@microsoft/power-apps-native-host 0.2.25 → 0.3.0

package/lib/typescript/commonjs/provider/PowerAppsHostProvider.d.ts

@@ -27,9 +27,10 @@
  *   </PowerAppsHostProvider>
  */
 import React from 'react';
-import type { ConnectorSchema } from '../platform/useConnectionRefs';
-import type { DatabaseReference } from '../platform/PowerPlatformEnvironmentApi';
+import type { ConnectorSchema } from '../connections/useConnectionRefs';
+import type { DatabaseReference } from '../platform/DataverseDataSources';
 import type { OnDisambiguationNeeded } from '../connections/types';
+import type { ConnectionReferenceConfig, ConnectionUsageInput, ResourceConsentRequirement } from '../connections/types';
 export interface PowerAppsHostProviderProps {
     /**
      * Callback to acquire an access token for the given scopes.
@@ -41,12 +42,12 @@ export interface PowerAppsHostProviderProps {
      * Connection resolution only runs when this is true.
      */
     isSignedIn: boolean;
+    /** Sign out the active account. Shown on blocking connection error screens. */
+    onSignOut?: () => void | Promise<void>;
     /**
      * PowerApps app GUID (from power.config.json `appId`).
-     * When set, connection references are fetched from the PowerApps RP
-     * `/apps/{appId}/launch` API at runtime instead of using the static
-     * `connectionReferences` prop.  Leave undefined during local development
-     * to fall back to the static `connectionReferences`.
+      * Outside Dev Player, app and connection metadata is fetched exclusively
+      * from the PowerApps RP `/apps/{appId}/launch` API.
      */
     appId?: string;
     /** Power Platform environment GUID (from power.config.json). */
@@ -58,6 +59,7 @@ export interface PowerAppsHostProviderProps {
     region?: string;
     /**
      * The connectionReferences map from power.config.json.
+      * Used only in Dev Player for unpublished local apps.
      * Shape: { [refId]: { id: string; dataSources: string[] } }
      *
      * NOTE: This prop must be referentially stable across renders (memoize it in
@@ -65,18 +67,16 @@ export interface PowerAppsHostProviderProps {
      * so passing a fresh object literal every render forces continuous
      * re-registration.
      */
-    connectionReferences: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences: Record<string, ConnectionReferenceConfig>;
     /**
      * Connector schema map keyed by data source name.
+      * Used only in Dev Player for unpublished local apps.
      * Generated automatically by generate-connector-schemas.
      */
     schemaMap: Record<string, ConnectorSchema>;
     /**
      * The databaseReferences map from power.config.json.
-     * Used to build CDS data sources for the bridge.
+      * Used only in Dev Player. Production database references come from RP.
      *
      * NOTE: Like `connectionReferences`, pass a referentially stable value; an
      * unstable identity each render triggers redundant bridge re-registration.
@@ -84,8 +84,8 @@ export interface PowerAppsHostProviderProps {
     databaseReferences?: Record<string, DatabaseReference>;
     /**
      * Optional custom renderer for the OAuth consent WebView shown during
-     * connection creation.  If not provided, the system browser is used via
-     * Linking.openURL().
+    * connection creation. If not provided, the system authentication browser
+    * is used. Pass the final redirect URL to onDone when the custom view captures it.
      *
      * @example
      *   // Using react-native-webview:
@@ -96,20 +96,31 @@ export interface PowerAppsHostProviderProps {
      *     </Modal>
      *   )}
      */
-    renderOAuthWebView?: (url: string, onDone: () => void) => React.ReactNode;
+    renderOAuthWebView?: (url: string, onDone: (redirectUrl?: string) => void) => React.ReactNode;
     /**
      * The ISV/wrap-app AAD client ID (from auth.config.json `msal.clientId`).
      * When provided, the ISV's service principal is granted CanView access on
      * each newly created connection, allowing APIM to accept tokens with this
      * appid at runtime (prevents 403 "missing connection ACL" for third-party tokens).
      */
-    isvClientId?: string;
+    isvClientId: string;
     /**
      * Called when multiple Connected connections exist for the same connector.
-     * Present a native picker UI and return the chosen connectionId, or null to
-     * accept the first Connected connection as a fallback.
+    * Present a native picker UI and return the chosen connectionId, or null to
+    * leave the reference unresolved.
      */
     onDisambiguationNeeded?: OnDisambiguationNeeded;
+    /**
+     * Called after the user selects Allow and before the player launches.
+     * Use this to persist app-to-connection usage through an approved public RP endpoint.
+     * Rejecting keeps the app gated and shows the error in the consent screen.
+    * Not invoked in Power Apps Dev Player; local testing is intentionally non-persistent.
+     */
+    onConnectionConsent?: (usages: ConnectionUsageInput[]) => void | Promise<void>;
+    /** Persist protected resource approval in production. Not invoked in Dev Player. */
+    onResourceConsent?: (resources: ResourceConsentRequirement[]) => void | Promise<void>;
+    /** Called when the user selects Do not allow. */
+    onConnectionConsentDeclined?: () => void | Promise<void>;
     children: React.ReactNode;
 }
 /**
@@ -119,5 +130,5 @@ export interface PowerAppsHostProviderProps {
  *
  * Children are never rendered until all required connections are resolved.
  */
-export declare function PowerAppsHostProvider({ acquireToken, isSignedIn, appId, environmentId, region, connectionReferences, schemaMap, databaseReferences, renderOAuthWebView, isvClientId, onDisambiguationNeeded, children, }: PowerAppsHostProviderProps): React.JSX.Element;
+export declare function PowerAppsHostProvider({ acquireToken, isSignedIn, onSignOut, appId, environmentId, region, connectionReferences, schemaMap, databaseReferences, renderOAuthWebView, isvClientId, onDisambiguationNeeded, onConnectionConsent, onResourceConsent, onConnectionConsentDeclined, children, }: PowerAppsHostProviderProps): React.JSX.Element;
 //# sourceMappingURL=PowerAppsHostProvider.d.ts.map

