@jskit-ai/connectors-catalog 0.1.1

package/test/apollo-io.test.js

@@ -0,0 +1,125 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { apolloIoProvider } from "../src/server/apollo-io.js";
+
+test("Apollo prospects, explicit enrichment and CRM changes run through the application-owned connection", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "apollo-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { response: { accounts: [] }, status: 200, fail: false, deny: false, key: "fixture-apollo-key" };
+  const context = { applicationId: "sales-app", subjectId: "workspace" };
+  const service = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { sales: {
+      provider: "apollo-io", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:APOLLO_API_KEY" }
+    } } }, providers: [apolloIoProvider], authorize: async owner => { if (state.deny) throw new Error("forbidden"); return owner; },
+    resolveReference: async () => state.key,
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({
+      keys: { current: new Uint8Array(32).fill(8) }, activeKeyId: "current"
+    }) }), fetchImpl: async (url, init) => {
+      requests.push({ url: new URL(url), init });
+      if (state.fail) throw new Error("uncertain outcome");
+      return Response.json(state.response, { status: state.status });
+    }
+  });
+  const identity = { context, integrationId: "sales" };
+  const invoke = (operation, input) => service.invoke({ ...identity, operation, input });
+  await service.connectApiKey(identity);
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].url.pathname, "/api/v1/accounts/search");
+  state.response = { people: [{ id: "person-1", first_name: "Fixture" }], total_entries: 1 };
+  assert.equal((await invoke("people.search", { person_titles: ["Designer", "Founder"], page: 2 })).people[0].id, "person-1");
+  assert.deepEqual(requests.at(-1).url.searchParams.getAll("person_titles[]"), ["Designer", "Founder"]);
+  assert.equal(requests.at(-1).url.searchParams.get("page"), "2");
+  assert.equal(requests.at(-1).init.body, undefined);
+  const beforeCharge = requests.length;
+  for (const [operation, input] of [
+    ["organizations.search", { q_organization_name: "Fixture" }],
+    ["organizations.enrich", { domain: "fixture.example", allowCreditConsumption: false }],
+    ["people.enrich", { id: "person-1" }]
+  ]) await assert.rejects(invoke(operation, input));
+  assert.equal(requests.length, beforeCharge);
+  state.response = { organizations: [{ id: "org-1" }], pagination: { page: 1 } };
+  await invoke("organizations.search", { q_organization_name: "Fixture & Co", allowCreditConsumption: true });
+  assert.equal(requests.at(-1).url.pathname, "/api/v1/mixed_companies/search");
+  assert.equal(requests.at(-1).url.searchParams.get("q_organization_name"), "Fixture & Co");
+  assert.equal(requests.at(-1).url.searchParams.has("allowCreditConsumption"), false);
+  state.response = { person: { id: "person-1", email: "fixture@example.test" }, match_confidence: "high" };
+  await invoke("people.enrich", { id: "person-1", allowCreditConsumption: true });
+  for (const field of ["reveal_personal_emails", "reveal_phone_number", "run_waterfall_email", "run_waterfall_phone"])
+    assert.equal(requests.at(-1).url.searchParams.get(field), "false");
+  state.response = { person: null, match_confidence: "none" };
+  assert.equal((await invoke("people.enrich", { id: "missing", allowCreditConsumption: true })).person, null);
+  state.response = { organization: { id: "org-1", domain: "fixture.example" } };
+  await invoke("organizations.enrich", { domain: "fixture.example", allowCreditConsumption: true });
+  assert.equal(requests.at(-1).init.method, "GET");
+
+  for (const [operation, input, method, endpoint, response] of [
+    ["contacts.search", { q_keywords: "Fixture" }, "POST", "contacts/search", { contacts: [] }],
+    ["contacts.create", { first_name: "Fixture", email: "fixture@example.test", run_dedupe: false }, "POST", "contacts", { contact: { id: "contact-1" } }],
+    ["contacts.update", { id: "contact-1", title: "Founder", label_names: ["Customers"] }, "PATCH", "contacts/contact-1", { contact: { id: "contact-1" } }],
+    ["accounts.create", { name: "Fixture", domain: "fixture.example" }, "POST", "accounts", { account: { id: "account-1" } }],
+    ["accounts.update", { id: "account-1", phone: "+61 800 000 000" }, "PATCH", "accounts/account-1", { account: { id: "account-1" } }],
+    ["deals.create", { name: "Renewal", account_id: "account-1", amount: "1200.50", closed_date: "2026-12-31" }, "POST", "opportunities", { opportunity: { id: "deal-1" } }],
