@memberjunction/connector-elevate 0.2.0

package/dist/ElevateConnector.d.ts

@@ -0,0 +1,458 @@
+import { type UserInfo } from '@memberjunction/core';
+import type { MJCompanyIntegrationEntity, MJIntegrationObjectEntity, MJIntegrationObjectFieldEntity } from '@memberjunction/core-entities';
+import { BaseRESTIntegrationConnector, type RESTAuthContext, type RESTResponse, type PaginationState, type PaginationType, type RateLimitPolicy, type ConnectionTestResult, type ExternalObjectSchema, type ExternalFieldSchema, type FetchContext, type FetchBatchResult, type SourceSchemaInfo, type SyncErrorCode, type ErrorSeverity, type UpdateRecordContext, type DeleteRecordContext, type CRUDResult } from '@memberjunction/integration-engine';
+/** Resolved per-connection auth + routing context. */
+interface ElevateAuthContext extends RESTAuthContext {
+    /** Per-connection base URL derived from the connection's `siteUrl` — never a vendor default. */
+    SiteUrl: string;
+    /** The api_key injected into every request body. NEVER logged, NEVER put in an error message. */
+    ApiKey: string;
+    /** The IntegrationID this context was resolved for (metadata lookups off the request path). */
+    IntegrationID: string;
+}
+/** A classified Elevate failure, derived from the observed error ENVELOPE rather than the status alone. */
+export interface ElevateErrorClassification {
+    /** Whether this response is a FAILURE at all. A 2xx carrying an error envelope is one. */
+    IsError: boolean;
+    /** Engine-level sync error code the run artifact reports. */
+    Code: SyncErrorCode;
+    /** Engine-level severity. */
+    Severity: ErrorSeverity;
+    /** Whether the engine may retry. A 500 from the read door is a CLIENT error → never retryable. */
+    Retryable: boolean;
+    /** Short machine-ish reason naming WHY this classification was chosen. */
+    Reason: string;
+    /** The unrecognised field name when the door rejected the `fields` allow-list, else null. */
+    UnknownField: string | null;
+}
+/**
+ * Typed transport failure. Carries the response headers so `ExtractRetryAfterMs` can honour
+ * `Retry-After` off the error the engine sees, and the classification so callers do not re-parse.
+ */
+export declare class ElevateAPIError extends Error {
+    readonly Status: number;
+    readonly Headers: Record<string, string>;
+    readonly Classification: ElevateErrorClassification;
+    constructor(message: string, Status: number, Headers: Record<string, string>, Classification: ElevateErrorClassification);
+}
+/**
+ * Elevate LMS (Cadmium) connector.
+ *
+ * Reads ride the Report API's single POST door with a JSON envelope; writes ride the base class's
+ * generic per-operation CRUD slots against the Registration API. Auth is a per-client `api_key`
+ * carried in the request BODY.
+ */
+export declare class ElevateConnector extends BaseRESTIntegrationConnector {
+    /** Resolved auth per CompanyIntegration.ID. The api_key is static and has no refresh endpoint. */
+    private authCache;
+    /** Field names the door's own `response.labels` dictionary has revealed, per connection+object. */
+    private discoveredFieldNames;
+    /**
+     * Learned field names this connection's door has PROVEN it accepts on a read, per connection+object.
+     * Only these are ever allowed to join a DATA read's `fields` allow-list — see {@link VerifyLearnedFields}.
+     */
+    private verifiedFieldNames;
+    /** One sampled value per discovered field name, used ONLY for runtime type inference. */
+    private discoveredSamples;
+    /** Field names this connection's door REJECTED — never requested again for that object. */
+    private rejectedFieldNames;
+    /** Declared resources this connection accepted a probe query for. Absence NEVER deactivates. */
+    private validatedResources;
+    /**
+     * `product_url` returned alongside a created registration, keyed by the new registration_id — the
+     * learner's link, which the generic `CRUDResult` has no slot for. Bounded (oldest evicted) so a long
+     * push cannot grow it without limit.
