@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/lib/typescript/commonjs/telemetry/index.d.ts

@@ -7,7 +7,9 @@
  * (`getAppLogger` / `configureAppLogger`). This module re-exports those
  * alongside the canonical host operation-name constants.
  */
-export { getAppLogger, configureAppLogger } from '@microsoft/power-apps-native-common';
+import { HttpClient } from '@microsoft/power-apps-native-common/http';
+export { getAppLogger, configureAppLogger, getCustomerTelemetryLogger } from '@microsoft/power-apps-native-common';
+export type { ICustomerTelemetryLogger } from '@microsoft/power-apps-native-common';
 /**
  * Canonical operation names for host package telemetry.
  * Follow the `PowerAppsHost.<Subsystem>.<Action>` convention so events are
@@ -34,15 +36,25 @@ export declare const HostOperationNames: {
     readonly BridgeTokenAcquireFailed: "PowerAppsHost.Bridge.TokenAcquire.Failed";
     /** Top-level React error boundary caught an unhandled JS error. */
     readonly RuntimeUnhandledJsError: "PowerAppsHost.Runtime.UnhandledJsError";
+    /** Power Platform RP HTTP request, including backend correlation IDs. */
+    readonly PlatformHttpRequest: "PowerAppsHost.Platform.HttpRequest";
     /** Resolve Dataverse instanceUrl from Power Platform environment API. */
     readonly PlatformFetchInstanceUrl: "PowerAppsHost.Platform.FetchInstanceUrl";
     /** useConnectionRefs failed to resolve connections (recoverable). Recorded only on failure. */
     readonly PlatformLoadConnectionsFailed: "PowerAppsHost.Platform.LoadConnections.Failed";
     /** Create a new Power Platform connection. */
     readonly PlatformCreateConnection: "PowerAppsHost.Platform.CreateConnection";
+    /** Repair an existing Power Platform connection. */
+    readonly PlatformRepairConnection: "PowerAppsHost.Platform.RepairConnection";
+    /** Poll a connection until it becomes active. */
+    readonly PlatformPollConnectionStatus: "PowerAppsHost.Platform.PollConnectionStatus";
     /** Resolve app connection references for the current launch. */
     readonly PlatformResolveConnectionRefs: "PowerAppsHost.Platform.ResolveConnectionRefs";
     /** Grant this app access to a Power Platform connection ACL. */
     readonly PlatformConnectionAclGrant: "PowerAppsHost.Platform.ConnectionAclGrant";
+    /** Installed Offline SDK predates the SDK-owned routing contract. */
+    readonly OfflineRoutingContractUnsupported: "PowerAppsHost.Offline.RoutingContract.Unsupported";
 };
+export declare const bridgeHttpClient: HttpClient;
+export declare const platformHttpClient: HttpClient;
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/auth/AuthContext.d.ts

@@ -46,9 +46,11 @@ export interface AuthProviderProps {
      * Pass explicitly only to override the default (e.g. in tests).
      */
     intuneConfig?: IntuneConfig;
+    /** Token audiences that must be available before the account is considered signed in. */
+    requiredScopes?: string[];
     children: React.ReactNode;
 }
-export declare function AuthProvider({ msalConfig, intuneConfig, children }: AuthProviderProps): React.JSX.Element;
+export declare function AuthProvider({ msalConfig, intuneConfig, requiredScopes, children, }: AuthProviderProps): React.JSX.Element;
 /**
  * Returns the current auth state from the nearest <AuthProvider>.
  * Must be called within the AuthProvider tree.

