@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/lib/module/connections/connectionMetadata.js

@@ -0,0 +1,112 @@
+"use strict";
+
+import { getConnectorId } from "./types.js";
+export function parseConnectionParameters(parameters) {
+  return Object.entries(parameters ?? {}).flatMap(([name, parameter]) => {
+    if (!parameter.uiDefinition) return [];
+    const constraints = parameter.uiDefinition.constraints;
+    const type = (parameter.type ?? 'string').toLowerCase();
+    const supportedType = type === 'string' || type === 'securestring' || type === 'boolean' || type === 'integer' || type === 'clientcertificate' ? type : null;
+    if (!supportedType) return [];
+    return [{
+      name,
+      displayName: parameter.uiDefinition.displayName ?? name,
+      type: supportedType,
+      required: constraints?.required === true || constraints?.required === 'true',
+      hidden: constraints?.hidden === true || constraints?.hidden === 'true',
+      capabilities: constraints?.capability,
+      allowedValues: constraints?.allowedValues?.filter(item => Boolean(item.value)).map(item => ({
+        value: item.value,
+        displayName: item.displayName ?? item.value
+      })),
+      defaultValue: parameter.defaultValue
+    }];
+  });
+}
+export function buildConnectionParameterSets(connectionParameters, parameterSets) {
+  const declaredSets = (parameterSets ?? []).filter(item => Boolean(item.name)).map(item => ({
+    name: item.name,
+    displayName: item.uiDefinition?.displayName ?? item.name,
+    parameters: parseConnectionParameters(item.connectionParameters ?? item.parameters),
+    requiresApiConsent: hasOAuthParameter(item.connectionParameters ?? item.parameters),
+    gatewayParameterName: Object.entries(item.connectionParameters ?? item.parameters ?? {}).find(([, parameter]) => parameter.type?.toLowerCase() === 'gatewaysetting')?.[0]
+  }));
+  return declaredSets.length > 0 ? declaredSets : [{
+    name: undefined,
+    displayName: 'Default',
+    parameters: parseConnectionParameters(connectionParameters),
+    requiresApiConsent: hasOAuthParameter(connectionParameters),
+    gatewayParameterName: Object.entries(connectionParameters ?? {}).find(([, parameter]) => parameter.type?.toLowerCase() === 'gatewaysetting')?.[0]
+  }];
+}
+export function hasOAuthParameter(parameters) {
+  return Object.values(parameters ?? {}).some(parameter => parameter.type?.toLowerCase() === 'oauthsetting');
+}
+export function buildConnectionUserConsentUrl(environmentEndpoint, connectorId, connectionId) {
+  return `${environmentEndpoint}/connectivity/connectors/${encodeURIComponent(getConnectorId(connectorId))}` + `/connections/${encodeURIComponent(connectionId)}/userConsent?api-version=1`;
+}
+export function getAppLaunchFailureMessage(status, statusText, responseText) {
+  if (status === 404) return null;
+  return `Unable to load the published app (HTTP ${status}): ${responseText || statusText}`;
+}
+export function isAppLaunchAccessDenied(status, responseText) {
+  if (status !== 403) return false;
+  try {
+    const body = JSON.parse(responseText);
+    return body.error?.code === 'PowerAppsNoAccess' || body.error?.details?.some(detail => detail.code === 'PowerAppsNoAccess') === true;
+  } catch {
+    return false;
+  }
+}
+export function buildConsentLinkDefinition(redirectUrl) {
+  return {
+    redirectUrl
+  };
+}
+export function serializeConnectionParameters(input) {
+  const parameters = {
+    ...(input?.parameters ?? {}),
+    ...(input?.gatewayObjectId && input.gatewayParameterName ? {
+      [input.gatewayParameterName]: {
+        gatewayObjectId: input.gatewayObjectId
+      }
+    } : {})
+  };
+  if (!input?.parameterSetName) return {
+    connectionParameters: parameters
+  };
+  return {
+    connectionParametersSet: {
+      name: input.parameterSetName,
+      values: Object.fromEntries(Object.entries(parameters).map(([name, value]) => [name, {
