@microsoft/power-apps-native-host 0.4.0 → 0.5.1

package/scripts/dev.js

@@ -0,0 +1,405 @@
+#!/usr/bin/env node
+'use strict';
+
+const { spawn } = require('node:child_process');
+const { createConnection, createServer, isIP } = require('node:net');
+const path = require('node:path');
+const { setTimeout: delay } = require('node:timers/promises');
+
+const DEFAULT_PORT = 8081;
+
+function parseArgs(args) {
+  const expoArgs = [];
+  let tunnel = false;
+  let tenantId;
+
+  for (let index = 0; index < args.length; index += 1) {
+    const argument = args[index];
+    if (argument === '--tunnel') {
+      tunnel = true;
+    } else if (argument === '--tunnel-tenant') {
+      tenantId = args[index + 1];
+      if (!tenantId || tenantId.startsWith('--')) {
+        throw new Error('--tunnel-tenant requires an Entra tenant ID.');
+      }
+      index += 1;
+    } else {
+      expoArgs.push(argument);
+    }
+  }
+
+  const portIndex = expoArgs.findIndex(argument => argument === '--port' || argument === '-p');
+  const inlinePort = expoArgs.find(argument => argument.startsWith('--port='));
+  const port = portIndex >= 0
+    ? Number(expoArgs[portIndex + 1])
+    : inlinePort
+      ? Number(inlinePort.slice('--port='.length))
+      : DEFAULT_PORT;
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error('Expo port must be an integer between 1 and 65535.');
+  }
+  if (tenantId && !tunnel) {
+    throw new Error('--tunnel-tenant requires --tunnel.');
+  }
+
+  return { expoArgs, port, tenantId, tunnel };
+}
+
+function buildLaunchUrl(tunnelUrl, connectToken) {
+  const endpoint = new URL(tunnelUrl);
+  if (endpoint.protocol !== 'https:' || !endpoint.hostname.endsWith('.devtunnels.ms')) {
+    throw new Error(`Unexpected Dev Tunnels endpoint: ${tunnelUrl}`);
+  }
+  if (!connectToken) {
+    throw new Error('Dev Tunnels did not return a connect token.');
+  }
+  const launchUrl = new URL('powerapps-dev-player://launch');
+  launchUrl.searchParams.set('url', endpoint.toString());
+  launchUrl.searchParams.set('tunnelToken', connectToken);
+  return launchUrl.toString();
+}
+
+function selectTunnelUrl(portForwardingUris) {
+  const tunnelUrl = portForwardingUris?.find(uri => {
+    try {
+      const endpoint = new URL(uri);
+      return endpoint.protocol === 'https:'
+        && (!endpoint.port || endpoint.port === '443')
+        && endpoint.hostname.endsWith('.devtunnels.ms');
+    } catch {
+      return false;
+    }
+  });
+  if (!tunnelUrl) {
+    throw new Error('Dev Tunnels did not return an HTTPS forwarding URL on port 443.');
+  }
+  return tunnelUrl;
+}
+
+function usesLanHost(expoArgs) {
+  if (expoArgs.includes('--localhost') || expoArgs.includes('--offline')) return false;
+  if (expoArgs.includes('--lan')) return true;
+
+  const hostIndex = expoArgs.indexOf('--host');
+  const inlineHost = expoArgs.find(argument => argument.startsWith('--host='));
+  const host = hostIndex >= 0
+    ? expoArgs[hostIndex + 1]
+    : inlineHost?.slice('--host='.length);
+  return host ? host === 'lan' : true;
+}
+
+async function resolveLanUrl(port, resolveNetwork) {
+  const lanNetwork = resolveNetwork ?? require('lan-network').lanNetwork;
+  const { address } = await lanNetwork();
+  const addressFamily = isIP(address);
+  if (!addressFamily || address === '127.0.0.1' || address === '::1') {
+    throw new Error('Could not determine a LAN address. Use --tunnel or pass --host localhost.');