package/lib/typescript/module/auth/AuthContext.web.d.ts

@@ -0,0 +1,21 @@
+import React from 'react';
+import type { IntuneConfig, MsalAuthConfig } from '@microsoft/power-apps-native-auth';
+export interface AuthState {
+    isLoading: boolean;
+    isAuthReady: boolean;
+    isSignedIn: boolean;
+    hasRealAccount: boolean;
+    error: Error | null;
+    acquireToken: (scopes: string[]) => Promise<string | null>;
+    signIn: () => Promise<void>;
+    signOut: () => Promise<void>;
+}
+export interface AuthProviderProps {
+    msalConfig: MsalAuthConfig;
+    intuneConfig?: IntuneConfig;
+    requiredScopes?: string[];
+    children: React.ReactNode;
+}
+export declare function AuthProvider({ children }: AuthProviderProps): React.JSX.Element;
+export declare function useAuth(): AuthState;
+//# sourceMappingURL=AuthContext.web.d.ts.map

package/lib/typescript/module/auth/completePowerAppsAuthSession.d.ts

@@ -0,0 +1,8 @@
+import type { WebBrowserCompleteAuthSessionOptions, WebBrowserCompleteAuthSessionResult } from 'expo-web-browser';
+/**
+ * Completes an Expo web authentication popup when the current route is its
+ * redirect target. Call this at module initialization in the OAuth callback
+ * route; navigation after completion remains application-owned.
+ */
+export declare function completePowerAppsAuthSession(options?: WebBrowserCompleteAuthSessionOptions): WebBrowserCompleteAuthSessionResult;
+//# sourceMappingURL=completePowerAppsAuthSession.d.ts.map

package/lib/typescript/module/bridge/PowerPagesBridge.d.ts

@@ -0,0 +1,18 @@
+import type { AppConnectionReference, CdsDataSourceConfig } from './NativePowerAppsBridge.js';
+export type PowerPagesBridgeOptions = {
+    dataSources: CdsDataSourceConfig[];
+    connections: Record<string, AppConnectionReference>;
+};
+export declare class PowerPagesBridge {
+    private options;
+    constructor(options: PowerPagesBridgeOptions);
+    updateOptions(options: PowerPagesBridgeOptions): void;
+    initialize(): Promise<void>;
+    createRequestBody(config: {
+        body?: string | Uint8Array | ArrayBuffer | Blob;
+    }): Blob | string | Uint8Array | ArrayBuffer;
+    executePluginAsync<T = unknown>(pluginName: string, pluginAction: string, params: unknown[]): Promise<T>;
+    private sendHttpAsync;
+}
+export declare function setupPowerPagesHost(options: PowerPagesBridgeOptions): void;
+//# sourceMappingURL=PowerPagesBridge.d.ts.map

package/lib/typescript/module/bridge/bridgeState.d.ts

@@ -0,0 +1,5 @@
+import type { NativeBridgeOptions } from './NativePowerAppsBridge.js';
+export declare function getRequestBodyForMethod(method: string, body: BodyInit | null): BodyInit | null;
+export declare function assertSuccessfulHttpStatus(status: number, method: string): void;
+export declare function updateBridgeOptionsInPlace(current: NativeBridgeOptions, next: NativeBridgeOptions): NativeBridgeOptions;
+//# sourceMappingURL=bridgeState.d.ts.map

