@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/lib/commonjs/provider/SessionDetailsGesture.js

@@ -0,0 +1,216 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.SessionDetailsGesture = SessionDetailsGesture;
+var _react = _interopRequireWildcard(require("react"));
+var _reactNative = require("react-native");
+var Clipboard = _interopRequireWildcard(require("expo-clipboard"));
+var _reactNativeGestureHandler = require("react-native-gesture-handler");
+var _index = require("../telemetry/index.js");
+var _jsxRuntime = require("react/jsx-runtime");
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+const SWIPE_DISTANCE = 80;
+function SessionDetailsGesture({
+  enabled,
+  appName,
+  appId,
+  environmentId,
+  region,
+  appVersion,
+  children
+}) {
+  const [visible, setVisible] = (0, _react.useState)(false);
+  const [sessionId, setSessionId] = (0, _react.useState)();
+  const [copied, setCopied] = (0, _react.useState)(false);
+  const showSessionDetails = (0, _react.useCallback)(() => {
+    setSessionId((0, _index.getAppLogger)().sessionId);
+    setCopied(false);
+    setVisible(true);
+  }, []);
+  const gesture = (0, _react.useMemo)(() => _reactNativeGestureHandler.Gesture.Pan().enabled(enabled && _reactNative.Platform.OS !== 'web').minPointers(3).maxPointers(3).runOnJS(true).onEnd(({
+    translationX,
+    translationY
+  }) => {
+    if (translationY >= SWIPE_DISTANCE && translationY > Math.abs(translationX)) {
+      showSessionDetails();
+    }
+  }), [enabled, showSessionDetails]);
+  const close = (0, _react.useCallback)(() => setVisible(false), []);
+  const copySessionId = (0, _react.useCallback)(async () => {
+    if (!sessionId) return;
+    await Clipboard.setStringAsync(sessionId);
+    setCopied(true);
+  }, [sessionId]);
+  return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_jsxRuntime.Fragment, {
+    children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNativeGestureHandler.GestureDetector, {
+      gesture: gesture,
+      children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.View, {
+        style: styles.content,
+        children: children
+      })
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Modal, {
+      animationType: "fade",
+      onRequestClose: close,
+      transparent: true,
+      visible: visible,
+      children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Pressable, {
+        accessibilityRole: "button",
+        accessibilityLabel: "Close session details",
+        onPress: close,
+        style: styles.backdrop,
+        children: /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.Pressable, {
+          accessible: false,
+          onPress: event => event.stopPropagation(),
+          style: styles.panel,
+          children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+            style: styles.title,
+            children: "Session details"
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(SessionDetail, {
+            label: "Telemetry session ID",
+            value: sessionId ?? 'Not available',
+            selectable: true,
+            singleLine: true
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Pressable, {
+            accessibilityRole: "button",
+            disabled: !sessionId,
+            onPress: () => {
+              void copySessionId();
+            },
+            style: ({
+              pressed
+            }) => [styles.copyButton, !sessionId && styles.disabledButton, pressed && styles.pressedButton],
+            children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+              style: styles.copyButtonText,
+              children: copied ? 'Copied' : 'Copy session ID'
+            })
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(SessionDetail, {
+            label: "App",
+            value: appName
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(SessionDetail, {
+            label: "App ID",
+            value: appId ?? 'Not available',
+            selectable: true
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(SessionDetail, {
+            label: "Environment ID",
+            value: environmentId ?? 'Not available',
+            selectable: true
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(SessionDetail, {
+            label: "Region",
+            value: region
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(SessionDetail, {
+            label: "App version",
+            value: appVersion ?? 'Not available'
+          }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Pressable, {
+            accessibilityRole: "button",
+            onPress: close,
+            style: styles.closeButton,
+            children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+              style: styles.closeButtonText,
+              children: "Close"
+            })
+          })]
+        })
+      })
+    })]
+  });
+}
+function SessionDetail({
+  label,
+  value,
+  selectable = false,
+  singleLine = false
+}) {
+  return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
+    style: styles.row,
+    children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+      style: styles.label,
+      children: label
+    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+      adjustsFontSizeToFit: singleLine,
+      minimumFontScale: 0.85,
+      numberOfLines: singleLine ? 1 : undefined,
+      selectable: selectable,
+      style: styles.value,
+      children: value
+    })]
+  });
+}
+const styles = _reactNative.StyleSheet.create({
+  content: {
+    flex: 1
+  },
+  backdrop: {
+    alignItems: 'center',
+    backgroundColor: 'rgba(0, 0, 0, 0.48)',
+    flex: 1,
+    justifyContent: 'center',
+    paddingHorizontal: 12,
+    paddingVertical: 24
+  },
+  panel: {
+    backgroundColor: '#FFFFFF',
+    borderRadius: 8,
+    maxWidth: 520,
+    paddingHorizontal: 16,
+    paddingVertical: 24,
+    width: '100%'
+  },
+  title: {
+    color: '#242424',
+    fontSize: 20,
+    fontWeight: '700',
+    marginBottom: 20
+  },
+  row: {
+    marginBottom: 14
+  },
+  label: {
+    color: '#616161',
+    fontSize: 12,
+    fontWeight: '600',
+    marginBottom: 3
+  },
+  value: {
+    color: '#242424',
+    fontSize: 15,
+    lineHeight: 21
+  },
+  copyButton: {
+    alignSelf: 'flex-start',
+    borderColor: '#0F6CBD',
+    borderRadius: 4,
+    borderWidth: 1,
+    marginBottom: 14,
+    marginTop: -4,
+    paddingHorizontal: 12,
+    paddingVertical: 7
+  },
+  copyButtonText: {
+    color: '#0F6CBD',
+    fontSize: 13,
+    fontWeight: '600'
+  },
+  disabledButton: {
+    opacity: 0.45
+  },
+  pressedButton: {
+    opacity: 0.7
+  },
+  closeButton: {
+    alignItems: 'center',
+    alignSelf: 'flex-end',
+    backgroundColor: '#0F6CBD',
+    borderRadius: 4,
+    marginTop: 8,
+    minWidth: 88,
+    paddingHorizontal: 18,
+    paddingVertical: 10
+  },
+  closeButtonText: {
+    color: '#FFFFFF',
+    fontSize: 14,
+    fontWeight: '600'
+  }
+});