+  }
+  const hostname = addressFamily === 6 ? `[${address}]` : address;
+  return `http://${hostname}:${port}/`;
+}
+
+function startExpo(projectRoot, expoArgs, environment = {}, spawnProcess = spawn) {
+  const expoCli = require.resolve('expo/bin/cli', { paths: [projectRoot] });
+  return spawnProcess(process.execPath, [expoCli, 'start', ...expoArgs], {
+    cwd: projectRoot,
+    env: { ...process.env, ...environment },
+    stdio: 'inherit',
+  });
+}
+
+function hasExplicitPort(expoArgs) {
+  return expoArgs.some(argument => argument === '--port' || argument === '-p' || argument.startsWith('--port='));
+}
+
+function isPortAvailable(port) {
+  return new Promise(resolve => {
+    const server = createServer();
+    server.once('error', () => resolve(false));
+    server.listen(port, () => server.close(() => resolve(true)));
+  });
+}
+
+async function resolveMetroOptions(options, checkPort = isPortAvailable) {
+  if (hasExplicitPort(options.expoArgs)) {
+    if (!await checkPort(options.port)) {
+      throw new Error(`Expo port ${options.port} is already in use. Choose another port with --port.`);
+    }
+    return { expoArgs: options.expoArgs, port: options.port };
+  }
+
+  for (let port = options.port; port <= 65535; port += 1) {
+    if (await checkPort(port)) {
+      return { expoArgs: [...options.expoArgs, '--port', String(port)], port };
+    }
+  }
+  throw new Error(`No available Expo port was found at or above ${options.port}.`);
+}
+
+async function waitForMetro(port, expo, timeoutMs = 60_000) {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (expo.exitCode !== null) {
+      throw new Error(`Expo exited before Metro started on port ${port}.`);
+    }
+    const connected = await new Promise(resolve => {
+      const socket = createConnection({ host: '127.0.0.1', port });
+      socket.once('connect', () => {
+        socket.destroy();
+        resolve(true);
+      });
+      socket.once('error', () => resolve(false));
+    });
+    if (connected) return;
+    await delay(100);
+  }
+  throw new Error(`Timed out waiting for Metro to start on port ${port}.`);
+}
+
+async function startExpoThenTunnel(startMetro, waitUntilReady, createTunnel) {
+  const expo = startMetro();
+  try {
+    await waitUntilReady(expo);
+    return { expo, tunnelState: await createTunnel() };
+  } catch (error) {
+    expo.kill?.('SIGTERM');
+    throw error;
+  }
+}
+
+async function startLan(projectRoot, options, resolveUrl = resolveLanUrl, spawnProcess = spawn) {
+  const qrcode = require('qrcode-terminal');
+  const lanUrl = await resolveUrl(options.port);
+  console.log(`\nLAN development server: ${lanUrl}`);
+  console.log('Scan this QR code with Power Apps Dev Player:');
+  qrcode.generate(lanUrl, { small: true });
+  console.log();
+  return startExpo(projectRoot, options.expoArgs, {
+    EXPO_NO_QR_CODE: '1',
+    EXPO_PACKAGER_PROXY_URL: lanUrl,
+  }, spawnProcess);
+}
+
+function isTunnelLimitError(error) {
+  if (!error) return false;
+  const text = [
+    error.message,
+    error.response?.data?.detail,
+    error.response?.data?.title,
+    typeof error.response?.data === 'string' ? error.response.data : '',
+  ]
+    .filter(Boolean)
+    .join(' ')
+    .toLowerCase();
+
+  return /tunnelsperuser(?:percluster)?/.test(text);
+}
+
+function getTunnelCreatedTime(tunnel) {
+  if (!tunnel?.created) return 0;
+  const time = new Date(tunnel.created).getTime();
+  return Number.isNaN(time) ? 0 : time;
