@jskit-ai/connectors-catalog 0.1.1

package/test/amazon-redshift.test.js

@@ -0,0 +1,272 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration, getProviderSettingsSchema } from "../../connectors-core/src/shared/configuration.js";
+import { connectorDefinitions } from "../src/shared/definitions.js";
+import { amazonRedshiftProvider as provider } from "../src/server/amazon-redshift.js";
+
+const context = { applicationId: "reports", subjectId: "owner" };
+const input = { context, integrationId: "warehouse" };
+const statementId = "12345678-1234-1234-1234-123456789abc";
+const columns = [{ name: "id", typeName: "int8" }];
+const table = { name: "sales", schema: "public", type: "TABLE" };
+
+async function fixture(t, deploymentType = "serverless", databaseUser) {
+  const directory = await mkdtemp(path.join(tmpdir(), "redshift-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(6) }, activeKeyId: "current" });
+  const requests = [], resolutions = [];
+  const target = { Database: "dev", ...(deploymentType === "serverless" ? { WorkgroupName: "analytics" } : { ClusterIdentifier: "analytics-cluster", DbUser: databaseUser || "IAM:reader" }) };
+  const state = { key: "AKIAEXAMPLEKEY1234567", secret: "not-live-redshift-secret", session: undefined, status: 200, response: undefined,
+    statement: { ...target, Id: statementId, Status: "FINISHED", HasResultSet: true },
+    started: { ...target, Id: statementId }, results: { ColumnMetadata: columns, Records: [[{ longValue: 7 }]], TotalNumRows: 1, NextToken: "opaque +/=" } };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { warehouse: {
+      provider: provider.id, displayName: "Warehouse", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:AWS_SECRET_ACCESS_KEY" },
+      settings: { deploymentType, region: "us-east-1", accessKeyIdRef: "env:AWS_ACCESS_KEY_ID", database: "dev",
+        ...(deploymentType === "serverless" ? { workgroup: "analytics" } : { clusterIdentifier: "analytics-cluster", ...(databaseUser ? { databaseUser } : {}) }) }
+    } }, extensions: { fromCli: true } },
+    providers: [provider], authorize: async (owner) => owner,
+    resolveReference: async (ref) => { resolutions.push(ref); return { "env:AWS_ACCESS_KEY_ID": state.key, "env:AWS_SECRET_ACCESS_KEY": state.secret, "env:AWS_SESSION_TOKEN": state.session }[ref]; },
+    store: createFileConnectionStore({ directory, protection }),
+    fetchImpl: async (address, init) => {
+      const headers = new Headers(init.headers), action = headers.get("x-amz-target").split(".").at(-1);
+      requests.push({ url: new URL(address), init, headers, action, body: JSON.parse(init.body) });
+      return Response.json(state.response ?? { ListTables: { Tables: [table] }, DescribeTable: { ColumnList: columns, TableName: "sales" },
+        ExecuteStatement: state.started, DescribeStatement: state.statement, GetStatementResult: state.results, CancelStatement: { Status: true } }[action], { status: state.status });
+    }
+  };
+  return { service: createConnectionService(options), options, requests, resolutions, state, target, directory, protection };
+}
+
+for (const [type, user] of [["serverless"], ["provisioned"], ["provisioned", "report_reader"]]) {
+  test(`Redshift ${type}${user ? " explicit DB user" : " IAM user"} signs a target-bound connection check and survives a file-store restart`, async (t) => {
+    const { service, options, requests, state, target, directory, protection } = await fixture(t, type, user);
+    const connected = await service.connectApiKey(input);
+    assert.equal(connected.status, "connected");
+    assert.deepEqual(requests.map((r) => r.action), ["ListTables"]);
+    const expected = { ...target }; if (!user) delete expected.DbUser;
+    assert.deepEqual(requests[0].body, { ...expected, MaxResults: 100 });
+    assert.equal(requests[0].url.origin, "https://redshift-data.us-east-1.amazonaws.com");
+    assert.match(requests[0].headers.get("authorization"), /AWS4-HMAC-SHA256 Credential=AKIAEXAMPLEKEY1234567\/\d{8}\/us-east-1\/redshift-data\/aws4_request/u);
+    assert.equal(requests[0].init.redirect, "error"); assert.equal(requests[0].init.credentials, "omit");
+    assert.equal(requests[0].headers.has("cookie"), false);
+    for (const name of await readdir(directory)) {
+      const file = await readFile(path.join(directory, name), "utf8");
+      assert.equal(file.includes(state.secret), false); assert.equal(file.includes(state.key), false);
+    }
+    const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+    assert.deepEqual(await restarted.status(input), connected);
+    state.key = "AKIAROTATEDKEY1234567";
+    await restarted.invoke({ ...input, operation: "tables.list" });
+    assert.ok(requests.at(-1).headers.get("authorization").includes(state.key));
+    await restarted.disconnect(input);
+    assert.equal((await service.status(input)).status, "disconnected");
+  });
+}
+
+test("Redshift CLI and form use the same conditional fields, defaults and credential references", async (t) => {
+  const { options, resolutions } = await fixture(t);
+  const parse = (config) => parseIntegrationConfiguration(JSON.stringify(config), { providers: connectorDefinitions });
