@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/lib/typescript/commonjs/{platform → connections}/PowerPlatformConnectionApi.d.ts

@@ -7,14 +7,12 @@
  * These mirror the endpoints used by ConnectorsApi in @microsoft/power-apps-common
  * but are implemented as plain async functions so they have no external dependencies.
  */
-import type { NativeConnectionInstance } from '../connections/types';
+import type { DatabaseReference } from '../platform/DataverseDataSources';
+import type { ConnectionInput, ConnectionParameterSet, ConnectionRequirement, ConnectionUsageInput, NativeConnectionInstance, ResourceConsentRequirement } from './types';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge';
-/**
- * Token scope for the Power Apps RP (api.powerapps.com).
- * Required when calling modifyPermissions to register a service principal
- * in the connection ACE so that APIM accepts third-party app tokens at runtime.
- */
-export declare const SERVICE_POWERAPPS_SCOPE = "https://service.powerapps.com/.default";
+export declare class AppLaunchAccessDeniedError extends Error {
+    constructor();
+}
 /** Subset of connector metadata returned by the Power Platform API. */
 export interface ConnectorMetadata {
     /** Short connector name, e.g. "shared_office365users". */
@@ -25,8 +23,15 @@ export interface ConnectorMetadata {
     iconUri: string;
     /** Description text. */
     description: string;
-    /** Whether this is a first-party (Microsoft-published) connector. */
-    isFirstParty: boolean;
+    /** Environment-specific APIM runtime URL used for connector requests. */
+    primaryRuntimeUrl: string;
+    scopes: {
+        will: string[];
+        wont: string[];
+    };
+    /** Whether the connector authenticates through an OAuth consent flow. */
+    hasOAuthParameter: boolean;
+    parameterSets: ConnectionParameterSet[];
 }
 /**
  * Fetch metadata for a single connector from the Power Platform API.
@@ -43,6 +48,8 @@ export declare function fetchConnectorMetadata(connectorId: string, environmentI
  * Returns only the `NativeConnectionInstance` shape used by the disambiguation layer.
  */
 export declare function fetchConnectionsForConnector(connectorId: string, environmentId: string, region: string, token: string): Promise<NativeConnectionInstance[]>;
+/** Delete a single connection instance from the user's environment. */
+export declare function deleteConnection(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 /**
  * Result of initiating an OAuth connection creation.
  *
@@ -51,8 +58,7 @@ export declare function fetchConnectionsForConnector(connectorId: string, enviro
  *   user can complete the OAuth consent flow. Poll `pollConnectionStatus`
  *   until the status changes to "Connected".
  *
- * `connected` — the connection was created and is already Connected (e.g.,
- *   first-party SSO connections that do not need explicit OAuth consent).
+ * `connected` — the connection resource was created in Connected state.
  *
  * `error` — creation failed; `message` contains the error description.
  */
@@ -71,7 +77,7 @@ export type CreateConnectionResult = {
  * Create a new connection for a connector in the user's environment.
  *
  * Calls:
- *   POST {envBase}/connectivity/apis/{connectorId}/connections
+ *   PUT {envBase}/connectivity/connectors/{connectorId}/connections/{connectionId}
  *
  * If the response contains a `consentLink`, the connection needs OAuth
  * completion (caller should open the URL and then poll `pollConnectionStatus`).
@@ -86,7 +92,8 @@ export type CreateConnectionResult = {
  *                           will redirect the user here after consent. Defaults to
  *                           the standard native-client redirect accepted by Power Platform.
  */
-export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string): Promise<CreateConnectionResult>;
+export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string, input?: ConnectionInput): Promise<CreateConnectionResult>;
+export declare function repairConnection(connectorId: string, connectionName: string, environmentId: string, region: string, token: string, oauthRedirectUrl?: string, input?: ConnectionInput, requiresApiConsent?: boolean): Promise<CreateConnectionResult>;
 /**
  * Poll a connection's status until it is "Connected" or a timeout is reached.