+        value
+      }]))
+    }
+  };
+}
+export function buildConnectionUsageUrl(environmentBaseUrl, environmentId, usage) {
+  return `${environmentBaseUrl}/powerapps/apis/${encodeURIComponent(getConnectorId(usage.apiId))}` + `/connections/${encodeURIComponent(usage.connectionId)}/usages` + `?api-version=1&$filter=environment eq '${environmentId}'`;
+}
+export function buildConnectionUsageRequest(appId, usage) {
+  const resourceId = appId.startsWith('/providers/') ? appId : `/providers/Microsoft.PowerApps/apps/${appId}`;
+  return {
+    properties: {
+      reference: usage.localRefId,
+      resourceId,
+      appActions: usage.appActions
+    }
+  };
+}
+export function buildScopeConsentUrl(environmentBaseUrl, appId) {
+  const appName = appId.split('/').filter(Boolean).pop() ?? appId;
+  return `${environmentBaseUrl}/powerapps/apps/${encodeURIComponent(appName)}` + '/reportScopesConsent?api-version=1';
+}
+export function buildScopeConsentRequest(usages) {
+  return {
+    consents: usages.map(usage => ({
+      connectionId: usage.connectionId,
+      consentType: 'userConsent',
+      scopes: usage.apiScopes
+    }))
+  };
+}

package/lib/module/connections/connectionState.js

@@ -0,0 +1,82 @@
+"use strict";
+
+import { normalizeApiId } from "./types.js";
+import { connectionIdsEqual } from "./disambiguate.js";
+export function isTransientConnectionConsentStatus(status) {
+  return status === 408 || status === 429 || status >= 500;
+}
+export function shouldGrantConnectionUserConsent(requirement, runningInDevPlayer) {
+  return runningInDevPlayer || !requirement.sharedConnectionId;
+}
+export function getConnectionNamesRequiringAclGrant(connectionRefs, connectionRequirements) {
+  const connectionNames = [];
+  const seen = new Set();
+  for (const requirement of connectionRequirements) {
+    if (!shouldGrantConnectionUserConsent(requirement, false)) continue;
+    const connectionName = requirement.dataSources.map(dataSource => connectionRefs[dataSource]?.connectionName).find(selectedName => Boolean(selectedName));
+    if (!connectionName || seen.has(connectionName)) continue;
+    seen.add(connectionName);
+    connectionNames.push(connectionName);
+  }
+  return connectionNames;
+}
+export function invalidateFailedAclGrants(result, failedConnectionNames) {
+  if (failedConnectionNames.size === 0) return;
+  for (const requirement of result.connectionRequirements) {
+    const selected = requirement.dataSources.map(dataSource => result.connectionRefs[dataSource]).find(Boolean);
+    if (!selected || !failedConnectionNames.has(selected.connectionName)) continue;
+    for (const dataSource of requirement.dataSources) {
+      const reference = result.connectionRefs[dataSource];
+      if (reference) reference.connectionName = '';
+    }
+    if (!result.missingConnectionReferences.some(item => item.localRefId === requirement.localRefId)) {
+      result.missingConnectionReferences.push(requirement);
+    }
+    if (!result.missingConnectors.includes(requirement.apiId)) {
+      result.missingConnectors.push(requirement.apiId);
+    }
+  }
+}
+export function selectLaunchConnection(result, localRefId, connectionId) {
+  const requirement = result.connectionRequirements.find(item => item.localRefId === localRefId);
+  const candidate = result.connectionCandidates[localRefId]?.find(item => connectionIdsEqual(item.id, connectionId));
+  if (!requirement || !candidate) return false;
+  for (const dataSource of requirement.dataSources) {
+    const reference = result.connectionRefs[dataSource];
+    if (reference) reference.connectionName = candidate.id;
+  }
+  result.missingConnectionReferences = result.missingConnectionReferences.filter(item => item.localRefId !== localRefId);
+  if (!result.missingConnectionReferences.some(item => item.apiId === requirement.apiId)) {