package/lib/typescript/commonjs/provider/PowerAppsProvider.d.ts

@@ -28,11 +28,12 @@ import React from 'react';
 import { createTamagui } from '@tamagui/core';
 import type { AuthProviderProps } from '../auth/AuthContext';
 import type { PowerAppsHostProviderProps } from './PowerAppsHostProvider';
-import type { ConnectorSchema } from '../platform/useConnectionRefs';
-import type { DatabaseReference } from '../platform/PowerPlatformEnvironmentApi';
-import type { OnDisambiguationNeeded } from '../connections/types';
+import type { ConnectorSchema } from '../connections/useConnectionRefs';
+import type { DatabaseReference } from '../platform/DataverseDataSources';
+import type { ConnectionReferenceConfig, OnDisambiguationNeeded } from '../connections/types';
 import type { ThemeTokens } from '../theme/tokens';
 import type { ILogger } from '@microsoft/power-apps-native-common';
+import type { ApplicationInsightsTelemetryProviderConfig } from '@microsoft/power-apps-native-common';
 /** Shape of power.config.json consumed by the provider. */
 export interface PowerConfig {
     /**
@@ -53,10 +54,7 @@ export interface PowerConfig {
      * Omit for the default global collector.
      */
     geoRegion?: string;
-    connectionReferences?: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences?: Record<string, ConnectionReferenceConfig>;
     databaseReferences?: Record<string, DatabaseReference>;
     /**
      * Allow additional keys — the offline SDK reads arbitrary fields from
@@ -67,6 +65,10 @@ export interface PowerConfig {
     [key: string]: unknown;
 }
 type TamaguiConfig = ReturnType<typeof createTamagui>;
+export interface AppInsightsConfig extends Omit<ApplicationInsightsTelemetryProviderConfig, 'deviceId' | 'sessionId'> {
+    /** Explicit opt-in. Application Insights telemetry is disabled unless this is true. */
+    enabled: boolean;
+}
 export interface PowerAppsProviderProps {
     /** MSAL configuration from auth.config.json (msal section). */
     msalConfig: AuthProviderProps['msalConfig'];
@@ -106,6 +108,12 @@ export interface PowerAppsProviderProps {
     renderOAuthWebView?: PowerAppsHostProviderProps['renderOAuthWebView'];
     /** See PowerAppsHostProviderProps.onDisambiguationNeeded. */
     onDisambiguationNeeded?: OnDisambiguationNeeded;
+    /** See PowerAppsHostProviderProps.onConnectionConsent. */
+    onConnectionConsent?: PowerAppsHostProviderProps['onConnectionConsent'];
+    /** See PowerAppsHostProviderProps.onResourceConsent. */
+    onResourceConsent?: PowerAppsHostProviderProps['onResourceConsent'];
+    /** See PowerAppsHostProviderProps.onConnectionConsentDeclined. */
+    onConnectionConsentDeclined?: PowerAppsHostProviderProps['onConnectionConsentDeclined'];
     /**
      * App name used as `clientType` in the auto-wired 1DS telemetry provider.
      * Appears in Kusto as the `clientType` column — use a stable
@@ -125,6 +133,20 @@ export interface PowerAppsProviderProps {
      *   logger becomes a no-op regardless of build variant.
      */
     logger?: ILogger | null;
+    /**
+     * Show app and telemetry session details after a three-finger downward swipe.
+     * Available in both development and published native apps. @default true
+     */
+    showSessionDetailsOnSwipe?: boolean;
+    /**
+     * Optional customer-owned Application Insights destination.
+     *
+     * Events are sent directly to the selected C1-owned Application Insights
+     * resource and fan out alongside the default Microsoft OneDS provider.
+     * Defaults to `expo.extra.appInsightsConfig` from app.json.
+     * Ignored when `logger` is provided or `null`.
+     */
+    appInsightsConfig?: AppInsightsConfig;
     /**
      * Offline profile JSON — optional override.
      * Primary source: SDK config plugin embeds offline-profile.json into the app
@@ -143,6 +165,6 @@ export interface PowerAppsProviderProps {
  * root layout.
  */
 export declare function PowerAppsProvider({ msalConfig, intuneConfig, powerConfig, schemaMap, tamaguiConfig, // override with app's tamagui.config.ts
-defaultTheme, theme, darkTheme, followSystemTheme, renderOAuthWebView, onDisambiguationNeeded, appName, logger: loggerProp, offlineProfile, children, }: PowerAppsProviderProps): React.JSX.Element;
+defaultTheme, theme, darkTheme, followSystemTheme, renderOAuthWebView, onDisambiguationNeeded, onConnectionConsent, onResourceConsent, onConnectionConsentDeclined, appName, logger: loggerProp, showSessionDetailsOnSwipe, appInsightsConfig, offlineProfile, children, }: PowerAppsProviderProps): React.JSX.Element;
 export {};
 //# sourceMappingURL=PowerAppsProvider.d.ts.map