+  assert.deepEqual(parse(options.configuration), options.configuration);
+  const defaults = structuredClone(options.configuration); delete defaults.integrations.warehouse.settings.deploymentType; delete defaults.integrations.warehouse.settings.region;
+  assert.equal(parse(defaults).integrations.warehouse.settings.deploymentType, "serverless");
+  assert.equal(parse(defaults).integrations.warehouse.settings.region, "us-east-1");
+  assert.equal(provider.settingsFields.find((f) => f.name === "region").items.length, 34);
+  const serverless = getProviderSettingsSchema(provider).getFieldDefinitions();
+  const provisioned = getProviderSettingsSchema(provider, { deploymentType: "provisioned" }).getFieldDefinitions();
+  assert.ok(serverless.workgroup.required); assert.equal(serverless.clusterIdentifier, undefined);
+  assert.ok(provisioned.clusterIdentifier.required); assert.equal(provisioned.workgroup, undefined); assert.equal(provisioned.databaseUser.required, false);
+  for (const change of [{ region: "https://other.example" }, { region: "cn-north-1" }, { deploymentType: "other" }, { deploymentType: "provisioned" },
+    { clusterIdentifier: "mixed-mode" }, { databaseUser: "wrong-mode" }, { workgroup: "arn:aws:example" }, { workgroup: "ab" }, { workgroup: undefined },
+    { database: "\n" }, { database: "é".repeat(64) }, { accessKeyIdRef: "raw-access-key" }, { sessionTokenRef: "raw-token" }]) {
+    const config = structuredClone(options.configuration); Object.assign(config.integrations.warehouse.settings, change);
+    assert.throws(() => parse(config), { code: "integration_configuration_invalid" });
+  }
+  const perUser = structuredClone(options.configuration); perUser.integrations.warehouse.accountMode = "per-user";
+  assert.throws(() => parse(perUser), { code: "integration_configuration_invalid" });
+  assert.equal(resolutions.length, 0);
+});
+
+test("Redshift metadata preserves filters, exact identifiers and opaque page tokens", async (t) => {
+  const { service, requests, state } = await fixture(t); await service.connectApiKey(input);
+  state.response = { Tables: [table], NextToken: " page +/= " };
+  const page = await service.invoke({ ...input, operation: "tables.list", input: { maxResults: 2, nextToken: " page +/= ", schemaPattern: "pub%", tablePattern: "sales_" } });
+  assert.equal(page.NextToken, " page +/= ");
+  assert.deepEqual(requests.at(-1).body, { Database: "dev", WorkgroupName: "analytics", MaxResults: 2, NextToken: " page +/= ", SchemaPattern: "pub%", TablePattern: "sales_" });
+  state.response = undefined;
+  await service.invoke({ ...input, operation: "table.describe", input: { table: " sales ", schema: " Mixed Case ", maxResults: 1 } });
+  assert.equal(requests.at(-1).body.Table, " sales "); assert.equal(requests.at(-1).body.Schema, " Mixed Case ");
+  for (const invalid of [{ maxResults: 1001 }, { maxResults: 0 }, { database: "other" }, { ConnectedDatabase: "other" }, { nextToken: "" }]) {
+    const count = requests.length;
+    await assert.rejects(service.invoke({ ...input, operation: "tables.list", input: invalid })); assert.equal(requests.length, count);
+  }
+});
+
+test("Redshift submits exact parameterized SQL with caller-owned idempotency and no automatic polling", async (t) => {
+  const { service, requests, state } = await fixture(t); await service.connectApiKey(input);
+  const values = { sql: " select :amount::bigint;\n", clientToken: "logical-request-1", parameters: [{ name: "amount", value: "9007199254740993" }] };
+  const started = await service.invoke({ ...input, operation: "query.start", input: values });
+  assert.equal(started.Id, statementId);
+  assert.deepEqual(requests.at(-1).body, { Database: "dev", WorkgroupName: "analytics", Sql: values.sql, ClientToken: values.clientToken, Parameters: values.parameters, ResultFormat: "JSON" });
+  assert.deepEqual(requests.map((r) => r.action), ["ListTables", "ExecuteStatement"]);
+  for (const change of [{ sql: " " }, { sql: "é".repeat(100001) }, { clientToken: undefined }, { clientToken: "a".repeat(65) },
+    { parameters: [] }, { parameters: Array.from({ length: 101 }, (_, i) => ({ name: `p${i}`, value: "1" })) },
+    { parameters: [{ name: "bad-name", value: "1" }] }, { parameters: [{ name: "amount", value: "" }] },
+    { parameters: [{ name: "amount", value: "1" }, { name: "amount", value: "2" }] }, { database: "other" }, { SecretArn: "arn:aws:secretsmanager:other" }]) {
+    const count = requests.length; await assert.rejects(service.invoke({ ...input, operation: "query.start", input: { ...values, ...change } })); assert.equal(requests.length, count);
+  }
+  state.started.Database = "other";
+  await assert.rejects(service.invoke({ ...input, operation: "query.start", input: values }), { code: "connector_access_denied" });
+});
+
+test("Redshift checks statement target and ID before returning status, results or cancelling", async (t) => {
+  const { service, requests, state } = await fixture(t); await service.connectApiKey(input);
+  for (const operation of ["query.status", "query.results", "query.cancel"]) {
+    for (const mismatch of [{ Database: "other" }, { WorkgroupName: "other" }, { ClusterIdentifier: "other" }]) {
