@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/lib/typescript/module/provider/PowerAppsHostProvider.d.ts

@@ -27,9 +27,10 @@
  *   </PowerAppsHostProvider>
  */
 import React from 'react';
-import type { ConnectorSchema } from '../platform/useConnectionRefs.js';
-import type { DatabaseReference } from '../platform/PowerPlatformEnvironmentApi.js';
+import type { ConnectorSchema } from '../connections/useConnectionRefs.js';
+import type { DatabaseReference } from '../platform/DataverseDataSources.js';
 import type { OnDisambiguationNeeded } from '../connections/types.js';
+import type { ConnectionReferenceConfig, ConnectionUsageInput, ResourceConsentRequirement } from '../connections/types.js';
 export interface PowerAppsHostProviderProps {
     /**
      * Callback to acquire an access token for the given scopes.
@@ -41,12 +42,12 @@ export interface PowerAppsHostProviderProps {
      * Connection resolution only runs when this is true.
      */
     isSignedIn: boolean;
+    /** Sign out the active account. Shown on blocking connection error screens. */
+    onSignOut?: () => void | Promise<void>;
     /**
      * PowerApps app GUID (from power.config.json `appId`).
-     * When set, connection references are fetched from the PowerApps RP
-     * `/apps/{appId}/launch` API at runtime instead of using the static
-     * `connectionReferences` prop.  Leave undefined during local development
-     * to fall back to the static `connectionReferences`.
+      * Outside Dev Player, app and connection metadata is fetched exclusively
+      * from the PowerApps RP `/apps/{appId}/launch` API.
      */
     appId?: string;
     /** Power Platform environment GUID (from power.config.json). */
@@ -58,6 +59,7 @@ export interface PowerAppsHostProviderProps {
     region?: string;
     /**
      * The connectionReferences map from power.config.json.
+      * Used only in Dev Player for unpublished local apps.
      * Shape: { [refId]: { id: string; dataSources: string[] } }
      *
      * NOTE: This prop must be referentially stable across renders (memoize it in
@@ -65,18 +67,16 @@ export interface PowerAppsHostProviderProps {
      * so passing a fresh object literal every render forces continuous
      * re-registration.
      */
-    connectionReferences: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences: Record<string, ConnectionReferenceConfig>;
     /**
      * Connector schema map keyed by data source name.
+      * Used only in Dev Player for unpublished local apps.
      * Generated automatically by generate-connector-schemas.
      */
     schemaMap: Record<string, ConnectorSchema>;
     /**
      * The databaseReferences map from power.config.json.
-     * Used to build CDS data sources for the bridge.
+      * Used only in Dev Player. Production database references come from RP.
      *
      * NOTE: Like `connectionReferences`, pass a referentially stable value; an
      * unstable identity each render triggers redundant bridge re-registration.
@@ -84,8 +84,8 @@ export interface PowerAppsHostProviderProps {
     databaseReferences?: Record<string, DatabaseReference>;
     /**
      * Optional custom renderer for the OAuth consent WebView shown during
-     * connection creation.  If not provided, the system browser is used via
-     * Linking.openURL().
+    * connection creation. If not provided, the system authentication browser
+    * is used. Pass the final redirect URL to onDone when the custom view captures it.
      *
      * @example
      *   // Using react-native-webview:
@@ -96,20 +96,31 @@ export interface PowerAppsHostProviderProps {
      *     </Modal>
      *   )}
      */
-    renderOAuthWebView?: (url: string, onDone: () => void) => React.ReactNode;
+    renderOAuthWebView?: (url: string, onDone: (redirectUrl?: string) => void) => React.ReactNode;
     /**
      * The ISV/wrap-app AAD client ID (from auth.config.json `msal.clientId`).
      * When provided, the ISV's service principal is granted CanView access on
      * each newly created connection, allowing APIM to accept tokens with this
      * appid at runtime (prevents 403 "missing connection ACL" for third-party tokens).
      */
-    isvClientId?: string;
+    isvClientId: string;
     /**
      * Called when multiple Connected connections exist for the same connector.
-     * Present a native picker UI and return the chosen connectionId, or null to
-     * accept the first Connected connection as a fallback.
+    * Present a native picker UI and return the chosen connectionId, or null to
+    * leave the reference unresolved.
      */
     onDisambiguationNeeded?: OnDisambiguationNeeded;
+    /**
+     * Called after the user selects Allow and before the player launches.
+     * Use this to persist app-to-connection usage through an approved public RP endpoint.
+     * Rejecting keeps the app gated and shows the error in the consent screen.
+    * Not invoked in Power Apps Dev Player; local testing is intentionally non-persistent.
+     */
+    onConnectionConsent?: (usages: ConnectionUsageInput[]) => void | Promise<void>;
+    /** Persist protected resource approval in production. Not invoked in Dev Player. */
+    onResourceConsent?: (resources: ResourceConsentRequirement[]) => void | Promise<void>;
+    /** Called when the user selects Do not allow. */
+    onConnectionConsentDeclined?: () => void | Promise<void>;
     children: React.ReactNode;
 }
 /**
@@ -119,5 +130,5 @@ export interface PowerAppsHostProviderProps {
  *
  * Children are never rendered until all required connections are resolved.
  */
-export declare function PowerAppsHostProvider({ acquireToken, isSignedIn, appId, environmentId, region, connectionReferences, schemaMap, databaseReferences, renderOAuthWebView, isvClientId, onDisambiguationNeeded, children, }: PowerAppsHostProviderProps): React.JSX.Element;
+export declare function PowerAppsHostProvider({ acquireToken, isSignedIn, onSignOut, appId, environmentId, region, connectionReferences, schemaMap, databaseReferences, renderOAuthWebView, isvClientId, onDisambiguationNeeded, onConnectionConsent, onResourceConsent, onConnectionConsentDeclined, children, }: PowerAppsHostProviderProps): React.JSX.Element;
 //# sourceMappingURL=PowerAppsHostProvider.d.ts.map