+     */
+    readonly LastCreatedProductURLs: Map<string, string>;
+    /** Warnings already emitted, so the log stays honest rather than noisy. */
+    private warnedOnce;
+    /** Verbatim `MJ: Integrations.Name`. Load-bearing: T1 compares this === the metadata Name. */
+    get IntegrationName(): string;
+    /** POST /api/registrations exists (productRegistration only) — `CreateAPIPath`/`CreateMethod` are populated. */
+    get SupportsCreate(): boolean;
+    /**
+     * FALSE. `Configuration.WriteCapability.update` (metadata): "No update endpoint is documented for
+     * any resource anywhere in the corpus." No IO carries `UpdateAPIPath`. `UpdateRecord` below fails
+     * loudly rather than no-opping or degrading into a create.
+     */
+    get SupportsUpdate(): boolean;
+    /**
+     * TRUE only in the sense the metadata declares: `POST /registrations/cancel` is a domain-specific
+     * CANCEL on one productRegistration, not a generic hard DELETE, and it is NOT reflected on the
+     * read side (`Configuration.DeleteSemantics` = 'none'). Deletion RECONCILIATION therefore needs a
+     * periodic key sweep — this connector never claims a delete FEED.
+     */
+    get SupportsDelete(): boolean;
+    /**
+     * FALSE, permanently. `Configuration.DiscoveryAuthoritativeness` records `no-describe-endpoint` at
+     * BOTH object and field level with `deactivationPermitted: false`. With no describe endpoint,
+     * absence at runtime proves nothing: a thin query result must never deactivate a persisted object
+     * or field, which would be tenant-visible data loss.
+     */
+    get DiscoveryIsAuthoritative(): boolean;
+    /**
+     * Rate limiting provably EXISTS (Elevate Release 2025.02, verbatim: "Introduced rate limiting for
+     * Report API requests") but is UNQUANTIFIED — no ceiling, window, burst or `Retry-After` format is
+     * documented anywhere. The only empirical evidence is the RealityProbe's own pacing result recorded
+     * in `Configuration.PaginationDefaultsNote`: a pass at ~1.1s between requests was rate-limited
+     * (429s on 4 windows); the re-paced pass at ~3.4s completed 15 windows all HTTP 200. That is an
+     * OBSERVATION, not a vendor commitment, so the sustained rate published here is deliberately below
+     * the slower of the two (≈0.29/s) and the engine's AIMD limiter does the pacing — this connector
+     * never sleeps on its own. Burst 1: the door serves one query per request, there is nothing to batch.
+     */
+    get RateLimitPolicy(): RateLimitPolicy;
+    /** One in flight. The limit exists, its numbers do not, and the door is a reporting engine. */
+    get MaxConcurrencyHint(): number;
+    /**
+     * Honours `Retry-After` (delta-seconds AND the HTTP-date form) off the typed error the transport
+     * threw, so the engine's AIMD bucket backs off by the vendor's own instruction. Returns undefined
+     * when the response carried no header — the metadata records `retryAfterHeaderDocumented: false`,
+     * so the header's absence is expected and must not be papered over with an invented number.
+     */
+    ExtractRetryAfterMs(error: unknown): number | undefined;
+    /**
+     * Strictly whatever the metadata declares. Only `Product` still carries one (`id`, probe-confirmed
+     * populated 1985/1985); `User.member_id` and `AccountingCode.id` were WITHDRAWN by the RealityProbe
+     * because they are not populated on every row, and a null-bearing column is not a resume cursor.
+     * Never synthesised here.
+     */
+    StableOrderingKey(objectName: string): string | null;
+    /**
+     * The declared catalog is the FLOOR, not the ceiling and not a code constant: it is seeded into the
+     * engine cache from `metadata/integrations/elevate/.elevate.integration.json` and read back here via
+     * the base implementation. On top of that floor this method VALIDATES each declared resource against
+     * THIS connection with a minimal probe query — accepted ⇒ present.
+     *
+     * A probe that fails NEVER removes an object. `DiscoveryIsAuthoritative` is false and the metadata
+     * records `deactivationPermitted: false`: with no describe endpoint, a rejection can mean a
+     * per-tenant permission, a transient fault, or a genuinely absent resource, and those are not
+     * distinguishable. The rejection is surfaced as a loud, once-per-connection warning instead.