+    ["deals.update", { id: "deal-1", opportunity_stage_id: "stage-1" }, "PATCH", "opportunities/deal-1", { opportunity: { id: "deal-1" } }],
+    ["deals.list", { page: 2 }, "GET", "opportunities/search", { opportunities: [{ id: "deal-1" }] }],
+    ["dealStages.list", {}, "GET", "opportunity_stages", { opportunity_stages: [{ id: "stage-1" }] }],
+    ["users.list", { page: 2 }, "GET", "users/search", { users: [{ id: "user-1" }] }]
+  ]) {
+    state.response = response;
+    assert.deepEqual(await invoke(operation, input), response);
+    const request = requests.at(-1);
+    assert.equal(request.url.pathname, `/api/v1/${endpoint}`);
+    assert.equal(request.init.method, method);
+    assert.equal(new Headers(request.init.headers).get("x-api-key"), state.key);
+    assert.equal(request.init.redirect, "error");
+    if (method === "PATCH") { const { id, ...body } = input; assert.deepEqual(JSON.parse(request.init.body), body); }
+  }
+  state.response = { contact: { id: "existing-contact" } };
+  await invoke("contacts.create", { first_name: "Fixture", run_dedupe: true });
+  assert.equal(JSON.parse(requests.at(-1).init.body).run_dedupe, true);
+  const beforeInvalid = requests.length;
+  for (const [operation, input] of [
+    ["people.search", { person_titles: Array(101).fill("Designer") }],
+    ["contacts.create", { first_name: "Fixture" }], ["contacts.update", { id: "contact-1" }],
+    ["accounts.update", { id: "../secrets", name: "Fixture" }], ["accounts.create", {}],
+    ["deals.create", { name: "Renewal", amount: "$1,200" }],
+    ["deals.update", { id: "deal-1", closed_date: "2026-02-30" }],
+    ["organizations.enrich", { domain: "https://fixture.example", allowCreditConsumption: true }],
+    ["people.enrich", { id: "person-1", allowCreditConsumption: true, reveal_phone_number: true }]
+  ]) await assert.rejects(invoke(operation, input));
+  state.deny = true;
+  await assert.rejects(invoke("contacts.create", { first_name: "Fixture", run_dedupe: false }));
+  state.deny = false;
+  await assert.rejects(service.invoke({ ...identity, context: { ...context, applicationId: "other" }, operation: "people.search" }));
+  assert.equal(requests.length, beforeInvalid);
+  state.response = { person: {} };
+  await assert.rejects(invoke("people.enrich", { id: "person-1", allowCreditConsumption: true }), { code: "connector_response_invalid" });
+  state.response = { error: { message: state.key } };
+  for (const status of [403, 422, 429]) {
+    state.status = status;
+    await assert.rejects(invoke("people.search", {}), error => !JSON.stringify(error).includes(state.key));
+  }
+  state.status = 200;
+  state.fail = true;
+  const beforeUncertain = requests.length;
+  await assert.rejects(invoke("contacts.create", { first_name: "Fixture", run_dedupe: false }));
+  assert.equal(requests.length, beforeUncertain + 1);
+  state.fail = false;
+  state.response = { accounts: [] };
+  state.key = "rotated-key";
+  await invoke("accounts.search", {});
+  assert.equal(new Headers(requests.at(-1).init.headers).get("x-api-key"), "rotated-key");
+  state.status = 401;
+  await assert.rejects(invoke("accounts.search", {}), { code: "connector_reconnect_required" });
+  state.status = 200;
+  await service.connectApiKey(identity);
+  await service.disconnect(identity);
+  const disconnectedRequests = requests.length;
+  await assert.rejects(invoke("people.search", {}));
+  assert.equal(requests.length, disconnectedRequests);
+});

package/test/asana.test.js

@@ -0,0 +1,99 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { asanaProvider } from "../src/server/asana.js";
+
+test("Asana creates a private project, explicitly shares it, tracks tasks and preserves sparse changes", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "asana-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { status: 200, response: { data: [{ gid: "123" }] }, fail: false, deny: false, key: "asana-fixture" };
+  const identity = { context: { applicationId: "work-app", subjectId: "workspace" }, integrationId: "work" };
+  const service = createConnectionService({ configuration: { schemaVersion: 1, registrations: {}, integrations: {
+    work: { provider: "asana", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:ASANA_API_KEY" } }
+  } }, providers: [asanaProvider], authorize: async context => { if (state.deny) throw new Error("forbidden"); return context; },
+  resolveReference: async () => state.key,
