@microsoft/power-apps-native-host 0.2.22 → 0.3.0

package/lib/commonjs/connections/connectionMetadata.js

@@ -0,0 +1,127 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.buildConnectionParameterSets = buildConnectionParameterSets;
+exports.buildConnectionUsageRequest = buildConnectionUsageRequest;
+exports.buildConnectionUsageUrl = buildConnectionUsageUrl;
+exports.buildConnectionUserConsentUrl = buildConnectionUserConsentUrl;
+exports.buildConsentLinkDefinition = buildConsentLinkDefinition;
+exports.buildScopeConsentRequest = buildScopeConsentRequest;
+exports.buildScopeConsentUrl = buildScopeConsentUrl;
+exports.getAppLaunchFailureMessage = getAppLaunchFailureMessage;
+exports.hasOAuthParameter = hasOAuthParameter;
+exports.isAppLaunchAccessDenied = isAppLaunchAccessDenied;
+exports.parseConnectionParameters = parseConnectionParameters;
+exports.serializeConnectionParameters = serializeConnectionParameters;
+var _types = require("./types.js");
+function parseConnectionParameters(parameters) {
+  return Object.entries(parameters ?? {}).flatMap(([name, parameter]) => {
+    if (!parameter.uiDefinition) return [];
+    const constraints = parameter.uiDefinition.constraints;
+    const type = (parameter.type ?? 'string').toLowerCase();
+    const supportedType = type === 'string' || type === 'securestring' || type === 'boolean' || type === 'integer' || type === 'clientcertificate' ? type : null;
+    if (!supportedType) return [];
+    return [{
+      name,
+      displayName: parameter.uiDefinition.displayName ?? name,
+      type: supportedType,
+      required: constraints?.required === true || constraints?.required === 'true',
+      hidden: constraints?.hidden === true || constraints?.hidden === 'true',
+      capabilities: constraints?.capability,
+      allowedValues: constraints?.allowedValues?.filter(item => Boolean(item.value)).map(item => ({
+        value: item.value,
+        displayName: item.displayName ?? item.value
+      })),
+      defaultValue: parameter.defaultValue
+    }];
+  });
+}
+function buildConnectionParameterSets(connectionParameters, parameterSets) {
+  const declaredSets = (parameterSets ?? []).filter(item => Boolean(item.name)).map(item => ({
+    name: item.name,
+    displayName: item.uiDefinition?.displayName ?? item.name,
+    parameters: parseConnectionParameters(item.connectionParameters ?? item.parameters),
+    requiresApiConsent: hasOAuthParameter(item.connectionParameters ?? item.parameters),
+    gatewayParameterName: Object.entries(item.connectionParameters ?? item.parameters ?? {}).find(([, parameter]) => parameter.type?.toLowerCase() === 'gatewaysetting')?.[0]
+  }));
+  return declaredSets.length > 0 ? declaredSets : [{
+    name: undefined,
+    displayName: 'Default',
+    parameters: parseConnectionParameters(connectionParameters),
+    requiresApiConsent: hasOAuthParameter(connectionParameters),
+    gatewayParameterName: Object.entries(connectionParameters ?? {}).find(([, parameter]) => parameter.type?.toLowerCase() === 'gatewaysetting')?.[0]
+  }];
+}
+function hasOAuthParameter(parameters) {
+  return Object.values(parameters ?? {}).some(parameter => parameter.type?.toLowerCase() === 'oauthsetting');
+}
+function buildConnectionUserConsentUrl(environmentEndpoint, connectorId, connectionId) {
+  return `${environmentEndpoint}/connectivity/connectors/${encodeURIComponent((0, _types.getConnectorId)(connectorId))}` + `/connections/${encodeURIComponent(connectionId)}/userConsent?api-version=1`;
+}
+function getAppLaunchFailureMessage(status, statusText, responseText) {
+  if (status === 404) return null;
+  return `Unable to load the published app (HTTP ${status}): ${responseText || statusText}`;
+}
+function isAppLaunchAccessDenied(status, responseText) {
+  if (status !== 403) return false;
+  try {
+    const body = JSON.parse(responseText);
+    return body.error?.code === 'PowerAppsNoAccess' || body.error?.details?.some(detail => detail.code === 'PowerAppsNoAccess') === true;
+  } catch {
+    return false;
+  }
+}
+function buildConsentLinkDefinition(redirectUrl) {
+  return {
+    redirectUrl
+  };
+}
+function serializeConnectionParameters(input) {
+  const parameters = {
+    ...(input?.parameters ?? {}),
+    ...(input?.gatewayObjectId && input.gatewayParameterName ? {
+      [input.gatewayParameterName]: {
+        gatewayObjectId: input.gatewayObjectId
+      }
+    } : {})
+  };