+     */
+    DiscoverObjects(companyIntegration: MJCompanyIntegrationEntity, contextUser: UserInfo): Promise<ExternalObjectSchema[]>;
+    /**
+     * Two-stage, additive. Stage 1 is the declared floor from the engine cache (the base implementation).
+     * Stage 2 probes THIS connection: every Report API response carries a `response.labels` dictionary
+     * keying the resource's FULL retrievable field set to its display label — returned irrespective of
+     * which columns the request asked for — so a site's configured custom/profile fields are reachable
+     * per tenant without any describe endpoint. Discovered-only fields are appended, never substituted,
+     * and a declared field is never dropped because a probe did not see it.
+     */
+    DiscoverFields(companyIntegration: MJCompanyIntegrationEntity, objectName: string, contextUser: UserInfo): Promise<ExternalFieldSchema[]>;
+    /**
+     * Declared ∪ runtime-discovered, so a tenant's own columns reach the schema builder. Delegates the
+     * union to the shared `mergeDeclaredWithSampledFields` helper (never-shrink by field name); the
+     * connector supplies no merge logic of its own.
+     */
+    IntrospectSchema(companyIntegration: MJCompanyIntegrationEntity, contextUser: UserInfo): Promise<SourceSchemaInfo>;
+    /**
+     * Runs the cheapest real read the door supports: a minimal single-column query against the first
+     * declared resource. A 200 with the documented envelope proves the site URL, the api_key and the
+     * door are all good together. The message never carries credential bytes.
+     */
+    TestConnection(companyIntegration: MJCompanyIntegrationEntity, contextUser: UserInfo): Promise<ConnectionTestResult>;
+    /**
+     * OVERRIDDEN because Elevate's reads are a POST-with-a-JSON-envelope to a SINGLE endpoint with the
+     * object chosen by a body field — the base class's generic per-operation GET-list CRUD would 404/405
+     * on every object. Everything that varies per object (door path, `resource` wire value, response
+     * keys, watermark field, window field) is routed FROM METADATA; nothing is a string guess in code.
+     */
+    FetchChanges(ctx: FetchContext): Promise<FetchBatchResult>;
+    /**
+     * Resolves the per-connection credential. Elevate's api_key is a single static per-client string
+     * with no authorize/token endpoint, no scopes and no documented expiry, so there is nothing to
+     * refresh and the resolved context is cached per CompanyIntegration. The credential is read through
+     * the standard `MJ: Credentials` record when the connection carries one, with the connection's own
+     * `Configuration` JSON as the fallback — no inline crypto anywhere.
+     */
+    protected Authenticate(companyIntegration: MJCompanyIntegrationEntity, contextUser: UserInfo): Promise<ElevateAuthContext>;
+    /**
+     * Transport headers ONLY. Elevate's credential does NOT travel in a header or a query string on any
+     * of its three POST operations — `Configuration.AuthHeaderPattern` is deliberately null and
+     * `AuthCredentialParamLocation` is 'body'. Reaching for the generic Bearer/Basic header path for
+     * this vendor is wrong, and no credential byte is ever placed here.
+     */
+    protected BuildHeaders(_auth: RESTAuthContext): Record<string, string>;
+    /**
+     * The single wire choke point. It owns four vendor-specific concerns:
+     *   1. Injecting `api_key` into the request BODY (never a header, never a query param, never logged).
+     *   2. Treating a VENDOR ERROR ENVELOPE as a failure even on a 2xx — the read door has been observed
+     *      answering `{ error: { message } }` and the write endpoints document `{ error_messages: {...} }`
+     *      with no status code shown, so a body-blind success check would sync zero rows silently.
+     *   3. Honouring 429 (and 503 carrying `Retry-After`) with bounded adaptive backoff.
+     *   4. NEVER retrying a 500 — this door returns 500 for CLIENT errors (wrong resource name,
+     *      non-existent field), and blind-retrying burns the unquantified rate-limit budget replaying a
+     *      request that can never succeed.
+     */
+    protected MakeHTTPRequest(auth: RESTAuthContext, url: string, method: string, headers: Record<string, string>, body?: unknown): Promise<RESTResponse>;
+    /**
+     * Strips the Report API envelope. The shape was OBSERVED by the RealityProbe (key names only):
+     * `{ response: { labels: {...}, items: [...], count: N } }`, so the rows are the array at the
+     * metadata-declared `ResponseDataKey` = `response.items`. A dotted key is walked, never split on the
+     * first segment only — declaring `response.items` and reading `response` would return zero rows.
