@microsoft/power-apps-native-host 0.4.0 → 0.5.1

package/lib/commonjs/platform/DataverseGlobalDiscoveryApi.js

@@ -3,36 +3,43 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.fetchAccessibleEnvironments = fetchAccessibleEnvironments;
+exports.fetchInstanceMetadata = fetchInstanceMetadata;
 exports.fetchInstanceUrl = fetchInstanceUrl;
+var _powerAppsNativeCommon = require("@microsoft/power-apps-native-common");
 var _http = require("@microsoft/power-apps-native-common/http");
 var SecureStore = _interopRequireWildcard(require("expo-secure-store"));
 var _index = require("../telemetry/index.js");
 var _GlobalDiscovery = require("./GlobalDiscovery.js");
+var _errors = require("../target/errors.js");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
-const INSTANCE_URL_CACHE_KEY_PREFIX = 'microsoft.power-apps-native-host.instance-url.v1';
+const INSTANCE_URL_CACHE_KEY_PREFIX = 'microsoft.power-apps-native-host.instance-url.v3';
 const INSTANCE_URL_CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1000;
 function getInstanceUrlCacheKey(environmentId, region) {
   return `${INSTANCE_URL_CACHE_KEY_PREFIX}.${region.toLowerCase()}.${environmentId.toLowerCase()}`;
 }
 async function getCachedInstanceUrl(environmentId, region) {
   try {
-    const cachedValue = await SecureStore.getItemAsync(getInstanceUrlCacheKey(environmentId, region));
+    const cacheKey = getInstanceUrlCacheKey(environmentId, region);
+    const cachedValue = await SecureStore.getItemAsync(cacheKey);
     if (!cachedValue) {
       return null;
     }
     const entry = JSON.parse(cachedValue);
-    if (typeof entry.instanceUrl !== 'string' || typeof entry.expiresAt !== 'number' || entry.expiresAt <= Date.now()) {
+    if (typeof entry.instanceUrl !== 'string' || entry.telemetryLocation !== undefined && entry.telemetryLocation !== 'eu' && entry.telemetryLocation !== 'global' || typeof entry.expiresAt !== 'number' || entry.expiresAt <= Date.now()) {
+      await SecureStore.deleteItemAsync(cacheKey);
       return null;
     }
-    return entry.instanceUrl;
+    return entry;
   } catch {
     return null;
   }
 }
-async function cacheInstanceUrl(environmentId, region, instanceUrl) {
+async function cacheInstanceUrl(environmentId, region, instanceUrl, telemetryLocation) {
   try {
     const entry = {
       instanceUrl,
+      telemetryLocation,
       expiresAt: Date.now() + INSTANCE_URL_CACHE_TTL_MS
     };
     await SecureStore.setItemAsync(getInstanceUrlCacheKey(environmentId, region), JSON.stringify(entry));
@@ -44,20 +51,40 @@ function getSafeErrorName(error) {
   return error instanceof Error ? error.constructor.name : typeof error;
 }
 