package/lib/typescript/commonjs/provider/SessionDetailsGesture.d.ts

@@ -0,0 +1,13 @@
+import React from 'react';
+interface SessionDetailsGestureProps {
+    enabled: boolean;
+    appName: string;
+    appId?: string;
+    environmentId?: string;
+    region: string;
+    appVersion?: string;
+    children: React.ReactNode;
+}
+export declare function SessionDetailsGesture({ enabled, appName, appId, environmentId, region, appVersion, children, }: SessionDetailsGestureProps): React.JSX.Element;
+export {};
+//# sourceMappingURL=SessionDetailsGesture.d.ts.map

package/lib/typescript/commonjs/telemetry/OfflineSdkTelemetry.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Forwards the privacy-safe Offline SDK transport through the host's existing
+ * app logger so offline events carry the same session, device, and user data.
+ *
+ * The host owns exactly one thing here: binding the SDK transport to this
+ * host's logger. Buffering and teardown semantics live in the SDK.
+ *
+ * Setup and teardown are fail-open but not silent. This runs from an effect in
+ * the provider that roots the app, so an unguarded throw would take down the
+ * whole tree — telemetry is never worth an app that will not start. An
+ * unexpected failure is therefore downgraded to a logged diagnostic rather than
+ * swallowed, so broken wiring stays observable.
+ */
+export declare function configureOfflineSdkTelemetry(forwardEvents: boolean): () => void;
+//# sourceMappingURL=OfflineSdkTelemetry.d.ts.map

package/lib/typescript/commonjs/telemetry/OfflineSdkTelemetry.web.d.ts

@@ -0,0 +1,2 @@
+export declare function configureOfflineSdkTelemetry(_forwardEvents: boolean): () => void;
+//# sourceMappingURL=OfflineSdkTelemetry.web.d.ts.map