package/lib/commonjs/telemetry/OfflineSdkTelemetry.js

@@ -0,0 +1,95 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.configureOfflineSdkTelemetry = configureOfflineSdkTelemetry;
+var _powerAppsNativeCommon = require("@microsoft/power-apps-native-common");
+var OfflineSdk = _interopRequireWildcard(require("@microsoft/power-apps-native-offline"));
+function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
+/**
+ * Operation names for this adapter's own diagnostics, following the
+ * `PowerAppsHost.<Subsystem>.<Action>` convention used by `HostOperationNames`.
+ *
+ * Declared locally rather than imported from `./index`: this module must stay
+ * fail-open and side-effect free, and the barrel constructs HTTP clients at
+ * import time. Two string constants are not worth that dependency.
+ */
+const OfflineTelemetryBindFailed = 'PowerAppsHost.Offline.TelemetryBind.Failed';
+const OfflineTelemetryUnbindFailed = 'PowerAppsHost.Offline.TelemetryUnbind.Failed';
+
+/**
+ * Non-sensitive error discriminator. Records the error's constructor name only,
+ * never its message, so diagnostics cannot leak user or tenant data.
+ */
+function getSafeErrorName(error) {
+  return error instanceof Error ? error.constructor.name : typeof error;
+}
+
+/**
+ * True when the resolved SDK exposes the v1 host-telemetry transport.
+ *
+ * Reading a missing export yields `undefined` rather than throwing, so this
+ * probe is safe on SDK builds that predate the transport. Keeping it separate
+ * from the `try`/`catch` below is what lets an out-of-range SDK stay a silent,
+ * expected no-op while genuine wiring failures still get reported.
+ *
+ * The version equality matters as much as the `typeof`: a future transport
+ * revision with a different sink shape would accept a v1 sink and silently
+ * malform every event rather than throw.
+ */
+function isTransportSupported() {
+  return typeof OfflineSdk.configureOfflineHostTelemetry === 'function' && OfflineSdk.OFFLINE_HOST_TELEMETRY_TRANSPORT_VERSION === 1;
+}
+
+/**
+ * Forwards the privacy-safe Offline SDK transport through the host's existing
+ * app logger so offline events carry the same session, device, and user data.
+ *
+ * The host owns exactly one thing here: binding the SDK transport to this
+ * host's logger. Buffering and teardown semantics live in the SDK.
+ *
+ * Setup and teardown are fail-open but not silent. This runs from an effect in
+ * the provider that roots the app, so an unguarded throw would take down the
+ * whole tree — telemetry is never worth an app that will not start. An
+ * unexpected failure is therefore downgraded to a logged diagnostic rather than
+ * swallowed, so broken wiring stays observable.
+ */
+function configureOfflineSdkTelemetry(forwardEvents) {
+  if (!isTransportSupported()) {
+    return () => undefined;
+  }
+  const stopForwarding = () => {
+    try {
+      OfflineSdk.configureOfflineHostTelemetry(undefined);
+    } catch (e) {
+      (0, _powerAppsNativeCommon.getAppLogger)().trackErrorEvent(OfflineTelemetryUnbindFailed, {
+        errorName: getSafeErrorName(e)
+      });
+    }
+  };
+  if (!forwardEvents) {
+    stopForwarding();
+    return stopForwarding;
+  }
+  try {
+    OfflineSdk.configureOfflineHostTelemetry({
+      // Resolved per event, not captured: the Dev Player swaps the logger when
+      // it switches apps, and a captured instance would strand events.
+      //
+      // `name` is the operation name only. Deliberately not passed as the
+      // optional third `eventName` argument: that overrides the canonical
+      // `PowerAppsClient.Activity`/`.Error` 1DS event names, which would hide
+      // every offline event from the queries and dashboards that filter on
+      // them. The name already reaches 1DS as `operation_Name`.
+      trackActivityEvent: (name, properties) => (0, _powerAppsNativeCommon.getAppLogger)().trackActivityEvent(name, properties),
+      trackErrorEvent: (name, properties) => (0, _powerAppsNativeCommon.getAppLogger)().trackErrorEvent(name, properties)
+    });
+  } catch (e) {
+    (0, _powerAppsNativeCommon.getAppLogger)().trackErrorEvent(OfflineTelemetryBindFailed, {
+      errorName: getSafeErrorName(e)
+    });
+    return () => undefined;
+  }
+  return stopForwarding;
+}