+  if (!input?.parameterSetName) return {
+    connectionParameters: parameters
+  };
+  return {
+    connectionParametersSet: {
+      name: input.parameterSetName,
+      values: Object.fromEntries(Object.entries(parameters).map(([name, value]) => [name, {
+        value
+      }]))
+    }
+  };
+}
+function buildConnectionUsageUrl(environmentBaseUrl, environmentId, usage) {
+  return `${environmentBaseUrl}/powerapps/apis/${encodeURIComponent((0, _types.getConnectorId)(usage.apiId))}` + `/connections/${encodeURIComponent(usage.connectionId)}/usages` + `?api-version=1&$filter=environment eq '${environmentId}'`;
+}
+function buildConnectionUsageRequest(appId, usage) {
+  const resourceId = appId.startsWith('/providers/') ? appId : `/providers/Microsoft.PowerApps/apps/${appId}`;
+  return {
+    properties: {
+      reference: usage.localRefId,
+      resourceId,
+      appActions: usage.appActions
+    }
+  };
+}
+function buildScopeConsentUrl(environmentBaseUrl, appId) {
+  const appName = appId.split('/').filter(Boolean).pop() ?? appId;
+  return `${environmentBaseUrl}/powerapps/apps/${encodeURIComponent(appName)}` + '/reportScopesConsent?api-version=1';
+}
+function buildScopeConsentRequest(usages) {
+  return {
+    consents: usages.map(usage => ({
+      connectionId: usage.connectionId,
+      consentType: 'userConsent',
+      scopes: usage.apiScopes
+    }))
+  };
+}

package/lib/commonjs/connections/connectionState.js

@@ -0,0 +1,96 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.applyRegisteredConnectionSelections = applyRegisteredConnectionSelections;
+exports.applyRegisteredConnectionUsages = applyRegisteredConnectionUsages;
+exports.getConnectionNamesRequiringAclGrant = getConnectionNamesRequiringAclGrant;
+exports.getUnregisteredConnectionRequirements = getUnregisteredConnectionRequirements;
+exports.hasRegisteredConnectionConsent = hasRegisteredConnectionConsent;
+exports.invalidateFailedAclGrants = invalidateFailedAclGrants;
+exports.isTransientConnectionConsentStatus = isTransientConnectionConsentStatus;
+exports.selectLaunchConnection = selectLaunchConnection;
+exports.shouldGrantConnectionUserConsent = shouldGrantConnectionUserConsent;
+exports.shouldPersistConnectionUsages = shouldPersistConnectionUsages;
+exports.shouldShowConnectionReview = shouldShowConnectionReview;
+var _types = require("./types.js");
+var _disambiguate = require("./disambiguate.js");
+function isTransientConnectionConsentStatus(status) {
+  return status === 408 || status === 429 || status >= 500;
+}
+function shouldGrantConnectionUserConsent(requirement, runningInDevPlayer) {
+  return runningInDevPlayer || !requirement.sharedConnectionId;
+}
+function getConnectionNamesRequiringAclGrant(connectionRefs, connectionRequirements) {
+  const connectionNames = [];
+  const seen = new Set();
+  for (const requirement of connectionRequirements) {
+    if (!shouldGrantConnectionUserConsent(requirement, false)) continue;
+    const connectionName = requirement.dataSources.map(dataSource => connectionRefs[dataSource]?.connectionName).find(selectedName => Boolean(selectedName));
+    if (!connectionName || seen.has(connectionName)) continue;
+    seen.add(connectionName);
+    connectionNames.push(connectionName);
+  }
+  return connectionNames;
+}
+function invalidateFailedAclGrants(result, failedConnectionNames) {
+  if (failedConnectionNames.size === 0) return;
+  for (const requirement of result.connectionRequirements) {
+    const selected = requirement.dataSources.map(dataSource => result.connectionRefs[dataSource]).find(Boolean);
+    if (!selected || !failedConnectionNames.has(selected.connectionName)) continue;
+    for (const dataSource of requirement.dataSources) {
+      const reference = result.connectionRefs[dataSource];
+      if (reference) reference.connectionName = '';
+    }
+    if (!result.missingConnectionReferences.some(item => item.localRefId === requirement.localRefId)) {
+      result.missingConnectionReferences.push(requirement);
+    }
+    if (!result.missingConnectors.includes(requirement.apiId)) {
+      result.missingConnectors.push(requirement.apiId);
+    }
+  }
+}
+function selectLaunchConnection(result, localRefId, connectionId) {
+  const requirement = result.connectionRequirements.find(item => item.localRefId === localRefId);
+  const candidate = result.connectionCandidates[localRefId]?.find(item => (0, _disambiguate.connectionIdsEqual)(item.id, connectionId));
