@jskit-ai/connectors-catalog 0.1.1

package/test/attention.test.js

@@ -0,0 +1,79 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { attentionProvider } from "../src/server/attention.js";
+
+test("Attention preserves full call content and supports explicit coaching and organization workflows", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "attention-repair-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { status: 200, response: { data: [] }, fail: false, deny: false };
+  const identity = { context: { applicationId: "coaching-app", subjectId: "workspace" }, integrationId: "calls" };
+  const service = createConnectionService({ configuration: { schemaVersion: 1, registrations: {}, integrations: {
+    calls: { provider: "attention", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:ATTENTION_API_KEY" } }
+  } }, providers: [attentionProvider], authorize: async context => { if (state.deny) throw new Error("forbidden"); return context; },
+    resolveReference: async () => "attention-fixture-key",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" }) }),
+    fetchImpl: async (url, init) => { requests.push({ url: new URL(url), init });
+      if (state.fail) throw new Error("uncertain result");
+      return state.response === null ? new Response(null, { status: state.status }) : Response.json(state.response, { status: state.status }); }
+  });
+  const invoke = (operation, input = {}) => service.invoke({ ...identity, operation, input });
+  await service.connectApiKey(identity);
+  const call = { type: "conversations", id: "call-1", attributes: { title: "Acme discovery", transcriptStatus: "completed",
+    transcript: { segments: [{ speaker: "Sam", start: 1.2, text: "We need appointment reminders." }] },
+    participants: [{ name: "Sam", email: "sam@example.test" }], scorecardResults: [{ title: "Discovery", summary: { averageScore: 85 } }] } };
+  state.response = call;
+  assert.deepEqual(await invoke("conversations.get", { id: "call-1" }), call);
+  assert.equal(requests.at(-1).url.searchParams.get("detailedTranscript"), "true");
+  for (const [operation, input, endpoint] of [
+    ["scorecards.list", { page: 2, size: 50 }, "scorecards"],
+    ["scorecardItems.list", { id: "score-1" }, "scorecards/score-1/items"],
+    ["users.list", { teamUUID: "team-1" }, "organizations/users"],
+    ["roles.list", {}, "organizations/roles"], ["teams.list", {}, "organizations/teams"]
+  ]) { state.response = { data: [{ uuid: "item-1", title: "Fixture" }], meta: { pageNumber: 2 } };
+    assert.deepEqual(await invoke(operation, input), state.response); assert.equal(requests.at(-1).url.pathname, `/v2/${endpoint}`); }
+  const scoring = { scorecard_uuid: "score-1", conversation_uuid: "call-1", summary: "Good discovery",
+    items: [{ scorecard_item_uuid: "criterion-1", numeric_result: 85, description: "Established needs" }] };
+  for (const [operation, method, endpoint, input, response] of [
+    ["conversations.update", "PUT", "conversations/call-1", { id: "call-1", title: "Reviewed call", labels: { reviewed: true } }, call],
+    ["conversations.archive", "DELETE", "conversations/call-1", { id: "call-1" }, { ...call, attributes: { ...call.attributes, archived: true } }],
+    ["conversations.import", "POST", "conversations/import", { userID: "user-1", mediaURL: "https://media.example.test/call.mp4", skipOpportunitiesExport: true }, { uuid: "import-1" }],
+    ["snippets.create", "POST", "snippets", { user_uuid: "user-1", conversation_id: "call-1", internal: true, notify_views: false, video: { start_time: 10, end_time: 20 } }, { id: "clip-1", url: "https://app.attention.tech/clip-1" }],
+    ["analysis.ask", "POST", "ask_attention/v2", { conversations_ids: ["call-1"], deal_id: "", prompt: "What matters?" }, [{ output: "Appointment reminders", error: "", conversation_id: "call-1" }]],
+    ["scorecards.get", "GET", "scorecards/score-1", { id: "score-1" }, { data: { id: "score-1", title: "Discovery" } }],
+    ["scorecardResults.create", "POST", "createScorecardResult", scoring, { success: true }],
+    ["scorecards.summary", "POST", "scorecards/summary", { scorecardUUID: "score-1", scorecardsItemsUUIDs: ["criterion-1"], teamUUIDs: [], userUUIDs: ["user-1"], fromDateTime: "2026-09-01T00:00:00Z", toDateTime: "2026-09-12T00:00:00Z" }, { data: [{ averageScore: 85 }] }],
+    ["users.create", "POST", "organizations/users", { email: "sam@example.test", first_name: "Sam", last_name: "Test", roleUUID: "role-1", teams: [{ uuid: "team-1", primary: true }], seat_type: "listener" }, { data: { uuid: "user-1" } }],
+    ["users.update", "PATCH", "organizations/users/user-1", { id: "user-1", firstName: "Samuel", teamUUIDsToRemove: ["old-team"], teamsToAdd: [{ uuid: "team-1", primary: true }] }, { data: { uuid: "user-1" } }],
+    ["users.delete", "DELETE", "organizations/users/user-1", { id: "user-1" }, null],
+    ["teams.create", "POST", "organizations/teams", { name: "Coaching", parentTeamUUID: "parent-1" }, { data: { uuid: "team-1" } }],
+    ["teams.update", "PATCH", "organizations/teams/team-1", { id: "team-1", name: "Sales coaching" }, { data: { uuid: "team-1" } }]