+  store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(4) }, activeKeyId: "current" }) }),
+  fetchImpl: async (url, init) => { requests.push({ url: new URL(url), init });
+    if (state.fail) throw new Error("uncertain provider result");
+    return Response.json(state.response, { status: state.status }); }
+  });
+  const invoke = (operation, input) => service.invoke({ ...identity, operation, input });
+  await service.connectApiKey(identity);
+  assert.equal(requests[0].url.pathname, "/api/1.0/workspaces");
+  for (const [operation, input, endpoint] of [
+    ["projects.list", { workspace: "123", archived: false }, "projects"],
+    ["users.list", { workspace: "123" }, "workspaces/123/users"],
+    ["teams.list", { workspace: "123" }, "workspaces/123/teams"],
+    ["tasks.list", { project: "456", completed_since: "now" }, "projects/456/tasks"]
+  ]) {
+    state.response = { data: [{ gid: "456" }], next_page: { offset: "next & page", uri: "https://untrusted.invalid/page" } };
+    assert.deepEqual(await invoke(operation, input), state.response);
+    assert.equal(requests.at(-1).url.pathname, `/api/1.0/${endpoint}`);
+    await invoke(operation, { ...input, offset: "next & page" });
+    assert.equal(requests.at(-1).url.origin, "https://app.asana.com");
+    assert.equal(requests.at(-1).url.searchParams.get("offset"), "next & page");
+    if (operation === "tasks.list") assert.ok(requests.at(-1).url.searchParams.get("opt_fields").includes("completed"));
+  }
+  for (const [operation, input, method, endpoint, data] of [
+    ["projects.create", { name: "Launch", workspace: "123", privacy_setting: "private" }, "POST", "projects", { name: "Launch", workspace: "123", privacy_setting: "private" }],
+    ["projectMembers.add", { project: "456", member: "789", access_level: "editor" }, "POST", "memberships", { parent: "456", member: "789", access_level: "editor" }],
+    ["projects.update", { gid: "456", archived: false, notes: "" }, "PUT", "projects/456", { archived: false, notes: "" }],
+    ["tasks.create", { name: "Publish", workspace: "123", projects: ["456"], assignee: "789", due_on: "2026-12-31" }, "POST", "tasks", { name: "Publish", workspace: "123", projects: ["456"], assignee: "789", due_on: "2026-12-31" }],
+    ["tasks.update", { gid: "900", completed: true }, "PUT", "tasks/900", { completed: true }],
+    ["tasks.update", { gid: "900", completed: false, assignee: null, start_on: null, due_on: null }, "PUT", "tasks/900", { completed: false, assignee: null, start_on: null, due_on: null }]
+  ]) {
+    state.response = { data: { gid: "900", ...data } };
+    assert.deepEqual(await invoke(operation, input), state.response);
+    const request = requests.at(-1);
+    assert.equal(request.url.pathname, `/api/1.0/${endpoint}`);
+    assert.equal(request.init.method, method);
+    assert.deepEqual(JSON.parse(request.init.body), { data });
+    assert.equal(new Headers(request.init.headers).get("authorization"), "Bearer asana-fixture");
+    assert.equal(request.init.redirect, "error");
+  }
+  for (const operation of ["tasks.get", "projects.get"]) {
+    state.response = { data: { gid: "900", name: "Fixture" } };
+    assert.deepEqual(await invoke(operation, { gid: "900" }), state.response);
+  }
+  const beforeInvalid = requests.length;
+  for (const [operation, input] of [
+    ["projects.create", { name: "Launch", workspace: "123" }],
+    ["projects.update", { gid: "456" }], ["tasks.get", { gid: "../secrets" }],
+    ["tasks.update", { gid: "900", start_on: "2026-09-12" }],
+    ["tasks.update", { gid: "900", due_on: "2026-02-30" }],
+    ["projects.update", { gid: "456", start_on: "2026-12-31", due_on: "2026-12-31" }],
+    ["tasks.update", { gid: "900", projects: ["456"] }],
+    ["projectMembers.add", { project: "456", member: "789", access_level: "owner" }]
+  ]) await assert.rejects(invoke(operation, input));
+  state.deny = true;
+  await assert.rejects(invoke("tasks.update", { gid: "900", completed: true }));
+  state.deny = false;
+  await assert.rejects(service.invoke({ ...identity, context: { ...identity.context, applicationId: "other" }, operation: "workspaces.list" }));
+  assert.equal(requests.length, beforeInvalid);
+  state.response = { data: {} };
+  await assert.rejects(invoke("tasks.get", { gid: "900" }), { code: "connector_response_invalid" });
+  for (const status of [400, 403, 404, 429]) {
+    state.status = status; state.response = { errors: [{ message: state.key }] };
+    await assert.rejects(invoke("tasks.get", { gid: "900" }), e => !JSON.stringify(e).includes(state.key));