+}
+
+function getTunnelHostConnectionCount(tunnel) {
+  const count = tunnel?.status?.hostConnectionCount;
+  if (typeof count === 'number') return count;
+  return typeof count?.current === 'number' ? count.current : null;
+}
+
+async function deleteOlderTunnel(managementClient, tunnels) {
+  if (!Array.isArray(tunnels) || tunnels.length === 0) {
+    return null;
+  }
+
+  const candidates = tunnels
+    .filter(t => Array.isArray(t.labels)
+      && t.labels.includes('power-apps-native')
+      && getTunnelHostConnectionCount(t) === 0)
+    .sort((a, b) => getTunnelCreatedTime(a) - getTunnelCreatedTime(b));
+
+  for (const candidate of candidates) {
+    try {
+      const result = await managementClient.deleteTunnel(candidate);
+      if (result === true) return candidate;
+    } catch (error) {
+      console.warn(
+        `[power-apps-dev] Failed to delete idle managed tunnel (${candidate.tunnelId || candidate.name || 'unnamed'}).`,
+        error,
+      );
+    }
+  }
+
+  return null;
+}
+
+async function createTunnelWithLimitHandling(managementClient, tunnelDefinition, options) {
+  try {
+    return await managementClient.createTunnel(tunnelDefinition, options);
+  } catch (error) {
+    if (!isTunnelLimitError(error) || !tunnelDefinition.clusterId) {
+      throw error;
+    }
+
+    let tunnels;
+    try {
+      tunnels = await managementClient.listTunnels(tunnelDefinition.clusterId);
+    } catch (listError) {
+      console.warn('[power-apps-dev] Failed to list tunnels during quota recovery.', listError);
+      throw error;
+    }
+    const deleted = await deleteOlderTunnel(managementClient, tunnels);
+    if (!deleted) {
+      console.warn('[power-apps-dev] No idle managed tunnel was available; skipping tunnel deletion.');
+      throw error;
+    }
+
+    console.warn(
+      `[power-apps-dev] Dev Tunnel limit reached. Deleted older tunnel (${deleted.tunnelId || deleted.name || 'unnamed'}) to make room.`,
+    );
+
+    return await managementClient.createTunnel(tunnelDefinition, options);
+  }
+}
+
+async function startAuthenticatedTunnel(projectRoot, options) {
+  const { AzureCliCredential } = require('@azure/identity');
+  const {
+    TunnelAccessScopes,
+    TunnelProtocol,
+    TunnelServiceProperties,
+  } = require('@microsoft/dev-tunnels-contracts');
+  const {
+    ManagementApiVersions,
+    TunnelAccessTokenProperties,
+    TunnelManagementHttpClient,
+  } = require('@microsoft/dev-tunnels-management');
+  const { TunnelRelayTunnelHost } = require('@microsoft/dev-tunnels-connections');
+  const qrcode = require('qrcode-terminal');
+  const packageJson = require('../package.json');
+
+  const metroOptions = await resolveMetroOptions(options);
+  const credential = new AzureCliCredential(options.tenantId ? { tenantId: options.tenantId } : {});
+  const scope = `${TunnelServiceProperties.production.serviceAppId}/.default`;
+  const getAuthorization = async () => {
+    const result = await credential.getToken(scope);
+    if (!result?.token) {
+      throw new Error('Azure CLI did not return a Dev Tunnels access token. Run `az login` and try again.');
+    }
+    return `Bearer ${result.token}`;
+  };
+  const managementClient = new TunnelManagementHttpClient(
+    [{ name: packageJson.name, version: packageJson.version }],
+    ManagementApiVersions.Version20230927preview,
+    getAuthorization,
+  );
+
+  let tunnel;
+  let host;
+  let expo;