+  if (!requirement || !candidate) return false;
+  for (const dataSource of requirement.dataSources) {
+    const reference = result.connectionRefs[dataSource];
+    if (reference) reference.connectionName = candidate.id;
+  }
+  result.missingConnectionReferences = result.missingConnectionReferences.filter(item => item.localRefId !== localRefId);
+  if (!result.missingConnectionReferences.some(item => item.apiId === requirement.apiId)) {
+    result.missingConnectors = result.missingConnectors.filter(apiId => apiId !== requirement.apiId);
+  }
+  return true;
+}
+function getUnregisteredConnectionRequirements(result, usages = result.registeredConnectionUsages) {
+  return result.connectionRequirements.filter(requirement => {
+    const selectedConnectionId = requirement.dataSources.map(dataSource => result.connectionRefs[dataSource]?.connectionName).find(Boolean);
+    if (!selectedConnectionId) return true;
+    return !usages.some(usage => usage.reference.toLowerCase() === requirement.localRefId.toLowerCase() && (0, _types.normalizeApiId)(usage.apiId) === requirement.apiId && (0, _disambiguate.connectionIdsEqual)(usage.connectionId, selectedConnectionId) && (usage.appActions.length === 0 || (requirement.appActions ?? []).every(action => usage.appActions.includes(action))));
+  });
+}
+function applyRegisteredConnectionSelections(result, usages) {
+  for (const requirement of result.connectionRequirements) {
+    const usage = usages.find(item => item.reference.toLowerCase() === requirement.localRefId.toLowerCase() && (0, _types.normalizeApiId)(item.apiId) === requirement.apiId);
+    if (!usage) continue;
+    const candidate = result.connectionCandidates[requirement.localRefId]?.find(item => (0, _disambiguate.connectionIdsEqual)(item.id, usage.connectionId));
+    if (candidate) selectLaunchConnection(result, requirement.localRefId, candidate.id);
+  }
+}
+function hasRegisteredConnectionConsent(result, usages = result.registeredConnectionUsages) {
+  return getUnregisteredConnectionRequirements(result, usages).length === 0;
+}
+function applyRegisteredConnectionUsages(result, usages) {
+  applyRegisteredConnectionSelections(result, usages);
+  result.registeredConnectionUsages = usages;
+  result.requiresConnectionConsent = getUnregisteredConnectionRequirements(result, usages).length > 0;
+}
+function shouldPersistConnectionUsages(runningInDevPlayer, appId) {
+  return !runningInDevPlayer && Boolean(appId);
+}
+function shouldShowConnectionReview(runningInDevPlayer, requiresConnectionConsent, hasResourceConsents) {
+  return !runningInDevPlayer && (requiresConnectionConsent || hasResourceConsents);
+}

package/lib/commonjs/connections/disambiguate.js

@@ -3,6 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
+exports.connectionIdsEqual = connectionIdsEqual;
 exports.disambiguateConnections = disambiguateConnections;
 exports.extractConnectionId = extractConnectionId;
 var _types = require("./types.js");
@@ -35,11 +36,20 @@ var _types = require("./types.js");
 function disambiguateConnections(connectionReferences, allConnectionsByApiId) {
   const resolutions = [];
   for (const [localRefId, ref] of Object.entries(connectionReferences)) {
-    const apiId = ref.id;
-    const all = allConnectionsByApiId[apiId] ?? [];
+    const apiId = (0, _types.normalizeApiId)(ref.id);
+    const all = allConnectionsByApiId[apiId] ?? allConnectionsByApiId[ref.id] ?? [];
     const connected = all.filter(c => c.status === _types.ConnectionStatus.Connected);
     let result;
-    if (connected.length === 1) {
+    if (ref.sharedConnectionId) {
+      const sharedId = extractConnectionId(ref.sharedConnectionId);
+      const shared = connected.find(connection => connectionIdsEqual(connection.id, sharedId));
+      result = shared ? {
+        kind: 'resolved',
+        connectionId: shared.id
+      } : {
+        kind: 'missing'
+      };
+    } else if (connected.length === 1) {
       result = {
         kind: 'resolved',
         connectionId: connected[0].id
@@ -73,16 +83,14 @@ function disambiguateConnections(connectionReferences, allConnectionsByApiId) {
  *   "abc12345def6789012345678901234ab"                        (bare UUID, no dashes)
  *   "abc12345-def6-7890-1234-5678901234ab"                   (UUID with dashes)
  *
- * Returns the 32-char hex ID (dashes stripped) or the raw string if no UUID
- * pattern is found.
