@microsoft/power-apps-native-host 0.2.25 → 0.3.0

package/lib/commonjs/offline/createOfflineHostActivationCallbacks.js

@@ -0,0 +1,61 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.createHostQueryClient = createHostQueryClient;
+exports.createOfflineHostActivationCallbacks = createOfflineHostActivationCallbacks;
+exports.resolveSdkMountDecision = resolveSdkMountDecision;
+var _reactQuery = require("@tanstack/react-query");
+function setNetworkMode(queryClient, networkMode) {
+  const current = queryClient.getDefaultOptions();
+  queryClient.setDefaultOptions({
+    ...current,
+    queries: {
+      ...current.queries,
+      staleTime: 60_000,
+      retry: 2,
+      networkMode
+    },
+    mutations: {
+      ...current.mutations,
+      retry: 0,
+      networkMode
+    }
+  });
+}
+function createHostQueryClient() {
+  return new _reactQuery.QueryClient({
+    defaultOptions: {
+      queries: {
+        staleTime: 60_000,
+        retry: 2
+      },
+      mutations: {
+        retry: 0
+      }
+    }
+  });
+}
+function createOfflineHostActivationCallbacks(queryClient) {
+  return {
+    prepareForOfflineActivation: () => queryClient.cancelQueries(),
+    completeOfflineActivation: async () => {
+      setNetworkMode(queryClient, 'always');
+      await queryClient.invalidateQueries();
+    },
+    rollbackOfflineActivation: async () => {
+      setNetworkMode(queryClient, undefined);
+      await queryClient.invalidateQueries();
+    }
+  };
+}
+function resolveSdkMountDecision(value) {
+  return typeof value === 'boolean' ? {
+    shouldMountChildren: value,
+    contractSupported: true
+  } : {
+    shouldMountChildren: true,
+    contractSupported: false
+  };
+}

package/lib/commonjs/offline/useOfflineIntegrationWithStartupGate.js

@@ -0,0 +1,46 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.useOfflineIntegrationWithStartupGate = useOfflineIntegrationWithStartupGate;
+var _react = require("react");
+var _reactQuery = require("@tanstack/react-query");
+var _powerAppsNativeCommon = require("@microsoft/power-apps-native-common");
+var _DataverseGlobalDiscoveryApi = require("../platform/DataverseGlobalDiscoveryApi.js");
+var _index = require("../telemetry/index.js");
+var _createOfflineHostActivationCallbacks = require("./createOfflineHostActivationCallbacks.js");
+var _useOfflineIntegration = require("./useOfflineIntegration");
+function useOfflineIntegrationWithStartupGate({
+  powerConfig,
+  offlineProfile,
+  acquireToken,
+  hasRealAccount,
+  isAuthReady
+}) {
+  const queryClient = (0, _reactQuery.useQueryClient)();
+  const resolveInstanceUrl = (0, _react.useCallback)(async (environmentId, region, acqToken) => (await (0, _DataverseGlobalDiscoveryApi.fetchInstanceUrl)(environmentId, region, acqToken)) ?? null, []);
+  const hostActivationCallbacks = (0, _react.useMemo)(() => (0, _createOfflineHostActivationCallbacks.createOfflineHostActivationCallbacks)(queryClient), [queryClient]);
+  const offline = (0, _useOfflineIntegration.useOfflineIntegration)({
+    powerConfig,
+    offlineProfile,
+    acquireToken,
+    isSignedIn: hasRealAccount,
+    authState: isAuthReady ? hasRealAccount ? 'authenticated' : 'signed-out' : 'hydrating',
+    fetchInstanceUrl: resolveInstanceUrl,
+    hostActivationCallbacks
+  });
+  const mountDecision = (0, _createOfflineHostActivationCallbacks.resolveSdkMountDecision)(offline.shouldMountChildren);
+  (0, _react.useEffect)(() => {
+    if (!mountDecision.contractSupported) {
+      (0, _powerAppsNativeCommon.getAppLogger)().trackErrorEvent(_index.HostOperationNames.OfflineRoutingContractUnsupported, {
+        fallbackRoute: 'online'
+      });
+    }
+  }, [mountDecision.contractSupported]);
+  return {
+    isEnabled: offline.isEnabled,
+    StatusOverlay: offline.StatusOverlay,
+    shouldMountChildren: mountDecision.shouldMountChildren
+  };
+}

