@microsoft/power-apps-native-host 0.2.25 → 0.3.3

package/lib/typescript/module/connections/ConnectionSetupScreen.d.ts

@@ -39,12 +39,23 @@
  * the consuming app decides how to render it (full-screen, modal, etc.).
  */
 import React from 'react';
-import type { ConnectorSchema } from '../platform/useConnectionRefs.js';
+import type { ConnectionConsentDetails, ResourceConsentRequirement } from '../connections/types.js';
+import type { ConnectorSchema } from './useConnectionRefs.js';
 export interface MissingConnectorEntry {
     /** Connector API ID (e.g. "/providers/Microsoft.PowerApps/apis/shared_office365users"). */
     apiId: string;
     /** Local ref ID from power.config.json (for correlation). */
     localRefId: string;
+    /** Canonical connector short name. Supplied by useConnectionRefs. */
+    connectorId?: string;
+    dataSources?: string[];
+    displayName?: string;
+    iconUri?: string;
+    appActions?: string[];
+    gatewayObjectIdHint?: string;
+    authenticationType?: string;
+    parameterSetName?: string;
+    sharedConnectionId?: string;
 }
 export interface ConnectionSetupScreenProps {
     /**
@@ -60,11 +71,20 @@ export interface ConnectionSetupScreenProps {
     environmentId: string;
     region?: string;
     acquireToken: (scopes: string[]) => Promise<string | null>;
+    onSignOut?: () => void | Promise<void>;
     /**
      * Called when all missing connections have been resolved.
-     * `resolvedIds` maps apiId → connectionId for all newly created connections.
+    * `resolvedIds` maps localRefId → connectionId for all newly created connections.
      */
-    onAllConnected: (resolvedIds: Record<string, string>) => void;
+    onAllConnected: (resolvedIds: Record<string, string>) => void | Promise<void>;
+    /** All connector usages requiring user approval, including already-resolved references. */
+    consentDetails?: ConnectionConsentDetails[];
+    /** Additional protected resources, such as cross-environment Dataverse instances. */
+    resourceConsents?: ResourceConsentRequirement[];
+    /** Called when the user explicitly declines access. */
+    onConsentDeclined?: () => void | Promise<void>;
+    /** Whether to show app-level Review Access after authentication. Defaults to true. */
+    showReview?: boolean;
     /**
      * If provided, a "Skip" button is shown. Useful for non-blocking connection flows.
      * The app should handle the case where connections remain unresolved.
@@ -76,11 +96,12 @@ export interface ConnectionSetupScreenProps {
      * access on each newly created connection, fixing the APIM 403 for
      * third-party app tokens.
      */
-    isvClientId?: string;
+    isvClientId: string;
     /**
      * Optional custom renderer for the OAuth WebView.
      * Receives the consent URL and a dismiss callback.
-     * If not provided, `Linking.openURL()` is used to open the URL in the system browser.
+    * If not provided, Expo's system authentication browser is used.
+    * Custom views should pass their final redirect URL to `onDone` when available.
      *
      * @example
      *   // Using react-native-webview:
@@ -91,7 +112,7 @@ export interface ConnectionSetupScreenProps {
      *     </Modal>
      *   )}
      */
-    renderOAuthWebView?: (url: string, onDone: () => void) => React.ReactNode;
+    renderOAuthWebView?: (url: string, onDone: (redirectUrl?: string) => void) => React.ReactNode;
     /** Optional title override (default: "Set up connections"). */
     title?: string;
 }
@@ -103,5 +124,5 @@ export interface ConnectionSetupScreenProps {
  * resolved `onAllConnected` fires and the parent app should unmount this
  * component and proceed to launch the app.