+  }
+  state.status = 200; state.fail = true;
+  const beforeUncertain = requests.length;
+  await assert.rejects(invoke("tasks.create", { name: "Publish", workspace: "123" }));
+  assert.equal(requests.length, beforeUncertain + 1);
+  state.fail = false; state.response = { data: [] }; state.key = "rotated-fixture";
+  await invoke("workspaces.list", {});
+  assert.equal(new Headers(requests.at(-1).init.headers).get("authorization"), "Bearer rotated-fixture");
+  state.status = 401;
+  await assert.rejects(invoke("workspaces.list", {}), { code: "connector_reconnect_required" });
+  state.status = 200;
+  await service.connectApiKey(identity);
+  await service.disconnect(identity);
+  const afterDisconnect = requests.length;
+  await assert.rejects(invoke("tasks.list", { project: "456" }));
+  assert.equal(requests.length, afterDisconnect);
+});

package/test/ashby.test.js

@@ -0,0 +1,97 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { ashbyProvider } from "../src/server/ashby.js";
+
+const id = "11111111-1111-4111-8111-111111111111";
+const stage = "22222222-2222-4222-8222-222222222222";
+test("Ashby syncs candidates/applications, updates a profile and explicitly advances a sourced application", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "ashby-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { status: 200, response: { success: true, results: [], moreDataAvailable: false }, fail: false, deny: false };
+  const identity = { context: { applicationId: "hiring-app", subjectId: "workspace" }, integrationId: "hiring" };
+  const service = createConnectionService({ configuration: { schemaVersion: 1, registrations: {}, integrations: {
+    hiring: { provider: "ashby", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:ASHBY_API_KEY" } }
+  } }, providers: [ashbyProvider], authorize: async context => { if (state.deny) throw new Error("forbidden"); return context; },
+  resolveReference: async () => "ashby-fixture-key",
+  store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" }) }),
+  fetchImpl: async (url, init) => { requests.push({ url: new URL(url), init });
+    if (state.fail) throw new Error("uncertain result");
+    return Response.json(state.response, { status: state.status }); }
+  });
+  const invoke = (operation, input) => service.invoke({ ...identity, operation, input });
+  await service.connectApiKey(identity);
+  assert.equal(requests[0].url.pathname, "/job.list");
+  for (const [operation, endpoint, input] of [
+    ["candidates.list", "candidate.list", {}],
+    ["applications.list", "application.list", { jobId: id, status: "Active" }],
+    ["interviewPlans.list", "interviewPlan.list", {}]
+  ]) {
+    state.response = { success: true, results: [{ id }], moreDataAvailable: true, nextCursor: "next & page" };
+    assert.deepEqual(await invoke(operation, { ...input, syncToken: "old-checkpoint" }), state.response);
+    assert.equal(requests.at(-1).url.pathname, `/${endpoint}`);
+    state.response = { success: true, results: [], moreDataAvailable: false, syncToken: "new-checkpoint" };
+    assert.equal((await invoke(operation, { ...input, syncToken: "old-checkpoint", cursor: "next & page" })).syncToken, "new-checkpoint");
+    const sent = JSON.parse(requests.at(-1).init.body);
+    assert.equal(sent.syncToken, "old-checkpoint");
+    assert.equal(sent.cursor, "next & page");
+  }
+  for (const [operation, input, endpoint, body] of [
+    ["jobs.get", { id }, "job.info", { id }],
+    ["candidates.get", { id }, "candidate.info", { id }],
+    ["candidates.create", { name: "Fixture Candidate", email: "candidate@example.test" }, "candidate.create", { name: "Fixture Candidate", email: "candidate@example.test" }],
+    ["candidates.update", { candidateId: id, phoneNumber: "+61 400 000 000" }, "candidate.update", { candidateId: id, phoneNumber: "+61 400 000 000", sendNotifications: false }],
+    ["applications.get", { applicationId: id }, "application.info", { applicationId: id }],
+    ["applications.create", { candidateId: id, jobId: id, interviewPlanId: stage }, "application.create", { candidateId: id, jobId: id, interviewPlanId: stage }],
+    ["applications.changeStage", { applicationId: id, interviewStageId: stage }, "application.changeStage", { applicationId: id, interviewStageId: stage }],
+    ["applications.changeStage", { applicationId: id, interviewStageId: stage, archiveReasonId: id }, "application.changeStage", { applicationId: id, interviewStageId: stage, archiveReasonId: id }]
+  ]) {