-/** Fetch the Dataverse instance URL from the Dataverse Global Discovery Service. */
-async function fetchInstanceUrl(environmentId, region, acquireToken, _bearerToken) {
+/** Enumerate enabled commercial-cloud Dataverse environments available to an authenticated tenant account. */
+async function fetchAccessibleEnvironments(tenantId, appDisplayName, appName, acquireToken) {
+  try {
+    const region = 'prod';
+    const token = await acquireToken([(0, _GlobalDiscovery.globalDiscoveryScope)(region)]);
+    if (!token) throw new Error('Global Discovery token is unavailable');
+    const response = await _index.platformHttpClient.request((0, _GlobalDiscovery.buildGlobalDiscoveryListUrl)(region), {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      }
+    });
+    if (!response.ok) throw new Error(`Global Discovery returned ${response.status} ${response.statusText}`);
+    const result = await response.json();
+    return (0, _GlobalDiscovery.parseDiscoveredEnvironments)(Array.isArray(result.value) ? result.value : [], tenantId, appDisplayName, appName);
+  } catch (error) {
+    throw new _errors.TargetRuntimeError('discovery-failed', 'discovery', true, 'Your environments could not be loaded. Try again.', undefined, error);
+  }
+}
+/** Fetch Dataverse environment metadata from the Global Discovery Service. */
+async function fetchInstanceMetadata(environmentId, region, acquireToken, _bearerToken) {
   const scenario = (0, _index.getAppLogger)().trackScenario(_index.HostOperationNames.PlatformFetchInstanceUrl, {
     environmentId,
     region
   });
   try {
-    const cachedInstanceUrl = await getCachedInstanceUrl(environmentId, region);
-    if (cachedInstanceUrl) {
+    const cachedMetadata = await getCachedInstanceUrl(environmentId, region);
+    if (cachedMetadata) {
       scenario.complete({
         hasInstanceUrl: true,
         cacheHit: true
       });
-      return cachedInstanceUrl;
+      return cachedMetadata;
     }
     const url = (0, _GlobalDiscovery.buildGlobalDiscoveryUrl)(environmentId, region);
     const token = await acquireToken([(0, _GlobalDiscovery.globalDiscoveryScope)(region)]);
@@ -75,20 +102,30 @@ async function fetchInstanceUrl(environmentId, region, acquireToken, _bearerToke
       throw new Error(`fetchInstanceUrl: Global Discovery returned ${response.status} ${response.statusText}`);
     }
     const result = await response.json();
-    const instanceUrl = result.value?.find(instance => instance.EnvironmentId?.toLowerCase() === environmentId.toLowerCase())?.ApiUrl;
+    const instance = result.value?.find(instance => instance.EnvironmentId?.toLowerCase() === environmentId.toLowerCase());
+    const instanceUrl = instance?.ApiUrl;
+    const telemetryLocation = (0, _powerAppsNativeCommon.tryResolveTelemetryLocationFromDataverseRegion)(instance?.Region);
     if (instanceUrl) {
-      await cacheInstanceUrl(environmentId, region, instanceUrl);
+      await cacheInstanceUrl(environmentId, region, instanceUrl, telemetryLocation);
     }
     scenario.complete({
       hasInstanceUrl: instanceUrl !== undefined,
       cacheHit: false,
       ...(0, _http.getHttpCorrelationProperties)(response.headers)
     });
-    return instanceUrl;
+    return instanceUrl ? {
+      instanceUrl,
+      telemetryLocation
+    } : undefined;
   } catch (error) {
     scenario.fail(undefined, {
       errorName: getSafeErrorName(error)
     });
     throw error;
   }
+}
+
+/** Fetch only the Dataverse instance URL for callers that do not need region metadata. */
+async function fetchInstanceUrl(environmentId, region, acquireToken, bearerToken) {
+  return (await fetchInstanceMetadata(environmentId, region, acquireToken, bearerToken))?.instanceUrl;
 }

package/lib/commonjs/platform/GlobalDiscovery.js

@@ -3,9 +3,13 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.buildGlobalDiscoveryListUrl = buildGlobalDiscoveryListUrl;
 exports.buildGlobalDiscoveryUrl = buildGlobalDiscoveryUrl;
 exports.globalDiscoveryEndpoint = globalDiscoveryEndpoint;
 exports.globalDiscoveryScope = globalDiscoveryScope;
+exports.isEnabledDiscoveryState = isEnabledDiscoveryState;
+exports.parseDiscoveredEnvironments = parseDiscoveredEnvironments;
+var _CanvasAppResolution = require("./CanvasAppResolution.js");
 const GLOBAL_DISCOVERY_HOST = {
   prod: 'globaldisco.crm.dynamics.com',
   gcc: 'globaldisco.crm9.dynamics.com',
@@ -28,6 +32,35 @@ const REGION_DISCOVERY_CLOUD = {
   mooncake: 'china'
 };
 const ENVIRONMENT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function isEnabledDiscoveryState(state) {
+  return state === 0 || typeof state === 'string' && (state === '0' || state.toLowerCase() === 'enabled');
+}
+function parseDiscoveredEnvironments(instances, tenantId, appDisplayName, appName) {
+  const normalizedTenantId = tenantId.trim().toLowerCase();
+  const environments = new Map();
+  for (const instance of instances) {
+    if (!isEnabledDiscoveryState(instance.State) || typeof instance.EnvironmentId !== 'string' || !ENVIRONMENT_ID_PATTERN.test(instance.EnvironmentId) || typeof instance.TenantId !== 'string' || instance.TenantId.toLowerCase() !== normalizedTenantId || typeof instance.ApiUrl !== 'string') continue;
+    const environmentId = instance.EnvironmentId.toLowerCase();
+    try {
+      const dataverseApiUrl = (0, _CanvasAppResolution.canonicalizeDataverseOrigin)(instance.ApiUrl);
+      if (environments.has(environmentId)) continue;
+      environments.set(environmentId, {
+        id: environmentId,
+        label: typeof instance.FriendlyName === 'string' && instance.FriendlyName.trim() ? instance.FriendlyName.trim() : environmentId,
+        tenantId: normalizedTenantId,
+        environmentId,
+        appDisplayName,
+        appName,
+        region: 'prod',
+        cloud: 'commercial',
+        dataverseApiUrl
+      });
+    } catch {
+      // Ignore records with untrusted or malformed API origins.
+    }
+  }
+  return [...environments.values()].sort((left, right) => left.label.localeCompare(right.label));
+}
 function globalDiscoveryEndpoint(region) {
   const cloud = REGION_DISCOVERY_CLOUD[region];
   if (!cloud) {
@@ -44,8 +77,14 @@ function buildGlobalDiscoveryUrl(environmentId, region) {
   }
   const normalizedEnvironmentId = environmentId.toLowerCase();
   const query = new URLSearchParams({
-    '$select': 'ApiUrl,EnvironmentId',
+    '$select': 'ApiUrl,EnvironmentId,Region',
     '$filter': `EnvironmentId eq '${normalizedEnvironmentId}'`
   });
   return `${globalDiscoveryEndpoint(region)}/api/discovery/v2.0/Instances?${query.toString()}`;
+}
+function buildGlobalDiscoveryListUrl(region) {
+  const query = new URLSearchParams({
+    '$select': 'ApiUrl,EnvironmentId,FriendlyName,Region,State,TenantId'
+  });
+  return `${globalDiscoveryEndpoint(region)}/api/discovery/v2.0/Instances?${query.toString()}`;
 }