package/lib/typescript/module/provider/PowerAppsHostProvider.web.d.ts

@@ -0,0 +1,5 @@
+import React from 'react';
+import type { PowerAppsHostProviderProps } from './PowerAppsHostProvider';
+export type { PowerAppsHostProviderProps } from './PowerAppsHostProvider';
+export declare function PowerAppsHostProvider({ connectionReferences, databaseReferences, children, }: PowerAppsHostProviderProps): React.JSX.Element;
+//# sourceMappingURL=PowerAppsHostProvider.web.d.ts.map

package/lib/typescript/module/provider/PowerAppsProvider.d.ts

@@ -5,7 +5,7 @@
  * Power Apps canvas app inside an Expo shell:
  *
  *   GestureHandlerRootView
- *   └── TamaguiProvider  (defaults to @tamagui/config/v3)
+ *   └── TamaguiProvider  (defaults to @tamagui/config/v5)
  *       └── PortalProvider  (required by ToastViewport)
  *           └── ToastProvider + ToastViewport
  *               └── QueryClientProvider  (own QueryClient, wired to NetInfo + AppState)
@@ -26,13 +26,14 @@
  */
 import React from 'react';
 import { createTamagui } from '@tamagui/core';
-import type { AuthProviderProps } from '../auth/AuthContext.js';
-import type { PowerAppsHostProviderProps } from './PowerAppsHostProvider.js';
-import type { ConnectorSchema } from '../platform/useConnectionRefs.js';
-import type { DatabaseReference } from '../platform/PowerPlatformEnvironmentApi.js';
-import type { OnDisambiguationNeeded } from '../connections/types.js';
+import type { AuthProviderProps } from '../auth/AuthContext';
+import type { PowerAppsHostProviderProps } from './PowerAppsHostProvider';
+import type { ConnectorSchema } from '../connections/useConnectionRefs.js';
+import type { DatabaseReference } from '../platform/DataverseDataSources.js';
+import type { ConnectionReferenceConfig, OnDisambiguationNeeded } from '../connections/types.js';
 import type { ThemeTokens } from '../theme/tokens.js';
 import type { ILogger } from '@microsoft/power-apps-native-common';
+import type { ApplicationInsightsTelemetryProviderConfig } from '@microsoft/power-apps-native-common';
 /** Shape of power.config.json consumed by the provider. */
 export interface PowerConfig {
     /**
@@ -53,10 +54,7 @@ export interface PowerConfig {
      * Omit for the default global collector.
      */
     geoRegion?: string;
-    connectionReferences?: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences?: Record<string, ConnectionReferenceConfig>;
     databaseReferences?: Record<string, DatabaseReference>;
     /**
      * Allow additional keys — the offline SDK reads arbitrary fields from
@@ -67,6 +65,10 @@ export interface PowerConfig {
     [key: string]: unknown;
 }
 type TamaguiConfig = ReturnType<typeof createTamagui>;
+export interface AppInsightsConfig extends Omit<ApplicationInsightsTelemetryProviderConfig, 'deviceId' | 'sessionId'> {
+    /** Explicit opt-in. Application Insights telemetry is disabled unless this is true. */
+    enabled: boolean;
+}
 export interface PowerAppsProviderProps {
     /** MSAL configuration from auth.config.json (msal section). */
