@microsoft/power-apps-native-host 0.3.3 → 0.5.1

package/lib/commonjs/auth/AuthContext.js

@@ -10,6 +10,7 @@ var _reactNative = require("react-native");
 var _powerAppsNativeAuth = require("@microsoft/power-apps-native-auth");
 var _index = require("../telemetry/index.js");
 var _logger = require("../logger.js");
+var _targetAuthorization = require("./targetAuthorization.js");
 var _jsxRuntime = require("react/jsx-runtime");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 /*!
@@ -33,25 +34,19 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
 // '/.default' acquires a token covering all pre-consented permissions and
 // implicitly includes openid + profile + offline_access for the sign-in flow.
 const SIGN_IN_SCOPES = ['https://api.powerplatform.com/.default'];
+const AUTHENTICATION_ERROR_MESSAGE = 'We could not sign you in. Try again.';
 function getSafeErrorName(error) {
   return error instanceof Error ? error.constructor.name : typeof error;
 }
 function getErrorProperty(error, propertyName) {
   return error && typeof error === 'object' ? error[propertyName] : undefined;
 }
-function getSafeErrorMessage(error) {
-  if (error instanceof Error) return error.message;
-  return typeof error === 'string' ? error : String(error);
-}
 function getAuthErrorTelemetry(error) {
-  const errorMessage = getSafeErrorMessage(error);
-  const parsedNSError = /domain=([^\s]+) code=(-?\d+)/.exec(errorMessage);
   return {
     errorName: getSafeErrorName(error),
     errorCode: getErrorProperty(error, 'code'),
-    nativeErrorDomain: getErrorProperty(error, 'nativeErrorDomain') ?? parsedNSError?.[1],
-    nativeErrorCode: getErrorProperty(error, 'nativeErrorCode') ?? parsedNSError?.[2],
-    nativeErrorMessage: errorMessage.slice(0, 512)
+    nativeErrorDomain: getErrorProperty(error, 'nativeErrorDomain'),
+    nativeErrorCode: getErrorProperty(error, 'nativeErrorCode')
   };
 }
 function getAuthTelemetryProperties(useBroker, useEmbeddedWebView) {
@@ -65,6 +60,14 @@ function getAuthTelemetryProperties(useBroker, useEmbeddedWebView) {
 function accountsMatch(left, right) {
   return left.identifier === right.identifier && left.tenantId === right.tenantId;
 }
+function normalizeTenantId(tenantId) {
+  return tenantId.trim().toLowerCase();
+}
+function assertExpectedTenant(account, expectedTenantId) {
+  if (expectedTenantId && normalizeTenantId(account.tenantId) !== normalizeTenantId(expectedTenantId)) {
+    throw new Error('The signed-in account is not available in the selected environment tenant.');
+  }
+}
 async function validateRequiredScopes(pca, account, scopes) {
   for (const scope of scopes) {
     await pca.acquireTokenSilent({
@@ -73,13 +76,14 @@ async function validateRequiredScopes(pca, account, scopes) {
     });
   }
 }
-async function acquireRequiredScopesInteractively(pca, scopes) {
+async function acquireRequiredScopesInteractively(pca, scopes, expectedTenantId) {
   const [primaryScope, ...additionalScopes] = scopes;
   const primaryResult = await pca.acquireToken({
     scopes: [primaryScope],
     prompt: 'select_account'
   });
   const signedInAccount = primaryResult.account;
+  assertExpectedTenant(signedInAccount, expectedTenantId);
   for (const scope of additionalScopes) {
     try {
       await pca.acquireTokenSilent({
@@ -95,6 +99,7 @@ async function acquireRequiredScopesInteractively(pca, scopes) {
       if (!accountsMatch(signedInAccount, result.account)) {
         throw new Error('Sign in with the same account for all required Power Platform permissions.');
       }
+      assertExpectedTenant(result.account, expectedTenantId);
     }
   }
   await validateRequiredScopes(pca, signedInAccount, scopes);
@@ -105,6 +110,10 @@ function AuthProvider({
   msalConfig,
   intuneConfig,
   requiredScopes = [],
+  expectedTenantId,
+  authorityTenant,
+  preferredAccountIdentifier,
+  autoAuthorizeMissingScopes = false,
   children
 }) {
   const [isAuthReady, setIsAuthReady] = (0, _react.useState)(false);
@@ -147,6 +156,7 @@ function AuthProvider({
       return msalConfig.tenantId;
     }
   })();
+  const effectiveAuthorityTenant = authorityTenant ?? effectiveTenantId;
 