+      const old = state.statement; state.statement = { ...old, ...mismatch }; const count = requests.length;
+      await assert.rejects(service.invoke({ ...input, operation, input: { statementId } }), { code: "connector_access_denied" });
+      assert.deepEqual(requests.slice(count).map((r) => r.action), ["DescribeStatement"]); state.statement = old;
+    }
+  }
+  state.statement.Id = "abcdefab-1234-1234-1234-123456789abc";
+  await assert.rejects(service.invoke({ ...input, operation: "query.status", input: { statementId } }), { code: "connector_response_invalid" });
+});
+
+test("Redshift provisioned statement access checks explicit database user", async (t) => {
+  const { service, state, requests } = await fixture(t, "provisioned", "report_reader"); await service.connectApiKey(input);
+  state.statement.DbUser = "admin";
+  await assert.rejects(service.invoke({ ...input, operation: "query.results", input: { statementId } }), { code: "connector_access_denied" });
+  assert.equal(requests.at(-1).action, "DescribeStatement");
+});
+
+test("Redshift returns one result page with typed cells, nulls, empty strings and exact cursors", async (t) => {
+  const { service, state, requests } = await fixture(t); await service.connectApiKey(input);
+  state.results = { ColumnMetadata: [{ name: "value", typeName: "varchar" }], Records: [[{ isNull: true }], [{ stringValue: "" }], [{ stringValue: "9007199254740993" }], [{ longValue: 7 }], [{ doubleValue: 1.5 }], [{ booleanValue: false }], [{ blobValue: "AQID" }]], TotalNumRows: 7, NextToken: " next +/= " };
+  const result = await service.invoke({ ...input, operation: "query.results", input: { statementId, nextToken: " previous +/= " } });
+  assert.equal(result.NextToken, " next +/= "); assert.deepEqual(result.Records[2], [{ stringValue: "9007199254740993" }]);
+  assert.deepEqual(result.Records[6], [{ blobValue: new Uint8Array([1, 2, 3]) }]);
+  assert.deepEqual(requests.slice(-2).map((r) => r.action), ["DescribeStatement", "GetStatementResult"]);
+  assert.deepEqual(requests.at(-1).body, { Id: statementId, NextToken: " previous +/= " });
+  state.results.Records = [[{ longValue: 9007199254740992 }]];
+  await assert.rejects(service.invoke({ ...input, operation: "query.results", input: { statementId } }), { code: "connector_response_invalid" });
+});
+
+test("Redshift exposes job states and requires a finished result set before fetching", async (t) => {
+  const { service, state, requests } = await fixture(t); await service.connectApiKey(input);
+  for (const status of ["SUBMITTED", "PICKED", "STARTED", "FINISHED", "ABORTED", "FAILED"]) {
+    state.statement.Status = status;
+    assert.equal((await service.invoke({ ...input, operation: "query.status", input: { statementId } })).Status, status);
+    if (status !== "FINISHED") {
+      const count = requests.length;
+      await assert.rejects(service.invoke({ ...input, operation: "query.results", input: { statementId } }), { code: "connector_result_unavailable" });
+      assert.equal(requests.length, count + 1);
+    }
+  }
+  state.statement.Status = "FINISHED"; state.statement.HasResultSet = false;
+  await assert.rejects(service.invoke({ ...input, operation: "query.results", input: { statementId } }), { code: "connector_result_unavailable" });
+  assert.deepEqual(await service.invoke({ ...input, operation: "query.cancel", input: { statementId } }), { Status: true });
+  assert.deepEqual(requests.slice(-2).map((r) => r.action), ["DescribeStatement", "CancelStatement"]);
+  const count = requests.length; await service.disconnect(input); assert.equal(requests.length, count);
+});
+
+test("Redshift fails on malformed metadata, job and result responses", async (t) => {
+  const { service, state } = await fixture(t); await service.connectApiKey(input);
+  for (const [operation, bad] of [["tables.list", {}], ["tables.list", { Tables: [{ name: "x" }] }], ["table.describe", { ColumnList: [{}], TableName: "x" }],
+    ["query.status", { Id: statementId }], ["query.start", { Id: "not-an-id" }]]) {
+    state.response = bad;
+    await assert.rejects(service.invoke({ ...input, operation, input: { ...(operation === "table.describe" ? { table: "sales" } : {}), ...(operation === "query.status" ? { statementId } : {}), ...(operation === "query.start" ? { sql: "select 1", clientToken: "request-1" } : {}) } }), { code: "connector_response_invalid" });
+  }
+});
+
+test("Redshift credential errors, throttling and missing resources are redacted and never retried", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  for (const [status, name, code] of [[400, "ExpiredTokenException", "connector_reconnect_required"], [403, "AccessDeniedException", "connector_permission_denied"],
+    [400, "ThrottlingException", "connector_rate_limited"], [400, "ActiveStatementsExceededException", "connector_rate_limited"],
+    [400, "ResourceNotFoundException", "connector_not_found"], [400, "ValidationException", "connector_configuration_invalid"], [500, "InternalServerException", "connector_provider_failed"]]) {
+    state.status = status; state.response = { __type: name, Message: state.secret }; const count = requests.length;