+  let cleaningUp = false;
+  const cleanup = async () => {
+    if (cleaningUp) return;
+    cleaningUp = true;
+    expo?.kill('SIGTERM');
+    await host?.dispose().catch(() => undefined);
+    if (tunnel) await managementClient.deleteTunnel(tunnel).catch(() => undefined);
+    await managementClient.dispose().catch(() => undefined);
+  };
+
+  try {
+    const started = await startExpoThenTunnel(
+      () => startExpo(projectRoot, metroOptions.expoArgs, { EXPO_NO_QR_CODE: '1' }),
+      child => waitForMetro(metroOptions.port, child),
+      async () => {
+        tunnel = await createTunnelWithLimitHandling(
+          managementClient,
+          { labels: ['power-apps-native', 'development'] },
+          { tokenScopes: [TunnelAccessScopes.Host] },
+        );
+        const tunnelPort = await managementClient.createTunnelPort(
+          tunnel,
+          { portNumber: metroOptions.port, protocol: TunnelProtocol.Http, isDefault: true },
+          { tokenScopes: [TunnelAccessScopes.Connect] },
+        );
+        tunnel.ports = [tunnelPort];
+        host = new TunnelRelayTunnelHost(managementClient);
+        await host.connect(tunnel);
+        return tunnelPort;
+      },
+    );
+    expo = started.expo;
+    const tunnelPort = started.tunnelState;
+
+    const tunnelUrl = selectTunnelUrl(tunnelPort.portForwardingUris);
+    const connectToken = TunnelAccessTokenProperties.getTunnelAccessToken(
+      tunnelPort,
+      TunnelAccessScopes.Connect,
+    );
+
+    const launchUrl = buildLaunchUrl(tunnelUrl, connectToken);
+    console.log(`\nAuthenticated Dev Tunnel: ${tunnelUrl}`);
+    console.log('Scan this QR code with Power Apps Dev Player:');
+    qrcode.generate(launchUrl, { small: true });
+    console.log('\nThe tunnel is private and will be deleted when this process exits.\n');
+
+    const exitCode = await new Promise((resolve, reject) => {
+      const signals = ['SIGINT', 'SIGTERM'];
+      const finish = result => {
+        for (const signal of signals) process.removeListener(signal, stop);
+        resolve(result);
+      };
+      const stop = () => {
+        expo.kill('SIGTERM');
+        finish(0);
+      };
+      for (const signal of signals) process.once(signal, stop);
+      expo.once('error', error => {
+        for (const signal of signals) process.removeListener(signal, stop);
+        reject(error);
+      });
+      expo.once('exit', code => finish(code ?? 1));
+    });
+    await cleanup();
+    return exitCode;
+  } catch (error) {
+    await cleanup();
+    throw error;
+  }
+}
+
+async function main() {
+  const options = parseArgs(process.argv.slice(2));
+  const projectRoot = process.cwd();
+  if (!options.tunnel) {
+    const expo = usesLanHost(options.expoArgs)
+      ? await startLan(projectRoot, options)
+      : startExpo(projectRoot, options.expoArgs);
+    expo.once('exit', code => process.exit(code ?? 1));
+    return;
+  }
+
+  process.exitCode = await startAuthenticatedTunnel(projectRoot, options);
+}
+
+if (require.main === module) {
+  main().catch(error => {
+    console.error(`[power-apps-dev] ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = 1;
+  });
+}
+
+module.exports = {
+  buildLaunchUrl,
+  createTunnelWithLimitHandling,
+  deleteOlderTunnel,
+  isTunnelLimitError,
+  parseArgs,
+  resolveMetroOptions,
+  resolveLanUrl,
+  selectTunnelUrl,
+  startExpo,
+  startExpoThenTunnel,
+  startLan,
+  usesLanHost,
+};