+    result.missingConnectors = result.missingConnectors.filter(apiId => apiId !== requirement.apiId);
+  }
+  return true;
+}
+export function getUnregisteredConnectionRequirements(result, usages = result.registeredConnectionUsages) {
+  return result.connectionRequirements.filter(requirement => {
+    const selectedConnectionId = requirement.dataSources.map(dataSource => result.connectionRefs[dataSource]?.connectionName).find(Boolean);
+    if (!selectedConnectionId) return true;
+    return !usages.some(usage => usage.reference.toLowerCase() === requirement.localRefId.toLowerCase() && normalizeApiId(usage.apiId) === requirement.apiId && connectionIdsEqual(usage.connectionId, selectedConnectionId) && (usage.appActions.length === 0 || (requirement.appActions ?? []).every(action => usage.appActions.includes(action))));
+  });
+}
+export function applyRegisteredConnectionSelections(result, usages) {
+  for (const requirement of result.connectionRequirements) {
+    const usage = usages.find(item => item.reference.toLowerCase() === requirement.localRefId.toLowerCase() && normalizeApiId(item.apiId) === requirement.apiId);
+    if (!usage) continue;
+    const candidate = result.connectionCandidates[requirement.localRefId]?.find(item => connectionIdsEqual(item.id, usage.connectionId));
+    if (candidate) selectLaunchConnection(result, requirement.localRefId, candidate.id);
+  }
+}
+export function hasRegisteredConnectionConsent(result, usages = result.registeredConnectionUsages) {
+  return getUnregisteredConnectionRequirements(result, usages).length === 0;
+}
+export function applyRegisteredConnectionUsages(result, usages) {
+  applyRegisteredConnectionSelections(result, usages);
+  result.registeredConnectionUsages = usages;
+  result.requiresConnectionConsent = getUnregisteredConnectionRequirements(result, usages).length > 0;
+}
+export function shouldPersistConnectionUsages(runningInDevPlayer, appId) {
+  return !runningInDevPlayer && Boolean(appId);
+}
+export function shouldShowConnectionReview(runningInDevPlayer, requiresConnectionConsent, hasResourceConsents) {
+  return !runningInDevPlayer && (requiresConnectionConsent || hasResourceConsents);
+}

package/lib/module/connections/disambiguate.js

@@ -11,7 +11,7 @@
  * other web-host dependency.
  */
 
-import { ConnectionStatus } from "./types.js";
+import { ConnectionStatus, normalizeApiId } from "./types.js";
 /**
  * Disambiguate a set of connection references against the user's available
  * connection instances.
@@ -30,11 +30,20 @@ import { ConnectionStatus } from "./types.js";
 export function disambiguateConnections(connectionReferences, allConnectionsByApiId) {
   const resolutions = [];
   for (const [localRefId, ref] of Object.entries(connectionReferences)) {
-    const apiId = ref.id;
-    const all = allConnectionsByApiId[apiId] ?? [];
+    const apiId = normalizeApiId(ref.id);
+    const all = allConnectionsByApiId[apiId] ?? allConnectionsByApiId[ref.id] ?? [];
     const connected = all.filter(c => c.status === ConnectionStatus.Connected);
     let result;
-    if (connected.length === 1) {
+    if (ref.sharedConnectionId) {
+      const sharedId = extractConnectionId(ref.sharedConnectionId);
+      const shared = connected.find(connection => connectionIdsEqual(connection.id, sharedId));
+      result = shared ? {
+        kind: 'resolved',
+        connectionId: shared.id
+      } : {
+        kind: 'missing'
+      };
+    } else if (connected.length === 1) {
       result = {
         kind: 'resolved',
         connectionId: connected[0].id
@@ -68,16 +77,14 @@ export function disambiguateConnections(connectionReferences, allConnectionsByAp
  *   "abc12345def6789012345678901234ab"                        (bare UUID, no dashes)
  *   "abc12345-def6-7890-1234-5678901234ab"                   (UUID with dashes)
  *
- * Returns the 32-char hex ID (dashes stripped) or the raw string if no UUID
- * pattern is found.