  */
-export declare function ConnectionSetupScreen({ missingConnectors, schemaMap, environmentId, region, acquireToken, isvClientId, onAllConnected, onSkip, renderOAuthWebView, title, }: ConnectionSetupScreenProps): React.JSX.Element;
+export declare function ConnectionSetupScreen({ missingConnectors, schemaMap, environmentId, region, acquireToken, onSignOut, isvClientId, onAllConnected, onSkip, consentDetails, resourceConsents, onConsentDeclined, showReview, renderOAuthWebView, title, }: ConnectionSetupScreenProps): React.JSX.Element;
 //# sourceMappingURL=ConnectionSetupScreen.d.ts.map

package/lib/typescript/module/{platform → connections}/PowerPlatformConnectionApi.d.ts

@@ -7,14 +7,12 @@
  * These mirror the endpoints used by ConnectorsApi in @microsoft/power-apps-common
  * but are implemented as plain async functions so they have no external dependencies.
  */
-import type { NativeConnectionInstance } from '../connections/types.js';
+import type { DatabaseReference } from '../platform/DataverseDataSources.js';
+import type { ConnectionInput, ConnectionParameterSet, ConnectionRequirement, ConnectionUsageInput, NativeConnectionInstance, ResourceConsentRequirement } from './types.js';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
-/**
- * Token scope for the Power Apps RP (api.powerapps.com).
- * Required when calling modifyPermissions to register a service principal
- * in the connection ACE so that APIM accepts third-party app tokens at runtime.
- */
-export declare const SERVICE_POWERAPPS_SCOPE = "https://service.powerapps.com/.default";
+export declare class AppLaunchAccessDeniedError extends Error {
+    constructor();
+}
 /** Subset of connector metadata returned by the Power Platform API. */
 export interface ConnectorMetadata {
     /** Short connector name, e.g. "shared_office365users". */
@@ -25,8 +23,15 @@ export interface ConnectorMetadata {
     iconUri: string;
     /** Description text. */
     description: string;
-    /** Whether this is a first-party (Microsoft-published) connector. */
-    isFirstParty: boolean;
+    /** Environment-specific APIM runtime URL used for connector requests. */
+    primaryRuntimeUrl: string;
+    scopes: {
+        will: string[];
+        wont: string[];
+    };
+    /** Whether the connector authenticates through an OAuth consent flow. */
+    hasOAuthParameter: boolean;
+    parameterSets: ConnectionParameterSet[];
 }
 /**
  * Fetch metadata for a single connector from the Power Platform API.
@@ -43,6 +48,8 @@ export declare function fetchConnectorMetadata(connectorId: string, environmentI
  * Returns only the `NativeConnectionInstance` shape used by the disambiguation layer.
  */
 export declare function fetchConnectionsForConnector(connectorId: string, environmentId: string, region: string, token: string): Promise<NativeConnectionInstance[]>;
+/** Delete a single connection instance from the user's environment. */
+export declare function deleteConnection(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 /**
  * Result of initiating an OAuth connection creation.
  *
@@ -51,8 +58,7 @@ export declare function fetchConnectionsForConnector(connectorId: string, enviro
  *   user can complete the OAuth consent flow. Poll `pollConnectionStatus`
  *   until the status changes to "Connected".
  *
- * `connected` — the connection was created and is already Connected (e.g.,
- *   first-party SSO connections that do not need explicit OAuth consent).
+ * `connected` — the connection resource was created in Connected state.
  *
  * `error` — creation failed; `message` contains the error description.
  */
@@ -71,7 +77,7 @@ export type CreateConnectionResult = {
  * Create a new connection for a connector in the user's environment.
  *
  * Calls:
- *   POST {envBase}/connectivity/apis/{connectorId}/connections
+ *   PUT {envBase}/connectivity/connectors/{connectorId}/connections/{connectionId}
  *
  * If the response contains a `consentLink`, the connection needs OAuth
  * completion (caller should open the URL and then poll `pollConnectionStatus`).
@@ -86,7 +92,8 @@ export type CreateConnectionResult = {
  *                           will redirect the user here after consent. Defaults to
  *                           the standard native-client redirect accepted by Power Platform.