package/lib/commonjs/telemetry/OfflineSdkTelemetry.web.js

@@ -0,0 +1,9 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.configureOfflineSdkTelemetry = configureOfflineSdkTelemetry;
+function configureOfflineSdkTelemetry(_forwardEvents) {
+  return () => undefined;
+}

package/lib/commonjs/telemetry/index.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.HostOperationNames = void 0;
+exports.bridgeHttpClient = exports.HostOperationNames = void 0;
 Object.defineProperty(exports, "configureAppLogger", {
   enumerable: true,
   get: function () {
@@ -16,6 +16,15 @@ Object.defineProperty(exports, "getAppLogger", {
     return _powerAppsNativeCommon.getAppLogger;
   }
 });
+Object.defineProperty(exports, "getCustomerTelemetryLogger", {
+  enumerable: true,
+  get: function () {
+    return _powerAppsNativeCommon.getCustomerTelemetryLogger;
+  }
+});
+exports.platformHttpClient = void 0;
+var _http = require("@microsoft/power-apps-native-common/http");
+var _logger = require("../logger.js");
 var _powerAppsNativeCommon = require("@microsoft/power-apps-native-common");
 /*!
  * Copyright (C) Microsoft Corporation. All rights reserved.
@@ -57,14 +66,24 @@ const HostOperationNames = exports.HostOperationNames = {
   /** Top-level React error boundary caught an unhandled JS error. */
   RuntimeUnhandledJsError: 'PowerAppsHost.Runtime.UnhandledJsError',
   // ── Platform APIs ─────────────────────────────────────────────────────────
+  /** Power Platform RP HTTP request, including backend correlation IDs. */
+  PlatformHttpRequest: 'PowerAppsHost.Platform.HttpRequest',
   /** Resolve Dataverse instanceUrl from Power Platform environment API. */
   PlatformFetchInstanceUrl: 'PowerAppsHost.Platform.FetchInstanceUrl',
   /** useConnectionRefs failed to resolve connections (recoverable). Recorded only on failure. */
   PlatformLoadConnectionsFailed: 'PowerAppsHost.Platform.LoadConnections.Failed',
   /** Create a new Power Platform connection. */
   PlatformCreateConnection: 'PowerAppsHost.Platform.CreateConnection',
+  /** Repair an existing Power Platform connection. */
+  PlatformRepairConnection: 'PowerAppsHost.Platform.RepairConnection',
+  /** Poll a connection until it becomes active. */
+  PlatformPollConnectionStatus: 'PowerAppsHost.Platform.PollConnectionStatus',
   /** Resolve app connection references for the current launch. */
   PlatformResolveConnectionRefs: 'PowerAppsHost.Platform.ResolveConnectionRefs',
   /** Grant this app access to a Power Platform connection ACL. */
-  PlatformConnectionAclGrant: 'PowerAppsHost.Platform.ConnectionAclGrant'
-};
+  PlatformConnectionAclGrant: 'PowerAppsHost.Platform.ConnectionAclGrant',
+  /** Installed Offline SDK predates the SDK-owned routing contract. */
+  OfflineRoutingContractUnsupported: 'PowerAppsHost.Offline.RoutingContract.Unsupported'
+};
+const bridgeHttpClient = exports.bridgeHttpClient = new _http.HttpClient(HostOperationNames.BridgeHttpRequest, _logger.isDebugLoggingEnabled);
+const platformHttpClient = exports.platformHttpClient = new _http.HttpClient(HostOperationNames.PlatformHttpRequest, _logger.isDebugLoggingEnabled);