     msalConfig: AuthProviderProps['msalConfig'];
@@ -81,7 +83,7 @@ export interface PowerAppsProviderProps {
     schemaMap: Record<string, ConnectorSchema>;
     /**
      * Tamagui design-system config.
-     * Defaults to the standard @tamagui/config/v3 preset.
+      * Defaults to the standard @tamagui/config/v5 preset.
      */
     tamaguiConfig?: TamaguiConfig;
     /** Tamagui default colour theme. @default 'light' */
@@ -106,6 +108,12 @@ export interface PowerAppsProviderProps {
     renderOAuthWebView?: PowerAppsHostProviderProps['renderOAuthWebView'];
     /** See PowerAppsHostProviderProps.onDisambiguationNeeded. */
     onDisambiguationNeeded?: OnDisambiguationNeeded;
+    /** See PowerAppsHostProviderProps.onConnectionConsent. */
+    onConnectionConsent?: PowerAppsHostProviderProps['onConnectionConsent'];
+    /** See PowerAppsHostProviderProps.onResourceConsent. */
+    onResourceConsent?: PowerAppsHostProviderProps['onResourceConsent'];
+    /** See PowerAppsHostProviderProps.onConnectionConsentDeclined. */
+    onConnectionConsentDeclined?: PowerAppsHostProviderProps['onConnectionConsentDeclined'];
     /**
      * App name used as `clientType` in the auto-wired 1DS telemetry provider.
      * Appears in Kusto as the `clientType` column — use a stable
@@ -125,6 +133,20 @@ export interface PowerAppsProviderProps {
      *   logger becomes a no-op regardless of build variant.
      */
     logger?: ILogger | null;
+    /**
+     * Show app and telemetry session details after a three-finger downward swipe.
+     * Available in both development and published native apps. @default true
+     */
+    showSessionDetailsOnSwipe?: boolean;
+    /**
+     * Optional customer-owned Application Insights destination.
+     *
+     * Events are sent directly to the selected C1-owned Application Insights
+     * resource and fan out alongside the default Microsoft OneDS provider.
+     * Defaults to `expo.extra.appInsightsConfig` from app.json.
+     * Ignored when `logger` is provided or `null`.
+     */
+    appInsightsConfig?: AppInsightsConfig;
     /**
      * Offline profile JSON — optional override.
      * Primary source: SDK config plugin embeds offline-profile.json into the app
@@ -143,6 +165,6 @@ export interface PowerAppsProviderProps {
  * root layout.
  */
 export declare function PowerAppsProvider({ msalConfig, intuneConfig, powerConfig, schemaMap, tamaguiConfig, // override with app's tamagui.config.ts
-defaultTheme, theme, darkTheme, followSystemTheme, renderOAuthWebView, onDisambiguationNeeded, appName, logger: loggerProp, offlineProfile, children, }: PowerAppsProviderProps): React.JSX.Element;
+defaultTheme, theme, darkTheme, followSystemTheme, renderOAuthWebView, onDisambiguationNeeded, onConnectionConsent, onResourceConsent, onConnectionConsentDeclined, appName, logger: loggerProp, showSessionDetailsOnSwipe, appInsightsConfig, offlineProfile, children, }: PowerAppsProviderProps): React.JSX.Element;
 export {};
 //# sourceMappingURL=PowerAppsProvider.d.ts.map