+ * Returns the terminal resource name exactly as supplied by Power Platform.
+ * Some connectors require dashed GUIDs while others use compact IDs.
  */
 export function extractConnectionId(rawName) {
-  // Match a standard UUID (with or without dashes) at the end of the string.
-  const match = rawName.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i);
-  if (match) {
-    return match[1].replace(/-/g, '');
-  }
-  // Some connections use a 32-char hex ID without dashes, after a slash.
   const slashIdx = rawName.lastIndexOf('/');
   return slashIdx >= 0 ? rawName.slice(slashIdx + 1) : rawName;
+}
+export function connectionIdsEqual(left, right) {
+  const normalize = value => extractConnectionId(value).replace(/-/g, '').toLowerCase();
+  return normalize(left) === normalize(right);
 }

package/lib/module/connections/resolveConnections.js

@@ -0,0 +1,342 @@
+"use strict";
+
+/*!
+ * power-apps-native-host — resolveConnections
+ *
+ * Pure async helpers for the two connection-resolution strategies used by
+ * useConnectionRefs:
+ *
+ *  • resolveViaStaticRefs — per-connector resolution using the static
+ *    connectionReferences map from power.config.json. Used only by Dev Player
+ *    for unpublished local apps. Handles pre-disambiguation ACL grants so
+ *    inaccessible connections are excluded before the user is asked to pick.
+ *
+ *  • applyAclGrants — post-resolution user consent used by the fast path
+ *    (production APKs via fetchAppLaunchData).
+ *
+ * Both helpers return / consume the shared AppLaunchResult shape so the
+ * hook orchestrator can handle them uniformly.
+ */
+
+import { fetchConnectorMetadata, grantConnectionUserConsent } from "./PowerPlatformConnectionApi.js";
+import { getConnectionNamesRequiringAclGrant, shouldGrantConnectionUserConsent } from "./connectionState.js";
+import { connectionUserConsentScope, buildEnvironmentEndpoint } from "../platform/PowerPlatformEnvironmentApi.js";
+import { fetchInstanceUrl } from "../platform/DataverseGlobalDiscoveryApi.js";
+import { connectionIdsEqual, disambiguateConnections, extractConnectionId } from "../connections/disambiguate.js";
+import { buildConnectionRequirements, ConnectionStatus, findConnectionDataSourceConflicts, getConnectionDatasetName, getFlowConnectionName, getFlowDataSourceNames, isCompositeConnectionApiId, getConnectorId, normalizeApiId } from "./types.js";
+import { platformHttpClient } from "../telemetry/index.js";
+const API_VERSION = '1';
+
+// ---------------------------------------------------------------------------
+// ConnectorSchema
+// ---------------------------------------------------------------------------
+
+/**
+ * Connector schema entry generated by `generate-connector-schemas`.
+ * Keyed by data source name in the `schemaMap` passed to `useConnectionRefs`.
+ */
+
+// ---------------------------------------------------------------------------
+// resolveViaStaticRefs
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve connections from the static `connectionReferences` map.
+ *
+ * Steps:
+ *  1. Build an apiId → schema lookup.
+ *  2. In parallel: fetch the Dataverse instanceUrl and all connection instances
+ *     for every connector.
+ *  3. If `isvClientId` is set, run pre-disambiguation user consent — connections
+ *     where the grant fails are marked `NeedsAclGrant` and excluded from
+ *     resolution, prompting the user to create a new connection.
+ *  4. Disambiguate: resolve single matches, invoke callbacks for ambiguous /
+ *     missing cases, perform one-shot retries when `onMissingConnection` returns
+ *     `true`.
+ *  5. Build and return an `AppLaunchResult`-shaped object.