package/lib/commonjs/provider/PowerAppsHostProvider.js

@@ -19,6 +19,7 @@ var _connectionState = require("../connections/connectionState.js");
 var _isDevPlayer = require("../utils/isDevPlayer.js");
 var _logger = require("../logger.js");
 var _index = require("../telemetry/index.js");
+var _CanvasAppResolution = require("../platform/CanvasAppResolution.js");
 var _jsxRuntime = require("react/jsx-runtime");
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
 /*!
@@ -73,6 +74,12 @@ function PowerAppsHostProvider({
   databaseReferences,
   renderOAuthWebView,
   isvClientId,
+  onTelemetryLocationResolved,
+  targetGeneration,
+  targetTenantId,
+  targetAppName,
+  targetAccountIdentifier,
+  expectedDataverseOrigin,
   onDisambiguationNeeded,
   onConnectionConsent,
   onResourceConsent,
@@ -153,7 +160,14 @@ function PowerAppsHostProvider({
     hasDataverse: (0, _DataverseDataSources.hasDataverseDatabaseReferences)(databaseReferences),
     schemaMap,
     onDisambiguationNeeded,
-    isvClientId
+    isvClientId,
+    onTelemetryLocationResolved,
+    targetIdentity: targetGeneration !== undefined && targetTenantId && targetAppName && targetAccountIdentifier ? {
+      tenantId: targetTenantId,
+      appName: targetAppName,
+      generation: targetGeneration,
+      accountIdentifier: targetAccountIdentifier
+    } : undefined
   });
 
   // Reset setup gate when the user signs out.
@@ -185,8 +199,24 @@ function PowerAppsHostProvider({
   // Build the missing-connector entries for ConnectionSetupScreen.
   const missingEntries = (0, _react.useMemo)(() => missingConnectionReferences, [missingConnectionReferences]);
   const resourceConsents = (0, _react.useMemo)(() => [...new Map(launchResourceConsents.map(resource => [resource.resourceId.toLowerCase(), resource])).values()], [launchResourceConsents]);
-  const currentConfigKey = (0, _react.useMemo)(() => (0, _types.buildConnectionResolutionKey)(appId, environmentId, _isDevPlayer.isDevPlayer ? connectionReferences : {}), [appId, environmentId, connectionReferences, _isDevPlayer.isDevPlayer]);
+  const currentConfigKey = (0, _react.useMemo)(() => (0, _types.buildConnectionResolutionKey)(appId, environmentId, _isDevPlayer.isDevPlayer ? connectionReferences : {}, targetGeneration !== undefined ? {
+    tenantId: targetTenantId,
+    appName: targetAppName,
+    region,
+    generation: targetGeneration,
+    accountIdentifier: targetAccountIdentifier
+  } : undefined), [appId, environmentId, connectionReferences, _isDevPlayer.isDevPlayer, region, targetAccountIdentifier, targetAppName, targetGeneration, targetTenantId]);
   const resolutionMatchesCurrentConfig = resolvedConfigKey === currentConfigKey;
+  const launchTargetMismatch = (() => {
+    if (!expectedDataverseOrigin) return false;
+    if (!isReady || !resolutionMatchesCurrentConfig) return false;
+    if (!dataverseOrgUrl) return true;
+    try {
+      return !(0, _CanvasAppResolution.areDataverseOriginAliases)(expectedDataverseOrigin, dataverseOrgUrl);
+    } catch {
+      return true;
+    }
+  })();
   const needsConsent = (0, _connectionState.shouldShowConnectionReview)(_isDevPlayer.isDevPlayer, requiresConnectionConsent, resourceConsents.length > 0);
 
