK's UI cannot render."
     ]
   },
-
   "android": {
     "repo": "microsoftconnect/ms-intune-app-sdk-android",
     "tag": "12.4.0",
     "expect": [
-      { "glob": "**/Microsoft.Intune.MAM.SDK.aar",         "as": "android/Microsoft.Intune.MAM.SDK.aar",                    "required": true },
-      { "glob": "**/com.microsoft.intune.mam.build.jar",   "as": "android/GradlePlugin/com.microsoft.intune.mam.build.jar", "required": true },
-      { "glob": "**/Microsoft.Intune.MAM.SDK.Support*.jar","as": "android/support/",                                        "required": false },
-      { "glob": "**/*License*.pdf",                        "as": "android/",                                                "required": false }
+      {
+        "glob": "**/Microsoft.Intune.MAM.SDK.aar",
+        "as": "android/Microsoft.Intune.MAM.SDK.aar",
+        "required": true
+      },
+      {
+        "glob": "**/com.microsoft.intune.mam.build.jar",
+        "as": "android/GradlePlugin/com.microsoft.intune.mam.build.jar",
+        "required": true
+      },
+      {
+        "glob": "**/Microsoft.Intune.MAM.SDK.Support*.jar",
+        "as": "android/support/",
+        "required": false
+      },
+      {
+        "glob": "**/*License*.pdf",
+        "as": "android/",
+        "required": false
+      }
     ]
   },
-
   "toolchain": {
     "_comment": [
       "A version bump forces a conscious check against the MAM compatibility matrix and the",
       "host app's toolchain (SPEC.md O-E).",
       "",
       "msal_android has no requirement from Microsoft to satisfy. The Android SDK guide says",
-    "only \"integrate MSAL\" and links the MSAL repository, unlike iOS where the coupling is",
-    "hard. So this is our choice, pinned for reproducibility rather than compatibility:",
-    "8.4.2, the current stable, released 2026-08-21.",
-    "",
-    "msal_ios is exact, not a range: the Intune SDK does not carry its own MSAL, it drives",
+      "only \"integrate MSAL\" and links the MSAL repository, unlike iOS where the coupling is",
+      "hard. So this is our choice, pinned for reproducibility rather than compatibility:",
+      "8.5.0, released 2026-09-16 with a fix for CVE-2026-54399 in Apache HttpCore.",
+      "",
+      "msal_ios is exact, not a range: the Intune SDK does not carry its own MSAL, it drives",
       "the app's. Two consumers on different MSALs is the same hazard pinning the Intune SDK",
       "exists to prevent. Resolved by CocoaPods on 2026-09-04, not guessed.",
       "",
       "`requires` is the compatibility-matrix row for the pinned Android tag above (12.4.0 ->",
-      "the 12.0.0 row). Microsoft tests these combinations; mixing rows is untested. These are",
-      "the library's own defaults in android/build.gradle. The consumer's app module, where the",
-      "MAM Gradle plugin actually runs, must land on the same row -- that is O-E, still open."
+      "the 12.0.0 row). Microsoft tests these combinations; mixing rows is untested by Microsoft.",
+      "",
+      "`verified` is what this project has built and run itself, off that row: a fresh app,",
+      "debug and release, with the MAM plugin's report confirming the Application rewrite. It",
+      "is not Microsoft's claim and doctor says so. Only versions read from an actual build",
+      "log are listed -- an entry missing agp means the build file did not state it, not that",
+      "any AGP works. Add a row by running verify:bare or verify:expo, never by reasoning."
     ],
     "javassist": "3.29.2-GA",
-    "msal_ios": "2.15.0",
-    "msal_android": "8.4.2",
-    "requires": { "android": "16", "gradle": "8.11.1", "agp": "8.9.1", "kotlin": "2.1.21", "java": "17" }
+    "msal_ios": "2.16.0",
+    "msal_android": "8.5.0",
+    "requires": {
+      "android": "16",
+      "gradle": "8.11.1",
+      "agp": "8.9.1",
+      "kotlin": "2.1.21",
+      "java": "17"
+    },
+    "verified": [
+      {
+        "reactNative": "0.74.7",
+        "gradle": "8.6",
+        "kotlin": "1.9.22",
+        "java": "17",
+        "date": "2026-09-30",
+        "ran": "verify:bare --rn 0.74.7 --platform android: debug and release, rewrite confirmed"
+      },
+      {
+        "reactNative": "0.85.0",
+        "gradle": "9.3.1",
+        "kotlin": "2.1.20",
+        "agp": "8.12.0",
+        "java": "17",
+        "date": "2026-09-30",
+        "ran": "example app: root assembleDebug, assembleRelease with R8, rewrite confirmed; enrollment on a Pixel 6"
+      },
+      {
+        "reactNative": "0.86.3 (Expo SDK 57)",
+        "gradle": "9.3.1",
+        "kotlin": "2.1.20",
+        "agp": "8.12.0",
+        "java": "17",
+        "date": "2026-09-30",
+        "ran": "verify:expo --device: debug and release, rewrite confirmed; enrollment on a Pixel 6 through Company Portal"
+      },
+      {
+        "reactNative": "0.87.1",
+        "gradle": "9.4.1",
+        "kotlin": "2.2.0",
+        "agp": "9.2.1",
+        "java": "17",
+        "date": "2026-09-30",
+        "ran": "verify:bare: debug and release, rewrite confirmed"
+      }
+    ]
   }
 }