package/lib/typescript/commonjs/telemetry/index.d.ts

@@ -7,7 +7,9 @@
  * (`getAppLogger` / `configureAppLogger`). This module re-exports those
  * alongside the canonical host operation-name constants.
  */
-export { getAppLogger, configureAppLogger } from '@microsoft/power-apps-native-common';
+import { HttpClient } from '@microsoft/power-apps-native-common/http';
+export { getAppLogger, configureAppLogger, getCustomerTelemetryLogger } from '@microsoft/power-apps-native-common';
+export type { ICustomerTelemetryLogger } from '@microsoft/power-apps-native-common';
 /**
  * Canonical operation names for host package telemetry.
  * Follow the `PowerAppsHost.<Subsystem>.<Action>` convention so events are
@@ -34,15 +36,25 @@ export declare const HostOperationNames: {
     readonly BridgeTokenAcquireFailed: "PowerAppsHost.Bridge.TokenAcquire.Failed";
     /** Top-level React error boundary caught an unhandled JS error. */
     readonly RuntimeUnhandledJsError: "PowerAppsHost.Runtime.UnhandledJsError";
+    /** Power Platform RP HTTP request, including backend correlation IDs. */
+    readonly PlatformHttpRequest: "PowerAppsHost.Platform.HttpRequest";
     /** Resolve Dataverse instanceUrl from Power Platform environment API. */
     readonly PlatformFetchInstanceUrl: "PowerAppsHost.Platform.FetchInstanceUrl";
     /** useConnectionRefs failed to resolve connections (recoverable). Recorded only on failure. */
     readonly PlatformLoadConnectionsFailed: "PowerAppsHost.Platform.LoadConnections.Failed";
     /** Create a new Power Platform connection. */
     readonly PlatformCreateConnection: "PowerAppsHost.Platform.CreateConnection";
+    /** Repair an existing Power Platform connection. */
+    readonly PlatformRepairConnection: "PowerAppsHost.Platform.RepairConnection";
+    /** Poll a connection until it becomes active. */
+    readonly PlatformPollConnectionStatus: "PowerAppsHost.Platform.PollConnectionStatus";
     /** Resolve app connection references for the current launch. */
     readonly PlatformResolveConnectionRefs: "PowerAppsHost.Platform.ResolveConnectionRefs";
     /** Grant this app access to a Power Platform connection ACL. */
     readonly PlatformConnectionAclGrant: "PowerAppsHost.Platform.ConnectionAclGrant";
+    /** Installed Offline SDK predates the SDK-owned routing contract. */
+    readonly OfflineRoutingContractUnsupported: "PowerAppsHost.Offline.RoutingContract.Unsupported";
 };
+export declare const bridgeHttpClient: HttpClient;
+export declare const platformHttpClient: HttpClient;
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/module/auth/AuthContext.d.ts

@@ -46,9 +46,11 @@ export interface AuthProviderProps {
      * Pass explicitly only to override the default (e.g. in tests).
      */
     intuneConfig?: IntuneConfig;
+    /** Token audiences that must be available before the account is considered signed in. */
+    requiredScopes?: string[];
     children: React.ReactNode;
 }
-export declare function AuthProvider({ msalConfig, intuneConfig, children }: AuthProviderProps): React.JSX.Element;
+export declare function AuthProvider({ msalConfig, intuneConfig, requiredScopes, children, }: AuthProviderProps): React.JSX.Element;
 /**
  * Returns the current auth state from the nearest <AuthProvider>.
  * Must be called within the AuthProvider tree.

package/lib/typescript/module/auth/AuthContext.web.d.ts

@@ -13,6 +13,7 @@ export interface AuthState {
 export interface AuthProviderProps {
     msalConfig: MsalAuthConfig;
     intuneConfig?: IntuneConfig;
+    requiredScopes?: string[];
     children: React.ReactNode;
 }
 export declare function AuthProvider({ children }: AuthProviderProps): React.JSX.Element;

package/lib/typescript/module/bridge/bridgeState.d.ts

@@ -0,0 +1,5 @@
+import type { NativeBridgeOptions } from './NativePowerAppsBridge.js';
+export declare function getRequestBodyForMethod(method: string, body: BodyInit | null): BodyInit | null;
+export declare function assertSuccessfulHttpStatus(status: number, method: string): void;
+export declare function updateBridgeOptionsInPlace(current: NativeBridgeOptions, next: NativeBridgeOptions): NativeBridgeOptions;
+//# sourceMappingURL=bridgeState.d.ts.map