+    state.response = { success: true, results: { id, ...body } };
+    assert.deepEqual(await invoke(operation, input), state.response);
+    const request = requests.at(-1);
+    assert.equal(request.url.pathname, `/${endpoint}`);
+    assert.equal(request.init.method, "POST");
+    assert.deepEqual(JSON.parse(request.init.body), body);
+    assert.equal(new Headers(request.init.headers).get("authorization"), `Basic ${Buffer.from("ashby-fixture-key:").toString("base64")}`);
+    assert.equal(new Headers(request.init.headers).get("accept"), "application/json; version=1");
+    assert.equal(request.init.redirect, "error");
+  }
+  state.response = { success: true, results: [{ id: stage, type: "Interview", title: "Screen" }] };
+  assert.equal((await invoke("interviewStages.list", { interviewPlanId: id })).results[0].id, stage);
+  state.response = { success: true, results: [{ id: stage, text: "Position closed" }] };
+  await invoke("archiveReasons.list", {});
+  assert.equal(requests.at(-1).url.pathname, "/archiveReason.list");
+  assert.deepEqual(JSON.parse(requests.at(-1).init.body), { includeArchived: false });
+  const beforeInvalid = requests.length;
+  for (const [operation, input] of [
+    ["candidates.create", { name: "" }], ["candidates.update", { candidateId: id }],
+    ["applications.create", { candidateId: id, jobId: "wrong" }],
+    ["applications.changeStage", { applicationId: id }],
+    ["applications.changeStage", { applicationId: id, interviewStageId: stage, archiveEmail: {} }],
+    ["applications.list", { limit: 101 }], ["interviewStages.list", {}]
+  ]) await assert.rejects(invoke(operation, input));
+  state.deny = true;
+  await assert.rejects(invoke("applications.changeStage", { applicationId: id, interviewStageId: stage }));
+  state.deny = false;
+  await assert.rejects(service.invoke({ ...identity, context: { ...identity.context, applicationId: "other" }, operation: "jobs.list" }));
+  assert.equal(requests.length, beforeInvalid);
+  for (const response of [{ success: false, errors: [{ message: "ashby-fixture-key" }] }, { success: true, results: {} }]) {
+    state.response = response;
+    await assert.rejects(invoke("candidates.get", { id }), e => !JSON.stringify(e).includes("ashby-fixture-key"));
+  }
+  state.response = { success: true, results: [], moreDataAvailable: true };
+  await assert.rejects(invoke("candidates.list", {}), { code: "connector_response_invalid" });
+  for (const status of [403, 429]) {
+    state.status = status;
+    await assert.rejects(invoke("applications.list", {}));
+  }
+  state.status = 200; state.fail = true;
+  const beforeUncertain = requests.length;
+  await assert.rejects(invoke("candidates.create", { name: "Fixture Candidate" }));
+  assert.equal(requests.length, beforeUncertain + 1);
+});

package/test/atlassian.test.js

@@ -0,0 +1,249 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { atlassianProvider, registerAtlassianClient } from "../src/server/atlassian.js";
+
+const context = { applicationId: "assistant-host", subjectId: "account-owner" };
+const input = { context, integrationId: "work" };
+const callback = "http://127.0.0.1:4919/atlassian/callback";
+const resource = "https://mcp.atlassian.com/v2/mcp";
+const endpoint = `${resource}?tools=all`;
+const tokenEndpoint = "https://auth.atlassian.com/oauth/token";
+const registrationEndpoint = "https://auth.atlassian.com/VCeDsk8ZHncYF1g234fKtc4lNipbBhu3/dcr/register";
+const scopes = ["read:me", "read:jira:agent-interface", "offline_access"];
+const discovery = { tools: [{ name: "getJiraIssue", inputSchema: { type: "object", properties: { cloudId: { type: "string" } } } }] };
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "atlassian-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" });
+  const state = { time: Date.now(), scopes, status: 200, list: discovery, call: { content: [{ type: "text", text: "Project work" }] } };
+  const requests = [];
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { atlassian: { source: "own", clientId: "fixture-client",
+      clientSecretRef: "env:ATLASSIAN_CLIENT_SECRET", callbackUrlRef: "env:ATLASSIAN_CALLBACK" } }, integrations: {
+      work: { provider: "atlassian", accountMode: "assistant", scopes,
+        authentication: { method: "oauth2", registrationRef: "atlassian" } }
+    } },
+    providers: [atlassianProvider], store: createFileConnectionStore({ directory, protection }), now: () => state.time,
+    authorize: async (owner, request) => request.operation === "tools.call" &&
