@jskit-ai/connectors-catalog 0.1.1

package/test/ai.test.js

@@ -0,0 +1,136 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { readFile } from "node:fs/promises";
+import { aiCatalogue, aiDefinition, DEFAULT_AI_MODEL, getAiModel, listAiModels } from "../src/shared/ai.js";
+import { createAiConnectionResolver } from "../src/server/ai.js";
+import { createEnvironmentReferenceResolver } from "../../connectors-core/src/server/environmentReferences.js";
+import { parseIntegrationConfiguration, validateIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+
+const configuration = (patch = {}) => ({ schemaVersion: 1, registrations: {}, integrations: {
+  suggestions: { provider: "ai", accountMode: "shared", scopes: [], authentication: { method: "none" }, ...patch }
+} });
+const actor = { applicationId: "dogandgroom", subjectId: "customer-one" };
+const request = { context: actor, integrationId: "suggestions" };
+const authorize = async (context) => context?.applicationId === actor.applicationId ? context : null;
+const validate = (config) => validateIntegrationConfiguration(config, { providers: [aiDefinition] });
+
+test("AI preserves the upstream snapshot, exposes every provider and separates deprecated models", () => {
+  assert.equal(aiCatalogue.extractedAt, "2026-09-10");
+  assert.equal(aiCatalogue.providers.length, 213);
+  assert.equal(listAiModels({ includeDeprecated: true }).length, 7614);
+  assert.match(aiCatalogue.sourceSha256, /^[a-f0-9]{64}$/u);
+  assert.equal(getAiModel("opencode/grok-code").status, "deprecated");
+  assert.equal(listAiModels().some((model) => model.key === "opencode/grok-code"), false);
+  assert.equal(aiCatalogue.providers.find((provider) => provider.id === "amazon-bedrock").connection, "framework");
+});
+
+test("AI lists every active Zen public model first and uses Big Pickle as the explicit default", () => {
+  assert.equal(listAiModels()[0].key, DEFAULT_AI_MODEL);
+  assert.deepEqual(listAiModels({ access: "free-no-setup" }).map((model) => model.id).sort(), [
+    "big-pickle", "ling-3.0-flash-fin-free", "mimo-v2.5-free", "muse-spark-1.2-contributor-free",
+    "muse-spark-1.3-contributor-free", "nemotron-3-ultra-free", "nemotron-3.5-lightning-free"
+  ].sort());
+  assert.equal(getAiModel("zai/glm-4.7-flash").access, "free-with-connection");
+  assert.equal(getAiModel("zai/glm-4.7").access, "paid");
+  for (const model of listAiModels({ access: "free-no-setup" })) {
+    assert.equal(model.providerId, "opencode"); assert.equal(model.cost.input, 0); assert.equal(model.cost.output, 0);
+    assert.ok(Object.values(model.cost).every((value) => value === 0));
+  }
+});
+
+test("AI JSON defaults agree with the form and preserve explicit free model choices", () => {
+  const config = validate(configuration());
+  assert.deepEqual(config.integrations.suggestions.settings, { model: "opencode/big-pickle" });
+  assert.deepEqual(config.integrations.suggestions.authentication, { method: "none" });
+  config.integrations.suggestions.settings.model = "opencode/mimo-v2.5-free";
+  assert.deepEqual(parseIntegrationConfiguration(JSON.stringify(config), { providers: [aiDefinition] }), config);
+  assert.equal(JSON.stringify(config).includes("public"), false);
+});
+
+test("AI refuses missing models, deprecated models, coding subscriptions and unsupported cloud setup", () => {
+  for (const model of ["opencode/removed", "opencode/grok-code", "zai-coding-plan/glm-4.7", "amazon-bedrock/anthropic.claude-v2", "constructor"]) {
+    assert.throws(() => validate(configuration({ settings: { model } })), { code: "integration_configuration_invalid" });
+  }
+  for (const model of ["zai/glm-4.7-flash", "zai/glm-4.7", "openai/gpt-5.4"]) {
+    assert.throws(() => validate(configuration({ settings: { model } })), (error) => {
+      assert.ok(error.fieldErrors["integrations.suggestions.authentication.method"]); return true;