package/lib/module/auth/AuthContext.js

@@ -31,10 +31,49 @@ const SIGN_IN_SCOPES = ['https://api.powerplatform.com/.default'];
 function getSafeErrorName(error) {
   return error instanceof Error ? error.constructor.name : typeof error;
 }
+function accountsMatch(left, right) {
+  return left.identifier === right.identifier && left.tenantId === right.tenantId;
+}
+async function validateRequiredScopes(pca, account, scopes) {
+  for (const scope of scopes) {
+    await pca.acquireTokenSilent({
+      scopes: [scope],
+      account
+    });
+  }
+}
+async function acquireRequiredScopesInteractively(pca, scopes) {
+  const [primaryScope, ...additionalScopes] = scopes;
+  const primaryResult = await pca.acquireToken({
+    scopes: [primaryScope],
+    prompt: 'select_account'
+  });
+  const signedInAccount = primaryResult.account;
+  for (const scope of additionalScopes) {
+    try {
+      await pca.acquireTokenSilent({
+        scopes: [scope],
+        account: signedInAccount
+      });
+    } catch {
+      const result = await pca.acquireToken({
+        scopes: [scope],
+        loginHint: signedInAccount.username,
+        prompt: 'login'
+      });
+      if (!accountsMatch(signedInAccount, result.account)) {
+        throw new Error('Sign in with the same account for all required Power Platform permissions.');
+      }
+    }
+  }
+  await validateRequiredScopes(pca, signedInAccount, scopes);
+  return signedInAccount;
+}
 const AuthContext = /*#__PURE__*/createContext(null);
 export function AuthProvider({
   msalConfig,
   intuneConfig,
+  requiredScopes = [],
   children
 }) {
   const [isAuthReady, setIsAuthReady] = useState(false);
@@ -99,6 +138,8 @@ export function AuthProvider({
   // Skip MSAL entirely; treat the session as already signed in so the app
   // renders without requiring credentials.
   const noAuthMode = !effectiveClientId;
+  const requiredScopeKey = [...new Set(requiredScopes)].join('|');
+  const effectiveRequiredScopes = requiredScopeKey ? requiredScopeKey.split('|') : SIGN_IN_SCOPES;
   const pcaRef = useRef(null);
   useEffect(() => {
     if (noAuthMode) {
@@ -124,8 +165,20 @@ export function AuthProvider({
       useBroker,
       platform: Platform.OS
     });
-    pca.init().then(() => pca.getAccounts()).then(accounts => {
-      const restoredAccount = accounts[0] ?? null;
+    pca.init().then(() => pca.getAccounts()).then(async accounts => {
+      let restoredAccount = accounts[0] ?? null;
+      if (restoredAccount) {
+        try {
+          await validateRequiredScopes(pca, restoredAccount, effectiveRequiredScopes);
+        } catch (tokenError) {
+          await pca.signOut({
+            account: restoredAccount
+          }).catch(() => undefined);
+          restoredAccount = null;
+          setError(new Error('Your session has expired. Sign in again to continue.'));
+          debugWarn('[AuthProvider] restored account is missing a required token:', tokenError);
+        }
+      }
       setAccount(restoredAccount);
       if (restoredAccount) {
         getAppLogger().identifyUser({
@@ -149,7 +202,7 @@ export function AuthProvider({
     });
     // Re-initialize only when the effective broker/identity settings change.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, useBroker]);
+  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, requiredScopeKey, useBroker]);
   const signIn = useCallback(async () => {
     const pca = pcaRef.current;
     if (!pca) return;
@@ -163,13 +216,11 @@ export function AuthProvider({
       if (!pca.isInitialized) {
         await pca.init();
       }
-      const result = await pca.acquireToken({
-        scopes: SIGN_IN_SCOPES
-      });
-      setAccount(result.account);
+      const signedInAccount = await acquireRequiredScopesInteractively(pca, effectiveRequiredScopes);