+    await assert.rejects(service.connectApiKey(input), (e) => { assert.equal(e.code, code); assert.equal(e.stack.includes(state.secret), false); return true; });
+    assert.equal(requests.length, count + 1);
+  }
+});
+
+test("Redshift supports explicit temporary AWS credentials, never host defaults", async (t) => {
+  const { service, options, state, requests } = await fixture(t);
+  state.key = undefined; await assert.rejects(service.connectApiKey(input), { code: "connector_binding_missing" });
+  state.key = "ASIAEXAMPLEKEY1234567"; await assert.rejects(service.connectApiKey(input), { code: "connector_binding_missing" });
+  assert.equal(requests.length, 0);
+  options.configuration.integrations.warehouse.settings.sessionTokenRef = "env:AWS_SESSION_TOKEN";
+  state.session = "temporary/+="; const temporary = createConnectionService(options); await temporary.connectApiKey(input);
+  assert.equal(requests[0].headers.get("x-amz-security-token"), state.session);
+});
+
+test("Redshift authorizes before secrets and binds connections to owners and warehouse settings", async (t) => {
+  const { service, options, requests, resolutions } = await fixture(t); await service.connectApiKey(input);
+  for (const owner of [{ ...context, subjectId: "other" }, { ...context, applicationId: "other" }]) {
+    await assert.rejects(service.invoke({ ...input, context: owner, operation: "tables.list" }), { code: "connector_reconnect_required" });
+  }
+  const configuration = structuredClone(options.configuration); configuration.integrations.warehouse.settings.workgroup = "other";
+  const changed = createConnectionService({ ...options, configuration }); assert.equal((await changed.status(input)).status, "reconnect-required");
+  await assert.rejects(changed.invoke({ ...input, operation: "tables.list" }), { code: "connector_reconnect_required" });
+  const count = resolutions.length;
+  const denied = createConnectionService({ ...options, authorize: async () => null });
+  await assert.rejects(denied.invoke({ ...input, operation: "query.start", input: { sql: "select 1", clientToken: "request-1" } }), { code: "connector_access_denied" });
+  assert.equal(resolutions.length, count); assert.equal(requests.length, 1);
+});
+
+test("Redshift local cancellation and timeout do not replay or silently cancel remote SQL", async (t) => {
+  const { options } = await fixture(t);
+  for (const [name, code] of [["AbortError", "connector_cancelled"], ["TimeoutError", "connector_provider_timeout"]]) {
+    const controller = new AbortController(), actions = [];
+    const interrupted = createConnectionService({ ...options, fetchImpl: async (address, init) => {
+      const action = new Headers(init.headers).get("x-amz-target").split(".").at(-1);
+      if (action !== "ExecuteStatement") return options.fetchImpl(address, init);
+      actions.push(action); controller.abort(new DOMException("Interrupted", name)); throw new Error("wrapped");
+    } });
+    await interrupted.connectApiKey(input);
+    await assert.rejects(interrupted.invoke({ ...input, operation: "query.start", input: { sql: "select 1", clientToken: "request-1" }, signal: controller.signal }), { code });
+    assert.deepEqual(actions, ["ExecuteStatement"]);
+    assert.equal((await interrupted.status(input)).status, "connected");
+  }
+});
+
+
+test("Redshift database/schema discovery preserves native names and paging in each configured target", async (t) => {
+  for (const [type, user] of [["serverless"], ["provisioned"], ["provisioned", "report_reader"]]) {
+    const { service, options, requests, state, target, resolutions } = await fixture(t, type, user);
+    await service.connectApiKey(input);
+    const expectedTarget = { ...target }; if (!user) delete expectedTarget.DbUser;
+    for (const [operation, action, field, filters] of [
+      ["databases.list", "ListDatabases", "Databases", {}],
+      ["schemas.list", "ListSchemas", "Schemas", { schemaPattern: "Mixed_%" }]
+    ]) {
+      state.response = { [field]: [" Mixed Case ", "資料"], NextToken: " next +/= " };
+      const result = await service.invoke({ ...input, operation, input: { maxResults: 2, nextToken: " previous +/= ", ...filters } });
+      assert.deepEqual(result, state.response);
+      assert.equal(requests.at(-1).action, action);
+      assert.deepEqual(requests.at(-1).body, { ...expectedTarget, MaxResults: 2, NextToken: " previous +/= ",
+        ...(filters.schemaPattern ? { SchemaPattern: filters.schemaPattern } : {}) });
+      state.response = { [field]: [], NextToken: "" };
+      assert.deepEqual(await service.invoke({ ...input, operation }), state.response);
+      for (const invalid of [{ maxResults: 1001 }, { maxResults: 0 }, { nextToken: "" },
+        { database: "other" }, { ConnectedDatabase: "other" }, { workgroup: "other" }]) {
+        const count = requests.length;
+        await assert.rejects(service.invoke({ ...input, operation, input: invalid }));
+        assert.equal(requests.length, count);
+      }
+      state.response = { [field]: "not-a-list" };
+      await assert.rejects(service.invoke({ ...input, operation }), { code: "connector_response_invalid" });
+      state.response = { [field]: [] };