package/src/api/tokenProvider.ts

@@ -20,6 +20,9 @@ let tokenProvider: TokenProvider | null = null;
  * Registers the provider for `authMode: 'external'`. Return `null` from it to say
  * "cannot get a token right now" — the SDK treats that as needing authorization rather
  * than as a hard failure.
+ *
+ * @internal Outside the contract in 1.x: `external` is kept working but has not been run
+ * on a device against a tenant. Planned for 2.0 — see `AuthMode`.
  */
 export function setTokenProvider(provider: TokenProvider | null): void {
   tokenProvider = provider;

package/src/index.ts

@@ -115,6 +115,7 @@ const Intune = {
   setResetHandler,
   getPolicy,
   getDiagnostics,
+  /** @internal Outside the contract in 1.x — see `AuthMode`. */
   setTokenProvider,
   onEnrollmentResult,
   onUnenrollmentResult,

package/src/internal/decode.ts

@@ -97,19 +97,38 @@ const RESET_STAGES = new Set<string>(Object.values(ResetStage));
 
 const RESET_REASONS = new Set<string>([
   'logout',
-  'tenant_changed',
-  'intune_disabled',
-  'remote_wipe',
-  'account_switch',
-  'support_reset',
+  'tenantChanged',
+  'intuneDisabled',
+  'remoteWipe',
+  'accountSwitch',
+  'supportReset',
   'resume',
 ]);
 
+/**
+ * The spellings before 1.0. The journal is persisted on the device, so an app updated
+ * while a reset is unfinished — the process killed mid-reset, or a service wipe waiting
+ * for the next launch — reads a reason an older version wrote. Dropping it to null would
+ * lose exactly the case the reason exists for: telling the user their administrator
+ * removed access.
+ */
+const LEGACY_RESET_REASONS: Record<string, ResetReason> = {
+  tenant_changed: 'tenantChanged',
+  intune_disabled: 'intuneDisabled',
+  remote_wipe: 'remoteWipe',
+  account_switch: 'accountSwitch',
+  support_reset: 'supportReset',
+};
+
 /** Null rather than a guess: an unrecognised reason is not worth acting on. */
 export function toResetReason(value: unknown): ResetReason | null {
-  return typeof value === 'string' && RESET_REASONS.has(value)
-    ? (value as ResetReason)
-    : null;
+  if (typeof value !== 'string') {
+    return null;
+  }
+  if (RESET_REASONS.has(value)) {
+    return value as ResetReason;
+  }
+  return LEGACY_RESET_REASONS[value] ?? null;
 }
 
 export function toResetStage(value: unknown): ResetStage | null {

package/src/types.ts

@@ -18,6 +18,10 @@
  *
  * The blocking distinction in SPEC §8 is load-bearing and easy to get backwards:
  * `NotLicensed` and `NotTargeted` must NOT block the user, `Failed` must.
+ *
+ * Gains members in minor versions, as Microsoft's SDKs add statuses — give a `switch`
+ * over it a `default`, and treat what lands there as not blocking. See
+ * [Versioning](https://bayazetyan.github.io/react-native-intune/docs/versioning).
  */
 export enum EnrollmentStatus {
   Succeeded = 'succeeded',
@@ -61,20 +65,33 @@ export enum FileProtectionLevel {
   None = 'none',
 }
 
-/** Why a reset was started. Recorded in the journal and surfaced in `getDiagnostics`. */
+/**
+ * Why a reset was started. Recorded in the journal and surfaced in `getDiagnostics`.
+ *
+ * camelCase, like every other string value in this API. Before 1.0 these were
+ * snake_case (`remote_wipe`); a journal written by an older version is still read, and
+ * its reason reported in the new spelling.
+ *
+ * Gains members in minor versions — give a `switch` over it a `default`.
+ */
 export type ResetReason =
   | 'logout'
-  | 'tenant_changed'
-  | 'intune_disabled'
-  | 'remote_wipe'
-  | 'account_switch'
-  | 'support_reset'
+  | 'tenantChanged'
+  | 'intuneDisabled'
+  | 'remoteWipe'
+  | 'accountSwitch'
+  | 'supportReset'
   | 'resume';
 
 /**
- * Who owns MSAL. `builtin` is the module (SPEC §3.1) and the default. `external` is for
- * apps that already have their own MSAL and supply MAM tokens via `setTokenProvider`;
- * it is a supported mode, not a documentation fallback.
+ * Who owns MSAL. `'builtin'` — the module — is the default and the only mode supported
+ * in 1.x.
+ *
+ * `'external'` is for apps that already have their own MSAL and answer the SDK's token
+ * requests themselves.
+ * **Not supported in 1.x.** `authMode: 'external'` is kept working in the code, but it has
+ * not been run on a device against a tenant, so it is undocumented and outside the semver
+ * contract — it may change in any release. It is planned for 2.0.
  */
 export type AuthMode = 'builtin' | 'external';
 