+ */
+export async function resolveViaStaticRefs({
+  connectionReferences,
+  schemaMap,
+  environmentId,
+  region,
+  acquireToken,
+  token,
+  isvClientId,
+  onDisambiguationNeeded,
+  onMissingConnection
+}) {
+  const directConnectionReferences = Object.fromEntries(Object.entries(connectionReferences).filter(([, reference]) => !isCompositeConnectionApiId(reference.id)));
+  const flowConnectionReferences = Object.fromEntries(Object.entries(connectionReferences).filter(([, reference]) => getConnectorId(reference.id) === 'shared_logicflows'));
+  // Build apiId → schema lookup from the static refs.
+  const schemaByApiId = Object.fromEntries(Object.values(directConnectionReferences).map(ref => {
+    const schema = ref.dataSources.map(ds => schemaMap[ds]).find(Boolean);
+    return schema ? [normalizeApiId(ref.id), schema] : null;
+  }).filter(entry => entry !== null));
+  await Promise.all(Object.values({
+    ...directConnectionReferences,
+    ...flowConnectionReferences
+  }).map(async reference => {
+    const apiId = normalizeApiId(reference.id);
+    if (schemaByApiId[apiId]) return;
+    const metadata = await fetchConnectorMetadata(getConnectorId(reference.id), environmentId, region, token);
+    if (!metadata?.primaryRuntimeUrl) return;
+    schemaByApiId[apiId] = {
+      name: metadata.name,
+      properties: {
+        primaryRuntimeUrl: metadata.primaryRuntimeUrl,
+        scopes: metadata.scopes
+      }
+    };
+  }));
+  const base = buildEnvironmentEndpoint(environmentId, region);
+  const headers = {
+    Authorization: `Bearer ${token}`
+  };
+
+  // Fetch Dataverse instanceUrl and all connection instances in parallel.
+  const [instanceUrl, ...connResults] = await Promise.all([fetchInstanceUrl(environmentId, region, acquireToken, token), ...Object.entries(directConnectionReferences).map(async ([localRefId, ref]) => {
+    const apiId = normalizeApiId(ref.id);
+    const schema = schemaByApiId[apiId];
+    if (!schema) {
+      return {
+        localRefId,
+        apiId,
+        dataSources: ref.dataSources,
+        instances: []
+      };
+    }
+    const url = `${base}/connectivity/connectors/${schema.name}/connections` + `?api-version=${API_VERSION}&$filter=environment eq '${environmentId}'`;
+    try {
+      const res = await platformHttpClient.request(url, {
+        headers
+      });
+      if (!res.ok) {
+        return {
+          localRefId,
+          apiId,
+          dataSources: ref.dataSources,
+          instances: []
+        };
+      }
+      const body = await res.json();
+      const instances = (body.value ?? []).map(c => {
+        const connected = c.properties?.statuses?.[0]?.status === 'Connected';
+        return {
+          id: extractConnectionId(c.name),
+          name: c.name,
+          apiId,
+          ownerId: c.properties?.createdBy?.id,
+          status: connected ? ConnectionStatus.Connected : ConnectionStatus.NotConnected,
+          displayName: c.properties?.displayName,
+          isAuthenticated: connected
+        };
+      });
+      return {
+        localRefId,
+        apiId,
+        dataSources: ref.dataSources,
+        instances
+      };
+    } catch {
+      return {
+        localRefId,
+        apiId,
+        dataSources: ref.dataSources,
+        instances: []
+      };
+    }
+  })]);
+
+  // Pre-disambiguation delegated consent grants (ISV apps only).