+      const before = resolutions.length, calls = requests.length;
+      const denied = createConnectionService({ ...options, authorize: async () => false });
+      await assert.rejects(denied.invoke({ ...input, operation }));
+      assert.equal(resolutions.length, before); assert.equal(requests.length, calls);
+    }
+    assert.equal(requests.some((request) => request.action === "ExecuteStatement"), false);
+  }
+});

package/test/amplitude.test.js

@@ -0,0 +1,239 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { amplitudeProvider, registerAmplitudeClient } from "../src/server/amplitude.js";
+
+const context = { applicationId: "assistant-host", subjectId: "account-owner" };
+const input = { context, integrationId: "analytics" };
+const callback = "http://127.0.0.1:4919/amplitude/callback";
+const scopes = ["mcp:read", "offline_access"];
+const discovery = { tools: [{ name: "get_amplitude_context", inputSchema: { type: "object", properties: { project_id: { type: "string" } } } }] };
+
+async function fixture(t, region = "us") {
+  const directory = await mkdtemp(path.join(tmpdir(), "amplitude-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" });
+  const origin = region === "eu" ? "https://mcp.eu.amplitude.com" : "https://mcp.amplitude.com";
+  const state = { time: Date.now(), scopes, status: 200, list: discovery, call: { content: [{ type: "text", text: "Project analytics" }] } };
+  const requests = [];
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { amplitude: { source: "own", clientId: "fixture-client",
+      clientSecretRef: "env:AMPLITUDE_CLIENT_SECRET", callbackUrlRef: "env:AMPLITUDE_CALLBACK" } }, integrations: {
+      analytics: { provider: "amplitude", accountMode: "assistant", scopes, settings: { region },
+        authentication: { method: "oauth2", registrationRef: "amplitude" } }
+    } },
+    providers: [amplitudeProvider], store: createFileConnectionStore({ directory, protection }), now: () => state.time,
+    authorize: async (owner, request) => request.operation === "tools.call" &&
+      (request.input.name !== "get_amplitude_context" || request.input.arguments.project_id !== "allowed-project") ? null : owner,
+    resolveReference: async (reference) => reference === "env:AMPLITUDE_CLIENT_SECRET" ? "fixture-client-secret" : callback,
+    fetchImpl: async (address, init) => {
+      init.signal.throwIfAborted();
+      const url = String(address);
+      requests.push({ url, init, headers: new Headers(init.headers) });
+      if (url === `${origin}/token`) {
+        if (state.tokenError) return Response.json({ error: state.tokenError, error_description: "fixture-client-secret" }, { status: 400 });
+        const refresh = new URLSearchParams(init.body).get("grant_type") === "refresh_token";
+        return Response.json({ token_type: "Bearer", access_token: refresh ? "refreshed-access" : "initial-access",
+          refresh_token: refresh ? "rotated-refresh" : "initial-refresh", expires_in: 60, scope: state.scopes.join(" ") });
+      }
+      assert.equal(url, `${origin}/mcp`);
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      if (state.status !== 200) return new Response("initial-access fixture-client-secret", { status: state.status,
+        headers: { "WWW-Authenticate": 'Bearer resource_metadata="https://unexpected.invalid/auth"' } });
+      const message = JSON.parse(init.body);
+      requests.at(-1).message = message;
+      if (message.id === undefined) return new Response(null, { status: 202 });
+      const result = message.method === "initialize" ? { protocolVersion: message.params.protocolVersion,
+        capabilities: { tools: {} }, serverInfo: { name: "amplitude-fixture", version: "1" } }
+        : message.method === "tools/list" ? state.list : state.call;
+      if (state.pause && message.method === "tools/call") {
+        state.started();
+        return new Promise((resolve, reject) => init.signal.addEventListener("abort", () => reject(init.signal.reason), { once: true }));
+      }
+      return Response.json({ jsonrpc: "2.0", id: message.id, result }, { headers: { "Mcp-Session-Id": "amplitude-session" } });
+    }
+  };
+  const service = createConnectionService(options);
+  const complete = async (start, extra = "code=fixture-code") => service.completeAuthorization({ ...input,
+    callbackUrl: `${callback}?state=${new URL(start.authorizationUrl).searchParams.get("state")}&${extra}` });
+  return { service, options, state, requests, origin, directory, protection, complete };
+}
+
+for (const region of ["us", "eu"]) {
+  test(`Amplitude ${region} uses regional PKCE and resource-bound grants, verifies discovery and refreshes after file restart`, async (t) => {
+    const { service, options, requests, state, origin, complete, directory, protection } = await fixture(t, region);
+    const start = await service.beginAuthorization(input);
+    const url = new URL(start.authorizationUrl);
+    assert.equal(url.origin + url.pathname, `${origin}/authorize`);
+    assert.equal(url.searchParams.get("resource"), origin);
+    assert.equal(url.searchParams.get("scope"), scopes.join(" "));