  */
-export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string): Promise<CreateConnectionResult>;
+export declare function createConnection(connectorId: string, environmentId: string, region: string, token: string, displayName?: string, oauthRedirectUrl?: string, input?: ConnectionInput): Promise<CreateConnectionResult>;
+export declare function repairConnection(connectorId: string, connectionName: string, environmentId: string, region: string, token: string, oauthRedirectUrl?: string, input?: ConnectionInput, requiresApiConsent?: boolean): Promise<CreateConnectionResult>;
 /**
  * Poll a connection's status until it is "Connected" or a timeout is reached.
  *
@@ -101,6 +108,7 @@ export declare function createConnection(connectorId: string, environmentId: str
 export declare function pollConnectionStatus(connectorId: string, connectionName: string, environmentId: string, region: string, acquireToken: (scopes: string[]) => Promise<string | null>, options?: {
     intervalMs?: number;
     timeoutMs?: number;
+    signal?: AbortSignal;
 }): Promise<NativeConnectionInstance | null>;
 /**
  * Confirm a consent code returned by the APIM consent server in the OAuth
@@ -141,13 +149,38 @@ export interface AppLaunchResult {
      * has no linked Dataverse database).
      */
     dataverseOrgUrl: string;
+    /** Dataverse table metadata returned by the app launch endpoint. */
+    databaseReferences: Record<string, DatabaseReference>;
     /**
      * Connector short-names (e.g. "shared_office365users") for which the
      * launch API found no "Connected" connection instance for the signed-in
      * user.  These connectors need the connection setup flow.
      */
     missingConnectors: string[];
+    /** Missing requirements keyed by the app's local connection-reference ID. */
+    missingConnectionReferences: ConnectionRequirement[];
+    /** Every app requirement, including references resolved by the launch API. */
+    connectionRequirements: ConnectionRequirement[];
+    /** Connected candidates retained for explicit per-reference disambiguation. */
+    connectionCandidates: Record<string, NativeConnectionInstance[]>;
+    /** Non-connector protected resources requiring explicit user disclosure. */
+    resourceConsents: ResourceConsentRequirement[];
+    /** Configuration errors that make bridge connection binding ambiguous. */
+    configurationErrors: string[];
+    /** Durable app-to-connection bindings returned by launch or the app connections API. */
+    registeredConnectionUsages: RegisteredConnectionUsage[];
+    /** True when at least one selected local reference/action is not durably registered. */
+    requiresConnectionConsent: boolean;
+}
+export interface RegisteredConnectionUsage {
+    reference: string;
+    apiId: string;
+    connectionId: string;
+    appActions: string[];
 }
+export declare function fetchAppConnectionUsages(appId: string, environmentId: string, region: string, token: string): Promise<RegisteredConnectionUsage[]>;
+export declare function postConnectionUsage(appId: string, usage: ConnectionUsageInput, environmentId: string, region: string, token: string): Promise<void>;
+export declare function reportScopeConsents(appId: string, usages: ConnectionUsageInput[], environmentId: string, region: string, token: string): Promise<void>;
 /**
  * Fetch app launch data from the Power Platform environment-scoped launch
  * endpoint and process it into the shape the NativePowerAppsBridge needs.
@@ -160,7 +193,7 @@ export interface AppLaunchResult {
  *                                          — Dataverse org URL
  *
  * Endpoint (environment-scoped, same base as all Power Platform API calls):
- *   GET {envEndpoint}/powerapps/apps/{appId}/launch
+ *   POST {envEndpoint}/powerapps/apps/{appId}/launch
  *       ?api-version=2&lastKnownGoodPublishedVersion=true
  *
  * Authentication: bearer token for {@link powerPlatformScope}`(region)`.
@@ -169,37 +202,13 @@ export interface AppLaunchResult {
  * @param environmentId - Environment GUID.
  * @param region        - Cluster region (default "prod").