+  //
+  // Connections where the grant fails are marked NeedsAclGrant so
+  // disambiguation treats them as unavailable and surfaces the
+  // "missing connection" flow, steering the user to create a new one. Fixed
+  if (isvClientId) {
+    const consentToken = await acquireToken([connectionUserConsentScope(region)]);
+    if (consentToken) {
+      const attemptedGrants = new Set();
+      await Promise.all(connResults.map(async r => {
+        const reference = directConnectionReferences[r.localRefId];
+        if (!reference || !shouldGrantConnectionUserConsent(reference, true)) return;
+        const connId = schemaByApiId[r.apiId]?.name;
+        if (!connId) return;
+        await Promise.all(r.instances.map(async inst => {
+          if (inst.status !== ConnectionStatus.Connected) return;
+          if (reference?.sharedConnectionId && !connectionIdsEqual(inst.id, reference.sharedConnectionId)) return;
+          const grantKey = `${connId.toLowerCase()}/${inst.id.toLowerCase()}`;
+          if (attemptedGrants.has(grantKey)) return;
+          attemptedGrants.add(grantKey);
+          const ok = await grantConnectionUserConsent(connId, inst.id, environmentId, region, consentToken);
+          if (!ok) inst.status = ConnectionStatus.NeedsAclGrant;
+        }));
+      }));
+    } else {
+      for (const result of connResults) {
+        for (const instance of result.instances) {
+          if (instance.status === ConnectionStatus.Connected) {
+            instance.status = ConnectionStatus.NeedsAclGrant;
+          }
+        }
+      }
+    }
+  }
+
+  // Disambiguation.
+  const allConnectionsByApiId = {};
+  for (const r of connResults) {
+    allConnectionsByApiId[r.apiId] = r.instances;
+  }
+  const disambiguationResults = disambiguateConnections(directConnectionReferences, allConnectionsByApiId);
+  const resolvedIds = {};
+  const unresolvedApiIds = [];
+  for (const dr of disambiguationResults) {
+    if (dr.result.kind === 'resolved') {
+      resolvedIds[dr.localRefId] = dr.result.connectionId;
+    } else if (dr.result.kind === 'ambiguous') {
+      const picked = onDisambiguationNeeded ? await onDisambiguationNeeded({
+        localRefId: dr.localRefId,
+        apiId: dr.apiId,
+        candidates: dr.result.candidates
+      }) : null;
+      if (picked) {
+        resolvedIds[dr.localRefId] = picked;
+      } else {
+        resolvedIds[dr.localRefId] = '';
+        unresolvedApiIds.push(normalizeApiId(dr.apiId));
+      }
+    } else {
+      // kind === 'missing'
+      let retried = false;
+      if (onMissingConnection) {
+        retried = await onMissingConnection({
+          localRefId: dr.localRefId,
+          apiId: dr.apiId
+        });
+      }
+      if (retried) {
+        // One-shot retry for this specific connector.
+        const schema = schemaByApiId[dr.apiId];
+        if (schema) {
+          try {
+            const url = `${base}/connectivity/connectors/${schema.name}/connections` + `?api-version=${API_VERSION}&$filter=environment eq '${environmentId}'`;
+            const res = await platformHttpClient.request(url, {
+              headers
+            });
+            if (res.ok) {
+              const body = await res.json();
+              const retryInstances = (body.value ?? []).map(c => {
+                const connected = c.properties?.statuses?.[0]?.status === 'Connected';
+                return {
+                  id: extractConnectionId(c.name),
+                  name: c.name,
+                  apiId: dr.apiId,
+                  status: connected ? ConnectionStatus.Connected : ConnectionStatus.NotConnected,
+                  isAuthenticated: connected
+                };
+              });
+              const connected = retryInstances.find(i => i.status === ConnectionStatus.Connected);
+              if (connected) {
+                resolvedIds[dr.localRefId] = connected.id;
+                continue;
+              }
+            }
+          } catch {
+            // Fall through to missing.
+          }
+        }
+      }
+      resolvedIds[dr.localRefId] = '';
+      unresolvedApiIds.push(normalizeApiId(dr.apiId));
+    }
+  }
+  const dataverseOrgUrl = (instanceUrl ?? '').replace(/\/$/, '');
+
+  // Build the final AppConnectionReference map.