   // Called by ConnectionSetupScreen once every missing connector is resolved.
@@ -260,17 +290,21 @@ function PowerAppsHostProvider({
   connectionRefsRef.current = connectionRefs;
   const configuredBridgeInputsRef = (0, _react.useRef)(undefined);
   const [, setBridgeRegistrationVersion] = (0, _react.useState)(0);
-  const hasResolvedConnections = isSignedIn && isReady && resolutionMatchesCurrentConfig && (missingConnectors.length === 0 || consentApproved) && (!needsConsent || consentApproved);
+  const hasResolvedConnections = isSignedIn && isReady && resolutionMatchesCurrentConfig && !launchTargetMismatch && (missingConnectors.length === 0 || consentApproved) && (!needsConsent || consentApproved);
   const isBridgeConfiguredFor = (connections, dataSources) => {
     const currentInputs = configuredBridgeInputsRef.current;
-    return currentInputs?.connections === connections && currentInputs.dataSources === dataSources;
+    const runtimeIdentity = targetGeneration === undefined ? undefined : `${targetGeneration}:${targetAccountIdentifier ?? ''}`;
+    return currentInputs?.connections === connections && currentInputs.dataSources === dataSources && currentInputs.runtimeIdentity === runtimeIdentity;
   };
   const configureBridgeNow = (0, _react.useCallback)((connections, dataSources) => {
     const previousInputs = configuredBridgeInputsRef.current;
-    const shouldConfigureBridge = !previousInputs || previousInputs.connections !== connections || previousInputs.dataSources !== dataSources;
+    const runtimeIdentity = targetGeneration === undefined ? undefined : `${targetGeneration}:${targetAccountIdentifier ?? ''}`;
+    const shouldConfigureBridge = !previousInputs || previousInputs.connections !== connections || previousInputs.dataSources !== dataSources || previousInputs.runtimeIdentity !== runtimeIdentity;
     if (!shouldConfigureBridge) return;
     (0, _logger.debugLog)(`[PAHost] setupNativeHost: isReady=${isReady} missingConnectors=${missingConnectors.length} setupDone=${setupDone} connections=${Object.keys(connections).join(', ') || '(none)'}`);
     (0, _setupNativeHost.setupNativeHost)({
+      targetGeneration,
+      runtimeIdentity,
       getConnectorToken: async _apiId => {
         (0, _logger.debugLog)(`[PAHost] getConnectorToken: acquiring token for apiId="${_apiId}"`);
         let token;
@@ -327,11 +361,12 @@ function PowerAppsHostProvider({
     });
     configuredBridgeInputsRef.current = {
       connections,
-      dataSources
+      dataSources,
+      runtimeIdentity
     };
     setBridgeRegistrationVersion(version => version + 1);
     (0, _logger.debugLog)('[PAHost] bridge registered');
-  }, [isReady, missingConnectors.length, setupDone]);
+  }, [isReady, missingConnectors.length, setupDone, targetAccountIdentifier, targetGeneration]);
   const staticBridgeRegistered = isBridgeConfiguredFor(staticConnectionRefs, cdsDataSources);
   const resolvedBridgeRegistered = hasResolvedConnections && isBridgeConfiguredFor(mergedRefs, cdsDataSources);
 