+     */
+    protected NormalizeResponse(rawBody: unknown, responseDataKey: string | null): Record<string, unknown>[];
+    /**
+     * ALWAYS `HasMore: false`. Pagination was PROBED AND DECIDED NEGATIVE at volume: 29,003 unfiltered
+     * rows equalled the sum of 15 all-HTTP-200 yearly windows, and none of limit/offset/page/per_page/
+     * page_size changed the row count. There is no scheme to extract, and inventing one would silently
+     * truncate. Bulk beyond the probed ceiling is bounded by DATE WINDOWS in `FetchChanges`, not pages.
+     */
+    protected ExtractPaginationInfo(_rawBody: unknown, _paginationType: PaginationType, _currentPage: number, _currentOffset: number, _pageSize: number): PaginationState;
+    /** The connection's OWN Elevate site root. There is no vendor host and no fallback default. */
+    protected GetBaseURL(_companyIntegration: MJCompanyIntegrationEntity, auth: RESTAuthContext): string;
+    /**
+     * Projects each declared dot-path column onto its flat MJ column name (`product.title` lands at
+     * `raw.product.title`, the IOF is named `product_title`) while PRESERVING the complete source row:
+     * the spread keeps every key the door returned so the framework's custom-column capture can still
+     * see a per-tenant column this build never declared.
+     */
+    protected TransformRecord(raw: Record<string, unknown>, _obj: MJIntegrationObjectEntity, fields: MJIntegrationObjectFieldEntity[]): Record<string, unknown>;
+    /**
+     * Reads the created record's id from a DOTTED body location. The base helper understands only
+     * `body` / `header`; Elevate declares `body.registration_id`, and `registration_id` is the ONLY
+     * handle the Cancellation API accepts, so losing it here would make every cancel impossible.
+     * `product_url` from the same body is stashed on {@link LastCreatedProductURLs}.
+     */
+    protected ExtractIDFromResponse(response: RESTResponse, idLocation: string | null): string | undefined;
+    /** Reads the vendor's message out of either observed envelope: `{error:{message}}` / `{error_messages:{}}`. */
+    protected ExtractErrorMessage(response: RESTResponse): string | undefined;
+    /**
+     * ALWAYS fails, explicitly. No update endpoint is documented for ANY Elevate resource, so there is
+     * nothing to call: no IO carries `UpdateAPIPath`. This method exists so the failure is a classified,
+     * visible NOT-SUPPORTED rather than a silent no-op — and it must never degrade into a create, which
+     * would mint a second registration for the same learner.
+     */
+    UpdateRecord(ctx: UpdateRecordContext): Promise<CRUDResult>;
+    /**
+     * OVERRIDDEN for one reason: the id location. Elevate's cancel is a POST whose `registration_id`
+     * travels in the BODY (`DeleteIDLocation` = `body.registration_id`), and the base class's generic
+     * delete sends NO body at all for a non-path id location — the call would arrive without the id and
+     * cancel nothing. Everything else is still read from metadata: the verb comes from `DeleteMethod`
+     * (POST, never assumed DELETE) and the path is used EXACTLY as declared — `/registrations/cancel`
+     * genuinely has no `/api/` prefix, and "fixing" it would 404.
+     */
+    DeleteRecord(ctx: DeleteRecordContext): Promise<CRUDResult>;
+    /**
+     * Classifies from the observed error ENVELOPE, not the status alone. Two shapes exist and they are
+     * NOT shared between surfaces (`Configuration.ErrorResponseShape.surfaceSplit`): the read door
+     * answers `{ error: { message } }` (observed at HTTP 500) and the write endpoints document
+     * `{ error_messages: { field: message } }` with NO status code ever shown. A 2xx carrying either is
+     * a FAILURE — treating it as a successful empty read is exactly how a sync reports zero rows and
+     * green at the same time.