package/lib/commonjs/offline/useOfflineIntegrationWithStartupGate.web.js

@@ -0,0 +1,13 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.useOfflineIntegrationWithStartupGate = useOfflineIntegrationWithStartupGate;
+function useOfflineIntegrationWithStartupGate(_options) {
+  return {
+    isEnabled: false,
+    StatusOverlay: null,
+    shouldMountChildren: true
+  };
+}

package/lib/commonjs/platform/DataverseDataSources.js

@@ -0,0 +1,14 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.buildCdsDataSources = buildCdsDataSources;
+function buildCdsDataSources(databaseReferences, dataverseOrgUrl) {
+  return Object.values(databaseReferences).flatMap(databaseReference => Object.values(databaseReference.dataSources ?? {}).map(dataSource => ({
+    runtimeUrl: dataverseOrgUrl ? `${dataverseOrgUrl}/api/data/v9.0/` : '',
+    entitySetName: dataSource.entitySetName ?? '',
+    logicalName: dataSource.logicalName ?? '',
+    version: '9.2'
+  })));
+}

package/lib/commonjs/platform/DataverseGlobalDiscoveryApi.js

@@ -0,0 +1,49 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.fetchInstanceUrl = fetchInstanceUrl;
+var _http = require("@microsoft/power-apps-native-common/http");
+var _index = require("../telemetry/index.js");
+var _GlobalDiscovery = require("./GlobalDiscovery.js");
+function getSafeErrorName(error) {
+  return error instanceof Error ? error.constructor.name : typeof error;
+}
+
+/** Fetch the Dataverse instance URL from the Dataverse Global Discovery Service. */
+async function fetchInstanceUrl(environmentId, region, acquireToken, _bearerToken) {
+  const scenario = (0, _index.getAppLogger)().trackScenario(_index.HostOperationNames.PlatformFetchInstanceUrl, {
+    environmentId,
+    region
+  });
+  try {
+    const url = (0, _GlobalDiscovery.buildGlobalDiscoveryUrl)(environmentId, region);
+    const token = await acquireToken([(0, _GlobalDiscovery.globalDiscoveryScope)(region)]);
+    if (!token) {
+      throw new Error('fetchInstanceUrl: failed to acquire Dataverse Global Discovery token');
+    }
+    const response = await _index.platformHttpClient.request(url, {
+      method: 'GET',
+      headers: {
+        Authorization: `Bearer ${token}`,
+        'Content-Type': 'application/json'
+      }
+    });
+    if (!response.ok) {
+      throw new Error(`fetchInstanceUrl: Global Discovery returned ${response.status} ${response.statusText}`);
+    }
+    const result = await response.json();
+    const instanceUrl = result.value?.find(instance => instance.EnvironmentId?.toLowerCase() === environmentId.toLowerCase())?.ApiUrl;
+    scenario.complete({
+      hasInstanceUrl: instanceUrl !== undefined,
+      ...(0, _http.getHttpCorrelationProperties)(response.headers)
+    });
+    return instanceUrl;
+  } catch (error) {
+    scenario.fail(undefined, {
+      errorName: getSafeErrorName(error)
+    });
+    throw error;
+  }
+}