@@ -369,7 +404,11 @@ function PowerAppsHostProvider({
 
   if (connectionError) {
     const accessDenied = connectionErrorKind === 'app-access-denied';
-    return renderConnectionError(accessDenied ? 'You don’t have access' : 'Unable to load app', [connectionError], accessDenied);
+    const appNotFound = connectionErrorKind === 'app-not-found';
+    return renderConnectionError(accessDenied ? 'You don’t have access' : appNotFound ? 'App not found' : 'Unable to load app', [connectionError], accessDenied);
+  }
+  if (launchTargetMismatch) {
+    return renderConnectionError('Environment mismatch', ['The app launch response does not match the selected environment. Return to environment selection and try again.']);
   }
   if (configurationErrors.length > 0) {
     return renderConnectionError('Connection configuration error', configurationErrors);

package/lib/commonjs/provider/PowerAppsProvider.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.PowerAppsProvider = PowerAppsProvider;
+var _CanvasAppResolution = require("../platform/CanvasAppResolution.js");
 var _react = _interopRequireWildcard(require("react"));
 var _reactNative = require("react-native");
 var _reactNativeGestureHandler = require("react-native-gesture-handler");
@@ -26,6 +27,12 @@ var _createOfflineHostActivationCallbacks = require("../offline/createOfflineHos
 var _useOfflineIntegrationWithStartupGate = require("../offline/useOfflineIntegrationWithStartupGate");
 var _SessionDetailsGesture = require("./SessionDetailsGesture.js");
 var _OfflineSdkTelemetry = require("../telemetry/OfflineSdkTelemetry");
+var _setupNativeHost = require("../bridge/setupNativeHost.js");
+var _errors = require("../target/errors.js");
+var _GlobalDiscovery = require("../platform/GlobalDiscovery.js");
+var _tenantMode = require("../config/tenantMode.js");
+var _runtimeTenantMode = require("../config/runtimeTenantMode");
+var _PowerAppsTargetBootstrap = require("../target/PowerAppsTargetBootstrap.js");
 var _jsxRuntime = require("react/jsx-runtime");
 function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
 function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r = new WeakMap(), n = new WeakMap(); return (_interopRequireWildcard = function (e, t) { if (!t && e && e.__esModule) return e; var o, i, f = { __proto__: null, default: e }; if (null === e || "object" != typeof e && "function" != typeof e) return f; if (o = t ? n : r) { if (o.has(e)) return o.get(e); o.set(e, f); } for (const t in e) "default" !== t && {}.hasOwnProperty.call(e, t) && ((i = (o = Object.defineProperty) && Object.getOwnPropertyDescriptor(e, t)) && (i.get || i.set) ? o(f, t, i) : f[t] = e[t]); return f; })(e, t); }
@@ -57,7 +64,6 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
  */
 
 (0, _powerAppsNativeCommon.suppressKnownWarnings)();
-
 // ---- React-Query wiring (runs once at module load) ----
 
 // Wire onlineManager to NetInfo so refetchOnReconnect fires on mobile
@@ -90,6 +96,7 @@ _reactQuery.focusManager.setEventListener(handleFocus => {
 // The bare @tamagui/config/v5 preset is only a last-resort fallback for tests
 // and storybook — it will not resolve custom $surface* tokens.
 const defaultTamaguiConfig = (0, _core.createTamagui)(_v.defaultConfig);
+const EMPTY_TARGET_CONNECTION_REFERENCES = {};
 function hasConfiguredValue(value) {
   return typeof value === 'string' && value.trim().length > 0;
 }
@@ -170,6 +177,65 @@ function readAppInsightsConfig(value) {
 // Separate from PowerAppsProvider only because useAuth() must be called inside
 // AuthProvider. All auth-dependent wiring lives here.
 