@@ -89,7 +106,7 @@ export type IntuneConfig = {
   authority: string;
   /** Must match the platform format — see the README. */
   redirectUri: string;
-  /** Default `'builtin'`. */
+  /** Default `'builtin'`, and the only value supported in 1.x. */
   authMode?: AuthMode;
   /** Default `false`. */
   verboseLogging?: boolean;
@@ -168,7 +185,10 @@ export type EnrollParams = {
   /** Entra object ID. Never a UPN — that is what `upn` below is for. */
   accountId: string;
   /**
-   * **Android, `authMode: 'external'` only.** `registerAccountForMAM` takes the UPN as
+   * @internal
+   *
+   * **Android, `authMode: 'external'` only** — outside the contract in 1.x, see `AuthMode`.
+   * `registerAccountForMAM` takes the UPN as
    * well as the object ID and will not accept null for it, and in `external` mode the
    * module has no MSAL cache to resolve one from.
    *
@@ -208,9 +228,19 @@ export type BrokerStatus = {
 export type EnrollmentResult = {
   status: EnrollmentStatus;
   accountId: string | null;
-  /** Raw platform constant *name*, e.g. `LicensedNotTargeted`. For support bundles. */
+  /**
+   * Raw platform constant *name*, e.g. `LicensedNotTargeted`. For support bundles.
+   *
+   * **Outside the semver contract.** It is the SDK's own name and changes when
+   * Microsoft's SDK does — log it, do not branch on it. Branch on `status`. See
+   * [Versioning](https://bayazetyan.github.io/react-native-intune/docs/versioning).
+   */
   nativeCode: string;
-  /** SDK debug string. Safe to log — contains no token. */
+  /**
+   * SDK debug string. Safe to log — contains no token.
+   *
+   * **Outside the semver contract**, like `nativeCode`.
+   */
   nativeMessage: string;
   restartRequired: boolean;
 };
@@ -224,6 +254,11 @@ export type EnrollmentResult = {
 export type IntuneState = {
   configured: boolean;
   configuredTenantId: string | null;
+  /**
+   * What the SDK reports as registered. An array because that is the SDK's shape; with
+   * one identity per installation it holds zero or one account in practice, and more
+   * than one means an earlier registration was left behind.
+   */
   registeredAccountIds: string[];
   enrolledAccountId: string | null;
   /** `null` means no account is registered. */
@@ -283,12 +318,21 @@ export type PolicySnapshot = {
   raw: Record<string, string>;
 };
 
-/** Opaque key/value for support bundles. Contains no tokens and no UPNs. */
+/**
+ * Opaque key/value for support bundles. Contains no tokens and no UPNs.
+ *
+ * **Outside the semver contract**: the keys follow whatever is useful to diagnose and
+ * may change in any release. See [Versioning](https://bayazetyan.github.io/react-native-intune/docs/versioning).
+ */
 export type Diagnostics = Record<string, string>;
 
 // ---------------------------------------------------------------- events
 
-/** Payload of a native-initiated MAM service token request. See SPEC §13.4. */
+/**
+ * Payload of a native-initiated MAM service token request, for `authMode: 'external'`.
+ *
+ * @internal Outside the contract in 1.x — see `AuthMode`.
+ */
 export type TokenRequest = {
   resourceId: string;
   tenantId: string;
@@ -299,6 +343,8 @@ export type TokenRequest = {
 /**
  * Return the access token, or `null` to signal "cannot get a token right now". Runs on a
  * background thread's behalf, and the SDK may ask with no JS call in flight.
+ *
+ * @internal Outside the contract in 1.x — see `AuthMode`.
  */
 export type TokenProvider = (
   request: TokenRequest
@@ -335,6 +381,7 @@ export type IntuneEvents = {
   unenrollmentResult: EnrollmentResult;
   wipeRequested: WipeRequest;
   restartRequired: RestartRequest;
+  /** @internal The `external` token bridge — outside the contract in 1.x. */
   tokenRequest: TokenRequest & { requestId: string };
   brokerStatusChanged: BrokerStatus;
 };
@@ -347,6 +394,9 @@ export type IntuneEvents = {
  *
  * `E_NATIVE` appearing in logs is a signal to extend the native mapping table, not an
  * acceptable steady state.
+ *
+ * Gains members in minor versions — give a `switch` over it a `default`. See
+ * [Versioning](https://bayazetyan.github.io/react-native-intune/docs/versioning).
  */
 export type IntuneErrorCode =
   | 'E_NOT_CONFIGURED'
@@ -354,6 +404,7 @@ export type IntuneErrorCode =
   | 'E_SDK_UNAVAILABLE'
   | 'E_BROKER_MISSING'
   | 'E_INVALID_ACCOUNT_ID'
+  // The next three are reached only with authMode 'external', outside the contract in 1.x.
   | 'E_TOKEN_PROVIDER_FAILED'
   | 'E_TOKEN_PROVIDER_MISSING'
   | 'E_EXTERNAL_AUTH_MODE'