package/lib/commonjs/platform/GlobalDiscovery.js

@@ -0,0 +1,51 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.buildGlobalDiscoveryUrl = buildGlobalDiscoveryUrl;
+exports.globalDiscoveryEndpoint = globalDiscoveryEndpoint;
+exports.globalDiscoveryScope = globalDiscoveryScope;
+const GLOBAL_DISCOVERY_HOST = {
+  prod: 'globaldisco.crm.dynamics.com',
+  gcc: 'globaldisco.crm9.dynamics.com',
+  usg: 'globaldisco.crm.microsoftdynamics.us',
+  dod: 'globaldisco.crm.appsplatform.us',
+  china: 'globaldisco.crm.dynamics.cn'
+};
+const REGION_DISCOVERY_CLOUD = {
+  dev: 'prod',
+  test: 'prod',
+  preprod: 'prod',
+  preview: 'prod',
+  firstrelease: 'prod',
+  prod: 'prod',
+  gccmoderate: 'gcc',
+  gov: 'gcc',
+  gcchigh: 'usg',
+  high: 'usg',
+  dod: 'dod',
+  mooncake: 'china'
+};
+const ENVIRONMENT_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function globalDiscoveryEndpoint(region) {
+  const cloud = REGION_DISCOVERY_CLOUD[region];
+  if (!cloud) {
+    throw new Error(`Dataverse Global Discovery is not available for Power Platform region "${region}"`);
+  }
+  return `https://${GLOBAL_DISCOVERY_HOST[cloud]}`;
+}
+function globalDiscoveryScope(region) {
+  return `${globalDiscoveryEndpoint(region)}/user_impersonation`;
+}
+function buildGlobalDiscoveryUrl(environmentId, region) {
+  if (!ENVIRONMENT_ID_PATTERN.test(environmentId)) {
+    throw new Error(`Invalid Power Platform environment ID: "${environmentId}"`);
+  }
+  const normalizedEnvironmentId = environmentId.toLowerCase();
+  const query = new URLSearchParams({
+    '$select': 'ApiUrl,EnvironmentId',
+    '$filter': `EnvironmentId eq '${normalizedEnvironmentId}'`
+  });
+  return `${globalDiscoveryEndpoint(region)}/api/discovery/v2.0/Instances?${query.toString()}`;
+}

package/lib/commonjs/platform/PowerPlatformEnvironmentApi.js

@@ -4,22 +4,13 @@ Object.defineProperty(exports, "__esModule", {
   value: true
 });
 exports.POWER_PLATFORM_API_SCOPE = void 0;
-exports.buildCdsDataSources = buildCdsDataSources;
 exports.buildEnvironmentEndpoint = buildEnvironmentEndpoint;
-exports.fetchInstanceUrl = fetchInstanceUrl;
+exports.connectionUserConsentScope = connectionUserConsentScope;
 exports.powerPlatformScope = powerPlatformScope;
-var _index = require("../telemetry/index.js");
 /*!
  * power-apps-native-host — PowerPlatformEnvironmentApi
  *
- * Mirrors the Host SDK's DefaultAppMetadataProvider.fetchAppMetadataFromPowerConfig
- * pattern: resolves the Power Platform environment-scoped API endpoint from the
- * environment GUID and region, then fetches linkedEnvironmentMetadata to obtain
- * the Dataverse instanceUrl.
- *
- * Reference (Host SDK):
- *   packages/power-apps-host/src/providers/defaults/DefaultAppMetadataProvider.ts
- *   packages/power-apps-common/src/services/PowerPlatformApiDiscovery.ts
+ * Resolves Power Platform RP endpoints and scopes.
  */
 
 // ---------------------------------------------------------------------------
@@ -78,10 +69,6 @@ function buildEnvironmentEndpoint(environmentId, region) {
   return `https://${hexPrefix}.${hexSuffix}.environment.${hostNameSuffix}`;
 }
 
-// ---------------------------------------------------------------------------
-// Public API
-// ---------------------------------------------------------------------------
-
 /**
  * Token scope for the Power Platform management API (prod cluster).
  * Non-prod clusters (test, gov, high, dev, mooncake, etc.) host the management
@@ -99,96 +86,9 @@ function powerPlatformScope(region) {
   const host = HOST_NAME_SUFFIX[region] ?? HOST_NAME_SUFFIX['prod'];
   return `https://${host}/.default`;
 }
-function getSafeErrorName(error) {
-  return error instanceof Error ? error.constructor.name : typeof error;
-}
 