package/scripts/upgrade-authoring.js

@@ -10,7 +10,7 @@ const { HOST_PACKAGE, TEMPLATE_VERSION_PATH, assertSafeFilePath, hashContent, is
 
 const AUTHORING_LOCK_PATH = 'packages/power-apps-native-host/compatibility/.migration-build.lock';
 const AUTHORING_JOURNAL_PATH = 'packages/power-apps-native-host/compatibility/.migration-build-journal.json';
-const TEMPLATE_PATH = 'templates/expo-app-standalone';
+const TEMPLATE_PATH = 'packages/power-apps-native-template/template';
 const TSCONFIG_PATH = 'tsconfig.json';
 const GITIGNORE_PATH = '.gitignore';
 const GITIGNORE_START = '# POWER APPS MANAGED START - DO NOT REMOVE OR RENAME THE COMMENT';
@@ -18,10 +18,14 @@ const GITIGNORE_END = '# POWER APPS MANAGED END - DO NOT REMOVE OR RENAME THE CO
 const MANAGED_PACKAGE_FIELDS = ['main'];
 const PROFILE_PATH = 'packages/power-apps-native-host/compatibility/current.json';
 const TEMPLATE_BASELINE_TAG_PREFIX = 'standalone-template-migration-baseline-v';
-const LEGACY_TEMPLATE_BASELINE_TAG_PATTERN = /^template-migration-baseline-v\d+$/;
 const RELEASE_HOST_VERSION = '__RELEASE_HOST_VERSION__';
 const NATIVE_RUNTIME_FINGERPRINT_SCRIPT = 'scripts/repository/native-runtime-fingerprint.js';
 const NATIVE_RUNTIME_PLATFORMS = ['android', 'ios'];
+const SCAFFOLD_ONLY_TEMPLATE_PATHS = new Set([
+  'AGENTS.md',
+  'CLAUDE.md',
+  '.github/copilot-instructions.md',
+]);
 const CUSTOMER_SECTIONS = [
   {
     name: 'customer app settings',
@@ -72,33 +76,84 @@ function inferBuildBaseTag(repositoryRoot) {
   if (!Number.isInteger(profile.targetTemplateVersion)) throw new Error('Current compatibility profile has an invalid targetTemplateVersion');
   const currentTag = templateBaselineTag(profile.targetTemplateVersion);
   if (git(repositoryRoot, ['show-ref', '--verify', '--quiet', `refs/tags/${currentTag}`], true) !== null) return currentTag;
-  const legacyTags = git(repositoryRoot, ['tag', '--merged', 'HEAD', '--list', 'template-migration-baseline-v*', '--sort=-version:refname'])
-    .trim().split('\n').filter(Boolean);
-  const legacyTag = legacyTags.find(tag => {
-    if (!LEGACY_TEMPLATE_BASELINE_TAG_PATTERN.test(tag)) return false;
-    const base = resolveVersionTag(repositoryRoot, tag);
-    return readTemplateState(repositoryRoot, base.commit)?.templateVersion === profile.targetTemplateVersion;
-  });
-  if (legacyTag) return legacyTag;
   throw new Error(`Could not infer template migration baseline. Expected ${currentTag}.`);
 }
 
 function getTemplateChanges(repositoryRoot, fromTag) {
   const base = resolveVersionTag(repositoryRoot, fromTag);
-  const tracked = git(repositoryRoot, ['diff', '--no-renames', '--name-only', '--diff-filter=ACDMT', base.commit, '--', TEMPLATE_PATH])
-    .trim().split('\n').filter(Boolean);
-  const untracked = git(repositoryRoot, ['ls-files', '--others', '--exclude-standard', '--', TEMPLATE_PATH])
-    .trim().split('\n').filter(Boolean);
-  const paths = [...new Set([...tracked, ...untracked])].sort();
+  const basePaths = templatePathsAtCommit(repositoryRoot, base.commit);
+  const targetPaths = templatePathsAtWorktree(repositoryRoot);
+  const paths = [...new Set([...basePaths, ...targetPaths])]
+    .filter(relativePath => !isScaffoldOnlyTemplatePath(relativePath))
+    .filter(relativePath => {
+      const baseContent = readGitFile(repositoryRoot, base.commit, relativePath);
+      const targetContent = readTemplateFile(repositoryRoot, relativePath);
+      return !buffersEqual(baseContent, targetContent)
+        || normalizedFileMode(fileMode(repositoryRoot, base.commit, relativePath))
+          !== normalizedFileMode(fileMode(repositoryRoot, null, relativePath));
+    })
+    .sort();
   return {
     baseTag: base.tag,
     baseCommit: base.commit,
-    files: paths.map(filePath => {
-      return { path: filePath.slice(`${TEMPLATE_PATH}/`.length) };
-    }),
+    files: paths.map(relativePath => ({ path: relativePath })),
   };
 }
 