+ * Returns the terminal resource name exactly as supplied by Power Platform.
+ * Some connectors require dashed GUIDs while others use compact IDs.
  */
 function extractConnectionId(rawName) {
-  // Match a standard UUID (with or without dashes) at the end of the string.
-  const match = rawName.match(/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/i);
-  if (match) {
-    return match[1].replace(/-/g, '');
-  }
-  // Some connections use a 32-char hex ID without dashes, after a slash.
   const slashIdx = rawName.lastIndexOf('/');
   return slashIdx >= 0 ? rawName.slice(slashIdx + 1) : rawName;
+}
+function connectionIdsEqual(left, right) {
+  const normalize = value => extractConnectionId(value).replace(/-/g, '').toLowerCase();
+  return normalize(left) === normalize(right);
 }

package/lib/commonjs/connections/resolveConnections.js

@@ -0,0 +1,347 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.applyAclGrants = applyAclGrants;
+exports.resolveViaStaticRefs = resolveViaStaticRefs;
+var _PowerPlatformConnectionApi = require("./PowerPlatformConnectionApi.js");
+var _connectionState = require("./connectionState.js");
+var _PowerPlatformEnvironmentApi = require("../platform/PowerPlatformEnvironmentApi.js");
+var _DataverseGlobalDiscoveryApi = require("../platform/DataverseGlobalDiscoveryApi.js");
+var _disambiguate = require("../connections/disambiguate.js");
+var _types = require("./types.js");
+var _index = require("../telemetry/index.js");
+/*!
+ * power-apps-native-host — resolveConnections
+ *
+ * Pure async helpers for the two connection-resolution strategies used by
+ * useConnectionRefs:
+ *
+ *  • resolveViaStaticRefs — per-connector resolution using the static
+ *    connectionReferences map from power.config.json. Used only by Dev Player
+ *    for unpublished local apps. Handles pre-disambiguation ACL grants so
+ *    inaccessible connections are excluded before the user is asked to pick.
+ *
+ *  • applyAclGrants — post-resolution user consent used by the fast path
+ *    (production APKs via fetchAppLaunchData).
+ *
+ * Both helpers return / consume the shared AppLaunchResult shape so the
+ * hook orchestrator can handle them uniformly.
+ */
+
+const API_VERSION = '1';
+
+// ---------------------------------------------------------------------------
+// ConnectorSchema
+// ---------------------------------------------------------------------------
+
+/**
+ * Connector schema entry generated by `generate-connector-schemas`.
+ * Keyed by data source name in the `schemaMap` passed to `useConnectionRefs`.
+ */
+
+// ---------------------------------------------------------------------------
+// resolveViaStaticRefs
+// ---------------------------------------------------------------------------
+
+/**
+ * Resolve connections from the static `connectionReferences` map.
+ *
+ * Steps:
+ *  1. Build an apiId → schema lookup.
+ *  2. In parallel: fetch the Dataverse instanceUrl and all connection instances
+ *     for every connector.
+ *  3. If `isvClientId` is set, run pre-disambiguation user consent — connections
+ *     where the grant fails are marked `NeedsAclGrant` and excluded from
+ *     resolution, prompting the user to create a new connection.
+ *  4. Disambiguate: resolve single matches, invoke callbacks for ambiguous /
+ *     missing cases, perform one-shot retries when `onMissingConnection` returns
+ *     `true`.
+ *  5. Build and return an `AppLaunchResult`-shaped object.