+     */
+    ClassifyElevateResponse(status: number, body: unknown): ElevateErrorClassification;
+    /** The raw HTTP call. Isolated so a mocked subclass can capture the wire without losing the behaviour above. */
+    protected rawRequest(url: string, method: string, headers: Record<string, string>, body?: unknown): Promise<RESTResponse>;
+    /** All ACTIVE IntegrationObjects for this integration; `[]` when the engine cache is unavailable. */
+    protected getCachedObjects(integrationID: string): MJIntegrationObjectEntity[];
+    /** The IntegrationID for this integration, or null when the engine cache is unavailable. */
+    protected tryGetIntegrationID(): string | null;
+    /**
+     * Runs ONE report query and returns its rows. Two safety behaviours ride here because both are
+     * per-query facts, not per-object ones:
+     *   • THE COMPLETENESS TRIPWIRE — `response.count` is the door's own total for the query; when it
+     *     exceeds `response.items.length` the read was silently truncated, which is the only protection
+     *     that survives above the 29,003 rows the probe actually measured.
+     *   • THE ALLOW-LIST REPAIR — a SAFETY NET for DECLARED columns (a wrong `wireSelector` in metadata):
+     *     the door rejects the WHOLE query for one unrecognised column and names the offender, so that name
+     *     is dropped, remembered and the query retried. Runtime-discovered names never rely on it — they
+     *     are proven out of band by {@link VerifyLearnedFields} before they may enter a data read — and the
+     *     repair refuses to act when the named column was not in the request it just sent, because dropping
+     *     it changes nothing and the retry would replay an identical, already-failed call.
+     */
+    private RunReportQuery;
+    /**
+     * Runs one date window, halving it when the door reports truncation. That is the ADAPTIVE sizing the
+     * probe's evidence calls for: it does not assume a chunk size is small enough, it verifies each chunk
+     * against the door's own count and splits until every chunk is provably complete.
+     */
+    private RunWindow;
+    /**
+     * Builds the request envelope. Key order is deliberate and stable — `resource` sits next to
+     * `format` so a captured request is self-describing. `api_key` is NOT added here; it is injected at
+     * the transport choke point so no caller can accidentally log or persist an envelope carrying it.
+     */
+    private BuildEnvelope;
+    /**
+     * json unless the connection explicitly asks for csv AND every selector is flat. The vendor is
+     * explicit that CSV "is limited to only the values in the top-most layer of the API response", so a
+     * dot-path selection silently loses its columns in csv — the request is forced back to json and the
+     * downgrade is announced rather than quietly honoured.
+     */
+    private ResolveFormat;
+    /**
+     * The `fields` allow-list for one DATA read: the DECLARED read-surface wire selectors UNIONED with the
+     * per-tenant column names this connection's door has PROVEN it accepts (see {@link VerifyLearnedFields}),
+     * minus anything the door has already rejected. A build-time-only list would truncate every record to
+     * what this build thought to ask for; the union is what makes a site's configured custom/profile
+     * columns reachable.
+     *
+     * The union is over VERIFIED names, never over freshly-learned ones. Elevate's allow-list is
+     * ALL-OR-NOTHING — one unrecognised name fails the WHOLE query — so folding an unproven label name
+     * into a data read makes every row of that object hostage to a guess: the read has to fail at least
+     * once, and it zeroes the object outright if the door's message does not NAME the offender (the
+     * repair below can only act on a named column). Unproven names are therefore proven OUT OF BAND
+     * first; a rejection there costs one probe and never a row.
+     * `FetchContext.RequestedSourceFields`, when the engine supplies it, narrows the union to the columns
+     * actually mapped.
+     */
+    private SelectorsFor;
+    /**
+     * Proves — OUT OF BAND, before any data read — which of the names runtime discovery has learned for
+     * this connection+object the door will actually accept in a `fields` allow-list. This is the whole
+     * reason a learned label can no longer zero an object's sync:
+     *
+     *   • the DATA read only ever asks for DECLARED columns ∪ names proven here, so an unrecognised
+     *     label can never fail it — named in the door's message or not;
+     *   • a rejection costs exactly this probe (never a row), the offending name is remembered as
+     *     rejected for the connection and is never asked for again;
+     *   • a probe that fails for ANY OTHER reason leaves the names UNVERIFIED rather than rejected —
+     *     absence of proof is not proof of absence, and the next sync re-attempts them.