  *
@@ -101,6 +108,7 @@ export declare function createConnection(connectorId: string, environmentId: str
 export declare function pollConnectionStatus(connectorId: string, connectionName: string, environmentId: string, region: string, acquireToken: (scopes: string[]) => Promise<string | null>, options?: {
     intervalMs?: number;
     timeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<NativeConnectionInstance | null>;
 /**
  * Confirm a consent code returned by the APIM consent server in the OAuth
@@ -141,13 +149,38 @@ export interface AppLaunchResult {
      * has no linked Dataverse database).
      */
     dataverseOrgUrl: string;
+    /** Dataverse table metadata returned by the app launch endpoint. */
+    databaseReferences: Record<string, DatabaseReference>;
     /**
      * Connector short-names (e.g. "shared_office365users") for which the
      * launch API found no "Connected" connection instance for the signed-in
      * user.  These connectors need the connection setup flow.
      */
     missingConnectors: string[];
+    /** Missing requirements keyed by the app's local connection-reference ID. */
+    missingConnectionReferences: ConnectionRequirement[];
+    /** Every app requirement, including references resolved by the launch API. */
+    connectionRequirements: ConnectionRequirement[];
+    /** Connected candidates retained for explicit per-reference disambiguation. */
+    connectionCandidates: Record<string, NativeConnectionInstance[]>;
+    /** Non-connector protected resources requiring explicit user disclosure. */
+    resourceConsents: ResourceConsentRequirement[];
+    /** Configuration errors that make bridge connection binding ambiguous. */
+    configurationErrors: string[];
+    /** Durable app-to-connection bindings returned by launch or the app connections API. */
+    registeredConnectionUsages: RegisteredConnectionUsage[];
+    /** True when at least one selected local reference/action is not durably registered. */
+    requiresConnectionConsent: boolean;
+}
+export interface RegisteredConnectionUsage {
+    reference: string;
+    apiId: string;
+    connectionId: string;
+    appActions: string[];
 }
+export declare function fetchAppConnectionUsages(appId: string, environmentId: string, region: string, token: string): Promise<RegisteredConnectionUsage[]>;
+export declare function postConnectionUsage(appId: string, usage: ConnectionUsageInput, environmentId: string, region: string, token: string): Promise<void>;
+export declare function reportScopeConsents(appId: string, usages: ConnectionUsageInput[], environmentId: string, region: string, token: string): Promise<void>;
 /**
  * Fetch app launch data from the Power Platform environment-scoped launch
  * endpoint and process it into the shape the NativePowerAppsBridge needs.
@@ -160,7 +193,7 @@ export interface AppLaunchResult {
  *                                          — Dataverse org URL
  *
  * Endpoint (environment-scoped, same base as all Power Platform API calls):
- *   GET {envEndpoint}/powerapps/apps/{appId}/launch
+ *   POST {envEndpoint}/powerapps/apps/{appId}/launch
  *       ?api-version=2&lastKnownGoodPublishedVersion=true
  *
  * Authentication: bearer token for {@link powerPlatformScope}`(region)`.
@@ -169,37 +202,13 @@ export interface AppLaunchResult {
  * @param environmentId - Environment GUID.
  * @param region        - Cluster region (default "prod").
  * @param token         - Bearer token for {@link powerPlatformScope}`(region)`.
- * @returns Processed launch data, or `null` if the call fails.
+ * @returns Processed launch data, or `null` when the app is not found.
  */
 export declare function fetchAppLaunchData(appId: string, environmentId: string, region: string, token: string): Promise<AppLaunchResult | null>;
 /**
- * Decode the `oid` (object ID) claim from a JWT access token.
- *
- * The oid claim is in the base64url-encoded payload section (middle part).
- * Available in Hermes (React Native) via the global `atob`.
- */
-export declare function parseJwtOid(jwtToken: string): string | null;
-/**
- * Add the ISV's AAD application (client) ID to the connection's ACL AppIds
- * list via the Power Apps RP `addAadAppToConnectionAcl` endpoint.