   // When broker is off (Android dev/embedded-WebView mode) the msauth:// redirect
   // URI is not registered in AAD and will cause "multiple apps listening" errors
@@ -172,7 +182,12 @@ function AuthProvider({
   const requiredScopeKey = [...new Set(requiredScopes)].join('|');
   const effectiveRequiredScopes = requiredScopeKey ? requiredScopeKey.split('|') : SIGN_IN_SCOPES;
   const pcaRef = (0, _react.useRef)(null);
+  const accountRef = (0, _react.useRef)(null);
+  accountRef.current = account;
+  const authGenerationRef = (0, _react.useRef)(0);
   (0, _react.useEffect)(() => {
+    const generation = ++authGenerationRef.current;
+    const isCurrent = () => authGenerationRef.current === generation;
     if (noAuthMode) {
       setIsAuthReady(true);
       setIsLoading(false);
@@ -181,7 +196,7 @@ function AuthProvider({
     const pca = new _powerAppsNativeAuth.PublicClientApplication({
       auth: {
         clientId: effectiveClientId,
-        authority: `https://login.microsoftonline.com/${effectiveTenantId}`,
+        authority: `https://login.microsoftonline.com/${effectiveAuthorityTenant}`,
         redirectUri: effectiveRedirectUri
       },
       useBroker,
@@ -195,19 +210,20 @@ function AuthProvider({
     const authTelemetryProperties = getAuthTelemetryProperties(useBroker, useEmbeddedWebView);
     const authInitScenario = (0, _index.getAppLogger)().trackScenario(_index.HostOperationNames.AuthInit, authTelemetryProperties);
     pca.init().then(() => pca.getAccounts()).then(async accounts => {
-      let restoredAccount = accounts[0] ?? null;
+      if (!isCurrent()) return;
+      const matchesExpectedTenant = candidate => !expectedTenantId || normalizeTenantId(candidate.tenantId) === normalizeTenantId(expectedTenantId);
+      let restoredAccount = preferredAccountIdentifier ? accounts.find(candidate => candidate.identifier === preferredAccountIdentifier && matchesExpectedTenant(candidate)) ?? null : accounts.find(matchesExpectedTenant) ?? null;
       if (restoredAccount) {
         try {
-          await validateRequiredScopes(pca, restoredAccount, effectiveRequiredScopes);
+          restoredAccount = autoAuthorizeMissingScopes ? await (0, _targetAuthorization.authorizeRequiredScopes)(pca, restoredAccount, effectiveRequiredScopes, expectedTenantId) : (await validateRequiredScopes(pca, restoredAccount, effectiveRequiredScopes), restoredAccount);
         } catch (tokenError) {
-          await pca.signOut({
-            account: restoredAccount
-          }).catch(() => undefined);
           restoredAccount = null;
+          if (!isCurrent()) return;
           setError(new Error('Your session has expired. Sign in again to continue.'));
           (0, _logger.debugWarn)('[AuthProvider] restored account is missing a required token:', tokenError);
         }
       }
+      if (!isCurrent()) return;
       setAccount(restoredAccount);
       if (restoredAccount) {
         (0, _index.getAppLogger)().identifyUser({
@@ -221,15 +237,19 @@ function AuthProvider({
         accountFound: accounts.length > 0
       });
     }).catch(e => {
+      if (!isCurrent()) return;
       (0, _logger.debugLog)('[AuthProvider] MSAL init failed:', e);
-      setError(e instanceof Error ? e : new Error(String(e)));
+      setError(new Error(AUTHENTICATION_ERROR_MESSAGE));
       setIsAuthReady(true);
       setIsLoading(false);
       authInitScenario.fail(undefined, getAuthErrorTelemetry(e));
     });
+    return () => {
+      if (isCurrent()) authGenerationRef.current += 1;
+    };
     // Re-initialize only when the effective broker/identity settings change.
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [effectiveClientId, effectiveTenantId, effectiveRedirectUri, requiredScopeKey, useBroker]);
+  }, [autoAuthorizeMissingScopes, effectiveClientId, effectiveAuthorityTenant, effectiveRedirectUri, expectedTenantId, preferredAccountIdentifier, requiredScopeKey, useBroker, useEmbeddedWebView]);
   const signIn = (0, _react.useCallback)(async () => {
     const pca = pcaRef.current;
     if (!pca) return;
@@ -242,7 +262,8 @@ function AuthProvider({
       if (!pca.isInitialized) {
         await pca.init();
       }
-      const signedInAccount = await acquireRequiredScopesInteractively(pca, effectiveRequiredScopes);
+      const signedInAccount = await acquireRequiredScopesInteractively(pca, effectiveRequiredScopes, expectedTenantId);
+      if (pcaRef.current !== pca) return;
       setAccount(signedInAccount);
       (0, _index.getAppLogger)().identifyUser({
         objectId: signedInAccount.identifier,
@@ -272,12 +293,13 @@ function AuthProvider({
       }
       signInScenario.complete();
     } catch (e) {
-      setError(e instanceof Error ? e : new Error(String(e)));
+      (0, _logger.debugWarn)('[AuthProvider] sign-in failed:', e);
+      setError(new Error(AUTHENTICATION_ERROR_MESSAGE));
       signInScenario.fail(undefined, getAuthErrorTelemetry(e));
     } finally {
       setIsLoading(false);
     }
-  }, [intuneEnabled, requiredScopeKey, useBroker]);
+  }, [expectedTenantId, intuneEnabled, requiredScopeKey, useBroker, useEmbeddedWebView]);
   const acquireToken = (0, _react.useCallback)(async scopes => {
     const pca = pcaRef.current;
     if (!pca || !account) return null;
@@ -286,6 +308,10 @@ function AuthProvider({
         scopes,
         account
       });
+      assertExpectedTenant(result.account, expectedTenantId);
+      if (pcaRef.current !== pca || !accountRef.current || !accountsMatch(accountRef.current, account)) {
+        return null;
+      }
       return result.accessToken;
     } catch (e) {
       (0, _logger.debugWarn)('[AuthContext] acquireTokenSilent failed for scopes:', scopes, e);
@@ -305,7 +331,7 @@ function AuthProvider({
       }
       return null;
     }
-  }, [account, requiredScopeKey]);
+  }, [account, expectedTenantId, requiredScopeKey]);
   const signOut = (0, _react.useCallback)(async () => {
     const pca = pcaRef.current;
     if (!pca || !account) return;
@@ -338,6 +364,7 @@ function AuthProvider({
       isAuthReady,
       isSignedIn: noAuthMode || account !== null,
       hasRealAccount: account !== null,
+      account,
       error,
       acquireToken,
       signIn,