+  ]) { state.response = response; assert.deepEqual(await invoke(operation, input).catch(error => { error.message = `${operation}: ${error.message}`; throw error; }), response === null ? {} : response);
+    const request = requests.at(-1); assert.equal(request.url.pathname, `/v2/${endpoint}`); assert.equal(request.init.method, method);
+    if (!["GET", "DELETE"].includes(method)) { const { id, ...body } = input; assert.deepEqual(JSON.parse(request.init.body), body); }
+    assert.equal(new Headers(request.init.headers).get("authorization"), "Bearer attention-fixture-key"); assert.equal(request.init.redirect, "error");
+  }
+  const before = requests.length;
+  for (const [operation, input] of [
+    ["conversations.get", { id: "../../other" }], ["conversations.update", { id: "call-1" }],
+    ["conversations.import", { mediaURL: "http://localhost/file", userID: "user-1" }],
+    ["snippets.create", { user_uuid: "user-1", conversation_id: "call-1", internal: true, notify_views: false, video: { start_time: 20, end_time: 10 } }],
+    ["scorecardResults.create", { ...scoring, items: [{ description: "Missing criterion" }] }],
+    ["users.create", { email: "sam@example.test", first_name: "Sam", last_name: "Test", roleUUID: "role-1", teams: [] }],
+    ["teams.update", { id: "team-1" }]
+  ]) await assert.rejects(invoke(operation, input));
+  state.deny = true; await assert.rejects(invoke("users.delete", { id: "user-1" })); state.deny = false;
+  assert.equal(requests.length, before);
+  state.response = { wrong: true }; await assert.rejects(invoke("conversations.get", { id: "call-1" }), { code: "connector_response_invalid" });
+  state.response = { success: false }; await assert.rejects(invoke("scorecardResults.create", scoring), { code: "connector_response_invalid" });
+  state.response = [{ conversation_id: "call-1", output: "", error: "Transcript pending" }];
+  assert.equal((await invoke("analysis.ask", { conversations_ids: ["call-1"], deal_id: "", prompt: "Summarize" }))[0].error, "Transcript pending");
+  for (const status of [403, 429]) { state.status = status; await assert.rejects(invoke("teams.list")); }
+  state.status = 200; state.fail = true; const uncertain = requests.length;
+  await assert.rejects(invoke("scorecardResults.create", scoring)); assert.equal(requests.length, uncertain + 1);
+});

package/test/aws.test.js

@@ -0,0 +1,405 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { awsS3Provider } from "../src/server/aws-s3.js";
+import { awsAthenaProvider } from "../src/server/aws-athena.js";
+import { transferS3Object } from "../patterns/aws-storage-queries/example/s3-transfer.js";
+
+const context = { applicationId: "reports", subjectId: "owner" };
+const input = { context, integrationId: "aws" };
+const listXml = '<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/"><Name>app-files</Name><KeyCount>0</KeyCount><MaxKeys>100</MaxKeys><IsTruncated>false</IsTruncated></ListBucketResult>';
+const workgroup = { WorkGroup: { Name: "primary", State: "ENABLED", Configuration: { EnforceWorkGroupConfiguration: true } } };
+const query = { QueryExecution: { QueryExecutionId: "query-1", WorkGroup: "primary", Status: { State: "SUCCEEDED" } } };
+const results = { ResultSet: { ResultSetMetadata: { ColumnInfo: [{ Name: "id", Type: "bigint" }] }, Rows: [{ Data: [{ VarCharValue: "id" }] }, { Data: [{}] }] }, NextToken: "opaque +/=", UpdateCount: 0 };
+
+async function fixture(t, provider = awsS3Provider) {
+  const directory = await mkdtemp(path.join(tmpdir(), "aws-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(5) }, activeKeyId: "current" });
+  const requests = [], resolutions = [];
+  const state = { key: "AKIAEXAMPLEKEY1234567", secret: "example-secret-not-live/+=", session: undefined,
+    status: 200, xml: listXml, response: undefined };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { aws: {
+      provider: provider.id, displayName: "My AWS", accountMode: "shared", scopes: provider.id === "aws-s3" ? ["read", "write"] : [],
+      authentication: { method: "api-key", secretRef: "env:AWS_SECRET_ACCESS_KEY" },
+      settings: { region: "us-east-1", accessKeyIdRef: "env:AWS_ACCESS_KEY_ID", ...(provider.id === "aws-s3" ? { bucket: "app-files" } : { workgroup: "primary" }) }
+    } }, extensions: { fromCli: true } },
+    providers: [provider], authorize: async (owner) => owner,
+    resolveReference: async (ref) => {
+      resolutions.push(ref);
+      return { "env:AWS_ACCESS_KEY_ID": state.key, "env:AWS_SECRET_ACCESS_KEY": state.secret, "env:AWS_SESSION_TOKEN": state.session }[ref];
+    },
+    store: createFileConnectionStore({ directory, protection }),
+    fetchImpl: async (address, init) => {
+      const headers = new Headers(init.headers);
+      const target = headers.get("x-amz-target")?.split(".").at(-1);
+      requests.push({ url: new URL(address), init, headers, target, body: init.body && JSON.parse(init.body) });
+      if (provider.id === "aws-s3") return new Response(state.xml, { status: state.status, headers: { "content-type": "application/xml" } });
