@memberjunction/server 6.2.0-edge.6 → 6.2.0-edge.7

package/dist/resolvers/IntegrationDiscoveryResolver.d.ts

@@ -136,6 +136,52 @@ declare class SchemaEvolutionOutput {
     ChangedObjects?: string[];
     /** U10 — objects whose Pull watermark was reset so the next sync backfills the schema change. */
     WatermarksReset?: string[];
+    /**
+     * Objects whose stored rows were CLEARED because the connector changed what identifies a row.
+     * Reported separately from WatermarksReset: a reset means "fetch it all again", this means
+     * "what was here could not be reconciled with the source and has been rebuilt from it".
+     */
+    RekeyedObjects?: string[];
+    /**
+     * Custom columns the source has been sending that are still sitting in the overflow JSON,
+     * offered here so a schema refresh is where you see them.
+     *
+     * everything.txt: promoting one "requires that the user accepts" it, so this is REPORT-ONLY.
+     * Pass the column names back in `acceptCustomColumns` to actually materialise them — in the
+     * same migration and the same restart as the refresh's own DDL.
+     */
+    CustomColumnCandidates?: CustomColumnCandidate[];
+    /** The accepted columns that were folded into this run's migration. */
+    PromotedColumns?: PromotedColumn[];
+}
+/**
+ * One tunable setting, described by the connector.
+ *
+ * Exists so a surface can render the settings for a connection it knows nothing about, and so the
+ * DEFAULT it shows is the engine's real one. The alternative — a hardcoded list per surface — is
+ * how a sample size of 500 came to be shown and stamped against an engine whose default is 50.
+ */
+declare class ConnectorSettingOutput {
+    Key: string;
+    Label: string;
+    Group: string;
+    Type: string;
+    Options?: string[];
+    /** JSON-encoded: the value is polymorphic per setting, and Type says how to read it. */
+    DefaultJSON?: string;
+    Min?: number;
+    Max?: number;
+    /** 'basic' | 'advanced' | 'expert' — how a surface decides what to show. */
+    Tier: string;
+    /** 'connection' | 'object' */
+    AppliesTo: string;
+    Description: string;
+    Sensitive: boolean;
+}
+declare class ConnectorSettingsSchemaOutput {
+    Success: boolean;
+    Message: string;
+    Settings: ConnectorSettingOutput[];
 }
 declare class ConnectorCapabilitiesOutput {
     Success: boolean;
@@ -220,6 +266,20 @@ declare class RefreshConnectorSchemaOutput {
     UnresolvedObjects?: string[];
     FailureMessage?: string;
 }
+/**
+ * The reply to a DETACHED discovery start. Deliberately a different shape from
+ * RefreshConnectorSchemaOutput: that one reports real counts because it waited, and handing back
+ * placeholder zeros from a run that has not begun is exactly the confusion this type avoids.
+ */
+declare class StartSchemaRefreshOutput {
+    Success: boolean;
+    Message: string;
+    /** Tail this with IntegrationTailRunEvents. 'not-started' when Success is false. */
+    RunID: string;
+    InProgress: boolean;
+    /** Set when the refusal was a lock: names what is holding it, so the UI can say why. */
+    BlockedBy?: string;
+}
 declare class IntegrationGenerateActionResult {
     Success: boolean;
     ActionID?: string;
@@ -340,6 +400,26 @@ declare class MutationResultOutput {
     Success: boolean;
     Message: string;
 }
+/**
+ * Deactivate returns more than a boolean because pausing a connection is not one act.
+ *
+ * A caller has to be able to tell "paused, and the sync you were watching is stopping" from
+ * "paused, and the sync you were watching will run to completion in a process I cannot reach".
+ * Both are successful pauses. Only one of them means the work has stopped, and a UI that says
+ * "stopping" for the second is lying to the operator about the state of their data.