package/lib/typescript/module/connections/ConnectionSetupScreen.d.ts

@@ -39,12 +39,23 @@
  * the consuming app decides how to render it (full-screen, modal, etc.).
  */
 import React from 'react';
-import type { ConnectorSchema } from '../platform/useConnectionRefs.js';
+import type { ConnectionConsentDetails, ResourceConsentRequirement } from '../connections/types.js';
+import type { ConnectorSchema } from './useConnectionRefs.js';
 export interface MissingConnectorEntry {
     /** Connector API ID (e.g. "/providers/Microsoft.PowerApps/apis/shared_office365users"). */
     apiId: string;
     /** Local ref ID from power.config.json (for correlation). */
     localRefId: string;
+    /** Canonical connector short name. Supplied by useConnectionRefs. */
+    connectorId?: string;
+    dataSources?: string[];
+    displayName?: string;
+    iconUri?: string;
+    appActions?: string[];
+    gatewayObjectIdHint?: string;
+    authenticationType?: string;
+    parameterSetName?: string;
+    sharedConnectionId?: string;
 }
 export interface ConnectionSetupScreenProps {
     /**
@@ -60,11 +71,20 @@ export interface ConnectionSetupScreenProps {
     environmentId: string;
     region?: string;
     acquireToken: (scopes: string[]) => Promise<string | null>;
+    onSignOut?: () => void | Promise<void>;
     /**
      * Called when all missing connections have been resolved.
-     * `resolvedIds` maps apiId → connectionId for all newly created connections.
+    * `resolvedIds` maps localRefId → connectionId for all newly created connections.
      */
-    onAllConnected: (resolvedIds: Record<string, string>) => void;
+    onAllConnected: (resolvedIds: Record<string, string>) => void | Promise<void>;
+    /** All connector usages requiring user approval, including already-resolved references. */
+    consentDetails?: ConnectionConsentDetails[];
+    /** Additional protected resources, such as cross-environment Dataverse instances. */
+    resourceConsents?: ResourceConsentRequirement[];
+    /** Called when the user explicitly declines access. */
+    onConsentDeclined?: () => void | Promise<void>;
+    /** Whether to show app-level Review Access after authentication. Defaults to true. */
+    showReview?: boolean;
     /**
      * If provided, a "Skip" button is shown. Useful for non-blocking connection flows.
      * The app should handle the case where connections remain unresolved.
@@ -76,11 +96,12 @@ export interface ConnectionSetupScreenProps {
      * access on each newly created connection, fixing the APIM 403 for
      * third-party app tokens.
      */
-    isvClientId?: string;
+    isvClientId: string;
     /**
      * Optional custom renderer for the OAuth WebView.
      * Receives the consent URL and a dismiss callback.
-     * If not provided, `Linking.openURL()` is used to open the URL in the system browser.
+    * If not provided, Expo's system authentication browser is used.
+    * Custom views should pass their final redirect URL to `onDone` when available.
      *
      * @example
      *   // Using react-native-webview:
@@ -91,7 +112,7 @@ export interface ConnectionSetupScreenProps {
      *     </Modal>
      *   )}
      */
-    renderOAuthWebView?: (url: string, onDone: () => void) => React.ReactNode;
+    renderOAuthWebView?: (url: string, onDone: (redirectUrl?: string) => void) => React.ReactNode;
     /** Optional title override (default: "Set up connections"). */
     title?: string;
 }
@@ -103,5 +124,5 @@ export interface ConnectionSetupScreenProps {
  * resolved `onAllConnected` fires and the parent app should unmount this
  * component and proceed to launch the app.
  */
-export declare function ConnectionSetupScreen({ missingConnectors, schemaMap, environmentId, region, acquireToken, isvClientId, onAllConnected, onSkip, renderOAuthWebView, title, }: ConnectionSetupScreenProps): React.JSX.Element;
+export declare function ConnectionSetupScreen({ missingConnectors, schemaMap, environmentId, region, acquireToken, onSignOut, isvClientId, onAllConnected, onSkip, consentDetails, resourceConsents, onConsentDeclined, showReview, renderOAuthWebView, title, }: ConnectionSetupScreenProps): React.JSX.Element;
 //# sourceMappingURL=ConnectionSetupScreen.d.ts.map

package/lib/typescript/module/{platform → connections}/PowerPlatformConnectionApi.d.ts