+      const response = state.response ?? { GetWorkGroup: workgroup, StartQueryExecution: { QueryExecutionId: "query-1" }, GetQueryExecution: query, GetQueryResults: results, StopQueryExecution: {} }[target];
+      return Response.json(response, { status: state.status });
+    }
+  };
+  return { service: createConnectionService(options), options, requests, resolutions, state, directory, protection };
+}
+
+for (const provider of [awsS3Provider, awsAthenaProvider]) {
+  test(`${provider.name} signs SDK requests with explicit credentials and persists only protected connection state`, async (t) => {
+    const { service, options, requests, state, directory, protection } = await fixture(t, provider);
+    const connected = await service.connectApiKey(input);
+    assert.equal(connected.status, "connected");
+    const { headers, url, init } = requests[0];
+    const serviceName = provider.id === "aws-s3" ? "s3" : "athena";
+    assert.equal(url.origin, `https://${serviceName}.us-east-1.amazonaws.com`);
+    assert.match(headers.get("authorization"), new RegExp(`AWS4-HMAC-SHA256 Credential=${state.key}/\\d{8}/us-east-1/${serviceName}/aws4_request`));
+    assert.equal(init.redirect, "error");
+    assert.equal(init.credentials, "omit");
+    assert.equal(headers.has("cookie"), false);
+    assert.equal(url.href.includes(state.secret), false);
+    for (const name of await readdir(directory)) {
+      const file = await readFile(path.join(directory, name), "utf8");
+      assert.equal(file.includes(state.secret), false);
+      assert.equal(file.includes(state.key), false);
+    }
+    const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+    assert.deepEqual(await restarted.status(input), connected);
+    state.key = "AKIAROTATEDKEY1234567";
+    state.secret = "rotated-secret";
+    await restarted.invoke({ ...input, operation: provider.checkOperation });
+    assert.ok(requests.at(-1).headers.get("authorization").includes(state.key));
+    assert.notEqual(requests.at(-1).headers.get("authorization"), headers.get("authorization"));
+    await restarted.disconnect(input);
+    assert.equal((await service.status(input)).status, "disconnected");
+  });
+
+  test(`${provider.name} rejects unknown regions, raw keys and invalid settings before resolving credentials`, async (t) => {
+    const { options, resolutions } = await fixture(t, provider);
+    const parse = (config) => parseIntegrationConfiguration(JSON.stringify(config), { providers: [provider] });
+    assert.deepEqual(parse(options.configuration), options.configuration);
+    for (const change of [{ region: "https://other.example" }, { region: "cn-north-1" }, { accessKeyIdRef: "AKIARAWKEY123456789" }, { sessionTokenRef: "raw-token" }, { sessionTokenRef: "https://key.example" },
+      ...(provider.id === "aws-s3" ? [{ bucket: "Bad_Bucket" }, { bucket: "192.168.0.1" }, { bucket: "name--x-s3" }, { bucket: "a..b" }] : [{ workgroup: "invalid/group" }, { resultLocation: "https://bucket.example" }, { resultLocation: "s3://results/a?key=secret" }])]) {
+      const configuration = structuredClone(options.configuration);
+      Object.assign(configuration.integrations.aws.settings, change);
+      assert.throws(() => parse(configuration), { code: "integration_configuration_invalid" });
+    }
+    const defaults = structuredClone(options.configuration);
+    delete defaults.integrations.aws.settings.region;
+    if (provider.id === "aws-athena") delete defaults.integrations.aws.settings.workgroup;
+    assert.equal(parse(defaults).integrations.aws.settings.region, "us-east-1");
+    if (provider.id === "aws-athena") assert.equal(parse(defaults).integrations.aws.settings.workgroup, "primary");
+    assert.equal(resolutions.length, 0);
+  });
+
+  test(`${provider.name} fails closed on missing credentials and signs temporary credentials without a host fallback`, async (t) => {
+    const { service, options, state, requests } = await fixture(t, provider);
+    for (const key of [undefined, "", "AKIA\nHEADER123456789", "ASIAEXAMPLEKEY1234567"]) {
+      state.key = key;
+      await assert.rejects(service.connectApiKey(input), { code: "connector_binding_missing" });
+    }
+    assert.equal(requests.length, 0);
+    options.configuration.integrations.aws.settings.sessionTokenRef = "env:AWS_SESSION_TOKEN";
+    const temporary = createConnectionService(options);
+    await assert.rejects(temporary.connectApiKey(input), { code: "connector_binding_missing" });
+    state.session = "session/+=value";
+    await temporary.connectApiKey(input);
+    assert.equal(requests[0].headers.get("x-amz-security-token"), state.session);
+    assert.ok(requests[0].headers.get("authorization").includes("x-amz-security-token"));
+    state.session = "rotated/session";
+    await temporary.invoke({ ...input, operation: provider.checkOperation });
+    assert.equal(requests[1].headers.get("x-amz-security-token"), state.session);
+  });
+
+  test(`${provider.name} isolates ownership, binds settings and authorizes before resolving secrets`, async (t) => {
+    const { service, options, requests, resolutions } = await fixture(t, provider);