- *
- * The RP finds the user's existing ACE (identified by `userOid`) and appends
- * `isvClientId` to its `AppIds` list. APIM's stage-2 token check verifies
- * that the requesting token's `appid` is present in this list, so without
- * this call APIM returns 403 "missing connection ACL" for third-party tokens.
- *
- * POST https://api.powerapps.com/providers/Microsoft.PowerApps/environments/{environmentId}
- *      /apis/{connectorId}/connections/{connectionId}/addAadAppToConnectionAcl
- *      ?api-version=2016-11-01
- *
- * Body: { "aadApplicationId": "<ISV client ID>", "objectId": "<user OID>" }
- *
- * @param connectorId   - Connector short name (e.g. "shared_office365users").
- * @param connectionId  - Bare 32-char hex connection ID.
- * @param environmentId - Environment GUID.
- * @param isvClientId   - The ISV's AAD application (client) ID.
- * @param userOid       - The signed-in user's AAD object ID (oid JWT claim).
- * @param token         - Bearer token for `https://service.powerapps.com/.default`.
+ * Grant the calling application's delegated access to a connection for the
+ * signed-in user. The backend derives both identities from the token and
+ * selects the most specific applicable user, group, or tenant ACL.
  */
-export declare function addAadAppToConnectionAcl(connectorId: string, connectionId: string, environmentId: string, isvClientId: string, userOid: string, token: string): Promise<boolean>;
+export declare function grantConnectionUserConsent(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 //# sourceMappingURL=PowerPlatformConnectionApi.d.ts.map

package/lib/typescript/commonjs/connections/connectionMetadata.d.ts

@@ -0,0 +1,66 @@
+import type { ConnectionInput, ConnectionParameterDefinition, ConnectionParameterSet, ConnectionUsageInput } from './types';
+export interface ConsentLinkDefinition {
+    redirectUrl: string;
+}
+export type SerializedConnectionParameters = {
+    connectionParameters: ConnectionInput['parameters'];
+} | {
+    connectionParametersSet: {
+        name: string;
+        values: Record<string, {
+            value: ConnectionInput['parameters'][string];
+        }>;
+    };
+};
+export interface RawConnectionParameter {
+    type?: string;
+    defaultValue?: string | boolean | number;
+    uiDefinition?: {
+        displayName?: string;
+        constraints?: {
+            required?: string | boolean;
+            hidden?: string | boolean;
+            capability?: string[];
+            allowedValues?: Array<{
+                value?: string;
+                displayName?: string;
+            }>;
+        };
+    };
+}
+export interface RawConnectionParameterSet {
+    name?: string;
+    uiDefinition?: {
+        displayName?: string;
+    };
+    connectionParameters?: Record<string, RawConnectionParameter>;
+    parameters?: Record<string, RawConnectionParameter>;
+}
+export declare function parseConnectionParameters(parameters: Record<string, RawConnectionParameter> | undefined): ConnectionParameterDefinition[];
+export declare function buildConnectionParameterSets(connectionParameters: Record<string, RawConnectionParameter> | undefined, parameterSets: RawConnectionParameterSet[] | undefined): ConnectionParameterSet[];
+export declare function hasOAuthParameter(parameters: Record<string, RawConnectionParameter> | undefined): boolean;
+export declare function buildConnectionUserConsentUrl(environmentEndpoint: string, connectorId: string, connectionId: string): string;
+export declare function getAppLaunchFailureMessage(status: number, statusText: string, responseText: string): string | null;
+export declare function isAppLaunchAccessDenied(status: number, responseText: string): boolean;
+export declare function buildConsentLinkDefinition(redirectUrl: string): ConsentLinkDefinition;
+export declare function serializeConnectionParameters(input?: ConnectionInput): SerializedConnectionParameters;
+export declare function buildConnectionUsageUrl(environmentBaseUrl: string, environmentId: string, usage: ConnectionUsageInput): string;
+export declare function buildConnectionUsageRequest(appId: string, usage: ConnectionUsageInput): {