+function TargetInnerProviders({
+  target,
+  authSession,
+  connectionReferences,
+  databaseReferences,
+  schemaMap,
+  renderOAuthWebView,
+  onDisambiguationNeeded,
+  onConnectionConsent,
+  onResourceConsent,
+  onConnectionConsentDeclined,
+  children
+}) {
+  if (authSession.accountTenantId.toLowerCase() !== target.tenantId.toLowerCase()) {
+    throw new _errors.TargetRuntimeError('tenant-mismatch', 'authentication', true, 'Sign in with an account that can access the selected environment tenant.', target.id);
+  }
+  const acquireToken = async scopes => {
+    if (scopes.length !== 1) throw new Error('Target token requests must use one audience');
+    const scope = scopes[0];
+    if (scope === 'https://apihub.azure.com/.default') return authSession.tokenBroker.acquireApiHubToken();
+    if (scope === (0, _PowerPlatformEnvironmentApi.powerPlatformScope)(target.region)) return authSession.tokenBroker.acquirePowerPlatformToken(target.region);
+    if (scope === (0, _PowerPlatformEnvironmentApi.connectionUserConsentScope)(target.region)) return authSession.tokenBroker.acquireConnectionUserConsentToken(target.region);
+    if (scope === (0, _GlobalDiscovery.globalDiscoveryScope)(target.region)) return authSession.tokenBroker.acquireGlobalDiscoveryToken();
+    const dataverseSuffix = ['/user_impersonation', '/.default'].find(suffix => scope.endsWith(suffix));
+    if (dataverseSuffix) {
+      const requestedOrigin = scope.slice(0, -dataverseSuffix.length);
+      if ((0, _CanvasAppResolution.areDataverseOriginAliases)(requestedOrigin, target.dataverseApiUrl)) {
+        return authSession.tokenBroker.acquireDataverseToken(requestedOrigin);
+      }
+    }
+    throw new Error(`Unsupported target token audience: ${scope}`);
+  };
+  (0, _react.useEffect)(() => {
+    return () => (0, _setupNativeHost.invalidateNativeHostRuntime)();
+  }, [authSession.accountIdentifier, authSession.generation]);
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(_PowerAppsHostProvider.PowerAppsHostProvider, {
+    acquireToken: acquireToken,
+    isSignedIn: true,
+    onSignOut: authSession.signOut,
+    appId: target.appId,
+    environmentId: target.environmentId,
+    region: target.region,
+    connectionReferences: connectionReferences,
+    schemaMap: schemaMap,
+    databaseReferences: databaseReferences,
+    isvClientId: authSession.clientId,
+    targetGeneration: authSession.generation,
+    targetTenantId: target.tenantId,
+    targetAppName: target.appName,
+    targetAccountIdentifier: authSession.accountIdentifier,
+    expectedDataverseOrigin: target.dataverseApiUrl,
+    renderOAuthWebView: renderOAuthWebView,
+    onDisambiguationNeeded: onDisambiguationNeeded,
+    onConnectionConsent: onConnectionConsent,
+    onResourceConsent: onResourceConsent,
+    onConnectionConsentDeclined: onConnectionConsentDeclined,
+    children: children
+  });
+}
 function InnerProviders({
   msalConfig,
   powerConfig,
@@ -181,6 +247,7 @@ function InnerProviders({
   onConnectionConsentDeclined,
   offlineProfile,
   onOfflineEnabledChange,
+  onTelemetryLocationResolved,
   children
 }) {
   const {
@@ -218,6 +285,7 @@ function InnerProviders({
     onConnectionConsent: onConnectionConsent,
     onResourceConsent: onResourceConsent,
     onConnectionConsentDeclined: onConnectionConsentDeclined,
+    onTelemetryLocationResolved: onTelemetryLocationResolved,
     children: [offline.shouldMountChildren && children, offline.StatusOverlay && /*#__PURE__*/(0, _jsxRuntime.jsx)(offline.StatusOverlay, {})]
   });
 }
@@ -233,9 +301,70 @@ function InnerProviders({
  * root layout.
  */
 function PowerAppsProvider({
+  ...props
+}) {
+  const {
+    appConfig,
+    msalConfig,
+    intuneConfig,
+    powerConfig,
+    schemaMap,
+    offlineProfile,
+    multiTenantExperience,
+    children,
+    ...commonProps
+  } = props;
+  const effectiveAppConfig = appConfig ?? {
+    expo: _expoConstants.default.expoConfig
+  };
+  const tenantMode = (0, _tenantMode.resolveTenantMode)(effectiveAppConfig);
+  (0, _runtimeTenantMode.assertNativeTenantMode)(tenantMode);
+  if (tenantMode === 'multi') {
+    const multiTenantConfig = (0, _tenantMode.resolveMultiTenantConfig)(effectiveAppConfig);
+    return /*#__PURE__*/(0, _jsxRuntime.jsx)(_PowerAppsTargetBootstrap.PowerAppsTargetBootstrap, {
+      msalConfig: msalConfig,
+      appDisplayName: multiTenantConfig.appDisplayName,
+      appName: multiTenantConfig.appName,
+      tenantPolicy: multiTenantConfig.tenantPolicy,
+      experienceComponent: multiTenantExperience,
+      children: (resolvedTarget, authSession) => /*#__PURE__*/(0, _jsxRuntime.jsx)(PowerAppsRuntimeProvider, {
+        ...commonProps,