+ */
+async function resolveViaStaticRefs({
+  connectionReferences,
+  schemaMap,
+  environmentId,
+  region,
+  acquireToken,
+  token,
+  isvClientId,
+  onDisambiguationNeeded,
+  onMissingConnection
+}) {
+  const directConnectionReferences = Object.fromEntries(Object.entries(connectionReferences).filter(([, reference]) => !(0, _types.isCompositeConnectionApiId)(reference.id)));
+  const flowConnectionReferences = Object.fromEntries(Object.entries(connectionReferences).filter(([, reference]) => (0, _types.getConnectorId)(reference.id) === 'shared_logicflows'));
+  // Build apiId → schema lookup from the static refs.
+  const schemaByApiId = Object.fromEntries(Object.values(directConnectionReferences).map(ref => {
+    const schema = ref.dataSources.map(ds => schemaMap[ds]).find(Boolean);
+    return schema ? [(0, _types.normalizeApiId)(ref.id), schema] : null;
+  }).filter(entry => entry !== null));
+  await Promise.all(Object.values({
+    ...directConnectionReferences,
+    ...flowConnectionReferences
+  }).map(async reference => {
+    const apiId = (0, _types.normalizeApiId)(reference.id);
+    if (schemaByApiId[apiId]) return;
+    const metadata = await (0, _PowerPlatformConnectionApi.fetchConnectorMetadata)((0, _types.getConnectorId)(reference.id), environmentId, region, token);
+    if (!metadata?.primaryRuntimeUrl) return;
+    schemaByApiId[apiId] = {
+      name: metadata.name,
+      properties: {
+        primaryRuntimeUrl: metadata.primaryRuntimeUrl,
+        scopes: metadata.scopes
+      }
+    };
+  }));
+  const base = (0, _PowerPlatformEnvironmentApi.buildEnvironmentEndpoint)(environmentId, region);
+  const headers = {
+    Authorization: `Bearer ${token}`
+  };
+
+  // Fetch Dataverse instanceUrl and all connection instances in parallel.
+  const [instanceUrl, ...connResults] = await Promise.all([(0, _DataverseGlobalDiscoveryApi.fetchInstanceUrl)(environmentId, region, acquireToken, token), ...Object.entries(directConnectionReferences).map(async ([localRefId, ref]) => {
+    const apiId = (0, _types.normalizeApiId)(ref.id);
+    const schema = schemaByApiId[apiId];
+    if (!schema) {
+      return {
+        localRefId,
+        apiId,
+        dataSources: ref.dataSources,
+        instances: []
+      };
+    }
+    const url = `${base}/connectivity/connectors/${schema.name}/connections` + `?api-version=${API_VERSION}&$filter=environment eq '${environmentId}'`;
+    try {
+      const res = await _index.platformHttpClient.request(url, {
+        headers
+      });
+      if (!res.ok) {
+        return {
+          localRefId,
+          apiId,
+          dataSources: ref.dataSources,
+          instances: []
+        };
+      }
+      const body = await res.json();
+      const instances = (body.value ?? []).map(c => {
+        const connected = c.properties?.statuses?.[0]?.status === 'Connected';
+        return {
+          id: (0, _disambiguate.extractConnectionId)(c.name),
+          name: c.name,
+          apiId,
+          ownerId: c.properties?.createdBy?.id,
+          status: connected ? _types.ConnectionStatus.Connected : _types.ConnectionStatus.NotConnected,
+          displayName: c.properties?.displayName,
+          isAuthenticated: connected
+        };
+      });
+      return {
+        localRefId,
+        apiId,
+        dataSources: ref.dataSources,
+        instances
+      };
+    } catch {
+      return {
+        localRefId,
+        apiId,
+        dataSources: ref.dataSources,
+        instances: []
+      };
+    }
+  })]);
+
+  // Pre-disambiguation delegated consent grants (ISV apps only).