@@ -7,14 +7,12 @@
  * These mirror the endpoints used by ConnectorsApi in @microsoft/power-apps-common
  * but are implemented as plain async functions so they have no external dependencies.
  */
-import type { NativeConnectionInstance } from '../connections/types.js';
+import type { DatabaseReference } from '../platform/DataverseDataSources.js';
+import type { ConnectionInput, ConnectionParameterSet, ConnectionRequirement, ConnectionUsageInput, NativeConnectionInstance, ResourceConsentRequirement } from './types.js';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
-/**
- * Token scope for the Power Apps RP (api.powerapps.com).
- * Required when calling modifyPermissions to register a service principal
- * in the connection ACE so that APIM accepts third-party app tokens at runtime.
- */
-export declare const SERVICE_POWERAPPS_SCOPE = "https://service.powerapps.com/.default";
+export declare class AppLaunchAccessDeniedError extends Error {
+    constructor();
+}
 /** Subset of connector metadata returned by the Power Platform API. */
 export interface ConnectorMetadata {
     /** Short connector name, e.g. "shared_office365users". */
@@ -25,8 +23,15 @@ export interface ConnectorMetadata {
     iconUri: string;
     /** Description text. */
     description: string;
-    /** Whether this is a first-party (Microsoft-published) connector. */
-    isFirstParty: boolean;
+    /** Environment-specific APIM runtime URL used for connector requests. */
+    primaryRuntimeUrl: string;
+    scopes: {
+        will: string[];
+        wont: string[];
+    };
+    /** Whether the connector authenticates through an OAuth consent flow. */
+    hasOAuthParameter: boolean;
+    parameterSets: ConnectionParameterSet[];
 }
 /**
  * Fetch metadata for a single connector from the Power Platform API.
@@ -43,6 +48,8 @@ export declare function fetchConnectorMetadata(connectorId: string, environmentI
  * Returns only the `NativeConnectionInstance` shape used by the disambiguation layer.
  */
 export declare function fetchConnectionsForConnector(connectorId: string, environmentId: string, region: string, token: string): Promise<NativeConnectionInstance[]>;
+/** Delete a single connection instance from the user's environment. */
+export declare function deleteConnection(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 /**
  * Result of initiating an OAuth connection creation.
  *
@@ -51,8 +58,7 @@ export declare function fetchConnectionsForConnector(connectorId: string, enviro
  *   user can complete the OAuth consent flow. Poll `pollConnectionStatus`
  *   until the status changes to "Connected".
  *
- * `connected` — the connection was created and is already Connected (e.g.,
- *   first-party SSO connections that do not need explicit OAuth consent).
+ * `connected` — the connection resource was created in Connected state.
  *
  * `error` — creation failed; `message` contains the error description.
  */
@@ -71,7 +77,7 @@ export type CreateConnectionResult = {
  * Create a new connection for a connector in the user's environment.
  *
  * Calls:
- *   POST {envBase}/connectivity/apis/{connectorId}/connections
+ *   PUT {envBase}/connectivity/connectors/{connectorId}/connections/{connectionId}
  *
  * If the response contains a `consentLink`, the connection needs OAuth
  * completion (caller should open the URL and then poll `pollConnectionStatus`).
@@ -86,7 +92,8 @@ export type CreateConnectionResult = {
  *                           will redirect the user here after consent. Defaults to
  *                           the standard native-client redirect accepted by Power Platform.
  */
-export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string): Promise<CreateConnectionResult>;
+export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string, input?: ConnectionInput): Promise<CreateConnectionResult>;
+export declare function repairConnection(connectorId: string, connectionName: string, environmentId: string, region: string, token: string, oauthRedirectUrl?: string, input?: ConnectionInput, requiresApiConsent?: boolean): Promise<CreateConnectionResult>;
 /**
  * Poll a connection's status until it is "Connected" or a timeout is reached.
  *
@@ -101,6 +108,7 @@ export declare function createConnection(connectorId: string, environmentId: str
 export declare function pollConnectionStatus(connectorId: string, connectionName: string, environmentId: string, region: string, acquireToken: (scopes: string[]) => Promise<string | null>, options?: {
     intervalMs?: number;
     timeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<NativeConnectionInstance | null>;
 /**
  * Confirm a consent code returned by the APIM consent server in the OAuth
@@ -141,13 +149,38 @@ export interface AppLaunchResult {
      * has no linked Dataverse database).
      */
     dataverseOrgUrl: string;
+    /** Dataverse table metadata returned by the app launch endpoint. */
+    databaseReferences: Record<string, DatabaseReference>;
     /**