+    properties: {
+        reference: string;
+        resourceId: string;
+        appActions: string[];
+    };
+};
+export declare function buildScopeConsentUrl(environmentBaseUrl: string, appId: string): string;
+export declare function buildScopeConsentRequest(usages: ConnectionUsageInput[]): {
+    consents: Array<{
+        connectionId: string;
+        consentType: 'userConsent';
+        scopes: {
+            will: string[];
+            wont: string[];
+        };
+    }>;
+};
+//# sourceMappingURL=connectionMetadata.d.ts.map

package/lib/typescript/commonjs/connections/connectionState.d.ts

@@ -0,0 +1,16 @@
+import type { AppLaunchResult } from './PowerPlatformConnectionApi';
+import type { RegisteredConnectionUsage } from './PowerPlatformConnectionApi';
+import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge';
+import type { ConnectionRequirement } from './types';
+export declare function isTransientConnectionConsentStatus(status: number): boolean;
+export declare function shouldGrantConnectionUserConsent(requirement: Pick<ConnectionRequirement, 'sharedConnectionId'>, runningInDevPlayer: boolean): boolean;
+export declare function getConnectionNamesRequiringAclGrant(connectionRefs: Record<string, AppConnectionReference>, connectionRequirements: ConnectionRequirement[]): string[];
+export declare function invalidateFailedAclGrants(result: AppLaunchResult, failedConnectionNames: ReadonlySet<string>): void;
+export declare function selectLaunchConnection(result: AppLaunchResult, localRefId: string, connectionId: string): boolean;
+export declare function getUnregisteredConnectionRequirements(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): ConnectionRequirement[];
+export declare function applyRegisteredConnectionSelections(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function hasRegisteredConnectionConsent(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): boolean;
+export declare function applyRegisteredConnectionUsages(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function shouldPersistConnectionUsages(runningInDevPlayer: boolean, appId: string | undefined): boolean;
+export declare function shouldShowConnectionReview(runningInDevPlayer: boolean, requiresConnectionConsent: boolean, hasResourceConsents: boolean): boolean;
+//# sourceMappingURL=connectionState.d.ts.map

package/lib/typescript/commonjs/connections/disambiguate.d.ts

@@ -27,6 +27,7 @@ import type { NativeConnectionInstance, NativeConnectionResolution } from './typ
 export declare function disambiguateConnections(connectionReferences: Record<string, {
     id: string;
     dataSources: string[];
+    sharedConnectionId?: string;
 }>, allConnectionsByApiId: Record<string, NativeConnectionInstance[]>): NativeConnectionResolution[];
 /**
  * Extract the connection UUID from a raw connection name returned by the API.
@@ -36,8 +37,9 @@ export declare function disambiguateConnections(connectionReferences: Record<str
  *   "abc12345def6789012345678901234ab"                        (bare UUID, no dashes)
  *   "abc12345-def6-7890-1234-5678901234ab"                   (UUID with dashes)
  *
- * Returns the 32-char hex ID (dashes stripped) or the raw string if no UUID
- * pattern is found.
+ * Returns the terminal resource name exactly as supplied by Power Platform.
+ * Some connectors require dashed GUIDs while others use compact IDs.
  */
 export declare function extractConnectionId(rawName: string): string;
+export declare function connectionIdsEqual(left: string, right: string): boolean;
 //# sourceMappingURL=disambiguate.d.ts.map

package/lib/typescript/commonjs/{platform → connections}/resolveConnections.d.ts

@@ -5,19 +5,18 @@
  * useConnectionRefs:
  *
  *  • resolveViaStaticRefs — per-connector resolution using the static
- *    connectionReferences map from power.config.json.  Used by the Dev Player
- *    and during local development (no appId) or when the launch API is
- *    unavailable.  Handles pre-disambiguation ACL grants so inaccessible
- *    connections are excluded before the user is asked to pick.