+      setAccount(signedInAccount);
       getAppLogger().identifyUser({
-        objectId: result.account.identifier,
-        tenantId: result.account.tenantId
+        objectId: signedInAccount.identifier,
+        tenantId: signedInAccount.tenantId
       });
       // Register the signed-in account with Intune MAM so the SDK can apply
       // app protection policies (PIN, wipe, copy-paste restriction, etc.).
@@ -178,9 +229,9 @@ export function AuthProvider({
       if (intuneEnabled) {
         try {
           await registerAndEnrollAccount({
-            upn: result.account.username,
-            aadId: result.account.identifier,
-            tenantId: result.account.tenantId
+            upn: signedInAccount.username,
+            aadId: signedInAccount.identifier,
+            tenantId: signedInAccount.tenantId
           });
           getAppLogger().trackActivityEvent(HostOperationNames.AuthIntuneEnroll);
         } catch (intuneErr) {
@@ -201,7 +252,7 @@ export function AuthProvider({
     } finally {
       setIsLoading(false);
     }
-  }, [intuneEnabled, useBroker]);
+  }, [intuneEnabled, requiredScopeKey, useBroker]);
   const acquireToken = useCallback(async scopes => {
     const pca = pcaRef.current;
     if (!pca || !account) return null;
@@ -212,18 +263,23 @@ export function AuthProvider({
       });
       return result.accessToken;
     } catch (e) {
-      // Silent acquisition failed — do NOT fall back to interactive here.
-      // Interactive sign-in is handled exclusively by signIn(). Falling back
-      // to interactive from acquireToken triggers an unexpected login webview
-      // whenever a connector needs a token the cache doesn't hold yet.
       debugWarn('[AuthContext] acquireTokenSilent failed for scopes:', scopes, e);
       getAppLogger().trackErrorEvent(HostOperationNames.AuthAcquireTokenSilentFailed, {
         scopeCount: scopes.length,
         errorName: getSafeErrorName(e)
       });
+      if (scopes.some(scope => effectiveRequiredScopes.includes(scope))) {
+        await pca.signOut({
+          account
+        }).catch(signOutError => {
+          debugWarn('[AuthContext] failed to clear an invalid session:', signOutError);
+        });
+        setError(new Error('Your session has expired. Sign in again to continue.'));
+        setAccount(null);
+      }
       return null;
     }
-  }, [account]);
+  }, [account, requiredScopeKey]);
   const signOut = useCallback(async () => {
     const pca = pcaRef.current;
     if (!pca || !account) return;

package/lib/module/auth/AuthContext.web.js

@@ -0,0 +1,26 @@
+"use strict";
+
+import React, { createContext, useContext } from 'react';
+import { jsx as _jsx } from "react/jsx-runtime";
+const hostedWebAuthState = {
+  isLoading: false,
+  isAuthReady: true,
+  isSignedIn: true,
+  hasRealAccount: false,
+  error: null,
+  acquireToken: async () => null,
+  signIn: async () => undefined,
+  signOut: async () => undefined
+};
+const AuthContext = /*#__PURE__*/createContext(hostedWebAuthState);
+export function AuthProvider({
+  children
+}) {
+  return /*#__PURE__*/_jsx(AuthContext.Provider, {
+    value: hostedWebAuthState,
+    children: children
+  });
+}
+export function useAuth() {
+  return useContext(AuthContext);
+}

package/lib/module/auth/completePowerAppsAuthSession.js

@@ -0,0 +1,11 @@
+"use strict";
+
+import * as WebBrowser from 'expo-web-browser';
+/**
+ * Completes an Expo web authentication popup when the current route is its
+ * redirect target. Call this at module initialization in the OAuth callback
+ * route; navigation after completion remains application-owned.
+ */
+export function completePowerAppsAuthSession(options) {
+  return WebBrowser.maybeCompleteAuthSession(options);
+}