      * Connector short-names (e.g. "shared_office365users") for which the
      * launch API found no "Connected" connection instance for the signed-in
      * user.  These connectors need the connection setup flow.
      */
     missingConnectors: string[];
+    /** Missing requirements keyed by the app's local connection-reference ID. */
+    missingConnectionReferences: ConnectionRequirement[];
+    /** Every app requirement, including references resolved by the launch API. */
+    connectionRequirements: ConnectionRequirement[];
+    /** Connected candidates retained for explicit per-reference disambiguation. */
+    connectionCandidates: Record<string, NativeConnectionInstance[]>;
+    /** Non-connector protected resources requiring explicit user disclosure. */
+    resourceConsents: ResourceConsentRequirement[];
+    /** Configuration errors that make bridge connection binding ambiguous. */
+    configurationErrors: string[];
+    /** Durable app-to-connection bindings returned by launch or the app connections API. */
+    registeredConnectionUsages: RegisteredConnectionUsage[];
+    /** True when at least one selected local reference/action is not durably registered. */
+    requiresConnectionConsent: boolean;
+}
+export interface RegisteredConnectionUsage {
+    reference: string;
+    apiId: string;
+    connectionId: string;
+    appActions: string[];
 }
+export declare function fetchAppConnectionUsages(appId: string, environmentId: string, region: string, token: string): Promise<RegisteredConnectionUsage[]>;
+export declare function postConnectionUsage(appId: string, usage: ConnectionUsageInput, environmentId: string, region: string, token: string): Promise<void>;
+export declare function reportScopeConsents(appId: string, usages: ConnectionUsageInput[], environmentId: string, region: string, token: string): Promise<void>;
 /**
  * Fetch app launch data from the Power Platform environment-scoped launch
  * endpoint and process it into the shape the NativePowerAppsBridge needs.
@@ -160,7 +193,7 @@ export interface AppLaunchResult {
  *                                          — Dataverse org URL
  *
  * Endpoint (environment-scoped, same base as all Power Platform API calls):
- *   GET {envEndpoint}/powerapps/apps/{appId}/launch
+ *   POST {envEndpoint}/powerapps/apps/{appId}/launch
  *       ?api-version=2&lastKnownGoodPublishedVersion=true
  *
  * Authentication: bearer token for {@link powerPlatformScope}`(region)`.
@@ -169,37 +202,13 @@ export interface AppLaunchResult {
  * @param environmentId - Environment GUID.
  * @param region        - Cluster region (default "prod").
  * @param token         - Bearer token for {@link powerPlatformScope}`(region)`.
- * @returns Processed launch data, or `null` if the call fails.
+ * @returns Processed launch data, or `null` when the app is not found.
  */
 export declare function fetchAppLaunchData(appId: string, environmentId: string, region: string, token: string): Promise<AppLaunchResult | null>;
 /**
- * Decode the `oid` (object ID) claim from a JWT access token.
- *
- * The oid claim is in the base64url-encoded payload section (middle part).
- * Available in Hermes (React Native) via the global `atob`.
- */
-export declare function parseJwtOid(jwtToken: string): string | null;
-/**
- * Add the ISV's AAD application (client) ID to the connection's ACL AppIds
- * list via the Power Apps RP `addAadAppToConnectionAcl` endpoint.
- *
- * The RP finds the user's existing ACE (identified by `userOid`) and appends
- * `isvClientId` to its `AppIds` list. APIM's stage-2 token check verifies
- * that the requesting token's `appid` is present in this list, so without
- * this call APIM returns 403 "missing connection ACL" for third-party tokens.
- *
- * POST https://api.powerapps.com/providers/Microsoft.PowerApps/environments/{environmentId}
- *      /apis/{connectorId}/connections/{connectionId}/addAadAppToConnectionAcl
- *      ?api-version=2016-11-01
- *
- * Body: { "aadApplicationId": "<ISV client ID>", "objectId": "<user OID>" }
- *
- * @param connectorId   - Connector short name (e.g. "shared_office365users").
- * @param connectionId  - Bare 32-char hex connection ID.
- * @param environmentId - Environment GUID.
- * @param isvClientId   - The ISV's AAD application (client) ID.
- * @param userOid       - The signed-in user's AAD object ID (oid JWT claim).
- * @param token         - Bearer token for `https://service.powerapps.com/.default`.
+ * Grant the calling application's delegated access to a connection for the
+ * signed-in user. The backend derives both identities from the token and
+ * selects the most specific applicable user, group, or tenant ACL.
  */
-export declare function addAadAppToConnectionAcl(connectorId: string, connectionId: string, environmentId: string, isvClientId: string, userOid: string, token: string): Promise<boolean>;
+export declare function grantConnectionUserConsent(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 //# sourceMappingURL=PowerPlatformConnectionApi.d.ts.map