  * @param token         - Bearer token for {@link powerPlatformScope}`(region)`.
- * @returns Processed launch data, or `null` if the call fails.
+ * @returns Processed launch data, or `null` when the app is not found.
  */
 export declare function fetchAppLaunchData(appId: string, environmentId: string, region: string, token: string): Promise<AppLaunchResult | null>;
 /**
- * Decode the `oid` (object ID) claim from a JWT access token.
- *
- * The oid claim is in the base64url-encoded payload section (middle part).
- * Available in Hermes (React Native) via the global `atob`.
- */
-export declare function parseJwtOid(jwtToken: string): string | null;
-/**
- * Add the ISV's AAD application (client) ID to the connection's ACL AppIds
- * list via the Power Apps RP `addAadAppToConnectionAcl` endpoint.
- *
- * The RP finds the user's existing ACE (identified by `userOid`) and appends
- * `isvClientId` to its `AppIds` list. APIM's stage-2 token check verifies
- * that the requesting token's `appid` is present in this list, so without
- * this call APIM returns 403 "missing connection ACL" for third-party tokens.
- *
- * POST https://api.powerapps.com/providers/Microsoft.PowerApps/environments/{environmentId}
- *      /apis/{connectorId}/connections/{connectionId}/addAadAppToConnectionAcl
- *      ?api-version=2016-11-01
- *
- * Body: { "aadApplicationId": "<ISV client ID>", "objectId": "<user OID>" }
- *
- * @param connectorId   - Connector short name (e.g. "shared_office365users").
- * @param connectionId  - Bare 32-char hex connection ID.
- * @param environmentId - Environment GUID.
- * @param isvClientId   - The ISV's AAD application (client) ID.
- * @param userOid       - The signed-in user's AAD object ID (oid JWT claim).
- * @param token         - Bearer token for `https://service.powerapps.com/.default`.
+ * Grant the calling application's delegated access to a connection for the
+ * signed-in user. The backend derives both identities from the token and
+ * selects the most specific applicable user, group, or tenant ACL.
  */
-export declare function addAadAppToConnectionAcl(connectorId: string, connectionId: string, environmentId: string, isvClientId: string, userOid: string, token: string): Promise<boolean>;
+export declare function grantConnectionUserConsent(connectorId: string, connectionId: string, environmentId: string, region: string, token: string): Promise<boolean>;
 //# sourceMappingURL=PowerPlatformConnectionApi.d.ts.map

package/lib/typescript/module/connections/connectionMetadata.d.ts

@@ -0,0 +1,66 @@
+import type { ConnectionInput, ConnectionParameterDefinition, ConnectionParameterSet, ConnectionUsageInput } from './types.js';
+export interface ConsentLinkDefinition {
+    redirectUrl: string;
+}
+export type SerializedConnectionParameters = {
+    connectionParameters: ConnectionInput['parameters'];
+} | {
+    connectionParametersSet: {
+        name: string;
+        values: Record<string, {
+            value: ConnectionInput['parameters'][string];
+        }>;
+    };
+};
+export interface RawConnectionParameter {
+    type?: string;
+    defaultValue?: string | boolean | number;
+    uiDefinition?: {
+        displayName?: string;
+        constraints?: {
+            required?: string | boolean;
+            hidden?: string | boolean;
+            capability?: string[];
+            allowedValues?: Array<{
+                value?: string;
+                displayName?: string;
+            }>;
+        };
+    };
+}
+export interface RawConnectionParameterSet {
+    name?: string;
+    uiDefinition?: {
+        displayName?: string;
+    };
+    connectionParameters?: Record<string, RawConnectionParameter>;
+    parameters?: Record<string, RawConnectionParameter>;
+}
+export declare function parseConnectionParameters(parameters: Record<string, RawConnectionParameter> | undefined): ConnectionParameterDefinition[];