+    });
+  }
+  for (const authentication of [{ method: "none", secretRef: "env:KEY" }, { method: "api-key", secretRef: "raw-key" },
+    { method: "oauth2", registrationRef: "codex" }]) {
+    assert.throws(() => validate(configuration({ authentication })), { code: "integration_configuration_invalid" });
+  }
+});
+
+test("AI resolves no-account SDK parameters without environment, network or an OpenCode runtime", async (t) => {
+  t.mock.method(globalThis, "fetch", () => { throw new Error("Network is forbidden in this resolver."); });
+  const resolver = createAiConnectionResolver({ configuration: configuration(), authorize,
+    resolveReference: () => { throw new Error("Free mode must not resolve credentials."); } });
+  assert.deepEqual(await resolver.resolve(request), { providerId: "opencode", model: "big-pickle",
+    sdkPackage: "@ai-sdk/openai-compatible", baseURL: "https://opencode.ai/zen/v1", apiKey: "public", access: "free-no-setup" });
+  assert.equal(globalThis.fetch.mock.callCount(), 0);
+  assert.equal(Object.hasOwn(resolver, "invoke"), false);
+});
+
+test("AI preserves model-specific SDK protocols including Zen Responses models", async () => {
+  const resolver = createAiConnectionResolver({ configuration: configuration({ settings: { model: "opencode/muse-spark-1.3-contributor-free" } }), authorize });
+  const result = await resolver.resolve(request);
+  assert.equal(result.sdkPackage, "@ai-sdk/openai"); assert.equal(result.model, "muse-spark-1.3-contributor-free");
+  assert.equal(result.baseURL, "https://opencode.ai/zen/v1");
+});
+
+test("AI shares the administrator's Env key only after application authorization and observes rotation", async () => {
+  const env = { APP_AI_API_KEY: "fixture-key-one" }; const decisions = [];
+  const resolver = createAiConnectionResolver({ configuration: configuration({ settings: { model: "zai/glm-4.7-flash" },
+    authentication: { method: "api-key", secretRef: "env:APP_AI_API_KEY" } }),
+  authorize: async (context, operation) => { decisions.push(operation); return authorize(context); },
+  resolveReference: createEnvironmentReferenceResolver(env) });
+  assert.equal((await resolver.resolve(request)).apiKey, "fixture-key-one"); env.APP_AI_API_KEY = "fixture-key-two";
+  const connection = await resolver.resolve({ ...request, context: { ...actor, subjectId: "customer-two" } });
+  assert.equal(connection.apiKey, "fixture-key-two"); assert.equal(connection.baseURL, "https://api.z.ai/api/paas/v4");
+  assert.equal(connection.model, "glm-4.7-flash");
+  assert.deepEqual(decisions[0], { integrationId: "suggestions", operation: "ai.resolve", accountMode: "shared" });
+  delete env.APP_AI_API_KEY;
+  await assert.rejects(resolver.resolve(request), { code: "connector_binding_missing" });
+});
+
+test("AI keeps individual account resolution scoped to the authorized app user and provider", async () => {
+  const keys = new Map([["customer-one", "user-one-key"], ["customer-two", "user-two-key"]]);
+  const config = configuration({ accountMode: "per-user", settings: { model: "zai/glm-4.7-flash" },
+    authentication: { method: "api-key", secretRef: "account:ai-key" } });
+  const resolver = createAiConnectionResolver({ configuration: config, authorize, resolveReference: async (ref, owner, slot) => {
+    assert.equal(ref, "account:ai-key"); assert.equal(owner.applicationId, actor.applicationId);
+    assert.deepEqual(slot, { integrationId: "suggestions", accountMode: "per-user", providerId: "zai" });
+    return keys.get(owner.subjectId);
+  } });
+  assert.equal((await resolver.resolve(request)).apiKey, "user-one-key");
+  assert.equal((await resolver.resolve({ ...request, context: { ...actor, subjectId: "customer-two" } })).apiKey, "user-two-key");
+  keys.delete("customer-one");