package/lib/commonjs/auth/targetAuthorization.js

@@ -0,0 +1,53 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.authorizeRequiredScopes = authorizeRequiredScopes;
+exports.isInteractionRequired = isInteractionRequired;
+function getErrorProperty(error, propertyName) {
+  return error && typeof error === 'object' ? error[propertyName] : undefined;
+}
+function getErrorMessage(error) {
+  if (error instanceof Error) return error.message;
+  return typeof error === 'string' ? error : String(error);
+}
+function normalizeTenantId(tenantId) {
+  return tenantId.trim().toLowerCase();
+}
+function assertExpectedTenant(account, expectedTenantId) {
+  if (expectedTenantId && normalizeTenantId(account.tenantId) !== normalizeTenantId(expectedTenantId)) {
+    throw new Error('The signed-in account is not available in the selected environment tenant.');
+  }
+}
+function accountsMatch(left, right) {
+  return left.identifier === right.identifier && normalizeTenantId(left.tenantId) === normalizeTenantId(right.tenantId);
+}
+function isInteractionRequired(error) {
+  const code = getErrorProperty(error, 'code');
+  return code === 1004 || code === '1004' || code === 'E_INTERACTION_REQUIRED' || /interaction[ _-]?required/i.test(getErrorMessage(error));
+}
+async function authorizeRequiredScopes(client, account, scopes, expectedTenantId) {
+  let authorizedAccount = account;
+  for (const scope of scopes) {
+    try {
+      const result = await client.acquireTokenSilent({
+        scopes: [scope],
+        account: authorizedAccount
+      });
+      authorizedAccount = result.account;
+    } catch (error) {
+      if (!isInteractionRequired(error)) throw error;
+      const result = await client.acquireToken({
+        scopes: [scope],
+        loginHint: authorizedAccount.username
+      });
+      if (!accountsMatch(authorizedAccount, result.account)) {
+        throw new Error('Sign in with the same account for all required Power Platform permissions.');
+      }
+      authorizedAccount = result.account;
+    }
+    assertExpectedTenant(authorizedAccount, expectedTenantId);
+  }
+  return authorizedAccount;
+}