-/**
- * Fetch the Dataverse instanceUrl for a Power Platform environment by calling
- * the environment-scoped Power Platform management API — the same call that
- * the Host SDK's DefaultAppMetadataProvider makes to populate
- * `databaseReferences[*].databaseDetails.linkedEnvironmentMetadata`.
- *
- * @param environmentId - Environment GUID (from power.config.json `environmentId`).
- * @param region        - Cluster region string (from power.config.json `region`, default "prod").
- * @param acquireToken  - Callback to obtain a bearer token for the given scopes.
- *                        Scope will be {@link powerPlatformScope}`(region)`.
- * @param bearerToken   - Optional pre-fetched bearer token for {@link powerPlatformScope}`(region)`.
- *                        Pass this to avoid a redundant `acquireToken` round-trip when the
- *                        caller has already obtained a token for the same audience.
- * @returns The Dataverse org URL (e.g. "https://org12345.crm.dynamics.com"), or
- *          `undefined` if the environment has no linked CDS database.
- */
-async function fetchInstanceUrl(environmentId, region, acquireToken, bearerToken) {
-  const scenario = (0, _index.getAppLogger)().trackScenario(_index.HostOperationNames.PlatformFetchInstanceUrl, {
-    environmentId,
-    region
-  });
-  try {
-    const baseUrl = buildEnvironmentEndpoint(environmentId, region);
-    const url = `${baseUrl}/powerapps/environment?api-version=1&%24filter=name+eq+%27${encodeURIComponent(environmentId)}%27`;
-    const token = bearerToken ?? (await acquireToken([powerPlatformScope(region)]));
-    if (!token) {
-      throw new Error('fetchInstanceUrl: failed to acquire Power Platform API token');
-    }
-    const response = await fetch(url, {
-      method: 'GET',
-      headers: {
-        Authorization: `Bearer ${token}`,
-        'Content-Type': 'application/json'
-      }
-    });
-    if (!response.ok) {
-      throw new Error(`fetchInstanceUrl: environment API returned ${response.status} ${response.statusText}`);
-    }
-    const env = await response.json();
-    const instanceUrl = env.properties?.linkedEnvironmentMetadata?.instanceUrl;
-    scenario.complete({
-      hasInstanceUrl: instanceUrl !== undefined
-    });
-    return instanceUrl;
-  } catch (e) {
-    scenario.fail(undefined, {
-      errorName: getSafeErrorName(e)
-    });
-    throw e;
-  }
-}
-
-// ---------------------------------------------------------------------------
-// buildCdsDataSources
-// ---------------------------------------------------------------------------
-
-/**
- * Shape of a single Dataverse table entry inside power.config.json
- * `databaseReferences[*].dataSources[*]`.
- */
-
-/**
- * Shape of a single database reference entry inside power.config.json
- * `databaseReferences`.
- */
-
-/**
- * Build the CDS data source config array that the SDK reads via
- * AppPowerAppsClientPlugin.getAppCdsDataSourceConfigsAsync.
- *
- * Pass the resolved Dataverse org URL (from useConnectionRefs) and the
- * databaseReferences map from power.config.json.  The resulting array is
- * passed directly to <PowerAppsHostProvider dataSources={...} />.
- *
- * @param databaseReferences - The `databaseReferences` map from power.config.json.
- * @param dataverseOrgUrl    - The resolved Dataverse org URL
- *                             (connectionRefs['commondataserviceforapps']?.datasetName).
- *                             Pass an empty string before the org URL is known;
- *                             the host provider will receive empty runtimeUrl entries
- *                             and the SDK will not attempt Dataverse calls.
- */
-function buildCdsDataSources(databaseReferences, dataverseOrgUrl) {
-  return Object.values(databaseReferences).flatMap(dbRef => Object.values(dbRef.dataSources ?? {}).map(ds => ({
-    runtimeUrl: dataverseOrgUrl ? `${dataverseOrgUrl}/api/data/v9.0/` : '',
-    entitySetName: ds.entitySetName ?? '',
-    logicalName: ds.logicalName ?? '',
-    version: '9.2'
-  })));
+/** Delegated permission required by the connection user-consent endpoint. */
+function connectionUserConsentScope(region) {
+  const host = HOST_NAME_SUFFIX[region] ?? HOST_NAME_SUFFIX['prod'];
+  return `https://${host}/Connectivity.Connections.UserConsent`;
 }