package/lib/typescript/module/provider/SessionDetailsGesture.d.ts

@@ -0,0 +1,13 @@
+import React from 'react';
+interface SessionDetailsGestureProps {
+    enabled: boolean;
+    appName: string;
+    appId?: string;
+    environmentId?: string;
+    region: string;
+    appVersion?: string;
+    children: React.ReactNode;
+}
+export declare function SessionDetailsGesture({ enabled, appName, appId, environmentId, region, appVersion, children, }: SessionDetailsGestureProps): React.JSX.Element;
+export {};
+//# sourceMappingURL=SessionDetailsGesture.d.ts.map

package/lib/typescript/module/telemetry/OfflineSdkTelemetry.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Forwards the privacy-safe Offline SDK transport through the host's existing
+ * app logger so offline events carry the same session, device, and user data.
+ *
+ * The host owns exactly one thing here: binding the SDK transport to this
+ * host's logger. Buffering and teardown semantics live in the SDK.
+ *
+ * Setup and teardown are fail-open but not silent. This runs from an effect in
+ * the provider that roots the app, so an unguarded throw would take down the
+ * whole tree — telemetry is never worth an app that will not start. An
+ * unexpected failure is therefore downgraded to a logged diagnostic rather than
+ * swallowed, so broken wiring stays observable.
+ */
+export declare function configureOfflineSdkTelemetry(forwardEvents: boolean): () => void;
+//# sourceMappingURL=OfflineSdkTelemetry.d.ts.map

package/lib/typescript/module/telemetry/OfflineSdkTelemetry.web.d.ts

@@ -0,0 +1,2 @@
+export declare function configureOfflineSdkTelemetry(_forwardEvents: boolean): () => void;
+//# sourceMappingURL=OfflineSdkTelemetry.web.d.ts.map