+function isScaffoldOnlyTemplatePath(relativePath) {
+  // Git uses '/', while a native Windows caller may supply '\'. Keep exact-path matching.
+  return SCAFFOLD_ONLY_TEMPLATE_PATHS.has(relativePath.replace(/\\/g, '/'));
+}
+
+function storedTemplatePath(relativePath) {
+  return relativePath === GITIGNORE_PATH ? 'gitignore' : relativePath;
+}
+
+function logicalTemplatePath(relativePath) {
+  return relativePath === 'gitignore' ? GITIGNORE_PATH : relativePath;
+}
+
+function templatePathsAtCommit(repositoryRoot, commit) {
+  const paths = git(repositoryRoot, ['ls-tree', '-r', '--name-only', commit, '--', TEMPLATE_PATH])
+    .trim().split('\n').filter(Boolean)
+    .map(filePath => filePath.slice(`${TEMPLATE_PATH}/`.length))
+    .map(logicalTemplatePath)
+    .sort();
+  if (!paths.includes(TEMPLATE_VERSION_PATH)) {
+    throw new Error(`Commit ${commit} does not contain the standalone template at ${TEMPLATE_PATH}`);
+  }
+  return paths;
+}
+
+function templatePathsAtWorktree(repositoryRoot) {
+  const tracked = git(repositoryRoot, ['ls-files', '--', TEMPLATE_PATH])
+    .trim().split('\n').filter(Boolean);
+  const untracked = git(repositoryRoot, ['ls-files', '--others', '--exclude-standard', '--', TEMPLATE_PATH])
+    .trim().split('\n').filter(Boolean);
+  return [...new Set([...tracked, ...untracked])]
+    .map(filePath => filePath.slice(`${TEMPLATE_PATH}/`.length))
+    .map(logicalTemplatePath)
+    .sort();
+}
+
+function readTemplateFile(repositoryRoot, relativePath) {
+  const filePath = path.join(repositoryRoot, TEMPLATE_PATH, storedTemplatePath(relativePath));
+  const stat = fs.lstatSync(filePath, { throwIfNoEntry: false });
+  if (!stat) return null;
+  // Compare link text, never follow a template link outside the canonical tree.
+  return stat.isSymbolicLink() ? Buffer.from(fs.readlinkSync(filePath)) : fs.readFileSync(filePath);
+}
+
+function buffersEqual(left, right) {
+  if (left === null || right === null) return left === right;
+  return left.equals(right);
+}
+
+function normalizedFileMode(mode) {
+  // Strip only the regular-file type prefix; retain symlink/submodule types.
+  return mode?.replace(/^100/, '000') || null;
+}
+
 function assertNoCustomerOwnedChanges(files) {
   const protectedFiles = files.filter(file => isCustomerOwnedPath(file.path));
   if (protectedFiles.length) {
@@ -107,18 +162,22 @@ function assertNoCustomerOwnedChanges(files) {
 }
 
 function readGitFile(repositoryRoot, commit, relativeTemplatePath) {
-  const result = childProcess.spawnSync('git', ['show', `${commit}:${TEMPLATE_PATH}/${relativeTemplatePath}`], { cwd: repositoryRoot, encoding: null });
+  const storedPath = storedTemplatePath(relativeTemplatePath);
+  const result = childProcess.spawnSync('git', ['show', `${commit}:${TEMPLATE_PATH}/${storedPath}`], { cwd: repositoryRoot, encoding: null });
   if (result.error) throw result.error;
   return result.status === 0 ? result.stdout : null;
 }
 