package/lib/commonjs/provider/PowerAppsHostProvider.js

@@ -9,9 +9,14 @@ var _reactNative = require("react-native");
 var _reactNativeSafeAreaContext = require("react-native-safe-area-context");
 var _setupNativeHost = require("../bridge/setupNativeHost.js");
 var _NativePowerAppsBridge = require("../bridge/NativePowerAppsBridge.js");
-var _useConnectionRefs = require("../platform/useConnectionRefs.js");
+var _useConnectionRefs = require("../connections/useConnectionRefs.js");
+var _DataverseDataSources = require("../platform/DataverseDataSources.js");
 var _PowerPlatformEnvironmentApi = require("../platform/PowerPlatformEnvironmentApi.js");
 var _ConnectionSetupScreen = require("../connections/ConnectionSetupScreen.js");
+var _types = require("../connections/types.js");
+var _PowerPlatformConnectionApi = require("../connections/PowerPlatformConnectionApi.js");
+var _connectionState = require("../connections/connectionState.js");
+var _isDevPlayer = require("../utils/isDevPlayer.js");
 var _logger = require("../logger.js");
 var _index = require("../telemetry/index.js");
 var _jsxRuntime = require("react/jsx-runtime");
@@ -48,6 +53,7 @@ function _interopRequireWildcard(e, t) { if ("function" == typeof WeakMap) var r
 // Entra ID token scope for the APIM connector proxy (API Hub).
 const CONNECTOR_SCOPE = 'https://apihub.azure.com/.default';
 const EMPTY_DATABASE_REFERENCES = {};
+const EMPTY_CONNECTION_REFERENCES = {};
 /**
  * Initialises the NativePowerAppsBridge and manages the full pre-launch
  * pipeline — connection resolution, disambiguation, and creation — before
@@ -58,6 +64,7 @@ const EMPTY_DATABASE_REFERENCES = {};
 function PowerAppsHostProvider({
   acquireToken,
   isSignedIn,
+  onSignOut,
   appId,
   environmentId,
   region = 'prod',
@@ -67,18 +74,75 @@ function PowerAppsHostProvider({
   renderOAuthWebView,
   isvClientId,
   onDisambiguationNeeded,
+  onConnectionConsent,
+  onResourceConsent,
+  onConnectionConsentDeclined,
   children
 }) {
   // Extra refs produced by ConnectionSetupScreen for newly-created connections.
   const [extraConnectionRefs, setExtraConnectionRefs] = (0, _react.useState)({});
-
-  // setupDone is derived — true as soon as extraConnectionRefs is populated.
-  const setupDone = Object.keys(extraConnectionRefs).length > 0;
+  const [consentApproved, setConsentApproved] = (0, _react.useState)(false);
+  const setupDone = consentApproved;
+  const renderConnectionError = (title, messages, useNeutralText = false) => /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
+    style: {
+      flex: 1,
+      padding: 24,
+      justifyContent: 'center',
+      backgroundColor: '#F8F8F8'
+    },
+    children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+      style: {
+        fontSize: 20,
+        fontWeight: '700',
+        color: '#1A1A1A',
+        marginBottom: 12
+      },
+      children: title
+    }), messages.map(message => /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+      style: {
+        fontSize: 14,
+        color: useNeutralText ? '#323130' : '#C4262E',
+        lineHeight: 20,
+        marginBottom: 8
+      },
+      children: message
+    }, message)), isSignedIn && onSignOut ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.TouchableOpacity, {
+      accessibilityRole: "button",
+      onPress: () => {
+        void onSignOut();
+      },
+      style: {
+        alignSelf: 'flex-start',
+        backgroundColor: '#0F6CBD',
+        paddingHorizontal: 20,
+        paddingVertical: 12,
+        borderRadius: 4,
+        marginTop: 12
+      },
+      children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.Text, {
+        style: {
+          color: '#FFFFFF',
+          fontSize: 15,
+          fontWeight: '600'
+        },
+        children: "Sign out"
+      })
+    }) : null]
+  });
   const {
     connectionRefs,
     isReady,
+    error: connectionError,
+    errorKind: connectionErrorKind,
     missingConnectors,
-    dataverseOrgUrl
+    missingConnectionReferences,
+    connectionRequirements,
+    resourceConsents: launchResourceConsents,
+    configurationErrors,
+    requiresConnectionConsent,
+    resolvedConfigKey,
+    dataverseOrgUrl,
+    databaseReferences: resolvedDatabaseReferences
   } = (0, _useConnectionRefs.useConnectionRefs)({
     isSignedIn,
     acquireToken,
@@ -96,39 +160,43 @@ function PowerAppsHostProvider({
     if (!isSignedIn) {
       (0, _logger.debugLog)('[PAHost] user signed out — resetting bridge state');
       setExtraConnectionRefs({});
+      setConsentApproved(false);
     }
   }, [isSignedIn]);
+  (0, _react.useEffect)(() => {
+    setExtraConnectionRefs({});
+    setConsentApproved(false);
+  }, [appId, environmentId, connectionReferences]);
 