+  const connectionRefs = {};
+  for (const [localRefId, ref] of Object.entries(directConnectionReferences)) {
+    const normalizedApiId = normalizeApiId(ref.id);
+    const schema = schemaByApiId[normalizedApiId];
+    const connectionName = resolvedIds[localRefId] ?? '';
+    const isDataverse = ref.id.includes('commondataserviceforapps');
+    const entry = {
+      apiId: normalizedApiId,
+      runtimeUrl: schema?.properties.primaryRuntimeUrl ?? '',
+      connectionName,
+      datasetName: isDataverse ? dataverseOrgUrl : getConnectionDatasetName(ref)
+    };
+    for (const ds of ref.dataSources) {
+      connectionRefs[ds] = entry;
+    }
+  }
+  for (const ref of Object.values(flowConnectionReferences)) {
+    const normalizedApiId = normalizeApiId(ref.id);
+    const schema = schemaByApiId[normalizedApiId];
+    const entry = {
+      apiId: normalizedApiId,
+      runtimeUrl: schema?.properties.primaryRuntimeUrl ?? '',
+      connectionName: getFlowConnectionName(ref),
+      datasetName: ''
+    };
+    for (const dataSource of getFlowDataSourceNames(ref)) {
+      connectionRefs[dataSource] = entry;
+    }
+  }
+  const scopesByApiId = Object.fromEntries(Object.entries(schemaByApiId).map(([apiId, schema]) => [apiId, {
+    will: schema.properties.scopes?.will ?? [],
+    wont: schema.properties.scopes?.wont ?? []
+  }]));
+  const requirements = buildConnectionRequirements(connectionReferences, scopesByApiId);
+  const requirementsByLocalRefId = Object.fromEntries(requirements.map(requirement => [requirement.localRefId, requirement]));
+  const missingConnectionReferences = Object.entries(resolvedIds).filter(([, connectionId]) => !connectionId).map(([localRefId]) => requirementsByLocalRefId[localRefId]).filter(requirement => Boolean(requirement));
+  const connectionCandidates = Object.fromEntries(connResults.map(result => [result.localRefId, result.instances]));
+  return {
+    connectionRefs,
+    dataverseOrgUrl,
+    databaseReferences: {},
+    missingConnectors: [...new Set(unresolvedApiIds)],
+    missingConnectionReferences,
+    connectionRequirements: Object.values(requirementsByLocalRefId),
+    connectionCandidates,
+    resourceConsents: [],
+    configurationErrors: findConnectionDataSourceConflicts(requirements).map(dataSource => `Data source "${dataSource}" is assigned to multiple connection references.`),
+    registeredConnectionUsages: [],
+    requiresConnectionConsent: requirements.length > 0
+  };
+}
+
+// ---------------------------------------------------------------------------
+// applyAclGrants
+// ---------------------------------------------------------------------------
+
+/**
+ * Run idempotent post-resolution delegated consent grants for the calling app.
+ *
+ * Used by the fast path (production APKs via `fetchAppLaunchData`) where the
+ * launch API has already resolved the user's connections. Grants are applied
+ * only to user-selected connections; fixed shared connections are already
+ * authorized by their owner and must not receive delegated user consent.
+ *
+ * For the slow path the grants run before disambiguation inside
+ * `resolveViaStaticRefs`, where they can still influence which connections
+ * are considered available.
+ *
+ * Returns the connection names whose ACL grants failed so callers can fail closed.
+ */
+export async function applyAclGrants(connectionRefs, connectionRequirements, environmentId, region, acquireToken) {
+  const connectionNames = getConnectionNamesRequiringAclGrant(connectionRefs, connectionRequirements);
+  if (connectionNames.length === 0) return new Set();
+  const connectionNamesSet = new Set(connectionNames);
+  const consentToken = await acquireToken([connectionUserConsentScope(region)]);
+  if (!consentToken) return new Set(connectionNames);
+  const seen = new Set();
+  const failed = new Set();
+  await Promise.all(Object.values(connectionRefs).map(async ref => {
+    if (!ref.connectionName || !connectionNamesSet.has(ref.connectionName) || seen.has(ref.connectionName)) return;
+    seen.add(ref.connectionName);
+    const granted = await grantConnectionUserConsent(ref.apiId, ref.connectionName, environmentId, region, consentToken);
+    if (!granted) failed.add(ref.connectionName);
+  }));
+  return failed;
+}