package/lib/typescript/module/connections/connectionMetadata.d.ts

@@ -0,0 +1,66 @@
+import type { ConnectionInput, ConnectionParameterDefinition, ConnectionParameterSet, ConnectionUsageInput } from './types.js';
+export interface ConsentLinkDefinition {
+    redirectUrl: string;
+}
+export type SerializedConnectionParameters = {
+    connectionParameters: ConnectionInput['parameters'];
+} | {
+    connectionParametersSet: {
+        name: string;
+        values: Record<string, {
+            value: ConnectionInput['parameters'][string];
+        }>;
+    };
+};
+export interface RawConnectionParameter {
+    type?: string;
+    defaultValue?: string | boolean | number;
+    uiDefinition?: {
+        displayName?: string;
+        constraints?: {
+            required?: string | boolean;
+            hidden?: string | boolean;
+            capability?: string[];
+            allowedValues?: Array<{
+                value?: string;
+                displayName?: string;
+            }>;
+        };
+    };
+}
+export interface RawConnectionParameterSet {
+    name?: string;
+    uiDefinition?: {
+        displayName?: string;
+    };
+    connectionParameters?: Record<string, RawConnectionParameter>;
+    parameters?: Record<string, RawConnectionParameter>;
+}
+export declare function parseConnectionParameters(parameters: Record<string, RawConnectionParameter> | undefined): ConnectionParameterDefinition[];
+export declare function buildConnectionParameterSets(connectionParameters: Record<string, RawConnectionParameter> | undefined, parameterSets: RawConnectionParameterSet[] | undefined): ConnectionParameterSet[];
+export declare function hasOAuthParameter(parameters: Record<string, RawConnectionParameter> | undefined): boolean;
+export declare function buildConnectionUserConsentUrl(environmentEndpoint: string, connectorId: string, connectionId: string): string;
+export declare function getAppLaunchFailureMessage(status: number, statusText: string, responseText: string): string | null;
+export declare function isAppLaunchAccessDenied(status: number, responseText: string): boolean;
+export declare function buildConsentLinkDefinition(redirectUrl: string): ConsentLinkDefinition;
+export declare function serializeConnectionParameters(input?: ConnectionInput): SerializedConnectionParameters;
+export declare function buildConnectionUsageUrl(environmentBaseUrl: string, environmentId: string, usage: ConnectionUsageInput): string;
+export declare function buildConnectionUsageRequest(appId: string, usage: ConnectionUsageInput): {
+    properties: {
+        reference: string;
+        resourceId: string;
+        appActions: string[];
+    };
+};
+export declare function buildScopeConsentUrl(environmentBaseUrl: string, appId: string): string;
+export declare function buildScopeConsentRequest(usages: ConnectionUsageInput[]): {
+    consents: Array<{
+        connectionId: string;
+        consentType: 'userConsent';
+        scopes: {
+            will: string[];
+            wont: string[];
+        };
+    }>;
+};
+//# sourceMappingURL=connectionMetadata.d.ts.map