package/lib/typescript/module/connections/ConnectionSetupScreen.d.ts

@@ -39,12 +39,23 @@
  * the consuming app decides how to render it (full-screen, modal, etc.).
  */
 import React from 'react';
-import type { ConnectorSchema } from '../platform/useConnectionRefs.js';
+import type { ConnectionConsentDetails, ResourceConsentRequirement } from '../connections/types.js';
+import type { ConnectorSchema } from './useConnectionRefs.js';
 export interface MissingConnectorEntry {
     /** Connector API ID (e.g. "/providers/Microsoft.PowerApps/apis/shared_office365users"). */
     apiId: string;
     /** Local ref ID from power.config.json (for correlation). */
     localRefId: string;
+    /** Canonical connector short name. Supplied by useConnectionRefs. */
+    connectorId?: string;
+    dataSources?: string[];
+    displayName?: string;
+    iconUri?: string;
+    appActions?: string[];
+    gatewayObjectIdHint?: string;
+    authenticationType?: string;
+    parameterSetName?: string;
+    sharedConnectionId?: string;
 }
 export interface ConnectionSetupScreenProps {
     /**
@@ -60,11 +71,20 @@ export interface ConnectionSetupScreenProps {
     environmentId: string;
     region?: string;
     acquireToken: (scopes: string[]) => Promise<string | null>;
+    onSignOut?: () => void | Promise<void>;
     /**
      * Called when all missing connections have been resolved.
-     * `resolvedIds` maps apiId → connectionId for all newly created connections.
+    * `resolvedIds` maps localRefId → connectionId for all newly created connections.
      */
-    onAllConnected: (resolvedIds: Record<string, string>) => void;
+    onAllConnected: (resolvedIds: Record<string, string>) => void | Promise<void>;
+    /** All connector usages requiring user approval, including already-resolved references. */
+    consentDetails?: ConnectionConsentDetails[];
+    /** Additional protected resources, such as cross-environment Dataverse instances. */
+    resourceConsents?: ResourceConsentRequirement[];
+    /** Called when the user explicitly declines access. */
+    onConsentDeclined?: () => void | Promise<void>;
+    /** Whether to show app-level Review Access after authentication. Defaults to true. */
+    showReview?: boolean;
     /**
      * If provided, a "Skip" button is shown. Useful for non-blocking connection flows.
      * The app should handle the case where connections remain unresolved.
@@ -76,11 +96,12 @@ export interface ConnectionSetupScreenProps {
      * access on each newly created connection, fixing the APIM 403 for
      * third-party app tokens.
      */
-    isvClientId?: string;
+    isvClientId: string;
     /**
      * Optional custom renderer for the OAuth WebView.
      * Receives the consent URL and a dismiss callback.
-     * If not provided, `Linking.openURL()` is used to open the URL in the system browser.
+    * If not provided, Expo's system authentication browser is used.
+    * Custom views should pass their final redirect URL to `onDone` when available.
      *
      * @example
      *   // Using react-native-webview:
@@ -91,7 +112,7 @@ export interface ConnectionSetupScreenProps {
      *     </Modal>
      *   )}
      */
-    renderOAuthWebView?: (url: string, onDone: () => void) => React.ReactNode;
+    renderOAuthWebView?: (url: string, onDone: (redirectUrl?: string) => void) => React.ReactNode;
     /** Optional title override (default: "Set up connections"). */
     title?: string;
 }
@@ -103,5 +124,5 @@ export interface ConnectionSetupScreenProps {
  * resolved `onAllConnected` fires and the parent app should unmount this
  * component and proceed to launch the app.
  */
-export declare function ConnectionSetupScreen({ missingConnectors, schemaMap, environmentId, region, acquireToken, isvClientId, onAllConnected, onSkip, renderOAuthWebView, title, }: ConnectionSetupScreenProps): React.JSX.Element;
+export declare function ConnectionSetupScreen({ missingConnectors, schemaMap, environmentId, region, acquireToken, onSignOut, isvClientId, onAllConnected, onSkip, consentDetails, resourceConsents, onConsentDeclined, showReview, renderOAuthWebView, title, }: ConnectionSetupScreenProps): React.JSX.Element;
 //# sourceMappingURL=ConnectionSetupScreen.d.ts.map

package/lib/typescript/module/{platform → connections}/PowerPlatformConnectionApi.d.ts