+    await service.connectApiKey(input);
+    for (const owner of [{ ...context, subjectId: "other" }, { ...context, applicationId: "other" }]) {
+      await assert.rejects(service.invoke({ ...input, context: owner, operation: provider.checkOperation }), { code: "connector_reconnect_required" });
+    }
+    const configuration = structuredClone(options.configuration);
+    configuration.integrations.aws.settings.region = "ap-southeast-2";
+    const changed = createConnectionService({ ...options, configuration });
+    assert.equal((await changed.status(input)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...input, operation: provider.checkOperation }), { code: "connector_reconnect_required" });
+    const count = resolutions.length;
+    const denied = createConnectionService({ ...options, authorize: async () => null });
+    await assert.rejects(denied.invoke({ ...input, operation: provider.checkOperation }), { code: "connector_access_denied" });
+    assert.equal(requests.length, 1);
+    assert.equal(resolutions.length, count);
+  });
+
+  test(`${provider.name} maps AWS failures without disclosing response bodies or retrying`, async (t) => {
+    const { service, state, requests } = await fixture(t, provider);
+    for (const [status, name, code] of [[403, "AccessDeniedException", "connector_permission_denied"], [400, "TooManyRequestsException", "connector_rate_limited"], [400, "ExpiredTokenException", "connector_reconnect_required"], [301, "PermanentRedirect", "connector_configuration_invalid"], [404, "NoSuchBucket", "connector_not_found"], [500, "InternalError", "connector_provider_failed"]]) {
+      state.status = status;
+      state.xml = `<Error><Code>${name}</Code><Message>${state.secret}</Message></Error>`;
+      state.response = { __type: name, Message: state.secret };
+      const count = requests.length;
+      await assert.rejects(service.connectApiKey(input), (error) => {
+        assert.equal(error.code, code);
+        assert.equal(error.stack.includes(state.secret), false);
+        return true;
+      });
+      assert.equal(requests.length, count + 1);
+      assert.equal((await service.status(input)).status, "disconnected");
+    }
+  });
+
+  test(`${provider.name} cancels or times out a signed request without replay`, async (t) => {
+    const { options } = await fixture(t, provider);
+    for (const [failure, code] of [["AbortError", "connector_cancelled"], ["TimeoutError", "connector_provider_timeout"]]) {
+      const controller = new AbortController();
+      let calls = 0;
+      const interrupted = createConnectionService({ ...options, fetchImpl: async () => {
+        calls++;
+        controller.abort(new DOMException("Interrupted", failure));
+        throw new Error("Wrapped failure");
+      } });
+      await assert.rejects(interrupted.connectApiKey({ ...input, signal: controller.signal }), { code });
+      assert.equal(calls, 1);
+    }
+  });
+}
+
+test("S3 lists bounded, encoded pages and rejects malformed HTTP-200 responses", async (t) => {
+  const { service, state, requests } = await fixture(t);
+  await service.connectApiKey(input);
+  assert.equal(requests[0].url.pathname, "/app-files/");
+  assert.equal(requests[0].url.searchParams.get("list-type"), "2");
+  state.xml = listXml.replace("<IsTruncated>false</IsTruncated>", "<IsTruncated>true</IsTruncated><NextContinuationToken>opaque+/=</NextContinuationToken>");
+  const result = await service.invoke({ ...input, operation: "objects.list", input: { prefix: " photos/ ", delimiter: "/", maxKeys: 10, continuationToken: "opaque+/=" } });
+  assert.equal(result.NextContinuationToken, "opaque+/=");
+  assert.equal(result.Contents, undefined);
+  assert.equal(requests[1].url.searchParams.get("prefix"), " photos/ ");
+  assert.equal(requests[1].url.searchParams.get("continuation-token"), "opaque+/=");
+  state.xml = listXml.replace("<KeyCount>0</KeyCount>", "<KeyCount>1</KeyCount><EncodingType>url</EncodingType><Contents><Key>photo%20%2B%25.jpg</Key><Size>123</Size></Contents>");
+  const encoded = await service.invoke({ ...input, operation: "objects.list" });
+  assert.equal(encoded.EncodingType, "url");
+  assert.equal(encoded.Contents[0].Key, "photo%20%2B%25.jpg");
+  for (const xml of ["<ListBucketResult/>", listXml.replace("app-files", "other-bucket"), listXml.replace("false", "true"), listXml.replace("<KeyCount>0</KeyCount>", "<Contents><Key>a</Key></Contents>")]) {
+    state.xml = xml;
+    await assert.rejects(service.invoke({ ...input, operation: "objects.list" }), { code: "connector_response_invalid" });
+  }
+  for (const fields of [{ maxKeys: 1001 }, { maxKeys: 1.5 }, { delimiter: "x" }, { Bucket: "other" }, { endpoint: "https://other.example" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "objects.list", input: fields }), { code: "connector_input_invalid" });
+  }
+});
+
+test("S3 presigns GET and PUT for exact keys with bounded expiry, read/write policy and no network use", async (t) => {
+  const { service, options, state, requests } = await fixture(t);