package/lib/commonjs/bridge/NativePowerAppsBridge.js

@@ -109,6 +109,7 @@ function arrayBufferViewToArrayBuffer(view) {
   return copy.buffer;
 }
 class NativePowerAppsBridge {
+  _runtimeEpoch = 0;
   constructor(_options) {
     this._options = _options;
   }
@@ -122,8 +123,14 @@ class NativePowerAppsBridge {
    * via globalThis would have no effect — mutating options is the correct path.
    */
   updateOptions(options) {
+    if (this._options.runtimeIdentity !== options.runtimeIdentity) {
+      this._runtimeEpoch += 1;
+    }
     this._options = (0, _bridgeState.updateBridgeOptionsInPlace)(this._options, options);
   }
+  invalidateRuntime() {
+    this._runtimeEpoch += 1;
+  }
   async initialize() {
     // No handshake required for the native path.
   }
@@ -152,9 +159,27 @@ class NativePowerAppsBridge {
     });
     switch (key) {
       case 'AppIdentityServicePlugin.getAppAccessTokenAsync':
-        return this._options.getConnectorToken(params[0]);
+        {
+          const runtimeEpoch = this._runtimeEpoch;
+          const generation = this._options.targetGeneration;
+          const runtimeIdentity = this._options.runtimeIdentity;
+          const token = await this._options.getConnectorToken(params[0]);
+          if (this._runtimeEpoch !== runtimeEpoch || this._options.targetGeneration !== generation || this._options.runtimeIdentity !== runtimeIdentity) {
+            throw new Error('NativePowerAppsBridge: target changed while acquiring a connector token');
+          }
+          return token;
+        }
       case 'AppIdentityServicePlugin.getAppDynamicResourceAccessTokenAsync':
-        return this._options.getDataverseToken(params[0]);
+        {
+          const runtimeEpoch = this._runtimeEpoch;
+          const generation = this._options.targetGeneration;
+          const runtimeIdentity = this._options.runtimeIdentity;
+          const token = await this._options.getDataverseToken(params[0]);
+          if (this._runtimeEpoch !== runtimeEpoch || this._options.targetGeneration !== generation || this._options.runtimeIdentity !== runtimeIdentity) {
+            throw new Error('NativePowerAppsBridge: target changed while acquiring a Dataverse token');
+          }
+          return token;
+        }
       case 'AppHttpClientPlugin.sendHttpAsync':
         return this._sendHttpAsync(params);
       case 'AppPowerAppsClientPlugin.getAppCdsDataSourceConfigsAsync':
@@ -198,6 +223,9 @@ class NativePowerAppsBridge {
    *   [{ status: number; headers: Record<string, string> }, ArrayBuffer]
    */
   async _sendHttpAsync(params) {
+    const requestRuntimeEpoch = this._runtimeEpoch;
+    const requestGeneration = this._options.targetGeneration;
+    const requestRuntimeIdentity = this._options.runtimeIdentity;
     const requestConfig = params[0];
     const bodyParam = params[1];
     const {
@@ -239,6 +267,9 @@ class NativePowerAppsBridge {
         headers: headers,
         body: bodyInit
       });
+      if (this._runtimeEpoch !== requestRuntimeEpoch || this._options.targetGeneration !== requestGeneration || this._options.runtimeIdentity !== requestRuntimeIdentity) {
+        throw new Error('NativePowerAppsBridge: target changed while the request was in flight');
+      }
     } catch (fetchErr) {
       (0, _logger.debugWarn)(`[bridge] fetch THREW for ${method} ${urlLabel}:`, fetchErr);
       (0, _logger.debugLog)(`[bridge] fetch THREW for ${method} ${urlLabel} | req body: ${typeof bodyInit === 'string' ? bodyInit.slice(0, 500) : bodyInit != null ? '<non-string body>' : '<no body>'}`);