package/lib/typescript/module/telemetry/index.d.ts

@@ -7,7 +7,9 @@
  * (`getAppLogger` / `configureAppLogger`). This module re-exports those
  * alongside the canonical host operation-name constants.
  */
-export { getAppLogger, configureAppLogger } from '@microsoft/power-apps-native-common';
+import { HttpClient } from '@microsoft/power-apps-native-common/http';
+export { getAppLogger, configureAppLogger, getCustomerTelemetryLogger } from '@microsoft/power-apps-native-common';
+export type { ICustomerTelemetryLogger } from '@microsoft/power-apps-native-common';
 /**
  * Canonical operation names for host package telemetry.
  * Follow the `PowerAppsHost.<Subsystem>.<Action>` convention so events are
@@ -34,15 +36,25 @@ export declare const HostOperationNames: {
     readonly BridgeTokenAcquireFailed: "PowerAppsHost.Bridge.TokenAcquire.Failed";
     /** Top-level React error boundary caught an unhandled JS error. */
     readonly RuntimeUnhandledJsError: "PowerAppsHost.Runtime.UnhandledJsError";
+    /** Power Platform RP HTTP request, including backend correlation IDs. */
+    readonly PlatformHttpRequest: "PowerAppsHost.Platform.HttpRequest";
     /** Resolve Dataverse instanceUrl from Power Platform environment API. */
     readonly PlatformFetchInstanceUrl: "PowerAppsHost.Platform.FetchInstanceUrl";
     /** useConnectionRefs failed to resolve connections (recoverable). Recorded only on failure. */
     readonly PlatformLoadConnectionsFailed: "PowerAppsHost.Platform.LoadConnections.Failed";
     /** Create a new Power Platform connection. */
     readonly PlatformCreateConnection: "PowerAppsHost.Platform.CreateConnection";
+    /** Repair an existing Power Platform connection. */
+    readonly PlatformRepairConnection: "PowerAppsHost.Platform.RepairConnection";
+    /** Poll a connection until it becomes active. */
+    readonly PlatformPollConnectionStatus: "PowerAppsHost.Platform.PollConnectionStatus";
     /** Resolve app connection references for the current launch. */
     readonly PlatformResolveConnectionRefs: "PowerAppsHost.Platform.ResolveConnectionRefs";
     /** Grant this app access to a Power Platform connection ACL. */
     readonly PlatformConnectionAclGrant: "PowerAppsHost.Platform.ConnectionAclGrant";
+    /** Installed Offline SDK predates the SDK-owned routing contract. */
+    readonly OfflineRoutingContractUnsupported: "PowerAppsHost.Offline.RoutingContract.Unsupported";
 };
+export declare const bridgeHttpClient: HttpClient;
+export declare const platformHttpClient: HttpClient;
 //# sourceMappingURL=index.d.ts.map

package/package.json

@@ -1,17 +1,24 @@
 {
   "name": "@microsoft/power-apps-native-host",
-  "version": "0.2.22",
+  "version": "0.3.0",
   "description": "React Native host integration for @microsoft/power-apps",
   "author": "Microsoft Corporation",
   "license": "SEE LICENSE IN LICENSE",
   "bugs": {
     "email": "pawrap-team@microsoft.com"
   },
+  "engines": {
+    "node": "^20.17.0 || >=22.9.0"
+  },
   "main": "./lib/commonjs/index.js",
   "module": "./lib/module/index.js",
   "types": "./lib/typescript/commonjs/index.d.ts",
   "exports": {
     ".": {
+      "browser": {
+        "types": "./lib/typescript/commonjs/index.d.ts",