+ */
+declare class DeactivateConnectionOutput {
+    Success: boolean;
+    Message: string;
+    /** How many scheduled jobs this pause actually moved from Active to Paused. */
+    SchedulesPaused: number;
+    /** The live sync run at the moment of pause, when there was one. */
+    InFlightSyncRunID?: string;
+    /** True when a live run existed AND a cancel was signalled for it. */
+    CancelRequested: boolean;
+    /** 'durable' | 'this-process' | 'unknown' | 'none' — see ConnectionPause.DescribeCancelScope. */
+    CancelScope: string;
+}
 declare class IntegrationSyncConfigInput {
     SyncConcurrency?: number;
     MaxConcurrency?: number;
@@ -530,6 +610,10 @@ declare class SyncHistoryOutput {
     Success: boolean;
     Message: string;
     Runs?: SyncRunSummaryOutput[];
+    /** Total runs for this connection, so a pager can size itself without fetching every row. */
+    TotalKnown?: number;
+    /** True when rows exist beyond this page. */
+    HasMore?: boolean;
 }
 declare class OperationProgressOutput {
     Success: boolean;
@@ -543,6 +627,8 @@ declare class OperationProgressOutput {
     RecordsCreated?: number;
     RecordsUpdated?: number;
     RecordsErrored?: number;
+    /** Records the sync chose not to write because the content hash matched. */
+    RecordsSkipped?: number;
     RSUStep?: string;
     RSURunning?: boolean;
     /** U11 — 1-based index of the current RSU step (determinate stepper). */
@@ -552,6 +638,65 @@ declare class OperationProgressOutput {
     ElapsedMs?: number;
     StartedAt?: string;
 }
+declare class ActiveOperationOutput {
+    /** 'sync' | 'rsu' | 'discovery' | 'maintenance' */
+    Kind: string;
+    /**
+     * 'connection' when this operation provably belongs to the requested connection;
+     * 'workspace' when it is process-wide and cannot be attributed to one. The UI must not claim a
+     * workspace-scoped RSU belongs to the connector being viewed - that mislabelling is why an
+     * unrelated schema update read as "your connector is building".
+     */
+    Scope: string;
+    Label: string;
+    RunID?: string;
+    StartedAt?: Date;
+    StepLabel?: string;
+    StepIndex?: number;
+    StepTotal?: number;
+    RecordsCreated?: number;
+    RecordsUpdated?: number;
+    RecordsSkipped?: number;
+    RecordsErrored?: number;
+    /** Only a sync can be cancelled, and only from the process running it. */
+    Cancellable: boolean;
+}
+declare class ActiveOperationsOutput {
+    Success: boolean;
+    Message: string;
+    Operations?: ActiveOperationOutput[];
+    /** What holds this connection's maintenance lock, if anything. */
+    MaintenanceLockReason?: string;
+}
+declare class ResourcePressureFindingOutput {
+    Code: string;
+    Message: string;
+}
+declare class ResourcePressureOutput {
+    Success: boolean;
+    Message: string;
+    HeapUsedFraction?: number;
+    HeapUsedMB?: number;
+    HeapLimitMB?: number;
+    ResidentMB?: number;
+    /**
+     * Resident set as a fraction of HOST memory, plus the host totals it is derived from.
+     *
+     * ResidentMB alone is a number with no denominator: a client cannot tell whether 3,478 MB is
+     * comfortable or one step from a SIGKILL without knowing the box. It was the latter on the
+     * sandbox on 2026-09-14 — 3,478 MB of 3,830 MB, killed by the kernel, while HeapUsedFraction
+     * (the only judgeable number this type exposed) sat unremarkable because `--max-old-space-size`
+     * bounds V8's old space and not the response buffers that actually filled the machine.
+     */
+    ResidentFraction?: number;
+    HostMemTotalMB?: number;
+    HostMemAvailableMB?: number;
+    ArtifactDiskFreeMB?: number;
+    WorkDirFreeMB?: number;
+    ActiveSyncCount?: number;
+    /** Empty when nothing is under pressure. Ordered most severe first. */
+    Findings?: ResourcePressureFindingOutput[];
+}
 declare class IntegrationRunCountsOutput {
     Processed?: number;
     Succeeded?: number;
@@ -564,6 +709,12 @@ declare class IntegrationRunSummaryArtifactOutput {
     RunKind: string;
     IntegrationID?: string;
     CompanyIntegrationID?: string;
+    /**
+     * Every connection the run touched. Populated for runs that can span more than one (an RSU
+     * batch); `CompanyIntegrationID` above is set only when this holds exactly one. A client should
+     * read this rather than the singular field when it needs to know what a run covers.