+ *    connectionReferences map from power.config.json. Used only by Dev Player
+ *    for unpublished local apps. Handles pre-disambiguation ACL grants so
+ *    inaccessible connections are excluded before the user is asked to pick.
  *
- *  • applyAclGrants — post-resolution ACL grants used by the fast path
+ *  • applyAclGrants — post-resolution user consent used by the fast path
  *    (production APKs via fetchAppLaunchData).
  *
  * Both helpers return / consume the shared AppLaunchResult shape so the
  * hook orchestrator can handle them uniformly.
  */
 import type { AppLaunchResult } from './PowerPlatformConnectionApi';
-import type { OnDisambiguationNeeded, OnMissingConnection } from '../connections/types';
+import type { ConnectionReferenceConfig, ConnectionRequirement, OnDisambiguationNeeded, OnMissingConnection } from './types';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge';
 /**
  * Connector schema entry generated by `generate-connector-schemas`.
@@ -28,6 +27,10 @@ export interface ConnectorSchema {
     name: string;
     properties: {
         primaryRuntimeUrl: string;
+        scopes?: {
+            will?: string[];
+            wont?: string[];
+        };
     };
 }
 export interface StaticRefsOptions {
@@ -35,19 +38,16 @@ export interface StaticRefsOptions {
      * Static connectionReferences from power.config.json.
      * Shape: { [refId]: { id: string; dataSources: string[] } }
      */
-    connectionReferences: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences: Record<string, ConnectionReferenceConfig>;
     /** Connector schema map keyed by data source name. */
     schemaMap: Record<string, ConnectorSchema>;
     environmentId: string;
     region: string;
-    /** Used for ACL grants and the Dataverse instanceUrl fetch. */
+    /** Used for connection consent and the Dataverse instanceUrl fetch. */
     acquireToken: (scopes: string[]) => Promise<string | null>;
     /** Pre-acquired Power Platform API bearer token. */
     token: string;
-    /** ISV client ID — when provided, runs pre-disambiguation ACL grants. */
+    /** ISV client ID — when provided, runs pre-disambiguation user consent. */
     isvClientId?: string;
     onDisambiguationNeeded?: OnDisambiguationNeeded;
     onMissingConnection?: OnMissingConnection;
@@ -59,7 +59,7 @@ export interface StaticRefsOptions {
  *  1. Build an apiId → schema lookup.
  *  2. In parallel: fetch the Dataverse instanceUrl and all connection instances
  *     for every connector.
- *  3. If `isvClientId` is set, run pre-disambiguation ACL grants — connections
+ *  3. If `isvClientId` is set, run pre-disambiguation user consent — connections
  *     where the grant fails are marked `NeedsAclGrant` and excluded from
  *     resolution, prompting the user to create a new connection.
  *  4. Disambiguate: resolve single matches, invoke callbacks for ambiguous /
@@ -69,18 +69,18 @@ export interface StaticRefsOptions {
  */
 export declare function resolveViaStaticRefs({ connectionReferences, schemaMap, environmentId, region, acquireToken, token, isvClientId, onDisambiguationNeeded, onMissingConnection, }: StaticRefsOptions): Promise<AppLaunchResult>;
 /**
- * Run idempotent post-resolution ACL grants on behalf of the ISV app.
+ * Run idempotent post-resolution delegated consent grants for the calling app.
  *
  * Used by the fast path (production APKs via `fetchAppLaunchData`) where the
- * launch API has already resolved the user's connections — grants are applied
- * after the fact so APIM accepts tokens issued to the ISV's AAD app.
+ * launch API has already resolved the user's connections. Grants are applied
+ * only to user-selected connections; fixed shared connections are already
+ * authorized by their owner and must not receive delegated user consent.
  *
  * For the slow path the grants run before disambiguation inside
  * `resolveViaStaticRefs`, where they can still influence which connections
  * are considered available.