+  await assert.rejects(resolver.resolve(request), { code: "connector_binding_missing" });
+  assert.equal((await resolver.resolve({ ...request, context: { ...actor, subjectId: "customer-two" } })).apiKey, "user-two-key");
+  config.integrations.suggestions.authentication.secretRef = "env:SHARED_KEY";
+  await assert.rejects(createAiConnectionResolver({ configuration: config, authorize }).resolve(request), { code: "connector_binding_invalid" });
+});
+
+test("AI denies unauthorized subjects before looking up credentials and redacts binding errors", async () => {
+  let lookups = 0;
+  const config = configuration({ settings: { model: "openai/gpt-5.4" }, authentication: { method: "api-key", secretRef: "env:KEY" } });
+  const resolver = createAiConnectionResolver({ configuration: config, authorize, resolveReference: () => {
+    lookups++; throw new Error("private-provider-token");
+  } });
+  for (const context of [null, {}, { ...actor, applicationId: "another-app" }]) {
+    await assert.rejects(resolver.resolve({ ...request, context }), { code: "connector_access_denied" });
+  }
+  assert.equal(lookups, 0);
+  await assert.rejects(resolver.resolve({ ...request, integrationId: "constructor" }), { code: "connector_not_found" });
+  await assert.rejects(resolver.resolve(request), (error) => error.code === "connector_binding_missing" && !String(error).includes("private-provider-token"));
+});
+
+test("AI can hand parameters to an app-owned SDK without making that SDK a dependency", async () => {
+  const result = await createAiConnectionResolver({ configuration: configuration(), authorize }).resolve(request);
+  // A controlled SDK factory fixture; no generated application or inference call.
+  const createProvider = (options) => ({ model: (id) => ({ endpoint: options.baseURL, id }) });
+  assert.deepEqual(createProvider(result).model(result.model), { endpoint: "https://opencode.ai/zen/v1", id: "big-pickle" });
+  const pkg = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));
+  assert.equal(Object.keys(pkg.dependencies).some((name) => name.startsWith("@ai-sdk/") || name.includes("opencode")), false);
+});

package/test/airtable.test.js

@@ -0,0 +1,125 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { airtableProvider } from "../src/server/airtable.js";
+
+const context = { applicationId: "records-app", subjectId: "workspace" };
+const baseId = "appFixture";
+const tableId = "tblFixture";
+const recordId = "recFixture";
+
+test("Airtable discovers schema, changes tables/fields and completes a paged record lifecycle", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "airtable-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  let fail = false;
+  let deny = false;
+  let status = 200;
+  let malformed = false;
+  let token = "fixture-token";
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { data: {
+      provider: "airtable", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:AIRTABLE_TOKEN" }
+    } } }, providers: [airtableProvider], authorize: async owner => {
+      if (deny) throw new Error("forbidden"); return owner;
+    }, resolveReference: async () => token,
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({
+      keys: { current: new Uint8Array(32).fill(9) }, activeKeyId: "current"
+    }) }), fetchImpl: async (url, init) => {
+      requests.push({ url: String(url), init });
+      if (fail) throw new Error("uncertain write");
+      if (status !== 200) return Response.json({ error: { type: "fixture" } }, { status });
+      if (malformed) return Response.json({});
+      const pathname = new URL(url).pathname;
+      if (pathname === "/v0/meta/bases") return Response.json(init.method === "POST" ? { id: baseId, tables: [{ id: tableId }] } : { bases: [{ id: baseId }] });
+      if (pathname.startsWith("/v0/meta/")) return Response.json(init.method === "GET" ?