+     */
+    CompanyIntegrationIDs?: string[];
     ObjectName?: string;
     TriggerType?: string;
     StartedAt: string;
@@ -598,6 +749,10 @@ declare class IntegrationListRunsOutput {
     Success: boolean;
     Message: string;
     Runs?: IntegrationRunSummaryArtifactOutput[];
+    /** Feed back as `offset` for the next page. Absent when there is no next page. */
+    NextOffset?: number;
+    /** True when the store holds more runs past this page. */
+    HasMore?: boolean;
 }
 declare class IntegrationRunDetailOutput {
     Success: boolean;
@@ -692,12 +847,90 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      * (IntegrationObjectField.RelatedIntegrationObjectID) plus soft-FK declarations in the IO's
      * Configuration (parentObjectName / parentObjectNames map / ReferencedType). Reads the
      * engine cache only (no DB round-trip); objects with no persisted IO row have no entry.
+     *
+     * Hard FK parents come from `GetRelatedIntegrationObjectIDs`, which answers a per-connection
+     * object from the scope's edge set. Its full field rows are cold here (only the sync loop warms
+     * them), so reading them would find no parents at all.
      */
     private computeObjectDependencyNames;
     /**
      * Discovers fields on a specific external object.
      */
     IntegrationDiscoverFields(companyIntegrationID: string, objectName: string, ctx: AppContext): Promise<DiscoverFieldsOutput>;
+    /**
+     * Tests credentials that have NOT been saved anywhere.
+     *
+     * ── Why this exists ───────────────────────────────────────────────────────
+     *
+     * `IntegrationTestConnection` takes a `companyIntegrationID`, so it can only test a
+     * connection that already exists. That forces every setup wizard into create-then-test:
+     * the workspace writes a Credential and a CompanyIntegration, THEN finds out the
+     * password was wrong, and something has to go back and delete them. Two cases escape
+     * that cleanup — a credential test that outlives the caller's gateway (most likely
+     * precisely when a host or tenant id is wrong, because that is what makes a vendor call
+     * hang rather than refuse), and a test that passes before a later step fails. Both leave
+     * a connection that answers every listing and syncs nothing.
+     *
+     * This inverts the order. Nothing is written, so there is nothing to clean up.
+     *
+     * ── How it can work without persisting ────────────────────────────────────
+     *
+     * The connector is resolved from the INTEGRATION row, not from a connection —
+     * `ConnectorFactory.Resolve` already only needs the former. The credentials then ride in
+     * on a transient CompanyIntegration that is constructed with `NewRecord()` and
+     * DELIBERATELY NEVER SAVED, carrying the values in `Configuration`.
+     *
+     * That works because every connector resolves its auth material the same way: prefer the
+     * linked Credential when `CredentialID` is set, otherwise fall back to the
+     * `Configuration` JSON. It is a de-facto framework convention rather than a documented
+     * one — verified across all seven connectors this was written for (NetSuite, Totara,
+     * Nimble AMS, OpenWater, PheedLoop, PropFuel, Elevate), each of which reads
+     * `CredentialID` first and `Configuration` second. A connector that reads ONLY
+     * `CredentialID` would report missing credentials here rather than misbehave, which is
+     * the safe direction to fail: the caller learns the probe cannot help and falls back to
+     * create-then-test, exactly as before.
+     *
+     * ── Rules this endpoint holds itself to ───────────────────────────────────
+     *
+     *  - NOTHING IS PERSISTED. No Credential, no CompanyIntegration, no Company. The
+     *    transient entity is a local and never leaves this method.
+     *  - THE VALUES ARE NEVER LOGGED. Not on success, not on failure, not inside an error
+     *    message. Only the integration id and the outcome are ever written down.
+     *  - IT CANNOT HANG. A hard deadline applies regardless of what the connector does,
+     *    because a probe that inherits the gateway-timeout problem solves nothing. A
+     *    timeout is reported as a timeout, which is itself the diagnosis for an unreachable
+     *    host.
+     *  - IT IS RATE LIMITED per (user, integration). The endpoint turns caller-supplied
+     *    input into an outbound vendor request, so an unbounded one is a request amplifier.
+     */
+    IntegrationProbeCredentials(integrationID: string, credentialValues: string, ctx: AppContext): Promise<ConnectionTestOutput>;
+    /**
+     * The probe's hard deadline.