+        appName: commonProps.appName ?? multiTenantConfig.appDisplayName,
+        appConfig: appConfig,
+        resolvedTarget: resolvedTarget,
+        authSession: authSession,
+        targetGeneration: authSession.generation,
+        powerConfig: {
+          appId: resolvedTarget.appId,
+          environmentId: resolvedTarget.environmentId,
+          region: resolvedTarget.region,
+          geoRegion: powerConfig.geoRegion,
+          connectionReferences: _isDevPlayer.isDevPlayer ? powerConfig.connectionReferences ?? {} : {},
+          databaseReferences: _isDevPlayer.isDevPlayer ? powerConfig.databaseReferences ?? {} : {}
+        },
+        schemaMap: _isDevPlayer.isDevPlayer ? schemaMap : {},
+        children: children
+      })
+    });
+  }
+  return /*#__PURE__*/(0, _jsxRuntime.jsx)(PowerAppsRuntimeProvider, {
+    ...commonProps,
+    appConfig: appConfig,
+    msalConfig: msalConfig,
+    intuneConfig: intuneConfig,
+    powerConfig: powerConfig,
+    schemaMap: schemaMap,
+    offlineProfile: offlineProfile,
+    children: children
+  });
+}
+function PowerAppsRuntimeProvider({
   appConfig,
   msalConfig,
   intuneConfig,
+  resolvedTarget,
+  authSession,
+  targetGeneration,
   powerConfig,
   schemaMap,
   tamaguiConfig = defaultTamaguiConfig,
@@ -257,13 +386,31 @@ function PowerAppsProvider({
   offlineProfile,
   children
 }) {
+  const targetAware = resolvedTarget !== undefined;
+  if (targetAware) {
+    if (!authSession || targetGeneration !== authSession.generation) {
+      throw new _errors.TargetRuntimeError('stale-operation', 'switching', false, 'The selected environment changed.');
+    }
+    if (offlineProfile) {
+      throw new _errors.TargetRuntimeError('offline-switch-unsupported', 'configuration', false, 'Offline mode is not available when switching environments.', resolvedTarget.id);
+    }
+    if (powerConfig.appId && powerConfig.appId.toLowerCase() !== resolvedTarget.appId.toLowerCase() || powerConfig.environmentId && powerConfig.environmentId.toLowerCase() !== resolvedTarget.environmentId.toLowerCase() || powerConfig.region && powerConfig.region.toLowerCase() !== resolvedTarget.region.toLowerCase()) {
+      throw new _errors.TargetRuntimeError('invalid-build-config', 'configuration', false, 'The selected environment does not match the packaged app configuration.', resolvedTarget.id);
+    }
+  }
   // Capture the logger-prop identity at mount time so the effect dep array
   // is stable (loggerProp is an object reference; re-running on every render
   // would reconfigure and leak the previous provider).
   const loggerPropRef = (0, _react.useRef)(loggerProp);
   const appInsightsConfigRef = (0, _react.useRef)(appInsightsConfig ?? readAppInsightsConfig(appConfig?.expo?.extra?.appInsightsConfig ?? _expoConstants.default.expoConfig?.extra?.appInsightsConfig));
   const [offlineTelemetryEnabled, setOfflineTelemetryEnabled] = (0, _react.useState)();
-  const missingClientIdInDevPlayer = _reactNative.Platform.OS !== 'web' && _isDevPlayer.isDevPlayer && !hasConfiguredValue(msalConfig.clientId) && requiresPowerPlatformAuth(powerConfig);
+  const oneDsProviderRef = (0, _react.useRef)(undefined);
+  const resolvedTelemetryLocationRef = (0, _react.useRef)(undefined);
+  const handleTelemetryLocationResolved = (0, _react.useCallback)(location => {
+    resolvedTelemetryLocationRef.current = location;
+    void oneDsProviderRef.current?.resolveTelemetryLocation(location);
+  }, []);
+  const missingClientIdInDevPlayer = !targetAware && _reactNative.Platform.OS !== 'web' && _isDevPlayer.isDevPlayer && !hasConfiguredValue(msalConfig?.clientId) && requiresPowerPlatformAuth(powerConfig);
   const missingAppId = _reactNative.Platform.OS !== 'web' && !_isDevPlayer.isDevPlayer && !hasConfiguredValue(powerConfig.appId);
   const missingEnvironmentId = !_isDevPlayer.isDevPlayer && !hasConfiguredValue(powerConfig.environmentId);
   const appId = typeof powerConfig.appId === 'string' ? powerConfig.appId.trim() : '';
@@ -273,7 +420,7 @@ function PowerAppsProvider({
   const skillCorrelationId = typeof appInstanceId === 'string' ? appInstanceId.trim() : '';
   const sessionDetailsGestureEnabled = showSessionDetailsOnLongPress ?? showSessionDetailsOnSwipe ?? true;
   const requiredAuthScopes = (0, _react.useMemo)(() => [(0, _PowerPlatformEnvironmentApi.powerPlatformScope)(powerConfig.region ?? 'prod')], [powerConfig.region]);
-  const queryClient = (0, _react.useMemo)(() => (0, _createOfflineHostActivationCallbacks.createHostQueryClient)(), []);
+  const queryClient = (0, _react.useMemo)(() => (0, _createOfflineHostActivationCallbacks.createHostQueryClient)(), [targetGeneration, authSession?.accountIdentifier]);
 