+        "default": "./lib/commonjs/index.js"
+      },
       "import": {
         "types": "./lib/typescript/module/index.d.ts",
         "default": "./lib/module/index.js"
@@ -22,43 +29,57 @@
       }
     },
     "./package.json": "./package.json",
+    "./metro-logger": "./scripts/metro-logger.js",
     "./app.plugin.js": "./app.plugin.js"
   },
   "bin": {
     "generate-connector-schemas": "scripts/generate-connector-schemas.js",
     "js-bundle": "scripts/bundle.js",
-    "build-ios-base": "scripts/build-ios-base.js"
+    "build-ios-base": "scripts/build-ios-base.js",
+    "power-apps-web": "scripts/start-web.mjs",
+    "wrap": "scripts/wrap.js",
+    "upgrade-template": "scripts/upgrade.js"
   },
   "files": [
     "lib/",
     "!lib/**/*.map",
     "app.plugin.js",
-    "scripts/"
+    "scripts/",
+    "compatibility/"
   ],
   "scripts": {
-    "prepack": "bob build && node ../../scripts/notices.js",
+    "prepack": "npm run build && npm test",
     "build": "bob build && node ../../scripts/notices.js",
-    "type-check": "tsc --noEmit"
+    "type-check": "tsc --noEmit",
+    "test": "node --test test/*.test.js",
+    "test:upgrade": "node --test test/upgrade.test.js",
+    "test:offline-compatibility": "bob build && node --test test/OfflineSdkCompatibility.test.js"
   },
   "dependencies": {
-    "@microsoft/power-apps-native-auth": "^0.3.4",
-    "@microsoft/power-apps-native-common": "^0.1.8",
-    "@tamagui/config": "1.144.4",
-    "@tamagui/core": "1.144.4",
-    "@tamagui/portal": "1.144.4",
-    "@tamagui/toast": "1.144.4",
-    "@tanstack/react-query": "5.62.0"
+    "@microsoft/power-apps-native-auth": "^0.3.6",
+    "@microsoft/power-apps-native-common": "^0.2.0",
+    "@ster5/global-mutex": "3.3.0",
+    "@tamagui/config": "2.4.5",
+    "@tamagui/core": "2.4.5",
+    "@tamagui/portal": "2.4.5",
+    "@tamagui/toast": "2.4.5",
+    "@tanstack/react-query": "5.62.0",
+    "diff": "9.0.0",
+    "resolve-workspace-root": "2.0.1",
+    "write-file-atomic": "7.0.1"
   },
   "peerDependencies": {
     "@microsoft/power-apps": "*",
-    "@microsoft/power-apps-native-offline": ">=0.1.0",
+    "@microsoft/power-apps-native-offline": ">=0.1.32",
     "@react-native-community/netinfo": ">=11.0.0",
     "burnt": ">=0.12.2",
-    "expo-constants": ">=55.0.0",
-    "expo-linking": ">=55.0.14",
-    "expo-web-browser": ">=55.0.14",
-    "react": ">=19.2.0",
-    "react-native": ">=0.83.4",
+    "expo-constants": ">=55.0.0 <56",
+    "expo-clipboard": ">=55.0.0 <56",
+    "expo-linking": ">=55.0.14 <56",
+    "expo-web-browser": ">=55.0.14 <56",
+    "react": ">=19.2.0 <20",
+    "react-dom": ">=19.2.0 <19.3.0",
+    "react-native": ">=0.83.4 <0.84",
     "react-native-gesture-handler": ">=2.0.0",
     "react-native-safe-area-context": ">=5.6.2"
   },
@@ -76,8 +97,12 @@
   "devDependencies": {
     "@types/react": "19.2.14",
     "cross-env": "7.0.3",
+    "expo-clipboard": "55.0.13",
     "expo-constants": "55.0.16",
     "expo-web-browser": "55.0.15",
+    "react": "19.2.0",
+    "react-dom": "19.2.0",
+    "react-native": "0.83.6",
     "react-native-safe-area-context": "5.6.2",
     "typescript": "5.9.3"
   },