+        { tables: [{ id: tableId, name: "Tasks", fields: [{ id: "fldName", type: "singleLineText", name: "Name" }] }] } :
+        { id: pathname.includes("/fields") ? "fldName" : tableId, name: "Tasks" });
+      if (pathname.endsWith("/listRecords")) return Response.json({ records: [{ id: recordId, fields: { Name: "Task" } }], offset: "opaque+/cursor" });
+      if (init.method === "DELETE") return Response.json({ id: recordId, deleted: true });
+      return Response.json({ id: recordId, fields: JSON.parse(init.body).fields });
+    }
+  });
+  const invoke = (operation, input) => service.invoke({ context, integrationId: "data", operation, input });
+  await service.connectApiKey({ context, integrationId: "data" });
+  assert.equal(requests.length, 1);
+  const newBase = await invoke("bases.create", { name: "Tasks", workspaceId: "wspFixture",
+    tables: [{ name: "Tasks", fields: [{ name: "Name", type: "singleLineText" }] }] });
+  assert.equal(newBase.id, baseId);
+  assert.equal(requests.at(-1).init.method, "POST");
+  assert.equal(JSON.parse(requests.at(-1).init.body).workspaceId, "wspFixture");
+  const tables = await invoke("tables.list", { baseId });
+  assert.equal(tables.tables[0].fields[0].type, "singleLineText");
+  await invoke("tables.create", { baseId, name: "Tasks", fields: [{ name: "Name", type: "singleLineText" }] });
+  assert.equal(requests.at(-1).init.method, "POST");
+  assert.equal(new URL(requests.at(-1).url).pathname, `/v0/meta/bases/${baseId}/tables`);
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body).fields, [{ name: "Name", type: "singleLineText" }]);
+  await invoke("tables.update", { baseId, tableId, name: "Renamed" });
+  assert.equal(requests.at(-1).init.method, "PATCH");
+  await invoke("fields.create", { baseId, tableId, field: { name: "Notes", type: "multilineText" } });
+  assert.equal(new URL(requests.at(-1).url).pathname, `/v0/meta/bases/${baseId}/tables/${tableId}/fields`);
+  await invoke("fields.update", { baseId, tableId, fieldId: "fldName", name: "Title" });
+  assert.equal(requests.at(-1).init.method, "PATCH");
+  const records = await invoke("records.list", { baseId, tableId, filterByFormula: '{Name}="a & b"' });
+  await invoke("records.list", { baseId, tableId, offset: records.offset });
+  assert.equal(JSON.parse(requests.at(-1).init.body).offset, "opaque+/cursor");
+  const created = await invoke("records.create", { baseId, tableId: "Tasks / urgent", fields: { Name: "Task", Done: false } });
+  assert.ok(requests.at(-1).url.endsWith("Tasks%20%2F%20urgent"));
+  assert.deepEqual(created.fields, { Name: "Task", Done: false });
+  assert.equal(JSON.parse(requests.at(-1).init.body).typecast, false);
+  await invoke("records.update", { baseId, tableId, recordId: created.id, fields: { Done: true } });
+  assert.equal(requests.at(-1).init.method, "PATCH");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body).fields, { Done: true });
+  await invoke("records.delete", { baseId, tableId, recordId });
+  assert.equal(requests.at(-1).init.method, "DELETE");
+  assert.equal(new Headers(requests.at(-1).init.headers).get("authorization"), "Bearer fixture-token");
+  const before = requests.length;
+  for (const input of [{ baseId: "../keys", tableId, fields: { Name: "bad" } },
+    { baseId, tableId: "..", fields: { Name: "bad" } }, { baseId, tableId, fields: {} },
+    { baseId, tableId, fields: [] }]) await assert.rejects(invoke("records.create", input));
+  await assert.rejects(invoke("records.list", { baseId, tableId, pageSize: 101 }));
+  await assert.rejects(invoke("bases.create", { name: "Empty", workspaceId: "wspFixture", tables: [] }));
+  await assert.rejects(invoke("tables.create", { baseId, name: "Duplicates", fields: [
+    { name: "Name", type: "singleLineText" }, { name: "name", type: "singleLineText" }
+  ] }));
+  deny = true;
+  await assert.rejects(invoke("records.delete", { baseId, tableId, recordId }));
+  deny = false;
+  await assert.rejects(service.invoke({ context: { ...context, applicationId: "other" }, integrationId: "data",
+    operation: "records.delete", input: { baseId, tableId, recordId } }));
+  assert.equal(requests.length, before);
+  for (const errorStatus of [403, 422, 429]) {
+    status = errorStatus;
+    await assert.rejects(invoke("records.create", { baseId, tableId, fields: { Name: "Task" } }));
+  }
+  status = 200;
+  fail = true;
+  const beforeFailure = requests.length;
+  await assert.rejects(invoke("records.create", { baseId, tableId, fields: { Name: "Task" } }));