+  //
+  // Connections where the grant fails are marked NeedsAclGrant so
+  // disambiguation treats them as unavailable and surfaces the
+  // "missing connection" flow, steering the user to create a new one. Fixed
+  if (isvClientId) {
+    const consentToken = await acquireToken([(0, _PowerPlatformEnvironmentApi.connectionUserConsentScope)(region)]);
+    if (consentToken) {
+      const attemptedGrants = new Set();
+      await Promise.all(connResults.map(async r => {
+        const reference = directConnectionReferences[r.localRefId];
+        if (!reference || !(0, _connectionState.shouldGrantConnectionUserConsent)(reference, true)) return;
+        const connId = schemaByApiId[r.apiId]?.name;
+        if (!connId) return;
+        await Promise.all(r.instances.map(async inst => {
+          if (inst.status !== _types.ConnectionStatus.Connected) return;
+          if (reference?.sharedConnectionId && !(0, _disambiguate.connectionIdsEqual)(inst.id, reference.sharedConnectionId)) return;
+          const grantKey = `${connId.toLowerCase()}/${inst.id.toLowerCase()}`;
+          if (attemptedGrants.has(grantKey)) return;
+          attemptedGrants.add(grantKey);
+          const ok = await (0, _PowerPlatformConnectionApi.grantConnectionUserConsent)(connId, inst.id, environmentId, region, consentToken);
+          if (!ok) inst.status = _types.ConnectionStatus.NeedsAclGrant;
+        }));
+      }));
+    } else {
+      for (const result of connResults) {
+        for (const instance of result.instances) {
+          if (instance.status === _types.ConnectionStatus.Connected) {
+            instance.status = _types.ConnectionStatus.NeedsAclGrant;
+          }
+        }
+      }
+    }
+  }
+
+  // Disambiguation.
+  const allConnectionsByApiId = {};
+  for (const r of connResults) {
+    allConnectionsByApiId[r.apiId] = r.instances;
+  }
+  const disambiguationResults = (0, _disambiguate.disambiguateConnections)(directConnectionReferences, allConnectionsByApiId);
+  const resolvedIds = {};
+  const unresolvedApiIds = [];
+  for (const dr of disambiguationResults) {
+    if (dr.result.kind === 'resolved') {
+      resolvedIds[dr.localRefId] = dr.result.connectionId;
+    } else if (dr.result.kind === 'ambiguous') {
+      const picked = onDisambiguationNeeded ? await onDisambiguationNeeded({
+        localRefId: dr.localRefId,
+        apiId: dr.apiId,
+        candidates: dr.result.candidates
+      }) : null;
+      if (picked) {
+        resolvedIds[dr.localRefId] = picked;
+      } else {
+        resolvedIds[dr.localRefId] = '';
+        unresolvedApiIds.push((0, _types.normalizeApiId)(dr.apiId));
+      }
+    } else {
+      // kind === 'missing'
+      let retried = false;
+      if (onMissingConnection) {
+        retried = await onMissingConnection({
+          localRefId: dr.localRefId,
+          apiId: dr.apiId
+        });
+      }
+      if (retried) {
+        // One-shot retry for this specific connector.
+        const schema = schemaByApiId[dr.apiId];
+        if (schema) {
+          try {
+            const url = `${base}/connectivity/connectors/${schema.name}/connections` + `?api-version=${API_VERSION}&$filter=environment eq '${environmentId}'`;
+            const res = await _index.platformHttpClient.request(url, {
+              headers
+            });
+            if (res.ok) {
+              const body = await res.json();
+              const retryInstances = (body.value ?? []).map(c => {
+                const connected = c.properties?.statuses?.[0]?.status === 'Connected';
+                return {
+                  id: (0, _disambiguate.extractConnectionId)(c.name),
+                  name: c.name,
+                  apiId: dr.apiId,
+                  status: connected ? _types.ConnectionStatus.Connected : _types.ConnectionStatus.NotConnected,
+                  isAuthenticated: connected
+                };
+              });
+              const connected = retryInstances.find(i => i.status === _types.ConnectionStatus.Connected);
+              if (connected) {
+                resolvedIds[dr.localRefId] = connected.id;
+                continue;
+              }
+            }
+          } catch {
+            // Fall through to missing.
+          }
+        }
+      }
+      resolvedIds[dr.localRefId] = '';
+      unresolvedApiIds.push((0, _types.normalizeApiId)(dr.apiId));
+    }
+  }
+  const dataverseOrgUrl = (instanceUrl ?? '').replace(/\/$/, '');
+
+  // Build the final AppConnectionReference map.