+  await service.connectApiKey(input);
+  const key = " space/é +%name.txt ";
+  for (const [operation, method] of [["objects.downloadUrl", "GET"], ["objects.uploadUrl", "PUT"]]) {
+    const result = await service.invoke({ ...input, operation, input: { key, expiresInSeconds: 90 } });
+    const url = new URL(result.url);
+    assert.equal(result.method, method);
+    assert.equal(result.expiresInSeconds, 90);
+    assert.equal(url.origin, "https://s3.us-east-1.amazonaws.com");
+    assert.equal(decodeURIComponent(url.pathname), `/app-files/${key}`);
+    assert.equal(url.searchParams.get("X-Amz-Expires"), "90");
+    assert.ok(url.searchParams.get("X-Amz-Credential").startsWith(state.key + "/"));
+    assert.match(url.searchParams.get("X-Amz-Signature"), /^[a-f0-9]{64}$/u);
+    assert.equal(url.href.includes(state.secret), false);
+  }
+  for (const fields of [{ key: "../file" }, { key: "a/./file" }, { key: "é".repeat(513) }, { key: "a", expiresInSeconds: 901 }, { key: "a", expiresInSeconds: 0 }, { key: "a", Bucket: "other" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "objects.uploadUrl", input: fields }), { code: "connector_input_invalid" });
+  }
+  const configuration = structuredClone(options.configuration);
+  configuration.integrations.aws.scopes = ["read"];
+  const reader = createConnectionService({ ...options, configuration });
+  await reader.connectApiKey(input);
+  await assert.rejects(reader.invoke({ ...input, operation: "objects.uploadUrl", input: { key: "file" } }), { code: "connector_scope_missing" });
+  assert.equal(requests.length, 2, "Only connection checks contact S3; URL construction is not upload/download proof.");
+});
+
+test("S3 application composition transfers exact binary bytes through signed GET and PUT", async (t) => {
+  const { service } = await fixture(t);
+  await service.connectApiKey(input);
+  const bytes = new Uint8Array([0, 255, 80, 65, 82, 49, 13, 10, 128]);
+  const signal = AbortSignal.timeout(5000);
+  const transfers = [];
+  const fetchImpl = async (address, init) => {
+    const url = new URL(address);
+    assert.equal(url.origin, "https://s3.us-east-1.amazonaws.com");
+    assert.equal(decodeURIComponent(url.pathname), "/app-files/data/é +%.parquet");
+    assert.match(url.searchParams.get("X-Amz-Signature"), /^[a-f0-9]{64}$/u);
+    assert.equal(init.credentials, "omit");
+    assert.equal(init.redirect, "error");
+    assert.equal(init.signal, signal);
+    assert.equal(new Headers(init.headers).has("authorization"), false);
+    transfers.push(init.method);
+    if (init.method === "PUT") {
+      assert.deepEqual(new Uint8Array(await new Response(init.body).arrayBuffer()), bytes);
+      return new Response(null, { status: 200, headers: { etag: '"object-version"' } });
+    }
+    return new Response(new ReadableStream({ start(controller) {
+      controller.enqueue(bytes.slice(0, 3)); controller.enqueue(bytes.slice(3)); controller.close();
+    } }));
+  };
+  const args = { service, ...input, key: "data/é +%.parquet", signal, fetchImpl };
+  const uploaded = await transferS3Object({ ...args, direction: "upload", body: bytes });
+  assert.equal(uploaded.headers.get("etag"), '"object-version"');
+  const downloaded = await transferS3Object({ ...args, direction: "download" });
+  assert.deepEqual(new Uint8Array(await downloaded.arrayBuffer()), bytes);
+  assert.deepEqual(transfers, ["PUT", "GET"]);
+});
+
+test("S3 transfer composition preserves denial, HTTP failures and uncertain writes without replay", async (t) => {
+  const { service, options } = await fixture(t);
+  await service.connectApiKey(input);
+  let calls = 0;
+  const args = { service, ...input, key: "data.bin", signal: AbortSignal.timeout(5000), direction: "upload", body: new Uint8Array([1]) };
+  await assert.rejects(transferS3Object({ ...args, fetchImpl: async () => {
+    calls++; throw new Error("network failure containing secret signed URL");
+  } }), (error) => {
+    assert.match(error.message, /completion is unknown/);
+    assert.equal(error.stack.includes("secret signed URL"), false);
+    assert.equal(error.cause, undefined);
+    return true;
+  });
+  assert.equal(calls, 1);
+  for (const status of [403, 404, 500]) {
+    await assert.rejects(transferS3Object({ ...args, fetchImpl: async () => {
+      calls++; return new Response("private provider error", { status });
+    } }), new RegExp(`HTTP ${status}`));
+  }
+  assert.equal(calls, 4);
+  const denied = createConnectionService({ ...options, authorize: async () => null });
+  await assert.rejects(transferS3Object({ ...args, service: denied, fetchImpl: async () => { calls++; } }), { code: "connector_access_denied" });
+  await assert.rejects(transferS3Object({ ...args, signal: AbortSignal.abort(), fetchImpl: async () => { calls++; } }), { name: "AbortError" });
+  assert.equal(calls, 4);
+  const partial = await transferS3Object({ ...args, direction: "download", fetchImpl: async () => new Response(
+    new ReadableStream({ start(controller) { controller.enqueue(new Uint8Array([1])); controller.error(new Error("truncated body")); } })
+  ) });