+    assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+    assert.equal(requests.length, 0);
+    assert.equal((await complete(start)).status, "connected");
+    const grant = requests.find((request) => request.url === `${origin}/token`);
+    const body = new URLSearchParams(grant.init.body);
+    assert.equal(body.get("resource"), origin);
+    assert.equal(body.get("client_secret"), "fixture-client-secret");
+    assert.equal(body.get("redirect_uri"), callback);
+    assert(body.get("code_verifier"));
+    assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 0);
+    for (const request of requests.filter(({ url }) => url.endsWith("/mcp"))) {
+      assert.equal(request.headers.get("authorization"), "Bearer initial-access");
+      assert.equal(request.init.redirect, "error");
+      assert.equal(request.init.credentials, "omit");
+    }
+    const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+    state.time += 61_000;
+    assert.deepEqual(await restarted.invoke({ ...input, operation: "tools.list" }), discovery);
+    const refresh = new URLSearchParams(requests.findLast(({ url }) => url.endsWith("/token")).init.body);
+    assert.equal(refresh.get("resource"), origin);
+    assert.equal(refresh.get("refresh_token"), "initial-refresh");
+    assert.equal(requests.at(-1).headers.get("authorization"), "Bearer refreshed-access");
+    assert.equal(requests.at(-1).init.method, "DELETE");
+    for (const name of await readdir(directory)) {
+      const stored = await readFile(path.join(directory, name), "utf8");
+      for (const secret of ["initial-access", "refreshed-access", "initial-refresh", "rotated-refresh", "fixture-client-secret", body.get("code_verifier")]) assert(!stored.includes(secret));
+    }
+    const count = requests.length;
+    await assert.rejects(complete(start), { code: "connector_attempt_invalid" });
+    for (const owner of [{ ...context, applicationId: "another-host" }, { ...context, subjectId: "another-owner" }]) {
+      await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "tools.list" }), { code: "connector_reconnect_required" });
+    }
+    assert.equal(requests.length, count);
+    await restarted.disconnect(input);
+    assert.equal((await service.status(input)).status, "disconnected");
+    assert.equal(requests.length, count);
+  });
+}
+
+test("Amplitude configuration and changed regions cannot bypass account ownership or reuse a pending grant", async (t) => {
+  const { options, service, complete, requests } = await fixture(t);
+  const parse = (config) => parseIntegrationConfiguration(JSON.stringify(config), { providers: [amplitudeProvider] });
+  for (const [field, value] of [["accountMode", "shared"], ["accountMode", "per-user"], ["scopes", ["admin"]], ["settings", { region: "https://unexpected.invalid" }]]) {
+    const config = structuredClone(options.configuration);
+    config.integrations.analytics[field] = value;
+    assert.throws(() => parse(config));
+  }
+  const start = await service.beginAuthorization(input);
+  const config = structuredClone(options.configuration);
+  config.integrations.analytics.settings.region = "eu";
+  const changed = createConnectionService({ ...options, configuration: config });
+  await assert.rejects(changed.completeAuthorization({ ...input, callbackUrl: `${callback}?code=x&state=${new URL(start.authorizationUrl).searchParams.get("state")}` }), { code: "connector_attempt_invalid" });
+  assert.equal(requests.length, 0);
+  await complete(await service.beginAuthorization(input));
+  assert.equal((await changed.status(input)).status, "reconnect-required");
+  const count = requests.length;
+  await assert.rejects(changed.invoke({ ...input, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  assert.equal(requests.length, count);
+});
+
+test("Amplitude authorizes exact tools and arguments, preserves tool errors and cancels without replay", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await complete(await service.beginAuthorization(input));
+  const count = requests.length;
+  for (const payload of [{ name: "delete_chart", arguments: {} }, { name: "get_amplitude_context", arguments: { project_id: "another-project" } }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload }), { code: "connector_access_denied" });
+  }
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list", input: { url: "https://unexpected.invalid" } }), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  const payload = { name: "get_amplitude_context", arguments: { project_id: "allowed-project" } };
+  const analytics = { content: [{ type: "text", text: "Allowed project: checkout analytics and saved funnel reports" }] };
+  state.call = analytics;
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.call", input: payload }), analytics);
+  state.call = { content: [{ type: "text", text: "No matching project" }], isError: true };
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.call", input: payload }), state.call);
+  assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/call").message.params, payload);
+  state.pause = true;
+  const started = new Promise((resolve) => { state.started = resolve; });
+  const controller = new AbortController();