+export declare function buildConnectionParameterSets(connectionParameters: Record<string, RawConnectionParameter> | undefined, parameterSets: RawConnectionParameterSet[] | undefined): ConnectionParameterSet[];
+export declare function hasOAuthParameter(parameters: Record<string, RawConnectionParameter> | undefined): boolean;
+export declare function buildConnectionUserConsentUrl(environmentEndpoint: string, connectorId: string, connectionId: string): string;
+export declare function getAppLaunchFailureMessage(status: number, statusText: string, responseText: string): string | null;
+export declare function isAppLaunchAccessDenied(status: number, responseText: string): boolean;
+export declare function buildConsentLinkDefinition(redirectUrl: string): ConsentLinkDefinition;
+export declare function serializeConnectionParameters(input?: ConnectionInput): SerializedConnectionParameters;
+export declare function buildConnectionUsageUrl(environmentBaseUrl: string, environmentId: string, usage: ConnectionUsageInput): string;
+export declare function buildConnectionUsageRequest(appId: string, usage: ConnectionUsageInput): {
+    properties: {
+        reference: string;
+        resourceId: string;
+        appActions: string[];
+    };
+};
+export declare function buildScopeConsentUrl(environmentBaseUrl: string, appId: string): string;
+export declare function buildScopeConsentRequest(usages: ConnectionUsageInput[]): {
+    consents: Array<{
+        connectionId: string;
+        consentType: 'userConsent';
+        scopes: {
+            will: string[];
+            wont: string[];
+        };
+    }>;
+};
+//# sourceMappingURL=connectionMetadata.d.ts.map

package/lib/typescript/module/connections/connectionState.d.ts

@@ -0,0 +1,16 @@
+import type { AppLaunchResult } from './PowerPlatformConnectionApi.js';
+import type { RegisteredConnectionUsage } from './PowerPlatformConnectionApi.js';
+import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
+import type { ConnectionRequirement } from './types.js';
+export declare function isTransientConnectionConsentStatus(status: number): boolean;
+export declare function shouldGrantConnectionUserConsent(requirement: Pick<ConnectionRequirement, 'sharedConnectionId'>, runningInDevPlayer: boolean): boolean;
+export declare function getConnectionNamesRequiringAclGrant(connectionRefs: Record<string, AppConnectionReference>, connectionRequirements: ConnectionRequirement[]): string[];
+export declare function invalidateFailedAclGrants(result: AppLaunchResult, failedConnectionNames: ReadonlySet<string>): void;
+export declare function selectLaunchConnection(result: AppLaunchResult, localRefId: string, connectionId: string): boolean;
+export declare function getUnregisteredConnectionRequirements(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): ConnectionRequirement[];
+export declare function applyRegisteredConnectionSelections(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function hasRegisteredConnectionConsent(result: AppLaunchResult, usages?: RegisteredConnectionUsage[]): boolean;
+export declare function applyRegisteredConnectionUsages(result: AppLaunchResult, usages: RegisteredConnectionUsage[]): void;
+export declare function shouldPersistConnectionUsages(runningInDevPlayer: boolean, appId: string | undefined): boolean;
+export declare function shouldShowConnectionReview(runningInDevPlayer: boolean, requiresConnectionConsent: boolean, hasResourceConsents: boolean): boolean;
+//# sourceMappingURL=connectionState.d.ts.map

package/lib/typescript/module/connections/disambiguate.d.ts

@@ -27,6 +27,7 @@ import type { NativeConnectionInstance, NativeConnectionResolution } from './typ
 export declare function disambiguateConnections(connectionReferences: Record<string, {
     id: string;
     dataSources: string[];
+    sharedConnectionId?: string;
 }>, allConnectionsByApiId: Record<string, NativeConnectionInstance[]>): NativeConnectionResolution[];
 /**
  * Extract the connection UUID from a raw connection name returned by the API.