  *
- * Failures are swallowed — a failed grant will surface as a 403 at runtime
- * when the connector is called.
+ * Returns the connection names whose ACL grants failed so callers can fail closed.
  */
-export declare function applyAclGrants(connectionRefs: Record<string, AppConnectionReference>, environmentId: string, isvClientId: string, acquireToken: (scopes: string[]) => Promise<string | null>): Promise<void>;
+export declare function applyAclGrants(connectionRefs: Record<string, AppConnectionReference>, connectionRequirements: ConnectionRequirement[], environmentId: string, region: string, acquireToken: (scopes: string[]) => Promise<string | null>): Promise<Set<string>>;
 //# sourceMappingURL=resolveConnections.d.ts.map

package/lib/typescript/commonjs/connections/types.d.ts

@@ -17,18 +17,146 @@ export declare enum ConnectionStatus {
     NeedsAclGrant = "NeedsAclGrant",
     NotConnected = "NotConnected"
 }
+export interface ConnectionReferenceConfig {
+    id: string;
+    dataSources: string[];
+    displayName?: string;
+    iconUri?: string;
+    appActions?: string[];
+    sharedConnectionId?: string;
+    gatewayObjectIdHint?: string;
+    authenticationType?: string;
+    parameterSetName?: string;
+    workflowDetails?: {
+        workflowEntityId?: string;
+        workflowDisplayName?: string;
+        workflowName?: string;
+    };
+    dataSets?: Record<string, unknown>;
+    dependencies?: Record<string, unknown>;
+    dependents?: string[];
+    nestedActions?: Array<{
+        actionName?: string;
+        apiName?: string;
+        flowConnectionRef?: string;
+    }>;
+    parameterHintsV2?: Record<string, {
+        value?: unknown;
+    }>;
+    [key: string]: unknown;
+}
+export interface ConnectionRequirement {
+    localRefId: string;
+    apiId: string;
+    connectorId: string;
+    dataSources: string[];
+    displayName?: string;
+    iconUri?: string;
+    appActions?: string[];
+    sharedConnectionId?: string;
+    gatewayObjectIdHint?: string;
+    authenticationType?: string;
+    parameterSetName?: string;
+    apiScopes: {
+        will: string[];
+        wont: string[];
+    };
+    isFlowDependent: boolean;
+}
+export type ConnectionParameterType = 'string' | 'securestring' | 'boolean' | 'integer' | 'clientcertificate';
+export interface ConnectionParameterDefinition {
+    name: string;
+    displayName: string;
+    type: ConnectionParameterType;
+    required: boolean;
+    hidden: boolean;
+    capabilities?: string[];
+    allowedValues?: Array<{
+        value: string;
+        displayName: string;
+    }>;
+    defaultValue?: string | boolean | number;
+}
+export interface ConnectionParameterSet {
+    /** Undefined for a connector's single, non-parameter-set authentication definition. */
+    name?: string;
+    displayName: string;
+    parameters: ConnectionParameterDefinition[];
+    requiresApiConsent: boolean;
+    gatewayParameterName?: string;
+}
+export type ConnectionParameterValue = string | boolean | number | {
+    pfx: string;
+    password: string;
+} | {
+    gatewayObjectId: string;
+};
+export interface ConnectionInput {
+    parameterSetName?: string;
+    gatewayObjectId?: string;
+    gatewayParameterName?: string;
+    parameters: Record<string, ConnectionParameterValue>;
+}
+export interface ConnectionConsentDetails {
+    localRefId: string;
+    connectorId: string;
+    displayName: string;
+    description: string;
+    appActions: string[];
+}
+export interface ResourceConsentRequirement {
+    resourceId: string;
+    displayName: string;
+}
+export interface ConnectionUsageInput {
+    localRefId: string;
+    apiId: string;
+    connectionId: string;
+    dataSources: string[];
+    appActions: string[];
+    apiScopes: {
+        will: string[];
+        wont: string[];
+    };
+}
+export declare function normalizeApiId(apiId: string): string;
+export declare function getConnectorId(apiId: string): string;
+export declare function getConnectionDatasetName(reference: {