package/lib/commonjs/bridge/PowerPagesBridge.js

@@ -130,11 +130,9 @@ class PowerPagesBridge {
       throw error;
     }
     if (!response.ok) {
-      const responseText = new TextDecoder().decode(responseBody).slice(0, 1000);
-      const detail = responseText ? `: ${responseText}` : '';
       // RuntimeDataClient treats JSON tuples as successful before inspecting status.
       // Reject with its HTTP-plugin error shape so 4xx/5xx responses remain failures.
-      throw [[`Power Pages Web API request failed (${response.status})${detail}`, undefined, {
+      throw [[`Power Pages Web API request failed (${response.status})`, undefined, {
         status: response.status,
         headers: responseHeaders
       }], responseBody];

package/lib/commonjs/bridge/setupNativeHost.js

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.invalidateNativeHostRuntime = invalidateNativeHostRuntime;
 exports.setupNativeHost = setupNativeHost;
 var _NativePowerAppsBridge = require("./NativePowerAppsBridge.js");
 var _logger = require("../logger.js");
@@ -62,4 +63,9 @@ function setupNativeHost(options) {
     globalThis.powerAppsBridge = _bridge;
     (0, _logger.debugLog)('[bridge] setupNativeHost: bridge ready');
   }
+}
+
+/** Invalidates in-flight work without replacing the SDK-cached bridge singleton. */
+function invalidateNativeHostRuntime() {
+  _bridge?.invalidateRuntime();
 }

package/lib/commonjs/config/expoConfig.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.createPowerAppsExpoConfig = createPowerAppsExpoConfig;
+var _tenantMode = require("./tenantMode.js");
 /**
  * Branding placeholder used when the app supplies no icon/splash of its own.
  *
@@ -17,6 +18,12 @@ exports.createPowerAppsExpoConfig = createPowerAppsExpoConfig;
  */
 const PLACEHOLDER_BRANDING_IMAGE = './assets/adaptive-icon.png';
 function createPowerAppsExpoConfig(baseConfig, settings, customize = config => config) {
+  const tenantMode = (0, _tenantMode.resolveTenantMode)({
+    expo: baseConfig
+  });
+  if (tenantMode === 'multi') (0, _tenantMode.resolveMultiTenantConfig)({
+    expo: baseConfig
+  });
   const resolvedIconPath = settings.iconPath || PLACEHOLDER_BRANDING_IMAGE;
   const resolvedSplashPath = settings.splashPath || process.env.APP_SPLASH_PATH || PLACEHOLDER_BRANDING_IMAGE;
   const icon = {
@@ -44,6 +51,13 @@ function createPowerAppsExpoConfig(baseConfig, settings, customize = config => c
     experiments: {
       typedRoutes: true
     },
+    extra: {
+      ...baseConfig.extra,
+      powerappsNative: {
+        ...baseConfig.extra?.powerappsNative,
+        tenantMode
+      }
+    },
     plugins: [...(settings.isDevClient ? ['expo-dev-client'] : []), 'expo-asset', 'expo-audio', 'expo-font', 'expo-image', 'expo-mail-composer', 'expo-router', 'expo-secure-store', 'expo-sharing', 'expo-video', 'expo-web-browser', '@microsoft/power-apps-native-host', '@microsoft/power-apps-native-offline', '@react-native-community/datetimepicker',
     // Configured explicitly rather than left to Expo's default so prebuild
     // emits named, resource-table-registered splash assets the wrap pipeline