@@ -7,14 +7,12 @@
  * These mirror the endpoints used by ConnectorsApi in @microsoft/power-apps-common
  * but are implemented as plain async functions so they have no external dependencies.
  */
-import type { NativeConnectionInstance } from '../connections/types.js';
+import type { DatabaseReference } from '../platform/DataverseDataSources.js';
+import type { ConnectionInput, ConnectionParameterSet, ConnectionRequirement, ConnectionUsageInput, NativeConnectionInstance, ResourceConsentRequirement } from './types.js';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
-/**
- * Token scope for the Power Apps RP (api.powerapps.com).
- * Required when calling modifyPermissions to register a service principal
- * in the connection ACE so that APIM accepts third-party app tokens at runtime.
- */
-export declare const SERVICE_POWERAPPS_SCOPE = "https://service.powerapps.com/.default";
+export declare class AppLaunchAccessDeniedError extends Error {
+    constructor();
+}
 /** Subset of connector metadata returned by the Power Platform API. */
 export interface ConnectorMetadata {
     /** Short connector name, e.g. "shared_office365users". */
@@ -25,8 +23,15 @@ export interface ConnectorMetadata {
     iconUri: string;
     /** Description text. */
     description: string;
-    /** Whether this is a first-party (Microsoft-published) connector. */
-    isFirstParty: boolean;
+    /** Environment-specific APIM runtime URL used for connector requests. */
+    primaryRuntimeUrl: string;
+    scopes: {
+        will: string[];
+        wont: string[];
+    };
+    /** Whether the connector authenticates through an OAuth consent flow. */
+    hasOAuthParameter: boolean;
+    parameterSets: ConnectionParameterSet[];
 }
 /**
  * Fetch metadata for a single connector from the Power Platform API.
@@ -43,6 +48,8 @@ export declare function fetchConnectorMetadata(connectorId: string, environmentI
  * Returns only the `NativeConnectionInstance` shape used by the disambiguation layer.
  */
 export declare function fetchConnectionsForConnector(connectorId: string, environmentId: string, region: string, token: string): Promise<NativeConnectionInstance[]>;
+/** Delete a single connection instance from the user's environment. */
+export declare function deleteConnection(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 /**
  * Result of initiating an OAuth connection creation.
  *
@@ -51,8 +58,7 @@ export declare function fetchConnectionsForConnector(connectorId: string, enviro
  *   user can complete the OAuth consent flow. Poll `pollConnectionStatus`
  *   until the status changes to "Connected".
  *
- * `connected` — the connection was created and is already Connected (e.g.,
- *   first-party SSO connections that do not need explicit OAuth consent).
+ * `connected` — the connection resource was created in Connected state.
  *
  * `error` — creation failed; `message` contains the error description.
  */
@@ -71,7 +77,7 @@ export type CreateConnectionResult = {
  * Create a new connection for a connector in the user's environment.
  *
  * Calls:
- *   POST {envBase}/connectivity/apis/{connectorId}/connections
+ *   PUT {envBase}/connectivity/connectors/{connectorId}/connections/{connectionId}
  *
  * If the response contains a `consentLink`, the connection needs OAuth
  * completion (caller should open the URL and then poll `pollConnectionStatus`).
@@ -86,7 +92,8 @@ export type CreateConnectionResult = {
  *                           will redirect the user here after consent. Defaults to
  *                           the standard native-client redirect accepted by Power Platform.
  */
-export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string): Promise<CreateConnectionResult>;
+export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string, input?: ConnectionInput): Promise<CreateConnectionResult>;
+export declare function repairConnection(connectorId: string, connectionName: string, environmentId: string, region: string, token: string, oauthRedirectUrl?: string, input?: ConnectionInput, requiresApiConsent?: boolean): Promise<CreateConnectionResult>;
 /**
  * Poll a connection's status until it is "Connected" or a timeout is reached.
  *
@@ -101,6 +108,7 @@ export declare function createConnection(connectorId: string, environmentId: str
 export declare function pollConnectionStatus(connectorId: string, connectionName: string, environmentId: string, region: string, acquireToken: (scopes: string[]) => Promise<string | null>, options?: {
     intervalMs?: number;
     timeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<NativeConnectionInstance | null>;
 /**
  * Confirm a consent code returned by the APIM consent server in the OAuth
@@ -141,13 +149,38 @@ export interface AppLaunchResult {
      * has no linked Dataverse database).
      */
     dataverseOrgUrl: string;
+    /** Dataverse table metadata returned by the app launch endpoint. */
+    databaseReferences: Record<string, DatabaseReference>;
     /**