+  const connectionRefs = {};
+  for (const [localRefId, ref] of Object.entries(directConnectionReferences)) {
+    const normalizedApiId = (0, _types.normalizeApiId)(ref.id);
+    const schema = schemaByApiId[normalizedApiId];
+    const connectionName = resolvedIds[localRefId] ?? '';
+    const isDataverse = ref.id.includes('commondataserviceforapps');
+    const entry = {
+      apiId: normalizedApiId,
+      runtimeUrl: schema?.properties.primaryRuntimeUrl ?? '',
+      connectionName,
+      datasetName: isDataverse ? dataverseOrgUrl : (0, _types.getConnectionDatasetName)(ref)
+    };
+    for (const ds of ref.dataSources) {
+      connectionRefs[ds] = entry;
+    }
+  }
+  for (const ref of Object.values(flowConnectionReferences)) {
+    const normalizedApiId = (0, _types.normalizeApiId)(ref.id);
+    const schema = schemaByApiId[normalizedApiId];
+    const entry = {
+      apiId: normalizedApiId,
+      runtimeUrl: schema?.properties.primaryRuntimeUrl ?? '',
+      connectionName: (0, _types.getFlowConnectionName)(ref),
+      datasetName: ''
+    };
+    for (const dataSource of (0, _types.getFlowDataSourceNames)(ref)) {
+      connectionRefs[dataSource] = entry;
+    }
+  }
+  const scopesByApiId = Object.fromEntries(Object.entries(schemaByApiId).map(([apiId, schema]) => [apiId, {
+    will: schema.properties.scopes?.will ?? [],
+    wont: schema.properties.scopes?.wont ?? []
+  }]));
+  const requirements = (0, _types.buildConnectionRequirements)(connectionReferences, scopesByApiId);
+  const requirementsByLocalRefId = Object.fromEntries(requirements.map(requirement => [requirement.localRefId, requirement]));
+  const missingConnectionReferences = Object.entries(resolvedIds).filter(([, connectionId]) => !connectionId).map(([localRefId]) => requirementsByLocalRefId[localRefId]).filter(requirement => Boolean(requirement));
+  const connectionCandidates = Object.fromEntries(connResults.map(result => [result.localRefId, result.instances]));
+  return {
+    connectionRefs,
+    dataverseOrgUrl,
+    databaseReferences: {},
+    missingConnectors: [...new Set(unresolvedApiIds)],
+    missingConnectionReferences,
+    connectionRequirements: Object.values(requirementsByLocalRefId),
+    connectionCandidates,
+    resourceConsents: [],
+    configurationErrors: (0, _types.findConnectionDataSourceConflicts)(requirements).map(dataSource => `Data source "${dataSource}" is assigned to multiple connection references.`),
+    registeredConnectionUsages: [],
+    requiresConnectionConsent: requirements.length > 0
+  };
+}
+
+// ---------------------------------------------------------------------------
+// applyAclGrants
+// ---------------------------------------------------------------------------
+
+/**
+ * Run idempotent post-resolution delegated consent grants for the calling app.
+ *
+ * Used by the fast path (production APKs via `fetchAppLaunchData`) where the
+ * launch API has already resolved the user's connections. Grants are applied
+ * only to user-selected connections; fixed shared connections are already
+ * authorized by their owner and must not receive delegated user consent.
+ *
+ * For the slow path the grants run before disambiguation inside
+ * `resolveViaStaticRefs`, where they can still influence which connections
+ * are considered available.
+ *
+ * Returns the connection names whose ACL grants failed so callers can fail closed.
+ */
+async function applyAclGrants(connectionRefs, connectionRequirements, environmentId, region, acquireToken) {
+  const connectionNames = (0, _connectionState.getConnectionNamesRequiringAclGrant)(connectionRefs, connectionRequirements);
+  if (connectionNames.length === 0) return new Set();
+  const connectionNamesSet = new Set(connectionNames);
+  const consentToken = await acquireToken([(0, _PowerPlatformEnvironmentApi.connectionUserConsentScope)(region)]);
+  if (!consentToken) return new Set(connectionNames);
+  const seen = new Set();
+  const failed = new Set();
+  await Promise.all(Object.values(connectionRefs).map(async ref => {
+    if (!ref.connectionName || !connectionNamesSet.has(ref.connectionName) || seen.has(ref.connectionName)) return;
+    seen.add(ref.connectionName);
+    const granted = await (0, _PowerPlatformConnectionApi.grantConnectionUserConsent)(ref.apiId, ref.connectionName, environmentId, region, consentToken);
+    if (!granted) failed.add(ref.connectionName);
+  }));
+  return failed;
+}