+    dataSets?: Record<string, unknown>;
+}): string;
+export declare function getFlowConnectionName(reference: ConnectionReferenceConfig): string;
+export declare function getFlowDataSourceNames(reference: ConnectionReferenceConfig): string[];
+export declare function buildConnectionRequirements(connectionReferences: Record<string, ConnectionReferenceConfig>, scopesByApiId?: Record<string, {
+    will: string[];
+    wont: string[];
+}>): ConnectionRequirement[];
+export declare function isCompositeConnectionApiId(apiId: string): boolean;
+export declare function findConnectionDataSourceConflicts(requirements: ConnectionRequirement[]): string[];
+export declare function hasCompleteStaticConnectionConfig(connectionReferences: Record<string, ConnectionReferenceConfig>, schemaMap: Record<string, {
+    name: string;
+    properties: {
+        primaryRuntimeUrl: string;
+    };
+}>): boolean;
+export declare function buildConnectionResolutionKey(appId: string | undefined, environmentId: string, connectionReferences: Record<string, ConnectionReferenceConfig>): string;
 /** A single connection instance returned by the Power Platform connectivity API. */
 export interface NativeConnectionInstance {
-    /** Extracted connection UUID (hex, no dashes). */
+    /** Terminal connection resource name exactly as returned by Power Platform. */
     id: string;
     /** Full resource name from the API (connector-prefixed, e.g. "shared_office365users/abc123"). */
     name: string;
     /** Connector API identifier (e.g. "/providers/Microsoft.PowerApps/apis/shared_office365users"). */
     apiId: string;
+    /** Object ID of the connection owner when returned by the connectivity API. */
+    ownerId?: string;
     /** Resolved authorization status of this connection. */
     status: ConnectionStatus;
     /** Optional human-readable display name from the API. */
     displayName?: string;
+    accountName?: string;
+    parameterSetName?: string;
+    isAuthenticated?: boolean;
+    statusErrorCode?: string;
 }
 /**
  * Result of attempting to match a single connection reference to an instance.

package/lib/typescript/commonjs/{platform → connections}/useConnectionRefs.d.ts

@@ -30,9 +30,12 @@
  *     },
  *   });
  */
-import { type OnDisambiguationNeeded, type OnMissingConnection } from '../connections/types';
+import type { DatabaseReference } from '../platform/DataverseDataSources';
+import type { OnDisambiguationNeeded, OnMissingConnection } from '../connections/types';
 import type { ConnectorSchema } from './resolveConnections';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge';
+import type { ConnectionRequirement, ResourceConsentRequirement } from './types';
+import type { ConnectionReferenceConfig } from './types';
 export type { ConnectorSchema } from './resolveConnections';
 export interface UseConnectionRefsOptions {
     isSignedIn: boolean;
@@ -46,23 +49,19 @@ export interface UseConnectionRefsOptions {
     region?: string;
     /**
      * PowerApps app GUID (from power.config.json `appId`).
-     * When provided (and not running inside the Dev Player), connection
-     * references are fetched at runtime from the PowerApps RP
-     * `/apps/{appId}/launch` endpoint and take precedence over the static
-     * `connectionReferences` object below.
-     * Leave undefined during local development to use the static fallback.
+      * Outside Dev Player, app and connection metadata is fetched exclusively
+      * from the PowerApps RP `/apps/{appId}/launch` endpoint.
      */
     appId?: string;
     /**
      * The connectionReferences map from power.config.json.
+      * Used only in Dev Player for unpublished local apps.
      * Shape: { [refId]: { id: string; dataSources: string[] } }
      */
-    connectionReferences: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences: Record<string, ConnectionReferenceConfig>;
     /**
      * Connector schema map keyed by data source name.
+      * Used only in Dev Player for unpublished local apps.