package/lib/commonjs/config/runtimeTenantMode.js

@@ -0,0 +1,16 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.assertNativeTenantMode = assertNativeTenantMode;
+var _powerAppsNativeAuth = require("@microsoft/power-apps-native-auth");
+var _errors = require("../target/errors.js");
+var _isDevPlayer = require("../utils/isDevPlayer.js");
+function assertNativeTenantMode(tenantMode) {
+  if (__DEV__ || _isDevPlayer.isDevPlayer) return;
+  const native = (0, _powerAppsNativeAuth.getWrapConfig)();
+  if (native.authContractVersion !== '2' || native.tenantMode !== 'single' && native.tenantMode !== 'multi' || native.tenantMode !== tenantMode) {
+    throw new _errors.TargetRuntimeError('invalid-build-config', 'configuration', false, 'The app authentication configuration does not match this build. Rebuild the app or contact your administrator.');
+  }
+}

package/lib/commonjs/config/runtimeTenantMode.web.js

@@ -0,0 +1,9 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.assertNativeTenantMode = assertNativeTenantMode;
+function assertNativeTenantMode(_tenantMode) {
+  // Native wrap metadata is not available on web.
+}

package/lib/commonjs/config/tenantMode.js

@@ -0,0 +1,68 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.MULTI_TENANT_AUTHORITY = void 0;
+exports.isTenantAllowed = isTenantAllowed;
+exports.resolveMultiTenantConfig = resolveMultiTenantConfig;
+exports.resolveTenantMode = resolveTenantMode;
+const MULTI_TENANT_AUTHORITY = exports.MULTI_TENANT_AUTHORITY = 'common';
+const GUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const CANVAS_APP_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,99}$/;
+function getPowerAppsNativeConfig(appConfig) {
+  if (!appConfig || typeof appConfig !== 'object') return {};
+  const config = appConfig;
+  return config.expo?.extra?.powerappsNative ?? {};
+}
+function resolveTenantMode(appConfig) {
+  const value = getPowerAppsNativeConfig(appConfig).tenantMode;
+  if (value === undefined) return 'single';
+  if (value === 'single' || value === 'multi') return value;
+  throw new Error('app.json expo.extra.powerappsNative.tenantMode must be "single" or "multi"');
+}
+function resolveMultiTenantConfig(appConfig) {
+  const config = getPowerAppsNativeConfig(appConfig);
+  if (typeof config.appDisplayName !== 'string' || config.appDisplayName.trim().length === 0) {
+    throw new Error('app.json expo.extra.powerappsNative.appDisplayName is required in multi-tenant mode');
+  }
+  if (typeof config.appName !== 'string' || !CANVAS_APP_NAME_PATTERN.test(config.appName.trim())) {
+    throw new Error('app.json expo.extra.powerappsNative.appName must start with a letter and contain only letters, numbers, or underscores (maximum 100 characters)');
+  }
+  const appIdentity = {
+    appDisplayName: config.appDisplayName.trim(),
+    appName: config.appName.trim()
+  };
+  if (config.tenantPolicy === 'organizations') {
+    return {
+      ...appIdentity,
+      tenantPolicy: 'organizations'
+    };
+  }
+  if (!config.tenantPolicy || typeof config.tenantPolicy !== 'object' || Array.isArray(config.tenantPolicy)) {
+    throw new Error('app.json expo.extra.powerappsNative.tenantPolicy must be "organizations" or an allowedTenantIds policy');
+  }
+  const values = config.tenantPolicy.allowedTenantIds;
+  if (!Array.isArray(values) || values.length === 0) {
+    throw new Error('app.json tenantPolicy.allowedTenantIds must be a non-empty tenant GUID array');
+  }
+  const allowedTenantIds = values.map(value => {
+    if (typeof value !== 'string' || !GUID_PATTERN.test(value.trim())) {
+      throw new Error('app.json tenantPolicy.allowedTenantIds must contain only tenant GUIDs');
+    }
+    return value.trim().toLowerCase();
+  });
+  if (new Set(allowedTenantIds).size !== allowedTenantIds.length) {
+    throw new Error('app.json tenantPolicy.allowedTenantIds must not contain duplicates');
+  }
+  return {
+    ...appIdentity,
+    tenantPolicy: {
+      allowedTenantIds
+    }
+  };
+}
+function isTenantAllowed(tenantId, policy) {
+  if (!GUID_PATTERN.test(tenantId.trim())) return false;
+  return policy === 'organizations' || policy.allowedTenantIds.includes(tenantId.trim().toLowerCase());
+}