+     *
+     * `TestConnectionMs` exists on the connector config but is advisory — an implementation
+     * that does not consult it can block for as long as the vendor's socket does, which is
+     * the whole failure this endpoint exists to avoid. So the bound is applied here, where it
+     * cannot be opted out of.
+     *
+     * 20 seconds: comfortably longer than any healthy handshake, comfortably shorter than the
+     * ~240s gateway ceiling that create-then-test keeps running into.
+     */
+    private static readonly PROBE_DEADLINE_MS;
+    private static withProbeDeadline;
+    /**
+     * Per (user, integration) rate limit.
+     *
+     * This endpoint converts caller-supplied input into an outbound request to a third party,
+     * which makes an unbounded version a request amplifier pointed at somebody else's API —
+     * and the fastest way to get a tenant's key rate-limited by its own vendor. In-process
+     * and per-instance on purpose: it is a courtesy bound on a human typing into a form, not
+     * a security boundary, and giving it a durable store would buy nothing a form's own pace
+     * does not already provide.
+     */
+    private static readonly PROBE_WINDOW_MS;
+    private static readonly PROBE_MAX_PER_WINDOW;
+    private static readonly probeHits;
+    private static probeRateLimited;
     /**
      * Tests connectivity to the external system.
      */
@@ -718,6 +951,23 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      * both on stdout (visible in the MJAPI log file) and in a per-run
      * `<cwd>/logs/integration-runs/<runID>/progress.jsonl` artifact.
      */
+    /**
+     * Start discovery and return immediately with a tailable RunID.
+     *
+     * plan.md is emphatic that this must exist: "going to a page should NEVER, NEVER trigger such
+     * things automatically, it must in a very clean way tell the user to click a button to start
+     * discovery of tables". A button needs a call that returns at once; the synchronous mutation
+     * runs the whole pipeline inline and times out at the gateway on a large catalog, which is why
+     * both surfaces ended up auto-triggering on page entry and adopting whatever run they found.
+     *
+     * A DISTINCT mutation rather than a flag on the synchronous one: that reply promises real
+     * counts because it waited, and a detached launch can only offer placeholder zeros.
+     *
+     * The lock is PROBED here so a second click is refused with a reason the UI can show. The
+     * pipeline still acquires it for real - this probe is not the guard, it is the clean answer in
+     * the common case. Losing the race just means the launch fails on the run stream instead.
+     */
+    IntegrationStartSchemaRefresh(companyIntegrationID: string, universalPKConvention: string | undefined, ctx: AppContext): Promise<StartSchemaRefreshOutput>;
     IntegrationRefreshConnectorSchema(companyIntegrationID: string, universalPKConvention: string | undefined, deactivateAbsent: boolean | undefined, ctx: AppContext): Promise<RefreshConnectorSchemaOutput>;
     /**
      * Generates + persists strongly-typed Action metadata on demand for an
@@ -858,16 +1108,19 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      */
     private userCanReadCompanyIntegration;
     /**
-     * Authorizes the caller for a single run artifact based on the run's
-     * manifest CompanyIntegrationID. Returns true when the run is tenant-scoped
-     * and the caller is authorized for that CompanyIntegration. Returns false
-     * for tenant-scoped runs the caller may not read, OR for runs with no
-     * CompanyIntegrationID (non-tenant-scoped artifacts are not exposed through
-     * these per-company endpoints).
+     * Authorizes the caller for a single run artifact against EVERY connection the run touched.
+     *
+     * The rule itself — AND over the run's whole connection set, and why anything weaker leaks —
+     * lives in {@link AuthorizeRunArtifact}. This method supplies the per-connection check, which is
+     * the part that needs the caller's context and the data provider's row-level security.
      */
+    private authorizeRunArtifact;
+    /** Boolean form of {@link authorizeRunArtifact}, for the list path which needs no message. */
     private userCanReadRunArtifact;
     /** Standard authorization-failure message for run-artifact endpoints. */
     private notAuthorizedForCompanyIntegrationMessage;
+    /** The denial message for a run, naming the connection that blocked it when there is one. */
+    private notAuthorizedForRunMessage;
     /**
      * Loads the CompanyIntegration + its parent Integration, then resolves the
      * appropriate connector via ConnectorFactory.
@@ -916,8 +1169,46 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      *     `IsPrimaryKey=true`.