@@ -36,8 +37,9 @@ export declare function disambiguateConnections(connectionReferences: Record<str
  *   "abc12345def6789012345678901234ab"                        (bare UUID, no dashes)
  *   "abc12345-def6-7890-1234-5678901234ab"                   (UUID with dashes)
  *
- * Returns the 32-char hex ID (dashes stripped) or the raw string if no UUID
- * pattern is found.
+ * Returns the terminal resource name exactly as supplied by Power Platform.
+ * Some connectors require dashed GUIDs while others use compact IDs.
  */
 export declare function extractConnectionId(rawName: string): string;
+export declare function connectionIdsEqual(left: string, right: string): boolean;
 //# sourceMappingURL=disambiguate.d.ts.map

package/lib/typescript/module/{platform → connections}/resolveConnections.d.ts

@@ -5,19 +5,18 @@
  * useConnectionRefs:
  *
  *  • resolveViaStaticRefs — per-connector resolution using the static
- *    connectionReferences map from power.config.json.  Used by the Dev Player
- *    and during local development (no appId) or when the launch API is
- *    unavailable.  Handles pre-disambiguation ACL grants so inaccessible
- *    connections are excluded before the user is asked to pick.
+ *    connectionReferences map from power.config.json. Used only by Dev Player
+ *    for unpublished local apps. Handles pre-disambiguation ACL grants so
+ *    inaccessible connections are excluded before the user is asked to pick.
  *
- *  • applyAclGrants — post-resolution ACL grants used by the fast path
+ *  • applyAclGrants — post-resolution user consent used by the fast path
  *    (production APKs via fetchAppLaunchData).
  *
  * Both helpers return / consume the shared AppLaunchResult shape so the
  * hook orchestrator can handle them uniformly.
  */
 import type { AppLaunchResult } from './PowerPlatformConnectionApi.js';
-import type { OnDisambiguationNeeded, OnMissingConnection } from '../connections/types.js';
+import type { ConnectionReferenceConfig, ConnectionRequirement, OnDisambiguationNeeded, OnMissingConnection } from './types.js';
 import type { AppConnectionReference } from '../bridge/NativePowerAppsBridge.js';
 /**
  * Connector schema entry generated by `generate-connector-schemas`.
@@ -28,6 +27,10 @@ export interface ConnectorSchema {
     name: string;
     properties: {
         primaryRuntimeUrl: string;
+        scopes?: {
+            will?: string[];
+            wont?: string[];
+        };
     };
 }
 export interface StaticRefsOptions {
@@ -35,19 +38,18 @@ export interface StaticRefsOptions {
      * Static connectionReferences from power.config.json.
      * Shape: { [refId]: { id: string; dataSources: string[] } }
      */
-    connectionReferences: Record<string, {
-        id: string;
-        dataSources: string[];
-    }>;
+    connectionReferences: Record<string, ConnectionReferenceConfig>;
+    /** Whether power.config.json contains Dataverse database references. */
+    hasDataverse: boolean;
     /** Connector schema map keyed by data source name. */
     schemaMap: Record<string, ConnectorSchema>;
     environmentId: string;
     region: string;
-    /** Used for ACL grants and the Dataverse instanceUrl fetch. */
+    /** Used for connection consent and the Dataverse instanceUrl fetch. */
     acquireToken: (scopes: string[]) => Promise<string | null>;
     /** Pre-acquired Power Platform API bearer token. */
     token: string;
-    /** ISV client ID — when provided, runs pre-disambiguation ACL grants. */
+    /** ISV client ID — when provided, runs pre-disambiguation user consent. */
     isvClientId?: string;
     onDisambiguationNeeded?: OnDisambiguationNeeded;
     onMissingConnection?: OnMissingConnection;
@@ -59,7 +61,7 @@ export interface StaticRefsOptions {
  *  1. Build an apiId → schema lookup.
  *  2. In parallel: fetch the Dataverse instanceUrl and all connection instances
  *     for every connector.