package/lib/typescript/module/connections/connectionState.d.ts

@@ -0,0 +1,16 @@
+import type { AppLaunchResult } from './PowerPlatformConnectionApi.js';
+import type { RegisteredConnectionUsage } from './PowerPlatformConnectionApi.js';
+import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
+import type { ConnectionRequirement } from './types.js';
+export declare function isTransientConnectionConsentStatus(status: number): boolean;
+export declare function shouldGrantConnectionUserConsent(requirement: Pick<ConnectionRequirement, 'sharedConnectionId'>, runningInDevPlayer: boolean): boolean;
+export declare function getConnectionNamesRequiringAclGrant(connectionRefs: Record<string, AppConnectionReference>, connectionRequirements: ConnectionRequirement[]): string[];
+export declare function invalidateFailedAclGrants(result: AppLaunchResult, failedConnectionNames: ReadonlySet<string>): void;
+export declare function selectLaunchConnection(result: AppLaunchResult, localRefId: string, connectionId: string): boolean;
+export declare function getUnregisteredConnectionRequirements(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): ConnectionRequirement[];
+export declare function applyRegisteredConnectionSelections(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function hasRegisteredConnectionConsent(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): boolean;
+export declare function applyRegisteredConnectionUsages(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function shouldPersistConnectionUsages(runningInDevPlayer: boolean, appId: string | undefined): boolean;
+export declare function shouldShowConnectionReview(runningInDevPlayer: boolean, requiresConnectionConsent: boolean, hasResourceConsents: boolean): boolean;
+//# sourceMappingURL=connectionState.d.ts.map

package/lib/typescript/module/connections/disambiguate.d.ts

@@ -27,6 +27,7 @@ import type { NativeConnectionInstance, NativeConnectionResolution } from './typ
 export declare function disambiguateConnections(connectionReferences: Record<string, {
     id: string;
     dataSources: string[];
+    sharedConnectionId?: string;
 }>, allConnectionsByApiId: Record<string, NativeConnectionInstance[]>): NativeConnectionResolution[];
 /**
  * Extract the connection UUID from a raw connection name returned by the API.
@@ -36,8 +37,9 @@ export declare function disambiguateConnections(connectionReferences: Record<str
  *   "abc12345def6789012345678901234ab"                        (bare UUID, no dashes)
  *   "abc12345-def6-7890-1234-5678901234ab"                   (UUID with dashes)
  *
- * Returns the 32-char hex ID (dashes stripped) or the raw string if no UUID
- * pattern is found.
+ * Returns the terminal resource name exactly as supplied by Power Platform.
+ * Some connectors require dashed GUIDs while others use compact IDs.
  */
 export declare function extractConnectionId(rawName: string): string;
+export declare function connectionIdsEqual(left: string, right: string): boolean;
 //# sourceMappingURL=disambiguate.d.ts.map