+  assert.equal(requests.length, beforeFailure + 1);
+  fail = false;
+  malformed = true;
+  await assert.rejects(invoke("tables.list", { baseId }), { code: "connector_response_invalid" });
+  malformed = false;
+  token = "rotated-fixture-token";
+  await invoke("records.list", { baseId, tableId });
+  assert.equal(new Headers(requests.at(-1).init.headers).get("authorization"), "Bearer rotated-fixture-token");
+  status = 401;
+  await assert.rejects(invoke("records.list", { baseId, tableId }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status({ context, integrationId: "data" })).status, "reconnect-required");
+  status = 200;
+  await service.connectApiKey({ context, integrationId: "data" });
+  assert.equal((await service.status({ context, integrationId: "data" })).status, "connected");
+  await service.disconnect({ context, integrationId: "data" });
+  const afterDisconnect = requests.length;
+  assert.equal((await service.status({ context, integrationId: "data" })).status, "disconnected");
+  await assert.rejects(invoke("records.list", { baseId, tableId }));
+  assert.equal(requests.length, afterDisconnect);
+  await service.connectApiKey({ context, integrationId: "data" });
+  assert.equal((await service.status({ context, integrationId: "data" })).status, "connected");
+});

package/test/algolia.test.js

@@ -0,0 +1,207 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { algoliaProvider } from "../src/server/algolia.js";
+
+const context = { applicationId: "app-one", subjectId: "team-one" };
+const input = { context, integrationId: "search" };
+const indices = { items: [{ name: "products", entries: 20 }], nbPages: 2 };
+const hits = { hits: [{ objectID: "product-1", name: "Phone" }], nbHits: 21, nbPages: 2, page: 0, hitsPerPage: 20 };
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "algolia-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(7) }, activeKeyId: "current" });
+  const requests = [];
+  const references = [];
+  const state = { key: "backend-fixture-secret", status: 200, response: indices };
+  const options = {
+    configuration: { schemaVersion: 1, integrations: {
+      search: { provider: "algolia", accountMode: "shared", scopes: [],
+        authentication: { method: "api-key", secretRef: "env:ALGOLIA_BACKEND_KEY" },
+        settings: { applicationId: "APP123ABC", publicApiKeyRef: "env:ALGOLIA_PUBLIC_KEY" }, extensions: { keep: true } }
+    }, registrations: {}, extensions: { fromCli: true } },
+    providers: [algoliaProvider], authorize: async (owner) => owner,
+    resolveReference: async (ref) => {
+      references.push(ref);
+      assert.equal(ref, "env:ALGOLIA_BACKEND_KEY");
+      return state.key;
+    },
+    store: createFileConnectionStore({ directory, protection }),
+    fetchImpl: async (address, init) => {
+      requests.push({ url: new URL(String(address)), init, headers: new Headers(init.headers) });
+      if (state.networkFailure) throw new Error("connection lost after write");
+      return Response.json(state.response, { status: state.status });
+    }
+  };
+  return { service: createConnectionService(options), options, directory, protection, requests, references, state };
+}
+
+test("Algolia persists a file connection, uses application headers and rotates only the backend key", async (t) => {
+  const { service, options, directory, protection, requests, references, state } = await fixture(t);
+  const connected = await service.connectApiKey(input);
+  assert.equal(connected.status, "connected");
+  const first = requests[0];
+  assert.equal(first.url.href, "https://app123abc.algolia.net/1/indexes?page=0&hitsPerPage=100");
+  assert.equal(first.headers.get("x-algolia-application-id"), "APP123ABC");
+  assert.equal(first.headers.get("x-algolia-api-key"), state.key);
+  assert.equal(first.init.redirect, "error");
+  assert.equal(first.headers.has("authorization"), false);
+  for (const name of await readdir(directory)) {
+    assert.equal((await readFile(path.join(directory, name), "utf8")).includes(state.key), false);
+  }
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  assert.deepEqual(await restarted.status(input), connected);
+  state.key = "rotated-fixture-secret";
+  assert.equal((await restarted.status(input)).status, "reconnect-required");
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "indices.list", input: { page: 1, hitsPerPage: 25 } }), indices);
+  assert.equal(requests.at(-1).url.search, "?page=1&hitsPerPage=25");
+  assert.equal(requests.at(-1).headers.get("x-algolia-api-key"), state.key);