   // Configure the app logger exactly once per mount inside useEffect so that
   // side effects (provider construction, async resolveDeviceId) never run
@@ -299,7 +446,9 @@ function PowerAppsProvider({
         clientType: appName ?? 'PowerAppsNative',
         appVersion: _expoConstants.default.expoConfig?.version,
         minSeverity: __DEV__ ? 'verbose' : 'info',
-        telemetryLocation: (0, _powerAppsNativeCommon.resolveTelemetryLocation)(powerConfig.geoRegion),
+        // Existing host inputs and API responses do not expose authoritative
+        // geography for every app. Keep public-cloud telemetry in EU rather
+        // than infer residency from an opaque ID or a service endpoint URL.
         commonProperties: {
           ...(appId ? {
             appId
@@ -313,10 +462,14 @@ function PowerAppsProvider({
         }
       };
       const configureDefaultLogger = (deviceId = 'react-native') => {
+        const resolvedTelemetryLocation = resolvedTelemetryLocationRef.current;
         const oneDsProvider = new _powerAppsNativeCommon.OneDsTelemetryProvider({
           ...providerConfig,
-          deviceId
+          deviceId,
+          telemetryLocation: resolvedTelemetryLocation ?? 'eu',
+          anonymous: !resolvedTelemetryLocation
         });
+        oneDsProviderRef.current = oneDsProvider;
         const providers = [oneDsProvider];
         let appInsightsEnabled = false;
         const configuredAppInsights = appInsightsConfigRef.current;
@@ -399,7 +552,19 @@ function PowerAppsProvider({
                 appVersion: _expoConstants.default.expoConfig?.version,
                 children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactQuery.QueryClientProvider, {
                   client: queryClient,
-                  children: missingAppId ? /*#__PURE__*/(0, _jsxRuntime.jsx)(MissingAppIdErrorScreen, {}) : missingEnvironmentId ? /*#__PURE__*/(0, _jsxRuntime.jsx)(MissingEnvironmentIdErrorScreen, {}) : missingClientIdInDevPlayer ? /*#__PURE__*/(0, _jsxRuntime.jsx)(MissingClientIdErrorScreen, {}) : /*#__PURE__*/(0, _jsxRuntime.jsx)(_AuthContext.AuthProvider, {
+                  children: missingAppId ? /*#__PURE__*/(0, _jsxRuntime.jsx)(MissingAppIdErrorScreen, {}) : missingEnvironmentId ? /*#__PURE__*/(0, _jsxRuntime.jsx)(MissingEnvironmentIdErrorScreen, {}) : missingClientIdInDevPlayer ? /*#__PURE__*/(0, _jsxRuntime.jsx)(MissingClientIdErrorScreen, {}) : targetAware && authSession ? /*#__PURE__*/(0, _jsxRuntime.jsx)(TargetInnerProviders, {
+                    target: resolvedTarget,
+                    authSession: authSession,
+                    connectionReferences: powerConfig.connectionReferences ?? EMPTY_TARGET_CONNECTION_REFERENCES,
+                    databaseReferences: powerConfig.databaseReferences,
+                    schemaMap: schemaMap,
+                    renderOAuthWebView: renderOAuthWebView,
+                    onDisambiguationNeeded: onDisambiguationNeeded,
+                    onConnectionConsent: onConnectionConsent,
+                    onResourceConsent: onResourceConsent,
+                    onConnectionConsentDeclined: onConnectionConsentDeclined,
+                    children: children
+                  }) : /*#__PURE__*/(0, _jsxRuntime.jsx)(_AuthContext.AuthProvider, {
                     msalConfig: msalConfig,
                     intuneConfig: intuneConfig,
                     requiredScopes: requiredAuthScopes,
@@ -414,6 +579,7 @@ function PowerAppsProvider({
                       onConnectionConsentDeclined: onConnectionConsentDeclined,
                       offlineProfile: offlineProfile,
                       onOfflineEnabledChange: setOfflineTelemetryEnabled,
+                      onTelemetryLocationResolved: handleTelemetryLocationResolved,
                       children: children
                     })
                   })