   // Merge hook refs with anything the setup screen created.
   const mergedRefs = (0, _react.useMemo)(() => ({
     ...connectionRefs,
     ...extraConnectionRefs
   }), [connectionRefs, extraConnectionRefs]);
-  const staticConnectionRefs = (0, _react.useMemo)(() => (0, _NativePowerAppsBridge.buildConnectionReferences)(connectionReferences), [connectionReferences]);
+  const staticConnectionRefs = (0, _react.useMemo)(() => _isDevPlayer.isDevPlayer ? (0, _NativePowerAppsBridge.buildConnectionReferences)(connectionReferences) : EMPTY_CONNECTION_REFERENCES, [connectionReferences, _isDevPlayer.isDevPlayer]);
 
   // dataverseOrgUrl comes directly from useConnectionRefs (fetched from the
   // environment metadata regardless of whether a commondataserviceforapps
   // connection reference is configured).  This allows Dataverse calls to work
   // even when there is no explicit Dataverse connection in connectionReferences.
-  const cdsDataSources = (0, _react.useMemo)(() => (0, _PowerPlatformEnvironmentApi.buildCdsDataSources)(databaseReferences ?? EMPTY_DATABASE_REFERENCES, dataverseOrgUrl), [databaseReferences, dataverseOrgUrl]);
+  const cdsDataSources = (0, _react.useMemo)(() => (0, _DataverseDataSources.buildCdsDataSources)(_isDevPlayer.isDevPlayer ? databaseReferences ?? EMPTY_DATABASE_REFERENCES : resolvedDatabaseReferences, dataverseOrgUrl), [databaseReferences, resolvedDatabaseReferences, dataverseOrgUrl, _isDevPlayer.isDevPlayer]);
 
   // Build the missing-connector entries for ConnectionSetupScreen.
-  const missingEntries = (0, _react.useMemo)(() => missingConnectors.map(apiId => {
-    const localRefId = Object.keys(connectionReferences).find(k => connectionReferences[k].id === apiId) ?? apiId;
-    return {
-      apiId,
-      localRefId
-    };
-  }), [missingConnectors, connectionReferences]);
+  const missingEntries = (0, _react.useMemo)(() => missingConnectionReferences, [missingConnectionReferences]);
+  const resourceConsents = (0, _react.useMemo)(() => [...new Map(launchResourceConsents.map(resource => [resource.resourceId.toLowerCase(), resource])).values()], [launchResourceConsents]);
+  const currentConfigKey = (0, _react.useMemo)(() => (0, _types.buildConnectionResolutionKey)(appId, environmentId, _isDevPlayer.isDevPlayer ? connectionReferences : {}), [appId, environmentId, connectionReferences, _isDevPlayer.isDevPlayer]);
+  const resolutionMatchesCurrentConfig = resolvedConfigKey === currentConfigKey;
+  const needsConsent = (0, _connectionState.shouldShowConnectionReview)(_isDevPlayer.isDevPlayer, requiresConnectionConsent, resourceConsents.length > 0);
 