+  const pending = assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload, signal: controller.signal }), { code: "connector_cancelled" });
+  await started;
+  controller.abort();
+  await pending;
+  assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 3);
+  assert.equal(requests.at(-1).init.method, "DELETE");
+});
+
+test("Amplitude denied consent, missing read permission and malformed discovery never create a grant", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await assert.rejects(complete(await service.beginAuthorization(input), "error=access_denied"), { code: "connector_consent_denied" });
+  assert.equal(requests.length, 0);
+  state.scopes = ["mcp:write"];
+  await assert.rejects(complete(await service.beginAuthorization(input)), { code: "connector_scope_missing" });
+  assert.equal(requests.length, 1);
+  state.scopes = scopes;
+  state.list = { wrong: [] };
+  await assert.rejects(complete(await service.beginAuthorization(input)), { code: "connector_provider_failed" });
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("Amplitude HTTP and refresh failures are sanitized and do not follow authentication metadata", async (t) => {
+  const { service, complete, requests, state, origin } = await fixture(t);
+  for (const [status, code] of [[401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    await assert.rejects(complete(await service.beginAuthorization(input)), (error) => {
+      assert.equal(error.code, code);
+      assert(!error.message.includes("fixture-client-secret"));
+      assert.equal(error.cause, undefined);
+      return true;
+    });
+  }
+  assert(requests.every(({ url }) => url === `${origin}/mcp` || url === `${origin}/token`));
+  state.status = 200;
+  await complete(await service.beginAuthorization(input));
+  state.time += 61_000;
+  state.tokenError = "invalid_grant";
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Amplitude registration uses the SDK and exact regional endpoint with explicit confidential client metadata", async () => {
+  for (const region of ["us", "eu"]) {
+    const requests = [];
+    const result = await registerAmplitudeClient({ region, clientName: "My assistant", callbackUrl: callback, scopes }, {
+      fetchImpl: async (url, init) => {
+        requests.push({ url: String(url), init });
+        return Response.json({ ...JSON.parse(init.body), client_id: "created-client", client_secret: "created-secret", client_secret_expires_at: 0 });
+      }
+    });
+    assert.deepEqual(result, { clientId: "created-client", clientSecret: "created-secret", clientSecretExpiresAt: 0 });
+    assert.equal(requests.length, 1);
+    assert.equal(requests[0].url, region === "eu" ? "https://mcp.eu.amplitude.com/register" : "https://mcp.amplitude.com/register");
+    assert.equal(requests[0].init.redirect, "error");
+    assert.equal(requests[0].init.credentials, "omit");
+    assert.deepEqual(JSON.parse(requests[0].init.body), { client_name: "My assistant", redirect_uris: [callback], token_endpoint_auth_method: "client_secret_post",
+      grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], scope: scopes.join(" ") });
+  }
+});
+
+test("Amplitude registration rejects invalid input before HTTP and sanitizes ambiguous provider results without retry", async () => {
+  const valid = { clientName: "CLI client", callbackUrl: callback, scopes };
+  let requests = 0;
+  const options = { fetchImpl: async () => { requests++; throw new Error("secret-provider-response"); } };
+  for (const fields of [{ region: "other" }, { callbackUrl: "http://remote.example/callback" }, { callbackUrl: "https://user:secret@example.test/callback" },
+    { callbackUrl: "https://example.test/callback?other=1" }, { scopes: [] }, { scopes: ["mcp:write"] }, { scopes: ["mcp:read", "mcp:read"] }, { clientName: "" }]) {
+    await assert.rejects(registerAmplitudeClient({ ...valid, ...fields }, options));
+  }
+  assert.equal(requests, 0);
+  await assert.rejects(registerAmplitudeClient(valid, options), (error) => {
+    assert.equal(error.code, "connector_registration_failed");
+    assert.equal(error.cause, undefined);
+    assert(!error.message.includes("secret-provider-response"));
+    return true;
+  });
+  assert.equal(requests, 1);
+  for (const changes of [{ client_secret: undefined }, { token_endpoint_auth_method: "none" }, { redirect_uris: ["https://unexpected.invalid"] }]) {
+    await assert.rejects(registerAmplitudeClient(valid, { fetchImpl: async (url, init) => Response.json({ ...JSON.parse(init.body),
+      client_id: "client", client_secret: "secret", ...changes }) }), { code: "connector_registration_failed" });
+  }
+  const controller = new AbortController();
+  controller.abort();
+  await assert.rejects(registerAmplitudeClient(valid, { ...options, signal: controller.signal }), { code: "connector_registration_interrupted" });
+  assert.equal(requests, 1);
+});

package/test/apify.test.js

@@ -0,0 +1,93 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { apifyProvider } from "../src/server/apify.js";
+
+const context = { applicationId: "scraping-app", subjectId: "workspace" };