- *  3. If `isvClientId` is set, run pre-disambiguation ACL grants — connections
+ *  3. If `isvClientId` is set, run pre-disambiguation user consent — connections
  *     where the grant fails are marked `NeedsAclGrant` and excluded from
  *     resolution, prompting the user to create a new connection.
  *  4. Disambiguate: resolve single matches, invoke callbacks for ambiguous /
@@ -67,20 +69,20 @@ export interface StaticRefsOptions {
  *     `true`.
  *  5. Build and return an `AppLaunchResult`-shaped object.
  */
-export declare function resolveViaStaticRefs({ connectionReferences, schemaMap, environmentId, region, acquireToken, token, isvClientId, onDisambiguationNeeded, onMissingConnection, }: StaticRefsOptions): Promise<AppLaunchResult>;
+export declare function resolveViaStaticRefs({ connectionReferences, hasDataverse, schemaMap, environmentId, region, acquireToken, token, isvClientId, onDisambiguationNeeded, onMissingConnection, }: StaticRefsOptions): Promise<AppLaunchResult>;
 /**
- * Run idempotent post-resolution ACL grants on behalf of the ISV app.
+ * Run idempotent post-resolution delegated consent grants for the calling app.
  *
  * Used by the fast path (production APKs via `fetchAppLaunchData`) where the
- * launch API has already resolved the user's connections — grants are applied
- * after the fact so APIM accepts tokens issued to the ISV's AAD app.
+ * launch API has already resolved the user's connections. Grants are applied
+ * only to user-selected connections; fixed shared connections are already
+ * authorized by their owner and must not receive delegated user consent.
  *
  * For the slow path the grants run before disambiguation inside
  * `resolveViaStaticRefs`, where they can still influence which connections
  * are considered available.
  *
- * Failures are swallowed — a failed grant will surface as a 403 at runtime
- * when the connector is called.
+ * Returns the connection names whose ACL grants failed so callers can fail closed.
  */
-export declare function applyAclGrants(connectionRefs: Record<string, AppConnectionReference>, environmentId: string, isvClientId: string, acquireToken: (scopes: string[]) => Promise<string | null>): Promise<void>;
+export declare function applyAclGrants(connectionRefs: Record<string, AppConnectionReference>, connectionRequirements: ConnectionRequirement[], environmentId: string, region: string, acquireToken: (scopes: string[]) => Promise<string | null>): Promise<Set<string>>;
 //# sourceMappingURL=resolveConnections.d.ts.map

package/lib/typescript/module/connections/types.d.ts

@@ -17,18 +17,146 @@ export declare enum ConnectionStatus {
     NeedsAclGrant = "NeedsAclGrant",
     NotConnected = "NotConnected"
 }
+export interface ConnectionReferenceConfig {
+    id: string;
+    dataSources: string[];
+    displayName?: string;
+    iconUri?: string;
+    appActions?: string[];
+    sharedConnectionId?: string;
+    gatewayObjectIdHint?: string;
+    authenticationType?: string;
+    parameterSetName?: string;
+    workflowDetails?: {
+        workflowEntityId?: string;
+        workflowDisplayName?: string;
+        workflowName?: string;
+    };
+    dataSets?: Record<string, unknown>;
+    dependencies?: Record<string, unknown>;
+    dependents?: string[];
+    nestedActions?: Array<{
+        actionName?: string;
+        apiName?: string;
+        flowConnectionRef?: string;
+    }>;
+    parameterHintsV2?: Record<string, {
+        value?: unknown;
+    }>;
+    [key: string]: unknown;
+}
+export interface ConnectionRequirement {
+    localRefId: string;
+    apiId: string;
+    connectorId: string;
+    dataSources: string[];
+    displayName?: string;
+    iconUri?: string;
+    appActions?: string[];
+    sharedConnectionId?: string;
+    gatewayObjectIdHint?: string;
+    authenticationType?: string;
+    parameterSetName?: string;
+    apiScopes: {
+        will: string[];
+        wont: string[];
+    };