   // Called by ConnectionSetupScreen once every missing connector is resolved.
-  const handleSetupComplete = (0, _react.useCallback)(resolvedIds => {
+  const handleSetupComplete = (0, _react.useCallback)(async resolvedIds => {
     const refs = {};
-    for (const [apiId, connectionId] of Object.entries(resolvedIds)) {
-      const localRefId = Object.keys(connectionReferences).find(k => connectionReferences[k].id === apiId);
-      if (!localRefId) continue;
-      const dataSources = connectionReferences[localRefId].dataSources;
-      const runtimeUrl = dataSources.map(ds => schemaMap[ds]?.properties?.primaryRuntimeUrl).find(Boolean) ?? '';
+    for (const [localRefId, connectionId] of Object.entries(resolvedIds)) {
+      const requirement = connectionRequirements.find(item => item.localRefId === localRefId);
+      if (!requirement) continue;
+      const apiId = requirement.apiId;
+      const dataSources = requirement.dataSources;
+      const runtimeUrl = dataSources.map(ds => connectionRefsRef.current[ds]?.runtimeUrl ?? (_isDevPlayer.isDevPlayer ? schemaMap[ds]?.properties?.primaryRuntimeUrl : undefined)).find(Boolean) ?? '';
       for (const ds of dataSources) {
         refs[ds] = {
           apiId,
@@ -142,7 +210,44 @@ function PowerAppsHostProvider({
       }
     }
     setExtraConnectionRefs(refs);
-  }, [connectionReferences, schemaMap]);
+    const mergedForConsent = {
+      ...connectionRefsRef.current,
+      ...refs
+    };
+    const usages = connectionRequirements.map(requirement => ({
+      localRefId: requirement.localRefId,
+      apiId: requirement.apiId,
+      connectionId: requirement.dataSources.map(dataSource => mergedForConsent[dataSource]?.connectionName).find(Boolean) ?? '',
+      dataSources: requirement.dataSources,
+      appActions: requirement.appActions ?? [],
+      apiScopes: requirement.apiScopes
+    }));
+    if (usages.some(usage => !usage.connectionId)) {
+      throw new Error('Not all required connections have been resolved.');
+    }
+    if (!_isDevPlayer.isDevPlayer && resourceConsents.length > 0 && !onResourceConsent) {
+      throw new Error('Protected resource consent requires an onResourceConsent persistence callback.');
+    }
+    const shouldPersistUsages = (0, _connectionState.shouldPersistConnectionUsages)(_isDevPlayer.isDevPlayer, appId);
+    if (shouldPersistUsages && appId && usages.length > 0) {
+      const token = await acquireToken([(0, _PowerPlatformEnvironmentApi.powerPlatformScope)(region)]);
+      if (!token) throw new Error('Unable to acquire a token to register connection usage.');
+      await Promise.all(usages.map(usage => (0, _PowerPlatformConnectionApi.postConnectionUsage)(appId, usage, environmentId, region, token)));
+      await (0, _PowerPlatformConnectionApi.reportScopeConsents)(appId, usages, environmentId, region, token);
+    }
+    if (!_isDevPlayer.isDevPlayer) {
+      await onConnectionConsent?.(usages);
+      await onResourceConsent?.(resourceConsents);
+    }
+    setConsentApproved(true);
+  }, [acquireToken, appId, environmentId, region, schemaMap, connectionRequirements, onConnectionConsent, onResourceConsent, resourceConsents, _isDevPlayer.isDevPlayer]);
+  const consentDetails = (0, _react.useMemo)(() => connectionRequirements.map(requirement => ({
+    localRefId: requirement.localRefId,
+    connectorId: requirement.connectorId,
+    displayName: requirement.displayName ?? requirement.connectorId.replace(/^shared_/, ''),
+    description: `Uses ${requirement.dataSources.join(', ')}`,
+    appActions: requirement.appActions ?? []
+  })), [connectionRequirements]);
 