+test("Apify submits a bounded run, observes terminal states, aborts and retrieves paged storage results", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "apify-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  let runStatus = "RUNNING";
+  let fail = false;
+  let status = 200;
+  let deny = false;
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { scraper: {
+      provider: "apify", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:APIFY_TOKEN" }
+    } } }, providers: [apifyProvider], authorize: async owner => { if (deny) throw new Error("forbidden"); return owner; },
+    resolveReference: async () => "fixture-token",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({
+      keys: { current: new Uint8Array(32).fill(6) }, activeKeyId: "current"
+    }) }), fetchImpl: async (url, init) => {
+      requests.push({ url: new URL(url), init });
+      if (fail) throw new Error("unknown submission outcome");
+      if (status !== 200) return Response.json({ error: { type: "fixture" } }, { status });
+      const pathname = new URL(url).pathname;
+      if (pathname === "/v2/actors") return Response.json({ data: { items: [], offset: 0, total: 0 } });
+      if (pathname === "/v2/actors/owner~actor") return Response.json({ data: { id: "actor-id", name: "actor" } });
+      if (pathname.includes("/datasets/")) return Response.json([{ title: "Fixture result" }]);
+      if (pathname.endsWith("/binary")) return new Response(new Uint8Array([0, 255, 1]), { headers: { "content-type": "application/octet-stream" } });
+      if (pathname.endsWith("/oversized")) return new Response(new Uint8Array(8 * 1024 * 1024 + 1));
+      if (pathname.includes("/key-value-stores/")) return Response.json({ result: "Stored output" });
+      return Response.json({ data: { id: "run-fixture", status: runStatus,
+        defaultDatasetId: "dataset-fixture", defaultKeyValueStoreId: "store-fixture", statusMessage: runStatus } });
+    }
+  });
+  await service.connectApiKey({ context, integrationId: "scraper" });
+  const invoke = (operation, input) => service.invoke({ context, integrationId: "scraper", operation, input });
+  await invoke("actors.get", { actorId: "owner~actor" });
+  const start = { actorId: "owner~actor", input: { query: "example" }, timeout: 120, maxTotalChargeUsd: 1 };
+  const run = await invoke("runs.start", start);
+  assert.equal(run.data.status, "RUNNING");
+  assert.equal(requests.at(-1).url.pathname, "/v2/actors/owner~actor/runs");
+  assert.equal(requests.at(-1).url.searchParams.get("maxTotalChargeUsd"), "1");
+  assert.equal(requests.at(-1).url.searchParams.get("restartOnError"), "false");
+  assert.equal(requests.at(-1).url.searchParams.get("waitForFinish"), "0");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), start.input);
+  for (const state of ["SUCCEEDED", "FAILED", "TIMED-OUT"]) {
+    runStatus = state;
+    assert.equal((await invoke("runs.get", { runId: run.data.id })).data.status, state);
+  }
+  runStatus = "ABORTING";
+  assert.equal((await invoke("runs.abort", { runId: run.data.id })).data.status, "ABORTING");
+  assert.equal(requests.at(-1).init.method, "POST");
+  assert.equal(requests.at(-1).url.searchParams.get("gracefully"), "true");
+  runStatus = "ABORTED";
+  assert.equal((await invoke("runs.get", { runId: run.data.id })).data.status, "ABORTED");
+  const page = await invoke("datasets.items", { datasetId: run.data.defaultDatasetId, limit: 1 });
+  assert.equal(page[0].title, "Fixture result");
+  await invoke("datasets.items", { datasetId: run.data.defaultDatasetId, limit: 1, offset: 1 });
+  assert.equal(requests.at(-1).url.searchParams.get("offset"), "1");
+  const stored = await invoke("stores.record", { storeId: run.data.defaultKeyValueStoreId, key: "OUTPUT/report" });
+  assert.deepEqual(JSON.parse(Buffer.from(stored.bodyBase64, "base64").toString()), { result: "Stored output" });
+  assert.equal(stored.contentType, "application/json");
+  assert.ok(requests.at(-1).url.pathname.endsWith("/OUTPUT%2Freport"));
+  assert.equal(new Headers(requests.at(-1).init.headers).get("authorization"), "Bearer fixture-token");
+  const binary = await invoke("stores.record", { storeId: "store-fixture", key: "binary" });
+  assert.deepEqual([...Buffer.from(binary.bodyBase64, "base64")], [0, 255, 1]);
+  await assert.rejects(invoke("stores.record", { storeId: "store-fixture", key: "oversized" }), { code: "connector_response_too_large" });
+  const before = requests.length;
+  for (const invalid of [{ ...start, actorId: "../keys" }, { ...start, timeout: 0 },
+    { ...start, maxTotalChargeUsd: undefined }, { ...start, input: [] }]) await assert.rejects(invoke("runs.start", invalid));
+  deny = true;
+  await assert.rejects(invoke("runs.start", start));
+  deny = false;
+  await assert.rejects(service.invoke({ context: { ...context, applicationId: "other" }, integrationId: "scraper",
+    operation: "runs.start", input: start }));
+  assert.equal(requests.length, before);
+  for (const errorStatus of [403, 429]) {
+    status = errorStatus;
+    await assert.rejects(invoke("runs.start", start));
+  }
+  status = 200;
+  fail = true;
+  const beforeFailure = requests.length;
+  await assert.rejects(invoke("runs.start", start));
+  assert.equal(requests.length, beforeFailure + 1);
+});