      *   - Foreign-key relationships are reconstructed from
      *     `RelatedIntegrationObjectID` lookups against the same cache.
+     *   - Under a per-connection catalog the FIELD rows come from `scopedFields`
+     *     (`LoadScopedFieldsForBuild`), never from the engine: a connection's field rows
+     *     are warmed on demand by the sync loop only, so the engine answers `[]` for them
+     *     during an apply and every object would build with no columns.
      */
     private buildSourceSchemaFromPersistedRows;
+    /**
+     * Brings the integration catalog caches to committed state, then re-configures the engine from it.
+     *
+     * Both halves are needed and the ORDER is the point. `mj sync push` writes IO/IOF rows through
+     * stored procedures, which fire no `BaseEntity` change events, so nothing invalidates the RunView
+     * cache and `Config(true)` re-queries straight back into the stale entries. The per-connection
+     * catalog entities are guarded individually because a workspace without that migration has not
+     * registered them, and a missing entity must not fail an apply.
+     *
+     * One method so the single apply and the batch apply cannot drift apart on it again.
+     */
+    private refreshIntegrationCatalogCaches;
+    /**
+     * The declared-but-inactive-row warnings for an apply, computed from the catalog rather than from
+     * whichever schema object the apply happens to be holding.
+     *
+     * Separate from {@link buildSourceSchemaFromPersistedRows} because the two are independent
+     * questions, and conflating them cost the batch path its warnings entirely: the batch builds its
+     * source schema once and hands it down as `prefetchedSourceSchema`, which skips the rebuild — and
+     * with it skipped the only place these warnings were ever collected. The warnings come from the
+     * IO/IOF rows' `Status`, which is knowable whenever the integration and the requested names are,
+     * so it never needed to ride along with a rebuild.
+     *
+     * `requestedNames` empty/undefined means "everything active", which deliberately does NOT report
+     * deactivated objects (a large catalog carries hundreds and announcing them on every apply is
+     * noise) — see ComputeInactiveRowWarnings.
+     *
+     * `scopedFields` is the connection's field rows when the apply runs under a per-connection catalog
+     * (`LoadScopedFieldsForBuild`). The FIELD half of the warnings reads through it for the same reason
+     * the rebuild does: the engine answers `[]` for a connection's fields during an apply, so reading
+     * them from the engine would silently drop every field warning. Without it the engine is read, as
+     * for the shared catalog.
+     */
+    private collectInactiveRowWarnings;
     private runSchemaRefreshPipeline;
     /** The body of {@link runSchemaRefreshPipeline}, run with the maintenance lock held. */
     private runSchemaRefreshPipelineLocked;
@@ -1031,9 +1322,28 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      */
     IntegrationPromoteCustomColumns(companyIntegrationID: string, entityNames: string[] | undefined, ctx: AppContext): Promise<PromoteCustomColumnsOutput>;
     /**
-     * Soft-deletes a CompanyIntegration by setting IsActive=false.
+     * Pauses a connection: IsActive=false, both scheduled jobs paused, and a stop requested for
+     * any sync already in flight.
+     *
+     * It used to be the first of those three only. The engine checks IsActive before a sync, so
+     * manual syncs did stop — but the CRON jobs kept firing (a sync schedule woke, was refused,
+     * and wrote a failed run, every tick, for as long as the connection stayed paused), the
+     * DISCOVERY schedule kept firing and was not refused at all (a paused connection went on
+     * rescanning the vendor on a timer, spending rate budget and rewriting the catalog the pause
+     * was meant to freeze), and an in-flight sync ran to completion.
+     *
+     * ORDER IS DELIBERATE. IsActive is written FIRST, because it is the flag every other actor
+     * reads: once it is false, nothing new can start, so a failure in any later step degrades the
+     * pause rather than voiding it. The schedules come next. The cancel is last and is
+     * best-effort by nature — a running sync belongs to whichever process owns it.
+     *
+     * WHAT PAUSE DOES NOT TOUCH: entity maps. Their Status is the user's own selection of which
+     * tables sync, and a pause that silently deselected tables would be undone wrong on resume.
+     *
+     * The reply distinguishes a stop that will happen from one that will not — see
+     * {@link DeactivateConnectionOutput}.