+     *
+     * Zero-cost when there is nothing new to prove (the overwhelmingly common case): with no unproven
+     * name the method makes no request at all. The probe is scoped by the SAME filter the imminent read
+     * uses, so proving a column on a watermarked object does not drag the whole resource across the wire.
+     */
+    private VerifyLearnedFields;
+    /** Learned names not yet proven, not already rejected, and not already covered by a declared column. */
+    private PendingLearnedFields;
+    /** Records the learned names this connection's door answered a read for. */
+    private MarkVerified;
+    /**
+     * Records the per-resource field dictionary the door returns on EVERY call (`response.labels`) as
+     * runtime-discovered column names for this connection, plus one sampled value each for type
+     * inference. This is discovery from a real runtime surface, not a build-time sample: nothing here is
+     * written back to the declared metadata.
+     */
+    private LearnLabels;
+    /** Remembers a column this connection's door refused, so it is never requested for that object again. */
+    private RememberRejected;
+    /**
+     * The silent-truncation tripwire. `response.count` is the door's OWN total for the query; when it
+     * disagrees with the number of rows actually returned, the read was capped. Raised as a FetchWarning
+     * so the engine surfaces it in the structured run artifact instead of it being a swallowed console line.
+     */
+    private CheckCompleteness;
+    /**
+     * The date column a bulk pull is chunked on — strictly the object's DECLARED
+     * `IncrementalWatermarkField`, and nothing else. For productRegistration that is `modified_at`: the
+     * probe-proven UPDATE watermark, deliberately not `transaction_at`, which is insert time and cannot
+     * see an edit. `null` for every other object, and then NO window is ever synthesised.
+     *
+     * A date-shaped column is NOT enough to justify a filter here. `EarnedCredit.updated_at` looks like a
+     * watermark and the metadata explicitly WITHHOLDS incremental capability for it: filters-envelope
+     * reachability for that resource is unproven, so chunking on it would apply an unevidenced filter and
+     * would silently drop every row whose column is null. Honour what the probe proved; do not re-derive it.
+     */
+    private WindowFieldFor;
+    /**
+     * Consecutive, NON-OVERLAPPING windows over `[start, end]`. The start is the sync watermark when the
+     * engine supplied one (so a delta pass re-reads only what changed), the resume cursor when a prior
+     * batch stopped mid-plan, or the connection's declared `elevateWindowStart`. With no lower bound at
+     * all the plan is EMPTY and the object is read in one query — verified by the completeness tripwire
+     * rather than assumed complete.
+     */
+    private BuildWindowPlan;
+    /** Halves a window, or null when it is already a single day and cannot be narrowed further. */
+    private SplitWindow;
+    /**
+     * The delta filter for an UNCHUNKED incremental read. Only ever built from the object's own declared
+     * watermark; an object whose metadata declares none runs a FULL SCAN, and no delta path is invented
+     * for it.
+     */
+    private WatermarkFilter;
+    /** Whether the connection explicitly asked for a bounded/chunked pull rather than the default. */
+    private HasExplicitWindowConfig;
+    /** Max-SEEN watermark across the batch (never "most recent row"), or null when the object has none. */
+    private MaxWatermark;
+    /**
+     * Builds one ExternalRecord. Identity is STABLE ACROSS PASSES by construction:
+     *   • when the object's DECLARED primary key is fully populated, the ExternalID is that key;
+     *   • otherwise — every Elevate object except Product, whose keys the RealityProbe demoted or
+     *     falsified — the identity is a content hash over the DECLARED READ PROJECTION only, never over
+     *     the whole raw row. That distinction is the point: hashing the raw row makes identity a
+     *     function of any volatile or per-tenant byte the door happens to add, which is the drift class
+     *     the two-pass idempotency rung exists to catch.
+     * `Fields` still carries the COMPLETE source row (plus the flattened projections) so the framework's
+     * custom-column capture sees everything the door returned.