      * Generated automatically by generate-connector-schemas.
      * Shape: { [dataSourceName]: ConnectorSchema }
      */
@@ -80,10 +79,11 @@ export interface UseConnectionRefsOptions {
      */
     onMissingConnection?: OnMissingConnection;
     /**
-     * The ISV's AAD application (client) ID.  When provided, each resolved
-     * `Connected` connection is checked via `addAadAppToConnectionAcl`.
+    * The ISV's AAD application (client) ID. When provided, each user-selected
+    * `Connected` connection is granted through delegated user consent. Fixed
+    * shared connections skip this grant in published apps.
      * Connections where the grant fails are marked `NeedsAclGrant` and treated
-     * as missing so the setup screen can guide the user to create a new one.
+    * as missing so the setup screen can guide the user to create a new one.
      */
     isvClientId?: string;
 }
@@ -91,12 +91,25 @@ export interface UseConnectionRefsResult {
     connectionRefs: Record<string, AppConnectionReference>;
     isReady: boolean;
     error: string | null;
+    errorKind: ConnectionResolutionErrorKind | null;
     /**
      * API IDs of connectors for which no connection was found (or the user did
      * not resolve during disambiguation).  Useful for surfacing a "Set up
      * connections" prompt in the app UI.
      */
     missingConnectors: string[];
+    /** Unresolved requirements keyed by the app's local connection-reference ID. */
+    missingConnectionReferences: ConnectionRequirement[];
+    /** Every connection reference required by the app. */
+    connectionRequirements: ConnectionRequirement[];
+    /** Non-connector protected resources returned by app launch metadata. */
+    resourceConsents: ResourceConsentRequirement[];
+    /** Blocking connection configuration errors. */
+    configurationErrors: string[];
+    /** Whether selected connection references still need durable app usage consent. */
+    requiresConnectionConsent: boolean;
+    /** Identity of the app/environment/config represented by this result. */
+    resolvedConfigKey: string | null;
     /**
      * The Dataverse org URL for this environment (e.g. "https://org12345.crm.dynamics.com").
      * Fetched from the Power Platform environment metadata independently of whether a
@@ -104,23 +117,19 @@ export interface UseConnectionRefsResult {
      * Empty string until isReady is true or if the environment has no linked Dataverse database.
      */
     dataverseOrgUrl: string;
+    /** Database references resolved from the RP launch response. */
+    databaseReferences: Record<string, DatabaseReference>;
 }
+export type ConnectionResolutionErrorKind = 'app-access-denied' | 'generic';
 /**
  * Resolves Power Platform connection references for the current user, with
  * disambiguation support for environments where multiple connections exist for
  * the same connector.
  *
- * On sign-in this hook:
- *  1. If `appId` is set (production template), fetches connection references
- *     from the PowerApps RP `/apps/{appId}/launch` endpoint and uses those
- *     in place of the static `connectionReferences` from power.config.json.
- *  2. Acquires a Power Platform API token.
- *  3. In parallel: fetches the Dataverse instanceUrl and ALL connections for
- *     each configured connector.
- *  4. Runs disambiguation: resolves single matches, invokes `onDisambiguationNeeded`
- *     for multiple matches, and invokes `onMissingConnection` for absent ones.
- *  5. Pre-warms the Dataverse token in the MSAL cache.
- *  6. Sets isReady=true with the fully-populated connections map.
+ * Outside Dev Player, the published app launch endpoint is authoritative.
+ * Dev Player resolves unpublished local references through per-connector APIs.
+ * Both paths disambiguate candidates, pre-warm Dataverse authentication, and
+ * return a fully populated bridge configuration.
  */
 export declare function useConnectionRefs({ isSignedIn, acquireToken, appId, environmentId, region, connectionReferences, schemaMap, onDisambiguationNeeded, onMissingConnection, isvClientId, }: UseConnectionRefsOptions): UseConnectionRefsResult;
 //# sourceMappingURL=useConnectionRefs.d.ts.map