      */
-    IntegrationDeactivateConnection(companyIntegrationID: string, ctx: AppContext): Promise<MutationResultOutput>;
+    IntegrationDeactivateConnection(companyIntegrationID: string, ctx: AppContext): Promise<DeactivateConnectionOutput>;
     /**
      * Reactivates a previously deactivated CompanyIntegration by setting IsActive=true.
      *
@@ -1161,6 +1471,33 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      */
     IntegrationWriteRecord(companyIntegrationID: string, objectName: string, operation: string, externalID: string, attributesJson: string, ctx: AppContext): Promise<WriteRecordOutput>;
     IntegrationCreateSchedule(input: CreateScheduleInput, ctx: AppContext): Promise<CreateScheduleOutput>;
+    /**
+     * Every scheduled job that targets this connection, with its kind, for pause/resume.
+     *
+     * Deliberately ONE view over both driver classes rather than two calls: pause has to move
+     * the pair together, and a partial failure that pauses the sync job but leaves the discovery
+     * job running is the exact defect this whole change exists to remove.
+     *
+     * Uses the same structured `"CompanyIntegrationID":"<uuid>"` predicate as
+     * {@link findExistingScheduledJob} — a bare-UUID substring would false-match the same id
+     * appearing under a different config key and pause an unrelated connection's job.
+     */
+    private findScheduledJobsForConnection;
+    /**
+     * A refusal reason when this connection is paused, or null when it is not.
+     *
+     * everything.txt C6 makes deactivation mean "stop touching the source". Syncs already honoured
+     * that — the engine checks IsActive before RunSync — but DISCOVERY never did. A paused
+     * connection could still be re-scanned by hand or by a cron that outlived the pause, which
+     * spends the customer's rate budget and rewrites the very catalog the pause was meant to
+     * freeze. Pausing the schedules stops the timer; this stops everything else.
+     *
+     * Fails OPEN: a connection we cannot read is not declared paused. The gate exists to honour an
+     * explicit pause, not to become a new way for discovery to be unavailable.
+     */
+    private describeIfPaused;
+    /** Moves one scheduled job to a status. Returns false on any failure; the caller reports honestly. */
+    private setScheduledJobStatus;
     /**
      * U7 — server-side schedule uniqueness: finds an existing (non-deleted) scheduled job of the
      * given job type that targets the given CompanyIntegration (its Configuration JSON carries
@@ -1179,14 +1516,56 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
     IntegrationGetRSUProgress(ctx: AppContext): Promise<OperationProgressOutput>;
     IntegrationGetSyncProgress(companyIntegrationID: string, ctx: AppContext): Promise<OperationProgressOutput>;
     IntegrationGetStatus(companyIntegrationID: string, ctx: AppContext): Promise<IntegrationStatusOutput>;
-    IntegrationGetSyncHistory(companyIntegrationID: string, limit: number, ctx: AppContext): Promise<SyncHistoryOutput>;
+    /**
+     * Paged run history, newest first.
+     *
+     * plan.md: "history must show a paginated list with all runs (25 per page) in the history, it
+     * should not shwo just aprt of it". Both surfaces used to fake paging by re-fetching with a
+     * DOUBLED limit and slicing client-side, which cannot reach past the cap and re-transfers
+     * everything already shown.
+     *
+     * `offset` maps to RunView's StartRow. TotalKnown comes from a separate count so a pager can
+     * size itself without fetching every row.
+     */
+    /**
+     * Everything running for a connection, in one call.
+     *
+     * plan.md: "In the UI for the integration ... there shouldbe an area that shows thigns that are
+     * running actively, this can be syncs, rsu, discovery, etc." and "Let us say i clear browser
+     * cache and then i go to that integration page, i should see the same steps i mentioned
+     * hapepning there to". Every field here is derived SERVER-side, so a cleared browser sees the
+     * same thing — nothing depends on client state.
+     *
+     * Previously a surface had to fan out to four queries and stitch them, and each got the
+     * attribution wrong in its own way. The two rules that fan-out kept breaking are encoded here:
+     *
+     *  - RSU status from GetStatus is PROCESS-WIDE. It is only attributed to this connection when
+     *    an RSU run artifact actually names it; otherwise it is reported Scope='workspace'.
+     *  - A ConnectorCreation run is discovery, never a sync. Narrating it as a sync is what made a
+     *    first-time setup claim it was syncing records it had not fetched.