+      (!["getJiraIssue", "getConfluencePage"].includes(request.input.name) || request.input.arguments.cloudId !== "allowed-site") ? null : owner,
+    resolveReference: async (reference) => reference === "env:ATLASSIAN_CLIENT_SECRET" ? "fixture-client-secret" : callback,
+    fetchImpl: async (address, init) => {
+      init.signal.throwIfAborted();
+      const url = String(address);
+      requests.push({ url, init, headers: new Headers(init.headers) });
+      if (url === tokenEndpoint) {
+        if (state.tokenError) return Response.json({ error: state.tokenError, error_description: "fixture-client-secret" }, { status: 400 });
+        const refresh = new URLSearchParams(init.body).get("grant_type") === "refresh_token";
+        return Response.json({ token_type: "Bearer", access_token: refresh ? "refreshed-access" : "initial-access",
+          refresh_token: refresh ? "rotated-refresh" : "initial-refresh", expires_in: 60, scope: state.scopes.join(" ") });
+      }
+      assert.equal(url, endpoint);
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      if (state.status !== 200) return new Response("initial-access fixture-client-secret", { status: state.status,
+        headers: { "WWW-Authenticate": 'Bearer resource_metadata="https://unexpected.invalid/auth"' } });
+      const message = JSON.parse(init.body);
+      requests.at(-1).message = message;
+      if (message.id === undefined) return new Response(null, { status: 202 });
+      const result = message.method === "initialize" ? { protocolVersion: message.params.protocolVersion,
+        capabilities: { tools: {} }, serverInfo: { name: "atlassian-fixture", version: "1" } }
+        : message.method === "tools/list" ? state.list : state.call;
+      if (state.pause && message.method === "tools/call") {
+        state.started();
+        return new Promise((resolve, reject) => init.signal.addEventListener("abort", () => reject(init.signal.reason), { once: true }));
+      }
+      return Response.json({ jsonrpc: "2.0", id: message.id, result }, { headers: { "Mcp-Session-Id": "atlassian-session" } });
+    }
+  };
+  const service = createConnectionService(options);
+  const complete = async (start, extra = "code=fixture-code") => service.completeAuthorization({ ...input,
+    callbackUrl: `${callback}?state=${new URL(start.authorizationUrl).searchParams.get("state")}&${extra}` });
+  return { service, options, state, requests, directory, protection, complete };
+}
+
+
+test("Atlassian v2 binds PKCE and resource grants to its authorization server, then refreshes after file restart", async (t) => {
+  const { service, options, requests, state, complete, directory, protection } = await fixture(t);
+  const start = await service.beginAuthorization(input);
+  const url = new URL(start.authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://auth.atlassian.com/authorize");
+  assert.equal(url.searchParams.get("resource"), resource);
+  assert.equal(url.searchParams.get("scope"), scopes.join(" "));
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(requests.length, 0);
+  assert.equal((await complete(start)).status, "connected");
+  const grant = new URLSearchParams(requests.find(({ url }) => url === tokenEndpoint).init.body);
+  assert.equal(grant.get("resource"), resource);
+  assert.equal(grant.get("client_secret"), "fixture-client-secret");
+  assert.equal(grant.get("redirect_uri"), callback);
+  assert(grant.get("code_verifier"));
+  assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 0);
+  const initialized = requests.find(({ message }) => message?.method === "initialize");
+  assert.deepEqual(initialized.message.params.capabilities, {});
+  for (const request of requests.filter(({ url }) => url === endpoint)) {
+    assert.equal(request.headers.get("authorization"), "Bearer initial-access");
+    assert.equal(request.init.redirect, "error");
+    assert.equal(request.init.credentials, "omit");
+  }
+  const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+  state.time += 61_000;
+  assert.deepEqual(await restarted.invoke({ ...input, operation: "tools.list", input: { cursor: "next-page" } }), discovery);
+  assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/list").message.params, { cursor: "next-page" });
+  const refresh = new URLSearchParams(requests.findLast(({ url }) => url === tokenEndpoint).init.body);
+  assert.equal(refresh.get("resource"), resource);
+  assert.equal(refresh.get("refresh_token"), "initial-refresh");
+  assert.equal(requests.at(-1).headers.get("authorization"), "Bearer refreshed-access");