package/scripts/build-ios-base.js

@@ -56,8 +56,13 @@ if (!xcworkspace) {
 // Derive scheme name from workspace name (strip .xcworkspace).
 const scheme = xcworkspace.replace('.xcworkspace', '');
 
-const archivePath = path.join(os.tmpdir(), 'pawrap-base.xcarchive');
-const ipaDir      = path.join(os.tmpdir(), 'pawrap-base-ipa');
+// --simulator: build for iOS Simulator instead of a physical device.
+// Use this for local testing; the default (device) build is for App Store / wrap pipeline.
+const isSimulator = process.argv.includes('--simulator');
+
+const archivePath    = path.join(os.tmpdir(), 'pawrap-base.xcarchive');
+const simDerivedPath = path.join(os.tmpdir(), 'pawrap-sim-derived');
+const ipaDir         = path.join(os.tmpdir(), 'pawrap-base-ipa');
 const payloadDir  = path.join(ipaDir, 'Payload');
 const ipaPath     = path.join(os.tmpdir(), 'pawrap-base.ipa');
 
@@ -66,31 +71,65 @@ function run(cmd, args, opts = {}) {
   execFileSync(cmd, args, { stdio: 'inherit', ...opts });
 }
 
-// 1. Archive (no code signing — wrap pipeline signs with customer cert).
-run('xcodebuild', [
-  '-workspace', path.join(iosDir, xcworkspace),
-  '-scheme',    scheme,
-  '-configuration', 'Release',
-  'archive',
-  '-archivePath', archivePath,
-  '-destination', 'generic/platform=iOS',
-  'CODE_SIGNING_REQUIRED=NO',
-  'CODE_SIGN_IDENTITY=',
-  'CODE_SIGNING_ALLOWED=NO',
-]);
-
-// 2. Package into an IPA.
-fs.rmSync(ipaDir, { recursive: true, force: true });
-fs.mkdirSync(payloadDir, { recursive: true });
-
-const appsGlob = path.join(archivePath, 'Products', 'Applications');
-for (const app of fs.readdirSync(appsGlob)) {
-  if (app.endsWith('.app')) {
-    fs.cpSync(path.join(appsGlob, app), path.join(payloadDir, app), { recursive: true });
+if (isSimulator) {
+  // ── Simulator build ──────────────────────────────────────────────────────
+  // Uses xcodebuild build (not archive) targeting iOS Simulator so the Mach-O
+  // platform is IOSSIMULATOR and xcrun simctl can launch it.
+  run('xcodebuild', [
+    '-workspace', path.join(iosDir, xcworkspace),
+    '-scheme',    scheme,
+    '-configuration', 'Release',
+    'build',
+    '-destination', 'generic/platform=iOS Simulator',
+    '-derivedDataPath', simDerivedPath,
+    'CODE_SIGNING_REQUIRED=NO',
+    'CODE_SIGN_IDENTITY=',
+    'CODE_SIGNING_ALLOWED=NO',
+  ]);
+
+  const simProductsDir = path.join(simDerivedPath, 'Build', 'Products', 'Release-iphonesimulator');
+  const appBundle = fs.readdirSync(simProductsDir).find(f => f.endsWith('.app'));
+  if (!appBundle) {
+    console.error('build-ios-base: no .app found in simulator build output');
+    process.exit(1);
   }
-}
 
-fs.rmSync(ipaPath, { force: true });
-run('zip', ['-r', ipaPath, '.'], { cwd: ipaDir });
+  // Package as IPA so the output format matches the device build.
+  // xcrun simctl install accepts simulator-built IPAs.
+  fs.rmSync(ipaDir, { recursive: true, force: true });
+  fs.mkdirSync(payloadDir, { recursive: true });
+  fs.cpSync(path.join(simProductsDir, appBundle), path.join(payloadDir, appBundle), { recursive: true });
+  fs.rmSync(ipaPath, { force: true });
+  run('zip', ['-r', ipaPath, '.'], { cwd: ipaDir });
+  console.log(`\n✓ Base IPA (simulator) ready: ${ipaPath}`);
+
+} else {
+  // ── Device build (default) ───────────────────────────────────────────────
+  // Archives without code signing so the wrap pipeline can re-sign with the
+  // customer's provisioning profile.
+  run('xcodebuild', [
+    '-workspace', path.join(iosDir, xcworkspace),
+    '-scheme',    scheme,
+    '-configuration', 'Release',
+    'archive',
+    '-archivePath', archivePath,
+    '-destination', 'generic/platform=iOS',
+    'CODE_SIGNING_REQUIRED=NO',
+    'CODE_SIGN_IDENTITY=',
+    'CODE_SIGNING_ALLOWED=NO',
+  ]);
 
-console.log(`\n✓ Base IPA ready: ${ipaPath}`);
+  fs.rmSync(ipaDir, { recursive: true, force: true });
+  fs.mkdirSync(payloadDir, { recursive: true });
+
+  const appsGlob = path.join(archivePath, 'Products', 'Applications');
+  for (const app of fs.readdirSync(appsGlob)) {
+    if (app.endsWith('.app')) {
+      fs.cpSync(path.join(appsGlob, app), path.join(payloadDir, app), { recursive: true });
+    }
+  }
+
+  fs.rmSync(ipaPath, { force: true });
+  run('zip', ['-r', ipaPath, '.'], { cwd: ipaDir });
+  console.log(`\n✓ Base IPA ready: ${ipaPath}`);
+}