+    isFlowDependent: boolean;
+}
+export type ConnectionParameterType = 'string' | 'securestring' | 'boolean' | 'integer' | 'clientcertificate';
+export interface ConnectionParameterDefinition {
+    name: string;
+    displayName: string;
+    type: ConnectionParameterType;
+    required: boolean;
+    hidden: boolean;
+    capabilities?: string[];
+    allowedValues?: Array<{
+        value: string;
+        displayName: string;
+    }>;
+    defaultValue?: string | boolean | number;
+}
+export interface ConnectionParameterSet {
+    /** Undefined for a connector's single, non-parameter-set authentication definition. */
+    name?: string;
+    displayName: string;
+    parameters: ConnectionParameterDefinition[];
+    requiresApiConsent: boolean;
+    gatewayParameterName?: string;
+}
+export type ConnectionParameterValue = string | boolean | number | {
+    pfx: string;
+    password: string;
+} | {
+    gatewayObjectId: string;
+};
+export interface ConnectionInput {
+    parameterSetName?: string;
+    gatewayObjectId?: string;
+    gatewayParameterName?: string;
+    parameters: Record<string, ConnectionParameterValue>;
+}
+export interface ConnectionConsentDetails {
+    localRefId: string;
+    connectorId: string;
+    displayName: string;
+    description: string;
+    appActions: string[];
+}
+export interface ResourceConsentRequirement {
+    resourceId: string;
+    displayName: string;
+}
+export interface ConnectionUsageInput {
+    localRefId: string;
+    apiId: string;
+    connectionId: string;
+    dataSources: string[];
+    appActions: string[];
+    apiScopes: {
+        will: string[];
+        wont: string[];
+    };
+}
+export declare function normalizeApiId(apiId: string): string;
+export declare function getConnectorId(apiId: string): string;
+export declare function getConnectionDatasetName(reference: {
+    dataSets?: Record<string, unknown>;
+}): string;
+export declare function getFlowConnectionName(reference: ConnectionReferenceConfig): string;
+export declare function getFlowDataSourceNames(reference: ConnectionReferenceConfig): string[];
+export declare function buildConnectionRequirements(connectionReferences: Record<string, ConnectionReferenceConfig>, scopesByApiId?: Record<string, {
+    will: string[];
+    wont: string[];
+}>): ConnectionRequirement[];
+export declare function isCompositeConnectionApiId(apiId: string): boolean;
+export declare function findConnectionDataSourceConflicts(requirements: ConnectionRequirement[]): string[];
+export declare function hasCompleteStaticConnectionConfig(connectionReferences: Record<string, ConnectionReferenceConfig>, schemaMap: Record<string, {
+    name: string;
+    properties: {
+        primaryRuntimeUrl: string;
+    };
+}>): boolean;
+export declare function buildConnectionResolutionKey(appId: string | undefined, environmentId: string, connectionReferences: Record<string, ConnectionReferenceConfig>): string;
 /** A single connection instance returned by the Power Platform connectivity API. */
 export interface NativeConnectionInstance {
-    /** Extracted connection UUID (hex, no dashes). */
+    /** Terminal connection resource name exactly as returned by Power Platform. */
     id: string;
     /** Full resource name from the API (connector-prefixed, e.g. "shared_office365users/abc123"). */
     name: string;
     /** Connector API identifier (e.g. "/providers/Microsoft.PowerApps/apis/shared_office365users"). */
     apiId: string;
+    /** Object ID of the connection owner when returned by the connectivity API. */
+    ownerId?: string;
     /** Resolved authorization status of this connection. */
     status: ConnectionStatus;
     /** Optional human-readable display name from the API. */
     displayName?: string;
+    accountName?: string;
+    parameterSetName?: string;
+    isAuthenticated?: boolean;
+    statusErrorCode?: string;
 }
 /**
  * Result of attempting to match a single connection reference to an instance.