 function fileMode(repositoryRoot, commit, relativePath) {
   if (commit) {
-    const output = git(repositoryRoot, ['ls-tree', commit, `${TEMPLATE_PATH}/${relativePath}`], true);
+    const storedPath = storedTemplatePath(relativePath);
+    const output = git(repositoryRoot, ['ls-tree', commit, `${TEMPLATE_PATH}/${storedPath}`], true);
     return output?.trim().split(/\s+/)[0] || null;
   }
-  const absolutePath = path.join(repositoryRoot, TEMPLATE_PATH, relativePath);
-  return fs.existsSync(absolutePath) ? (fs.statSync(absolutePath).mode & 0o777).toString(8).padStart(6, '0') : null;
+  const absolutePath = path.join(repositoryRoot, TEMPLATE_PATH, storedTemplatePath(relativePath));
+  const stat = fs.lstatSync(absolutePath, { throwIfNoEntry: false });
+  if (!stat) return null;
+  return stat.isSymbolicLink() ? '120000' : (stat.mode & 0o777).toString(8).padStart(6, '0');
 }
 
 async function runAuthoringCommand(command, startPath, options) {
@@ -360,10 +419,7 @@ function buildMigrationStep(repositoryRoot, options) {
   const fromTag = options.fromTag || inferBuildBaseTag(repositoryRoot);
   const templateChanges = getTemplateChanges(repositoryRoot, fromTag);
   const base = { tag: templateChanges.baseTag, commit: templateChanges.baseCommit };
-  const isLegacyBootstrap = !options.fromTag && LEGACY_TEMPLATE_BASELINE_TAG_PATTERN.test(fromTag);
-  const migrationFiles = isLegacyBootstrap
-    ? templateChanges.files.filter(file => !isCustomerOwnedPath(file.path))
-    : templateChanges.files;
+  const migrationFiles = templateChanges.files;
   assertNoCustomerOwnedChanges(migrationFiles);
   if (!migrationFiles.length) {
     if (options.skipIfNoChanges) {
@@ -407,8 +463,8 @@ function buildMigrationStep(repositoryRoot, options) {
   let gitignoreTransition = null;
   for (const relativePath of paths) {
     const baseContent = readGitFile(repositoryRoot, base.commit, relativePath);
-    const targetPath = path.join(repositoryRoot, TEMPLATE_PATH, relativePath);
-    if (fs.existsSync(targetPath) && fs.lstatSync(targetPath).isSymbolicLink()) {
+    const targetPath = path.join(repositoryRoot, TEMPLATE_PATH, storedTemplatePath(relativePath));
+    if (fs.lstatSync(targetPath, { throwIfNoEntry: false })?.isSymbolicLink()) {
       throw new Error(`Symbolic link template change ${relativePath} is not supported`);
     }
     const targetContent = fs.existsSync(targetPath) ? fs.readFileSync(targetPath) : null;
@@ -622,6 +678,7 @@ module.exports = {
   buildPackageTransitions,
   buildTsconfigTransitions,
   getTemplateChanges,
+  isScaffoldOnlyTemplatePath,
   nextNativeRuntime,
   runAuthoringCommand,
   updateProfileFromPackage,

package/scripts/wrap.js

@@ -52,6 +52,11 @@ const { execFileSync } = require('child_process');
 const path = require('path');
 const fs   = require('fs');
 const os   = require('os');
+const {
+  MULTI_TENANT_AUTHORITY,
+  resolveMultiTenantConfig,
+  resolveTenantMode,
+} = require('../lib/commonjs/config/tenantMode.js');
 