+  await assert.rejects(partial.arrayBuffer(), /truncated body/);
+});
+
+test("S3 local permissions never masquerade as an IAM grant and cannot bypass connection verification", async (t) => {
+  const { options, requests, resolutions, state } = await fixture(t);
+  options.configuration.integrations.aws.scopes = ["write"];
+  assert.throws(() => createConnectionService(options), (error) => {
+    assert.equal(error.fieldErrors["integrations.aws.scopes"], "Include this provider's required permissions.");
+    return true;
+  });
+  assert.equal(resolutions.length, 0);
+  options.configuration.integrations.aws.scopes = ["read"];
+  const service = createConnectionService(options);
+  assert.deepEqual((await service.connectApiKey(input)).grantedScopes, []);
+  state.status = 403;
+  state.xml = "<Error><Code>ExpiredToken</Code><Message>Expired session</Message></Error>";
+  await assert.rejects(service.invoke({ ...input, operation: "objects.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+  assert.equal(requests.length, 2);
+  state.status = 200;
+  state.xml = listXml;
+  state.key = "AKIARENEWEDKEY1234567";
+  state.secret = "renewed-secret";
+  assert.equal((await service.connectApiKey(input)).status, "connected");
+  assert.match(requests.at(-1).headers.get("authorization"), /AKIARENEWEDKEY1234567/);
+  assert.deepEqual(await service.disconnect(input), { status: "disconnected" });
+  assert.equal((await service.status(input)).status, "disconnected");
+  await assert.rejects(service.invoke({ ...input, operation: "objects.downloadUrl", input: { key: "private.txt" } }), { code: "connector_reconnect_required" });
+  assert.equal(requests.length, 3, "Disconnect is local and cannot revoke an already issued presigned URL.");
+});
+
+test("Athena never runs SQL on connect and sends the caller's exact statement and idempotency token", async (t) => {
+  const { service, options, requests } = await fixture(t, awsAthenaProvider);
+  await service.connectApiKey(input);
+  assert.deepEqual(requests.map((r) => r.target), ["GetWorkGroup"]);
+  const configuration = structuredClone(options.configuration);
+  configuration.integrations.aws.settings.resultLocation = "s3://query-results/reports/";
+  let authorized;
+  const configured = createConnectionService({ ...options, configuration, authorize: async (owner, request) => { authorized = request; return owner; } });
+  await configured.connectApiKey(input);
+  const fields = { sql: " SELECT '  value  ' ", clientRequestToken: "idempotency-key-for-this-query-0001", database: "reports", catalog: "AwsDataCatalog" };
+  const result = await configured.invoke({ ...input, operation: "query.start", input: fields });
+  assert.equal(result.QueryExecutionId, "query-1");
+  assert.deepEqual(authorized.input, fields);
+  assert.deepEqual(requests.at(-1).body, { QueryString: fields.sql, ClientRequestToken: fields.clientRequestToken, WorkGroup: "primary", QueryExecutionContext: { Database: "reports", Catalog: "AwsDataCatalog" }, ResultConfiguration: { OutputLocation: "s3://query-results/reports/" } });
+  await configured.invoke({ ...input, operation: "query.start", input: fields });
+  assert.equal(requests.at(-1).body.ClientRequestToken, fields.clientRequestToken);
+  for (const invalid of [{ sql: "SELECT 1" }, { ...fields, clientRequestToken: "short" }, { ...fields, sql: "" }, { ...fields, sql: "  " }, { ...fields, sql: "é".repeat(131073) }, { ...fields, workgroup: "other" }, { ...fields, resultLocation: "s3://other/" }]) {
+    await assert.rejects(configured.invoke({ ...input, operation: "query.start", input: invalid }), { code: "connector_input_invalid" });
+  }
+});
+
+test("Athena verifies workgroup before status/results/cancel and preserves result headers, empty cells and cursors", async (t) => {
+  const { service, state, requests } = await fixture(t, awsAthenaProvider);
+  await service.connectApiKey(input);
+  assert.deepEqual(await service.invoke({ ...input, operation: "query.status", input: { queryId: "query-1" } }), query);
+  assert.deepEqual(await service.invoke({ ...input, operation: "query.results", input: { queryId: "query-1", maxResults: 25, nextToken: "opaque +/=" } }), results);
+  assert.deepEqual(requests.slice(-2).map((r) => r.target), ["GetQueryExecution", "GetQueryResults"]);
+  assert.deepEqual(requests.at(-1).body, { QueryExecutionId: "query-1", MaxResults: 25, QueryResultType: "DATA_ROWS", NextToken: "opaque +/=" });
+  assert.deepEqual(await service.invoke({ ...input, operation: "query.cancel", input: { queryId: "query-1" } }), {});
+  assert.deepEqual(requests.slice(-2).map((r) => r.target), ["GetQueryExecution", "StopQueryExecution"]);
+  state.response = { QueryExecution: { ...query.QueryExecution, WorkGroup: "private" } };
+  for (const operation of ["query.status", "query.results", "query.cancel"]) {
+    const count = requests.length;
+    await assert.rejects(service.invoke({ ...input, operation, input: { queryId: "query-1" } }), { code: "connector_access_denied" });
+    assert.equal(requests.length, count + 1);
+    assert.equal(requests.at(-1).target, "GetQueryExecution");