+     */
+    IntegrationGetActiveOperations(companyIntegrationID: string, ctx: AppContext): Promise<ActiveOperationsOutput>;
+    /**
+     * What the tenant can see about its own resource headroom.
+     *
+     * plan.md line 158: "what happens if we run out of storage when we sync, how do we alert the
+     * user, OOM (MJC should handle)". The tenant MEASURES - it is the process that fills the heap
+     * and the disk - and the control plane decides. Before this there was no measurement at all,
+     * so a sync that died of OOM or a full disk did so with no warning ahead of it and no
+     * explanation after.
+     *
+     * Deliberately not authorized per connection: this is a property of the workspace, not of any
+     * one connector, and the control plane polls it to decide admission.
+     */
+    IntegrationGetResourcePressure(_ctx: AppContext): Promise<ResourcePressureOutput>;
+    IntegrationGetSyncHistory(companyIntegrationID: string, limit: number, offset: number, ctx: AppContext): Promise<SyncHistoryOutput>;
     /**
      * Lists integration runs (sync, connector-creation, RSU, discovery, …) from the
      * durable progress-artifact store, newest-first. Use this to render run history
      * with live status for a multi-tenant control surface. Optionally scope to a
      * single connector and/or run kind, or to only in-flight runs.
      */
-    IntegrationListRuns(ctx: AppContext, companyIntegrationID?: string, runKind?: string, inFlightOnly?: boolean, limit?: number): Promise<IntegrationListRunsOutput>;
+    IntegrationListRuns(ctx: AppContext, companyIntegrationID?: string, runKind?: string, inFlightOnly?: boolean, limit?: number, offset?: number): Promise<IntegrationListRunsOutput>;
     /** Returns only the run snapshots the caller is authorized to read. */
     private filterAuthorizedRuns;
     /**
@@ -1205,6 +1584,13 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
     private toRunSummaryArtifact;
     /** Maps the reader's lowercase counts shape to the PascalCase GraphQL output. */
     private toCountsOutput;
+    /**
+     * Returns the settings the connector bound to a CompanyIntegration declares in its
+     * `SettingsSchema` — key, label, group, type, default, bounds and tier — so a client can
+     * render the connection's settings form without knowing the connector. A connector that
+     * declares none returns an empty list.
+     */
+    IntegrationGetConnectorSettingsSchema(companyIntegrationID: string, ctx: AppContext): Promise<ConnectorSettingsSchemaOutput>;
     /**
      * Returns the CRUD capability flags for the connector bound to a CompanyIntegration.
      * Use this to determine which operations (Create/Update/Delete/Search) are supported
@@ -1230,7 +1616,7 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      * applies ALTER TABLE migrations via the RSU pipeline.
      * Compares the current connector introspection against existing MJ entities.
      */
-    IntegrationSchemaEvolution(companyIntegrationID: string, platform: string, skipGitCommit: boolean, skipRestart: boolean, autoEnableNewObjects: boolean, autoEnableNewColumns: boolean, deactivateAbsent: boolean | undefined, cascadeRemoveDependents: boolean, ctx: AppContext): Promise<SchemaEvolutionOutput>;
+    IntegrationSchemaEvolution(companyIntegrationID: string, platform: string, skipGitCommit: boolean, skipRestart: boolean, autoEnableNewObjects: boolean, autoEnableNewColumns: boolean, deactivateAbsent: boolean | undefined, cascadeRemoveDependents: boolean, acceptCustomColumns: string[], ctx: AppContext): Promise<SchemaEvolutionOutput>;
     /**
      * Refresh diff (continuing objects): reconciles one entity map's field maps to the
      * post-resolution IOF set.
@@ -1248,6 +1634,10 @@ export declare class IntegrationDiscoveryResolver extends ResolverBase {
      * A field map whose source field is no longer Active in the resolution is DISABLED, never
      * deleted — a later re-appearance re-enables it through the same reconciliation (the
      * field-is-back branch above), so retiring and restoring a column are both non-destructive.
+     *
+     * Under a per-connection catalog the field rows come from `scopedFields`, never from the
+     * engine: the engine answers `[]` for a cold per-connection object, and an empty field list here
+     * disables every Active field map on the object.
      */
     private reconcileFieldMapsForEntityMap;
     private sendWebhook;