+  assert.equal((await restarted.status(input)).status, "connected");
+  assert.deepEqual(new Set(references), new Set(["env:ALGOLIA_BACKEND_KEY"]));
+  for (const owner of [{ ...context, applicationId: "other-app" }, { ...context, subjectId: "other-team" }]) {
+    await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "indices.list" }), { code: "connector_reconnect_required" });
+  }
+  await restarted.disconnect(input);
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("Algolia validates portable application settings and keeps optional key references separate", async (t) => {
+  const { options, requests } = await fixture(t);
+  const parse = (configuration) => parseIntegrationConfiguration(JSON.stringify(configuration), { providers: [algoliaProvider] });
+  assert.deepEqual(parse(options.configuration), options.configuration);
+  for (const applicationId of [undefined, "", "app.attacker.invalid", "app/path", "x@host", "a-b", "x\r\ny", "x".repeat(64)]) {
+    const config = structuredClone(options.configuration);
+    config.integrations.search.settings.applicationId = applicationId;
+    assert.throws(() => parse(config), (error) => Boolean(error.fieldErrors["integrations.search.settings.applicationId"]));
+  }
+  const config = structuredClone(options.configuration);
+  config.integrations.search.settings.applicationId = " APP123ABC ";
+  assert.equal(parse(config).integrations.search.settings.applicationId, "APP123ABC");
+  config.integrations.search.settings.applicationId = "APP123ABC";
+  config.integrations.search.settings.publicApiKeyRef = "frontend-value-is-not-a-reference";
+  assert.throws(() => parse(config), (error) => Boolean(error.fieldErrors["integrations.search.settings.publicApiKeyRef"]));
+  delete config.integrations.search.settings.publicApiKeyRef;
+  assert.deepEqual(parse(config), config);
+  assert.equal(requests.length, 0);
+});
+
+test("Algolia searches a named index with encoded paths, JSON parameters and response pagination", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey(input);
+  state.response = hits;
+  const result = await service.invoke({ ...input, operation: "index.search", input: { indexName: "products /?&", query: "phone + café", page: 1, hitsPerPage: 25 } });
+  assert.deepEqual(result, hits);
+  const request = requests.at(-1);
+  assert.equal(request.url.href, "https://app123abc.algolia.net/1/indexes/products%20%2F%3F%26/query");
+  assert.equal(request.init.method, "POST");
+  assert.match(request.headers.get("content-type"), /application\/json/u);
+  assert.deepEqual(JSON.parse(request.init.body), { query: "phone + café", page: 1, hitsPerPage: 25 });
+  await service.invoke({ ...input, operation: "index.search", input: { indexName: "products" } });
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { query: "", page: 0, hitsPerPage: 20 });
+  const count = requests.length;
+  for (const invalid of [
+    {}, { indexName: "" }, { indexName: "." }, { indexName: ".." }, { indexName: "x".repeat(256) },
+    { indexName: "products", query: "é".repeat(257) }, { indexName: "products", hitsPerPage: 1001 },
+    { indexName: "products", page: -1 }, { indexName: "products", apiKey: "caller-key" },
+    { indexName: "products", url: "https://attacker.invalid" }
+  ]) await assert.rejects(service.invoke({ ...input, operation: "index.search", input: invalid }), { code: "connector_input_invalid" });
+  for (const invalid of [{ page: -1 }, { hitsPerPage: 0 }, { hitsPerPage: 1001 }, { page: null }, { url: "https://attacker.invalid" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "indices.list", input: invalid }), { code: "connector_input_invalid" });
+  }
+  assert.equal(requests.length, count);
+  await service.invoke({ ...input, operation: "index.search", input: { indexName: "products", query: "é".repeat(256), hitsPerPage: 1000 } });
+});
+
+test("Algolia rejects cross-application destinations and requires verification after configuration changes", async (t) => {
+  const { service, options, requests } = await fixture(t);
+  await service.connectApiKey(input);
+  const wrongDestination = createConnectionService({ ...options, providers: [{ ...algoliaProvider, operations: {
+    ...algoliaProvider.operations, "indices.list": { scopes: [], request: () => ({ method: "GET", url: "https://differentapp.algolia.net/1/indexes" }) }
+  } }] });
+  await assert.rejects(wrongDestination.invoke({ ...input, operation: "indices.list" }), { code: "connector_destination_invalid" });
+  assert.equal(requests.length, 1);