+  }
+  state.response = { QueryExecution: { ...query.QueryExecution, QueryExecutionId: "other-query" } };
+  await assert.rejects(service.invoke({ ...input, operation: "query.status", input: { queryId: "query-1" } }), { code: "connector_response_invalid" });
+});
+
+test("Athena rejects malformed verification and results, validates pagination and returns all job states", async (t) => {
+  const { service, state, options } = await fixture(t, awsAthenaProvider);
+  for (const response of [{}, { WorkGroup: { Name: "other", State: "ENABLED" } }, { WorkGroup: { Name: "primary" } }]) {
+    state.response = response;
+    await assert.rejects(service.connectApiKey(input), { code: "connector_response_invalid" });
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+  state.response = undefined;
+  await service.connectApiKey(input);
+  for (const status of ["QUEUED", "RUNNING", "SUCCEEDED", "FAILED", "CANCELLED"]) {
+    state.response = { QueryExecution: { ...query.QueryExecution, Status: { State: status } } };
+    const value = await service.invoke({ ...input, operation: "query.status", input: { queryId: "query-1" } });
+    assert.equal(value.QueryExecution.Status.State, status);
+  }
+  for (const fields of [{ queryId: " " }, { queryId: "query-1", maxResults: 0 }, { queryId: "query-1", maxResults: 1.5 }, { queryId: "query-1", nextToken: "" }, { queryId: "query-1", queryResultType: "DATA_MANIFEST" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "query.results", input: fields }), { code: "connector_input_invalid" });
+  }
+  const malformed = createConnectionService({ ...options, fetchImpl: async (_, init) => {
+    const target = new Headers(init.headers).get("x-amz-target");
+    return Response.json(target.endsWith("GetQueryExecution") ? query : { ResultSet: {} });
+  } });
+  await assert.rejects(malformed.invoke({ ...input, operation: "query.results", input: { queryId: "query-1" } }), { code: "connector_response_invalid" });
+});
+
+test("Athena browses catalogs, databases and typed table metadata with opaque pagination", async (t) => {
+  const { service, options, state, requests, resolutions } = await fixture(t, awsAthenaProvider);
+  await service.connectApiKey(input);
+  const cases = [
+    ["catalogs.list", "ListDataCatalogs", {}, { DataCatalogsSummary: [{ CatalogName: "AwsDataCatalog", Type: "GLUE" }] }],
+    ["databases.list", "ListDatabases", { catalog: "AwsDataCatalog" }, { DatabaseList: [{ Name: "reports", Description: "Reporting data" }] }],
+    ["tables.list", "ListTableMetadata", { catalog: "AwsDataCatalog", database: "reports" }, { TableMetadataList: [{ Name: "orders", Columns: [{ Name: "amount", Type: "decimal(38,2)" }], PartitionKeys: [{ Name: "day", Type: "date" }] }] }]
+  ];
+  for (const [operation, target, fields, response] of cases) {
+    state.response = { ...response, NextToken: "opaque +/=" };
+    const value = await service.invoke({ ...input, operation, input: { ...fields, maxResults: 2, nextToken: "previous +/=" } });
+    assert.deepEqual(value, state.response);
+    assert.equal(requests.at(-1).target, target);
+    assert.deepEqual(requests.at(-1).body, { WorkGroup: "primary", MaxResults: 2, NextToken: "previous +/=",
+      ...(fields.catalog ? { CatalogName: fields.catalog } : {}), ...(fields.database ? { DatabaseName: fields.database } : {}) });
+    state.response = { [Object.keys(response)[0]]: [] };
+    assert.deepEqual(await service.invoke({ ...input, operation, input: fields }), state.response);
+    state.response = { ...response, NextToken: "" };
+    await assert.rejects(service.invoke({ ...input, operation, input: fields }), { code: "connector_response_invalid" });
+    const count = requests.length;
+    await assert.rejects(service.invoke({ ...input, operation, input: { ...fields, maxResults: 51 } }), { code: "connector_input_invalid" });
+    assert.equal(requests.length, count);
+  }
+  state.response = { TableMetadataList: [{ Name: "orders", Columns: [{ Name: "bad", Type: 42 }] }] };
+  await assert.rejects(service.invoke({ ...input, operation: "tables.list", input: { catalog: "AwsDataCatalog", database: "reports" } }), { code: "connector_response_invalid" });
+  await assert.rejects(service.invoke({ ...input, operation: "catalogs.list", input: { maxResults: 1 } }), { code: "connector_input_invalid" });
+  const denied = createConnectionService({ ...options, authorize: async () => { throw new Error("Catalog not authorized"); } });
+  const count = resolutions.length;
+  await assert.rejects(denied.invoke({ ...input, operation: "databases.list", input: { catalog: "private" } }), /Catalog not authorized/);
+  assert.equal(resolutions.length, count);
+  assert.equal(requests.some((r) => r.target === "StartQueryExecution"), false);
+});

package/test/brevo.test.js

@@ -0,0 +1,71 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { brevoProvider } from "../src/server/brevo.js";
+
+test("Brevo explicitly sends messages and campaigns, manages contacts and retains DNS and delivery state", async t => {