 // ─── Parse args ───────────────────────────────────────────────────────────────
 const projectRoot = process.cwd();
@@ -62,6 +67,23 @@ if (platform !== 'android' && platform !== 'ios') {
   process.exit(1);
 }
 
+const appConfigPath = path.join(projectRoot, 'app.json');
+if (!fs.existsSync(appConfigPath)) {
+  console.error('✗ app.json not found.');
+  process.exit(1);
+}
+
+let appConfig;
+let tenantMode;
+try {
+  appConfig = JSON.parse(fs.readFileSync(appConfigPath, 'utf8'));
+  tenantMode = resolveTenantMode(appConfig);
+  if (tenantMode === 'multi') resolveMultiTenantConfig(appConfig);
+} catch (e) {
+  console.error(`✗ Invalid app.json Power Apps build configuration: ${e.message}`);
+  process.exit(1);
+}
+
 // ─── Load wrap.config.json ────────────────────────────────────────────────────
 const configPath = path.join(projectRoot, 'wrap.config.json');
 if (!fs.existsSync(configPath)) {
@@ -86,17 +108,27 @@ for (const field of ['bundleIdentifier', 'displayName']) {
     process.exit(1);
   }
 }
-if (!config.msal?.clientId || !config.msal?.tenantId) {
-  console.error('✗ wrap.config.json: missing required fields msal.clientId / msal.tenantId');
+if (!config.msal?.clientId) {
+  console.error('✗ wrap.config.json: missing required field msal.clientId');
+  process.exit(1);
+}
+if (tenantMode === 'single' && !config.msal.tenantId) {
+  console.error('✗ wrap.config.json: msal.tenantId is required in single-tenant mode');
+  process.exit(1);
+}
+if (tenantMode === 'multi' && config.msal.tenantId && config.msal.tenantId !== MULTI_TENANT_AUTHORITY) {
+  console.error(`✗ wrap.config.json: msal.tenantId must be omitted or "${MULTI_TENANT_AUTHORITY}" in multi-tenant mode`);
   process.exit(1);
 }
 
+const runtimeTenantId = tenantMode === 'multi' ? MULTI_TENANT_AUTHORITY : config.msal.tenantId;
+
 const {
   bundleIdentifier,
   displayName,
   version     = '1.0.0',
   versionCode = 1,
-  msal:       { clientId, tenantId },
+  msal:       { clientId },
   outputPath: outputPathRel = './dist',
 } = config;
 
@@ -132,7 +164,10 @@ function requireCommand(cmd, hint) {
 // ─── Step: write auth.config.json ─────────────────────────────────────────────
 function updateAuthConfig() {
   const authPath = path.join(projectRoot, 'auth.config.json');
-  fs.writeFileSync(authPath, JSON.stringify({ msal: { clientId, tenantId } }, null, 2) + '\n');
+  fs.writeFileSync(
+    authPath,
+    JSON.stringify({ authContractVersion: 2, tenantMode, msal: { clientId, tenantId: runtimeTenantId } }, null, 2) + '\n',
+  );
   ok(`auth.config.json updated (clientId: ${clientId})`);
 }
 
@@ -156,7 +191,9 @@ function runPrebuild(plat) {
     // ADAL / MAM — picked up by app.config.js → baked into Info.plist (iOS)
     // and Android string resources (via the power-apps-native-host config plugin).
     ADAL_CLIENT_ID:        clientId,
-    ADAL_TENANT_ID:        tenantId,
+    ADAL_TENANT_ID:        runtimeTenantId,
+    POWERAPPS_TENANT_MODE: tenantMode,
+    POWERAPPS_AUTH_CONTRACT_VERSION: '2',
     // iOS auth-broker redirect URI — msauth.<bundleId>://auth
     IOS_ADAL_REDIRECT_URI: `msauth.${bundleIdentifier}://auth`,
     // App icon — 1024×1024 PNG; Expo generates all platform sizes at prebuild time.