+  assert.equal(requests.at(-1).init.method, "DELETE");
+  for (const name of await readdir(directory)) {
+    const stored = await readFile(path.join(directory, name), "utf8");
+    for (const secret of ["initial-access", "refreshed-access", "initial-refresh", "rotated-refresh", "fixture-client-secret", grant.get("code_verifier")]) assert(!stored.includes(secret));
+  }
+  const count = requests.length;
+  await assert.rejects(complete(start), { code: "connector_attempt_invalid" });
+  for (const owner of [{ ...context, applicationId: "another-host" }, { ...context, subjectId: "another-owner" }]) {
+    await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  }
+  assert.equal(requests.length, count);
+  await restarted.disconnect(input);
+  assert.equal((await service.status(input)).status, "disconnected");
+  assert.equal(requests.length, count);
+});
+
+test("Atlassian validates assistant ownership and permissions, and cannot reuse attempts after scope edits", async (t) => {
+  const { options, service, requests } = await fixture(t);
+  const parse = (config) => parseIntegrationConfiguration(JSON.stringify(config), { providers: [atlassianProvider] });
+  for (const [field, value] of [["accountMode", "shared"], ["accountMode", "per-user"], ["scopes", ["admin"]], ["scopes", []]]) {
+    const config = structuredClone(options.configuration);
+    config.integrations.work[field] = value;
+    assert.throws(() => parse(config));
+  }
+  const config = structuredClone(options.configuration);
+  config.integrations.work.scopes = atlassianProvider.scopes.map(({ value }) => value);
+  assert.deepEqual(parse(config).integrations.work.scopes, config.integrations.work.scopes);
+  assert(atlassianProvider.scopes.filter(({ value }) => /^(write:|delete:|manage:)/.test(value)).every(({ recommended }) => !recommended));
+  const start = await service.beginAuthorization(input);
+  const changed = createConnectionService({ ...options, configuration: config });
+  await assert.rejects(changed.completeAuthorization({ ...input, callbackUrl: `${callback}?code=x&state=${new URL(start.authorizationUrl).searchParams.get("state")}` }), { code: "connector_attempt_invalid" });
+  assert.equal(requests.length, 0);
+});
+
+test("Atlassian authorizes the exact tool and destination site, preserves tool errors and cancels without replay", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await complete(await service.beginAuthorization(input));
+  const count = requests.length;
+  for (const payload of [{ name: "deleteJiraIssue", arguments: {} }, { name: "getJiraIssue", arguments: { cloudId: "another-site" } }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload }), { code: "connector_access_denied" });
+  }
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list", input: { url: "https://unexpected.invalid" } }), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  const payload = { name: "getJiraIssue", arguments: { cloudId: "allowed-site" } };
+  for (const [name, text] of [["getJiraIssue", "DOG-42: Grooming booking fails. Status: In Progress. Assignee: Sam."],
+    ["getConfluencePage", "Booking runbook: restart the worker, then verify the pending appointment queue."]]) {
+    state.call = { content: [{ type: "text", text }] };
+    const request = { name, arguments: { cloudId: "allowed-site" } };
+    assert.deepEqual(await service.invoke({ ...input, operation: "tools.call", input: request }), state.call);
+    assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/call").message.params, request);
+  }
+  state.call = { content: [{ type: "text", text: "This issue is not accessible" }], isError: true };
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.call", input: payload }), state.call);
+  assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/call").message.params, payload);
+  state.pause = true;
+  const started = new Promise((resolve) => { state.started = resolve; });
+  const controller = new AbortController();
+  const pending = assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload, signal: controller.signal }), { code: "connector_cancelled" });
+  await started;
+  controller.abort();
+  await pending;
+  assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 4);
+  assert.equal(requests.at(-1).init.method, "DELETE");
+});
+
+test("Atlassian declined consent and malformed discovery do not persist a connection", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await assert.rejects(complete(await service.beginAuthorization(input), "error=access_denied"), { code: "connector_consent_denied" });