      * Connector short-names (e.g. "shared_office365users") for which the
      * launch API found no "Connected" connection instance for the signed-in
      * user.  These connectors need the connection setup flow.
      */
     missingConnectors: string[];
+    /** Missing requirements keyed by the app's local connection-reference ID. */
+    missingConnectionReferences: ConnectionRequirement[];
+    /** Every app requirement, including references resolved by the launch API. */
+    connectionRequirements: ConnectionRequirement[];
+    /** Connected candidates retained for explicit per-reference disambiguation. */
+    connectionCandidates: Record<string, NativeConnectionInstance[]>;
+    /** Non-connector protected resources requiring explicit user disclosure. */
+    resourceConsents: ResourceConsentRequirement[];
+    /** Configuration errors that make bridge connection binding ambiguous. */
+    configurationErrors: string[];
+    /** Durable app-to-connection bindings returned by launch or the app connections API. */
+    registeredConnectionUsages: RegisteredConnectionUsage[];
+    /** True when at least one selected local reference/action is not durably registered. */
+    requiresConnectionConsent: boolean;
+}
+export interface RegisteredConnectionUsage {
+    reference: string;
+    apiId: string;
+    connectionId: string;
+    appActions: string[];
 }
+export declare function fetchAppConnectionUsages(appId: string, environmentId: string, region: string, token: string): Promise<RegisteredConnectionUsage[]>;
+export declare function postConnectionUsage(appId: string, usage: ConnectionUsageInput, environmentId: string, region: string, token: string): Promise<void>;
+export declare function reportScopeConsents(appId: string, usages: ConnectionUsageInput[], environmentId: string, region: string, token: string): Promise<void>;
 /**
  * Fetch app launch data from the Power Platform environment-scoped launch
  * endpoint and process it into the shape the NativePowerAppsBridge needs.
@@ -160,7 +193,7 @@ export interface AppLaunchResult {
  *                                          — Dataverse org URL
  *
  * Endpoint (environment-scoped, same base as all Power Platform API calls):
- *   GET {envEndpoint}/powerapps/apps/{appId}/launch
+ *   POST {envEndpoint}/powerapps/apps/{appId}/launch
  *       ?api-version=2&lastKnownGoodPublishedVersion=true
  *
  * Authentication: bearer token for {@link powerPlatformScope}`(region)`.
@@ -169,37 +202,13 @@ export interface AppLaunchResult {
  * @param environmentId - Environment GUID.
  * @param region        - Cluster region (default "prod").
  * @param token         - Bearer token for {@link powerPlatformScope}`(region)`.
- * @returns Processed launch data, or `null` if the call fails.
+ * @returns Processed launch data, or `null` when the app is not found.
  */
 export declare function fetchAppLaunchData(appId: string, environmentId: string, region: string, token: string): Promise<AppLaunchResult | null>;
 /**
- * Decode the `oid` (object ID) claim from a JWT access token.
- *
- * The oid claim is in the base64url-encoded payload section (middle part).
- * Available in Hermes (React Native) via the global `atob`.
- */
-export declare function parseJwtOid(jwtToken: string): string | null;
-/**
- * Add the ISV's AAD application (client) ID to the connection's ACL AppIds
- * list via the Power Apps RP `addAadAppToConnectionAcl` endpoint.
- *
- * The RP finds the user's existing ACE (identified by `userOid`) and appends
- * `isvClientId` to its `AppIds` list. APIM's stage-2 token check verifies
- * that the requesting token's `appid` is present in this list, so without
- * this call APIM returns 403 "missing connection ACL" for third-party tokens.
- *
- * POST https://api.powerapps.com/providers/Microsoft.PowerApps/environments/{environmentId}
- *      /apis/{connectorId}/connections/{connectionId}/addAadAppToConnectionAcl
- *      ?api-version=2016-11-01
- *
- * Body: { "aadApplicationId": "<ISV client ID>", "objectId": "<user OID>" }
- *
- * @param connectorId   - Connector short name (e.g. "shared_office365users").
- * @param connectionId  - Bare 32-char hex connection ID.
- * @param environmentId - Environment GUID.
- * @param isvClientId   - The ISV's AAD application (client) ID.
- * @param userOid       - The signed-in user's AAD object ID (oid JWT claim).
- * @param token         - Bearer token for `https://service.powerapps.com/.default`.
+ * Grant the calling application's delegated access to a connection for the
+ * signed-in user. The backend derives both identities from the token and
+ * selects the most specific applicable user, group, or tenant ACL.
  */
-export declare function addAadAppToConnectionAcl(connectorId: string, connectionId: string, environmentId: string, isvClientId: string, userOid: string, token: string): Promise<boolean>;
+export declare function grantConnectionUserConsent(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 //# sourceMappingURL=PowerPlatformConnectionApi.d.ts.map