package/lib/module/bridge/NativePowerAppsBridge.js

@@ -12,8 +12,10 @@
  */
 
 import { debugLog, debugWarn } from "../logger.js";
-import { getAppLogger, HostOperationNames } from "../telemetry/index.js";
+import { bridgeHttpClient, getAppLogger, HostOperationNames } from "../telemetry/index.js";
+import { getHttpCorrelationProperties } from '@microsoft/power-apps-native-common/http';
 import { sanitizeUrl } from '@microsoft/power-apps-native-common';
+import { assertSuccessfulHttpStatus, getRequestBodyForMethod, updateBridgeOptionsInPlace } from "./bridgeState.js";
 function getSafeErrorName(error) {
   return error instanceof Error ? error.constructor.name : typeof error;
 }
@@ -115,7 +117,7 @@ export class NativePowerAppsBridge {
    * via globalThis would have no effect — mutating options is the correct path.
    */
   updateOptions(options) {
-    this._options = options;
+    this._options = updateBridgeOptionsInPlace(this._options, options);
   }
   async initialize() {
     // No handshake required for the native path.
@@ -198,10 +200,6 @@ export class NativePowerAppsBridge {
       method
     } = requestConfig;
     const urlLabel = sanitizeUrl(url.replace(/^https?:\/\/[^/]+/, '').slice(0, 100));
-    const scenario = getAppLogger().trackScenario(HostOperationNames.BridgeHttpRequest, {
-      httpMethod: method,
-      url: urlLabel
-    });
     const isBlob = bodyParam instanceof Blob;
 
     // The SDK builds Authorization headers with the "paauth" scheme (its web-player
@@ -226,11 +224,12 @@ export class NativePowerAppsBridge {
       // SDK passed a plain object — JSON-stringify it as a fallback
       bodyInit = JSON.stringify(bodyParam);
     }
+    bodyInit = getRequestBodyForMethod(method, bodyInit);
     headers = normalizeJsonBodyHeaders(headers, bodyInit);
     debugLog(`[bridge] → ${method} ${urlLabel}`);
     let response;
     try {
-      response = await fetch(url, {
+      response = await bridgeHttpClient.request(url, {
         method,
         headers: headers,
         body: bodyInit
@@ -238,9 +237,6 @@ export class NativePowerAppsBridge {
     } catch (fetchErr) {
       debugWarn(`[bridge] fetch THREW for ${method} ${urlLabel}:`, fetchErr);
       debugLog(`[bridge] fetch THREW for ${method} ${urlLabel} | req body: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'}`);
-      scenario.fail(undefined, {
-        errorName: getSafeErrorName(fetchErr)
-      });
       throw fetchErr;
     }
     const responseHeaders = {};
@@ -251,20 +247,27 @@ export class NativePowerAppsBridge {
       const sdkKey = key === 'content-type' ? 'Content-Type' : key;
       responseHeaders[sdkKey] = value;
     });
-    const buffer = await response.arrayBuffer();
     debugLog(`[bridge] ${method} ${urlLabel} → ${response.status}`);
+    const correlationProperties = getHttpCorrelationProperties(response.headers);
+    let buffer;
+    try {
+      buffer = await response.arrayBuffer();
+    } catch (readErr) {
+      debugWarn(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | failed to read response body:`, readErr);
+      getAppLogger().trackErrorEvent(HostOperationNames.BridgeHttpRequest, {
+        phase: 'readResponseBody',
+        errorName: getSafeErrorName(readErr),
+        httpStatus: response.status,
+        ...correlationProperties
+      });
+      throw readErr;
+    }
     if (!response.ok) {
       const bodyText = new TextDecoder().decode(buffer).slice(0, 1000);
       debugWarn(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | res: ${bodyText}`);
       debugLog(`[bridge] HTTP ${response.status} for ${method} ${urlLabel} | req: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'} | res: ${bodyText}`);
-      scenario.completeWithError({
-        httpStatus: response.status
-      });
-    } else {
-      scenario.complete({
-        httpStatus: response.status
-      });
     }
+    assertSuccessfulHttpStatus(response.status, method);
     return [{
       status: response.status,
       headers: responseHeaders