   // ---- Bridge wiring ----
 
@@ -154,7 +259,7 @@ function PowerAppsHostProvider({
   connectionRefsRef.current = connectionRefs;
   const configuredBridgeInputsRef = (0, _react.useRef)(undefined);
   const [, setBridgeRegistrationVersion] = (0, _react.useState)(0);
-  const hasResolvedConnections = isSignedIn && isReady && (missingConnectors.length === 0 || setupDone);
+  const hasResolvedConnections = isSignedIn && isReady && resolutionMatchesCurrentConfig && (missingConnectors.length === 0 || consentApproved) && (!needsConsent || consentApproved);
   const isBridgeConfiguredFor = (connections, dataSources) => {
     const currentInputs = configuredBridgeInputsRef.current;
     return currentInputs?.connections === connections && currentInputs.dataSources === dataSources;
@@ -254,13 +359,34 @@ function PowerAppsHostProvider({
     }
   }, [isSignedIn, isReady]);
   (0, _react.useEffect)(() => {
-    if (isSignedIn && isReady && missingConnectors.length > 0 && !setupDone) {
+    if (isSignedIn && isReady && (missingConnectors.length > 0 || needsConsent) && !setupDone) {
       (0, _logger.debugLog)(`[PAHost] render: showing ConnectionSetupScreen for ${missingConnectors.length} missing connector(s):`, missingConnectors.join(', '));
     }
-  }, [isSignedIn, isReady, missingConnectors, setupDone]);
+  }, [isSignedIn, isReady, missingConnectors, needsConsent, setupDone]);
 
   // ---- Render ----
 
+  if (connectionError) {
+    const accessDenied = connectionErrorKind === 'app-access-denied';
+    return renderConnectionError(accessDenied ? 'You don’t have access' : 'Unable to load app', [connectionError], accessDenied);
+  }
+  if (configurationErrors.length > 0) {
+    return renderConnectionError('Connection configuration error', configurationErrors);
+  }
+  if (isSignedIn && !resolutionMatchesCurrentConfig) {
+    return /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.View, {
+      style: {
+        flex: 1,
+        alignItems: 'center',
+        justifyContent: 'center',
+        backgroundColor: '#F8F8F8'
+      },
+      children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNative.ActivityIndicator, {
+        size: "large"
+      })
+    });
+  }
+
   // First mount: register the native bridge with static manifest refs before
   // any route children can mount and call into @microsoft/power-apps.
   if (!staticBridgeRegistered && !hasResolvedConnections) {
@@ -296,7 +422,7 @@ function PowerAppsHostProvider({
   // Wrapped in SafeAreaProvider so useSafeAreaInsets() works even when the
   // consuming app hasn't mounted its own SafeAreaProvider yet.  Nesting is
   // safe — react-native-safe-area-context treats inner providers as no-ops.
-  if (isSignedIn && isReady && missingConnectors.length > 0 && !setupDone) {
+  if (isSignedIn && isReady && (missingConnectors.length > 0 || needsConsent) && !setupDone) {
     return /*#__PURE__*/(0, _jsxRuntime.jsx)(_reactNativeSafeAreaContext.SafeAreaProvider, {
       children: /*#__PURE__*/(0, _jsxRuntime.jsx)(_ConnectionSetupScreen.ConnectionSetupScreen, {
         missingConnectors: missingEntries,
@@ -304,8 +430,13 @@ function PowerAppsHostProvider({
         environmentId: environmentId,
         region: region,
         acquireToken: acquireToken,
+        onSignOut: isSignedIn ? onSignOut : undefined,
         isvClientId: isvClientId,
         onAllConnected: handleSetupComplete,
+        consentDetails: consentDetails,
+        resourceConsents: resourceConsents,
+        onConsentDeclined: onConnectionConsentDeclined,
+        showReview: !_isDevPlayer.isDevPlayer,
         renderOAuthWebView: renderOAuthWebView
         // No onSkip — connections are required.
       })