package/lib/typescript/module/connections/connectionMetadata.d.ts

@@ -0,0 +1,66 @@
+import type { ConnectionInput, ConnectionParameterDefinition, ConnectionParameterSet, ConnectionUsageInput } from './types.js';
+export interface ConsentLinkDefinition {
+    redirectUrl: string;
+}
+export type SerializedConnectionParameters = {
+    connectionParameters: ConnectionInput['parameters'];
+} | {
+    connectionParametersSet: {
+        name: string;
+        values: Record<string, {
+            value: ConnectionInput['parameters'][string];
+        }>;
+    };
+};
+export interface RawConnectionParameter {
+    type?: string;
+    defaultValue?: string | boolean | number;
+    uiDefinition?: {
+        displayName?: string;
+        constraints?: {
+            required?: string | boolean;
+            hidden?: string | boolean;
+            capability?: string[];
+            allowedValues?: Array<{
+                value?: string;
+                displayName?: string;
+            }>;
+        };
+    };
+}
+export interface RawConnectionParameterSet {
+    name?: string;
+    uiDefinition?: {
+        displayName?: string;
+    };
+    connectionParameters?: Record<string, RawConnectionParameter>;
+    parameters?: Record<string, RawConnectionParameter>;
+}
+export declare function parseConnectionParameters(parameters: Record<string, RawConnectionParameter> | undefined): ConnectionParameterDefinition[];
+export declare function buildConnectionParameterSets(connectionParameters: Record<string, RawConnectionParameter> | undefined, parameterSets: RawConnectionParameterSet[] | undefined): ConnectionParameterSet[];
+export declare function hasOAuthParameter(parameters: Record<string, RawConnectionParameter> | undefined): boolean;
+export declare function buildConnectionUserConsentUrl(environmentEndpoint: string, connectorId: string, connectionId: string): string;
+export declare function getAppLaunchFailureMessage(status: number, statusText: string, responseText: string): string | null;
+export declare function isAppLaunchAccessDenied(status: number, responseText: string): boolean;
+export declare function buildConsentLinkDefinition(redirectUrl: string): ConsentLinkDefinition;
+export declare function serializeConnectionParameters(input?: ConnectionInput): SerializedConnectionParameters;
+export declare function buildConnectionUsageUrl(environmentBaseUrl: string, environmentId: string, usage: ConnectionUsageInput): string;
+export declare function buildConnectionUsageRequest(appId: string, usage: ConnectionUsageInput): {
+    properties: {
+        reference: string;
+        resourceId: string;
+        appActions: string[];
+    };
+};
+export declare function buildScopeConsentUrl(environmentBaseUrl: string, appId: string): string;
+export declare function buildScopeConsentRequest(usages: ConnectionUsageInput[]): {
+    consents: Array<{
+        connectionId: string;
+        consentType: 'userConsent';
+        scopes: {
+            will: string[];
+            wont: string[];
+        };
+    }>;
+};
+//# sourceMappingURL=connectionMetadata.d.ts.map

package/lib/typescript/module/connections/connectionState.d.ts

@@ -0,0 +1,16 @@
+import type { AppLaunchResult } from './PowerPlatformConnectionApi.js';
+import type { RegisteredConnectionUsage } from './PowerPlatformConnectionApi.js';
+import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
+import type { ConnectionRequirement } from './types.js';
+export declare function isTransientConnectionConsentStatus(status: number): boolean;
+export declare function shouldGrantConnectionUserConsent(requirement: Pick<ConnectionRequirement, 'sharedConnectionId'>, runningInDevPlayer: boolean): boolean;
+export declare function getConnectionNamesRequiringAclGrant(connectionRefs: Record<string, AppConnectionReference>, connectionRequirements: ConnectionRequirement[]): string[];
+export declare function invalidateFailedAclGrants(result: AppLaunchResult, failedConnectionNames: ReadonlySet<string>): void;
+export declare function selectLaunchConnection(result: AppLaunchResult, localRefId: string, connectionId: string): boolean;
+export declare function getUnregisteredConnectionRequirements(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): ConnectionRequirement[];
+export declare function applyRegisteredConnectionSelections(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function hasRegisteredConnectionConsent(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): boolean;
+export declare function applyRegisteredConnectionUsages(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function shouldPersistConnectionUsages(runningInDevPlayer: boolean, appId: string | undefined): boolean;
+export declare function shouldShowConnectionReview(runningInDevPlayer: boolean, requiresConnectionConsent: boolean, hasResourceConsents: boolean): boolean;
+//# sourceMappingURL=connectionState.d.ts.map