+     */
+    private ToElevateRecord;
+    /** The stable projection a keyless record's identity hashes over: declared columns only, by MJ name. */
+    private IdentityBasis;
+    /** Declared PK names in Sequence order, mirroring the base class's `['ID']` synthetic fallback. */
+    private PrimaryKeyNames;
+    /** The read route for one object, entirely from metadata. Throws rather than guessing a wire value. */
+    private ReadRouteFor;
+    /** Fallback resource resolution: the depth-0 access path's own body selector. Still metadata, not code. */
+    private AccessPathResource;
+    /**
+     * The object's READ-surface columns. A field is excluded when the metadata marks it write-only or
+     * explicitly excludes it from the read selector — `registration_id` is exactly that case: the probe
+     * FALSIFIED it as a read column (`Field registration_id doesn't exist`) while it remains the only
+     * handle the cancel API accepts. Sending it would fail the WHOLE query for the object.
+     */
+    private ReadColumnsFor;
+    /** Parsed `Configuration` JSON for one IntegrationObject. */
+    private ObjectConfig;
+    /**
+     * Probes one declared resource against THIS connection with the cheapest possible query. Accepted ⇒
+     * present. A rejection is remembered and warned about but NEVER removes the object — with no describe
+     * endpoint, absence proves nothing, and deactivating on a thin result is tenant-visible data loss.
+     */
+    private ValidateResource;
+    /** Runs one read so the door's `response.labels` dictionary can be harvested for this connection. */
+    private LearnFieldsFromSource;
+    /** An `ExternalFieldSchema` for a column only runtime discovery has seen. Types inferred, never asserted. */
+    private SchemaForDiscoveredField;
+    /** Conservative runtime type inference from one observed value. Unknown ⇒ String, never a guessed width. */
+    private InferType;
+    /** Credential record first, connection Configuration second. No inline crypto; nothing is logged. */
+    private LoadCredentials;
+    /** Extracts the two Elevate credential fields from a credential/Configuration JSON string. */
+    private ParseCredentialJSON;
+    /** Merges the credential into the request body. The ONLY place the api_key ever touches the wire. */
+    private WithCredential;
+    /** Removes any occurrence of the credential from a string before it reaches a log or an error. */
+    private Redact;
+    /** The vendor's message from either observed envelope, or undefined when the body carries no error. */
+    private VendorMessage;
+    /** Pulls the offending column out of the door's own `Field <name> doesn't exist` message. */
+    private UnknownFieldFrom;
+    /** Walks a dotted path into a parsed body. Returns undefined at the first missing/non-object segment. */
+    private ReadPath;
+    /** Joins a base URL with an API path exactly as declared — no path is invented or normalised away. */
+    private JoinURL;
+    /** Path-only view of a URL, for messages that must never carry a query string or a credential. */
+    private PathOf;
+    /** Cache key scoping a per-tenant discovery to one connection + object. */
+    private CacheKey;
+    /** Deterministic ordering so discovery output is byte-stable across passes. */
+    private SortedNames;
+    /** A narrowing cast to a plain object, or null. */
+    private AsObject;
+    /** First non-empty string value among `keys` on a parsed object. */
+    private FirstString;
+    /** A trimmed string from the connection Configuration JSON. */
+    private ConfigString;
+    /** A finite number from the connection Configuration JSON. */
+    private ConfigNumber;
+    /** Tolerant JSON-object parse; malformed configuration degrades to "absent" rather than crashing a sync. */
+    private ParseJSONObject;
+    /** `YYYY-MM-DD` for today, in UTC — the granularity the probe partitioned with. */
+    private Today;
+    /** Normalises a watermark/config value to `YYYY-MM-DD`, or null when it is not a usable date. */
+    private ToDayString;
+    /** `YYYY-MM-DD` + n days, UTC. */
+    private AddDays;
+    /** Whole days between two `YYYY-MM-DD` values. */
+    private DayDiff;
+    /** The earlier of two `YYYY-MM-DD` values (lexicographic order is chronological for this format). */
+    private MinDay;
+    /** Sleeps, bounded. Only ever reached on a 429/503 with a honoured `Retry-After`. */
+    private Sleep;
+    /** An error message safe to log: never carries credential bytes. */
+    private SafeMessage;
+    /** Emits a warning at most once per connector lifetime, so the log stays honest rather than noisy. */
+    private WarnOnce;
+}
+export {};