+  assert.equal(requests.length, 0);
+  state.list = { wrong: [] };
+  await assert.rejects(complete(await service.beginAuthorization(input)), { code: "connector_provider_failed" });
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("Atlassian preserves the provider's reduced grant and permits empty discovery without claiming product access", async (t) => {
+  const { service, complete, state, requests } = await fixture(t);
+  state.scopes = ["read:me"];
+  state.list = { tools: [] };
+  const connected = await complete(await service.beginAuthorization(input));
+  assert.deepEqual(connected.grantedScopes, ["read:me"]);
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.list" }), { tools: [] });
+  assert(!requests.some(({ message }) => message?.method === "tools/call"));
+});
+
+test("Atlassian sanitizes HTTP/refresh failures, persists reconnect status and never follows injected auth metadata", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  for (const [status, code] of [[401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    await assert.rejects(complete(await service.beginAuthorization(input)), (error) => {
+      assert.equal(error.code, code);
+      assert(!error.message.includes("fixture-client-secret"));
+      assert.equal(error.cause, undefined);
+      return true;
+    });
+  }
+  assert(requests.every(({ url }) => url === endpoint || url === tokenEndpoint));
+  state.status = 200;
+  await complete(await service.beginAuthorization(input));
+  state.time += 61_000;
+  state.tokenError = "invalid_grant";
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Atlassian explicit registration uses its v2 issuer's DCR endpoint and preserves requested product permissions", async () => {
+  const requests = [];
+  const result = await registerAtlassianClient({ clientName: "My assistant", callbackUrl: callback, scopes }, {
+    fetchImpl: async (url, init) => {
+      requests.push({ url: String(url), init });
+      return Response.json({ ...JSON.parse(init.body), client_id: "created-client", client_secret: "created-secret", client_secret_expires_at: 0 });
+    }
+  });
+  assert.deepEqual(result, { clientId: "created-client", clientSecret: "created-secret", clientSecretExpiresAt: 0 });
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].url, registrationEndpoint);
+  assert.equal(requests[0].init.redirect, "error");
+  assert.equal(requests[0].init.credentials, "omit");
+  assert.deepEqual(JSON.parse(requests[0].init.body), { client_name: "My assistant", redirect_uris: [callback], token_endpoint_auth_method: "client_secret_post",
+    grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], scope: scopes.join(" ") });
+});
+
+test("Atlassian registration rejects invalid inputs and ambiguous responses without automatic replay", async () => {
+  const valid = { clientName: "CLI client", callbackUrl: callback, scopes };
+  let requests = 0;
+  const options = { fetchImpl: async () => { requests++; throw new Error("secret-provider-response"); } };
+  for (const fields of [{ callbackUrl: "http://remote.example/callback" }, { callbackUrl: "https://user:secret@example.test/callback" },
+    { callbackUrl: "https://example.test/callback?other=1" }, { scopes: [] }, { scopes: ["admin"] }, { scopes: ["read:me", "read:me"] }, { clientName: "" }]) {
+    await assert.rejects(registerAtlassianClient({ ...valid, ...fields }, options));
+    assert.equal(requests, 0, `Unexpected registration request for ${JSON.stringify(fields)}`);
+  }
+  assert.equal(requests, 0);
+  await assert.rejects(registerAtlassianClient(valid, options), (error) => {
+    assert.equal(error.code, "connector_registration_failed");
+    assert.equal(error.cause, undefined);
+    assert(!error.message.includes("secret-provider-response"));
+    return true;
+  });
+  assert.equal(requests, 1);
+  for (const changes of [{ client_secret: undefined }, { token_endpoint_auth_method: "none" }, { redirect_uris: ["https://unexpected.invalid"] }]) {
+    await assert.rejects(registerAtlassianClient(valid, { fetchImpl: async (url, init) => Response.json({ ...JSON.parse(init.body),
+      client_id: "client", client_secret: "secret", ...changes }) }), { code: "connector_registration_failed" });
+  }
+  const controller = new AbortController();
+  controller.abort();
+  await assert.rejects(registerAtlassianClient(valid, { ...options, signal: controller.signal }), { code: "connector_registration_interrupted" });
+  assert.equal(requests, 1);
+});