package/lib/typescript/module/{platform → connections}/resolveConnections.d.ts

@@ -5,19 +5,18 @@
  * useConnectionRefs:
  *
  *  • resolveViaStaticRefs — per-connector resolution using the static
- *    connectionReferences map from power.config.json.  Used by the Dev Player
- *    and during local development (no appId) or when the launch API is
- *    unavailable.  Handles pre-disambiguation ACL grants so inaccessible
- *    connections are excluded before the user is asked to pick.
+ *    connectionReferences map from power.config.json. Used only by Dev Player
+ *    for unpublished local apps. Handles pre-disambiguation ACL grants so
+ *    inaccessible connections are excluded before the user is asked to pick.
  *
- *  • applyAclGrants — post-resolution ACL grants used by the fast path
+ *  • applyAclGrants — post-resolution user consent used by the fast path
  *    (production APKs via fetchAppLaunchData).
  *
  * Both helpers return / consume the shared AppLaunchResult shape so the
  * hook orchestrator can handle them uniformly.
  */
 import type { AppLaunchResult } from './PowerPlatformConnectionApi.js';
-import type { OnDisambiguationNeeded, OnMissingConnection } from '../connections/types.js';
+import type { ConnectionReferenceConfig, ConnectionRequirement, OnDisambiguationNeeded, OnMissingConnection } from './types.js';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
 /**
  * Connector schema entry generated by `generate-connector-schemas`.
@@ -28,6 +27,10 @@ export interface ConnectorSchema {
     name: string;
     properties: {
         primaryRuntimeUrl: string;
+        scopes?: {
+            will?: string[];
+            wont?: string[];
+        };
     };
 }
 export interface StaticRefsOptions {
@@ -35,19 +38,16 @@ export interface StaticRefsOptions {
      * Static connectionReferences from power.config.json.
      * Shape: { [refId]: { id: string; dataSources: string[] } }
      */
-    connectionReferences: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences: Record<string, ConnectionReferenceConfig>;
     /** Connector schema map keyed by data source name. */
     schemaMap: Record<string, ConnectorSchema>;
     environmentId: string;
     region: string;
-    /** Used for ACL grants and the Dataverse instanceUrl fetch. */
+    /** Used for connection consent and the Dataverse instanceUrl fetch. */
     acquireToken: (scopes: string[]) => Promise<string | null>;
     /** Pre-acquired Power Platform API bearer token. */
     token: string;
-    /** ISV client ID — when provided, runs pre-disambiguation ACL grants. */
+    /** ISV client ID — when provided, runs pre-disambiguation user consent. */
     isvClientId?: string;
     onDisambiguationNeeded?: OnDisambiguationNeeded;
     onMissingConnection?: OnMissingConnection;
@@ -59,7 +59,7 @@ export interface StaticRefsOptions {
  *  1. Build an apiId → schema lookup.
  *  2. In parallel: fetch the Dataverse instanceUrl and all connection instances
  *     for every connector.
- *  3. If `isvClientId` is set, run pre-disambiguation ACL grants — connections
+ *  3. If `isvClientId` is set, run pre-disambiguation user consent — connections
  *     where the grant fails are marked `NeedsAclGrant` and excluded from
  *     resolution, prompting the user to create a new connection.
  *  4. Disambiguate: resolve single matches, invoke callbacks for ambiguous /
@@ -69,18 +69,18 @@ export interface StaticRefsOptions {
  */
 export declare function resolveViaStaticRefs({ connectionReferences, schemaMap, environmentId, region, acquireToken, token, isvClientId, onDisambiguationNeeded, onMissingConnection, }: StaticRefsOptions): Promise<AppLaunchResult>;
 /**
- * Run idempotent post-resolution ACL grants on behalf of the ISV app.
+ * Run idempotent post-resolution delegated consent grants for the calling app.
  *
  * Used by the fast path (production APKs via `fetchAppLaunchData`) where the
- * launch API has already resolved the user's connections — grants are applied
- * after the fact so APIM accepts tokens issued to the ISV's AAD app.
+ * launch API has already resolved the user's connections. Grants are applied
+ * only to user-selected connections; fixed shared connections are already
+ * authorized by their owner and must not receive delegated user consent.
  *
  * For the slow path the grants run before disambiguation inside
  * `resolveViaStaticRefs`, where they can still influence which connections
  * are considered available.
  *
- * Failures are swallowed — a failed grant will surface as a 403 at runtime
- * when the connector is called.
+ * Returns the connection names whose ACL grants failed so callers can fail closed.
  */
-export declare function applyAclGrants(connectionRefs: Record<string, AppConnectionReference>, environmentId: string, isvClientId: string, acquireToken: (scopes: string[]) => Promise<string | null>): Promise<void>;
+export declare function applyAclGrants(connectionRefs: Record<string, AppConnectionReference>, connectionRequirements: ConnectionRequirement[], environmentId: string, region: string, acquireToken: (scopes: string[]) => Promise<string | null>): Promise<Set<string>>;
 //# sourceMappingURL=resolveConnections.d.ts.map