+  const configuration = structuredClone(options.configuration);
+  configuration.integrations.search.settings.applicationId = "OTHERAPP";
+  const changed = createConnectionService({ ...options, configuration });
+  assert.equal((await changed.status(input)).status, "reconnect-required");
+  await assert.rejects(changed.invoke({ ...input, operation: "indices.list" }), { code: "connector_reconnect_required" });
+  assert.equal(requests.length, 1);
+  await changed.connectApiKey(input);
+  assert.equal(requests.at(-1).url.origin, "https://otherapp.algolia.net");
+  assert.equal(requests.at(-1).headers.get("x-algolia-application-id"), "OTHERAPP");
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Algolia failed verification and malformed responses never expose credentials or imply connection", async (t) => {
+  const { service, state } = await fixture(t);
+  for (const [status, code] of [[200, "connector_response_invalid"], [401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    state.response = { message: state.key };
+    await assert.rejects(service.connectApiKey(input), (error) => {
+      assert.equal(error.code, code);
+      assert.equal(JSON.stringify(error).includes(state.key), false);
+      assert.equal(error.message.includes(state.key), false);
+      return true;
+    });
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+  state.status = 200;
+  state.response = indices;
+  await service.connectApiKey(input);
+  for (const malformed of [{ items: [] }, { hits: [] }, { ...hits, page: "0" }]) {
+    state.response = malformed;
+    await assert.rejects(service.invoke({ ...input, operation: "index.search", input: { indexName: "products" } }), { code: "connector_response_invalid" });
+  }
+  state.status = 401;
+  await assert.rejects(service.invoke({ ...input, operation: "indices.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+
+test("Algolia indexes, partially updates and deletes records with explicit asynchronous completion", async t => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey(input);
+  state.response = { objectID: "product/1", taskID: 123, updatedAt: "2026-09-12T00:00:00Z" };
+  const record = { indexName: "products / live", objectID: "product/1", attributes: { name: "Phone", price: 10 } };
+  await service.invoke({ ...input, operation: "records.replace", input: record });
+  assert.equal(requests.at(-1).init.method, "PUT");
+  assert.equal(requests.at(-1).url.pathname, "/1/indexes/products%20%2F%20live/product%2F1");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), record.attributes);
+  await service.invoke({ ...input, operation: "records.update", input: { ...record, attributes: { price: 9 } } });
+  assert.equal(requests.at(-1).init.method, "POST");
+  assert.equal(requests.at(-1).url.searchParams.get("createIfNotExists"), "false");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { price: 9 });
+  const count = requests.length;
+  for (const invalid of [{ ...record, attributes: {} }, { ...record, objectID: ".." },
+    { ...record, attributes: { objectID: "other", price: 8 } }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "records.replace", input: invalid }));
+  }
+  assert.equal(requests.length, count);
+  for (const status of ["notPublished", "published"]) {
+    state.response = { status };
+    assert.deepEqual(await service.invoke({ ...input, operation: "tasks.get", input: { indexName: record.indexName, taskID: 123 } }), { status });
+  }
+  assert.equal(requests.at(-1).url.pathname, "/1/indexes/products%20%2F%20live/task/123");
+  state.response = { taskID: 124, deletedAt: "2026-09-12T00:00:00Z" };
+  await service.invoke({ ...input, operation: "records.delete", input: { indexName: record.indexName, objectID: record.objectID } });
+  assert.equal(requests.at(-1).init.method, "DELETE");
+  state.status = 403;
+  const beforeFailure = requests.length;
+  await assert.rejects(service.invoke({ ...input, operation: "records.replace", input: record }));
+  assert.equal(requests.length, beforeFailure + 1);
+  state.status = 200;
+  state.networkFailure = true;
+  const beforeUncertainWrite = requests.length;
+  await assert.rejects(service.invoke({ ...input, operation: "records.update", input: record }));
+  assert.equal(requests.length, beforeUncertainWrite + 1);
+  state.networkFailure = false;
+  state.response = { status: "unknown" };
+  await assert.rejects(service.invoke({ ...input, operation: "tasks.get", input: { indexName: record.indexName, taskID: 123 } }),
+    { code: "connector_response_invalid" });
+});