+  const directory = await mkdtemp(path.join(tmpdir(), "brevo-repair-")); t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = []; const state = { response: { contacts: [], count: 0 }, status: 200, deny: false, fail: false };
+  const identity = { context: { applicationId: "booking-app", subjectId: "owner" }, integrationId: "messaging" };
+  const service = createConnectionService({ configuration: { schemaVersion: 1, registrations: {}, integrations: {
+    messaging: { provider: "brevo", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:BREVO_API_KEY" } }
+  } }, providers: [brevoProvider], authorize: async context => { if (state.deny) throw new Error("denied"); return context; },
+    resolveReference: async () => "brevo-fixture-key",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" }) }),
+    fetchImpl: async (url, init) => { requests.push({ url: new URL(url), init }); if (state.fail) throw new Error("uncertain send");
+      return state.response === null ? new Response(null, { status: 204 }) : Response.json(state.response, { status: state.status }); }
+  });
+  const invoke = (operation, input = {}) => service.invoke({ ...identity, operation, input }); await service.connectApiKey(identity);
+  const sender = { email: "bookings@example.test", name: "Dog and Groom" };
+  const email = { sender, to: [{ email: "customer@example.test" }], subject: "Booking confirmed", textContent: "Tuesday at 10" };
+  const dns = { brevo_code: { host_name: "example.test", type: "TXT", value: "brevo-code:fixture", status: false },
+    dkim_record: { host_name: "mail._domainkey.example.test", type: "TXT", value: "fixture-dkim", status: false } };
+  for (const [operation, method, endpoint, input, response] of [
+    ["email.send", "POST", "smtp/email", email, { messageId: "<accepted-1>" }],
+    ["email.send", "POST", "smtp/email", { sender, to: email.to, templateId: 2, params: { APPOINTMENT: "Tuesday" } }, { messageId: "<accepted-2>" }],
+    ["sms.send", "POST", "transactionalSMS/sms", { sender: "DogGroom", recipient: "+61400000000", type: "transactional", content: "Your appointment is tomorrow" }, { messageId: 12, reference: "accepted", usedCredits: 1, remainingCredits: 9 }],
+    ["contacts.create", "POST", "contacts", { email: "customer@example.test", attributes: { FIRSTNAME: "Sam" }, listIds: [3], updateEnabled: false }, { id: 42 }],
+    ["contacts.update", "PUT", "contacts/customer%40example.test", { resource: "customer@example.test", emailBlacklisted: true }, null],
+    ["contacts.get", "GET", "contacts/customer%40example.test", { resource: "customer@example.test" }, { id: 42, emailBlacklisted: true }],
+    ["lists.create", "POST", "contacts/lists", { name: "Consenting customers", folderId: 1 }, { id: 3 }],
+    ["lists.addContacts", "POST", "contacts/lists/3/contacts/add", { resource: 3, emails: ["customer@example.test"] }, { contacts: { success: ["customer@example.test"], failure: ["missing@example.test"] } }],
+    ["lists.removeContacts", "POST", "contacts/lists/3/contacts/remove", { resource: 3, emails: ["customer@example.test"] }, { contacts: { success: ["customer@example.test"], failure: [] } }],
+    ["senders.create", "POST", "senders", sender, { id: 2, dkimError: true, spfError: false }],
+    ["domains.create", "POST", "senders/domains", { name: "example.test" }, { id: 4, domain_name: "example.test", message: "Created", dns_records: dns }],
+    ["domains.get", "GET", "senders/domains/example.test", { resource: "example.test" }, { domain: "example.test", verified: false, authenticated: false, dns_records: dns }],
+    ["domains.authenticate", "PUT", "senders/domains/example.test/authenticate", { resource: "example.test" }, { domain_name: "example.test", message: "Check requested" }],
+    ["campaigns.create", "POST", "emailCampaigns", { name: "Spring offers", sender, subject: "Spring", htmlContent: "<p>Offer</p>", recipients: { listIds: [3], exclusionListIds: [4] } }, { id: 7 }],
+    ["campaigns.get", "GET", "emailCampaigns/7", { resource: 7 }, { id: 7, status: "draft", statistics: {} }],
+    ["campaigns.sendTest", "POST", "emailCampaigns/7/sendTest", { resource: 7, emailTo: ["owner@example.test"] }, null],
+    ["campaigns.sendNow", "POST", "emailCampaigns/7/sendNow", { resource: 7 }, null],
+    ["events.create", "POST", "events", { event_name: "booking_completed", identifiers: { email_id: "customer@example.test" }, event_properties: { bookingId: "b-1" } }, null]
+  ]) { state.response = response; assert.deepEqual(await invoke(operation, input).catch(error => { error.message = `${operation}: ${error.message}`; throw error; }), response);
+    const request = requests.at(-1); assert.equal(request.url.pathname, `/v3/${endpoint}`); assert.equal(request.init.method, method);
+    if (method !== "GET") { const { resource, ...body } = input;
+      if (Object.keys(body).length) assert.deepEqual(JSON.parse(request.init.body), body); else assert.equal(request.init.body, undefined); }
+    assert.equal(new Headers(request.init.headers).get("api-key"), "brevo-fixture-key"); assert.equal(request.init.redirect, "error");
+  }
+  for (const [operation, key, endpoint] of [["folders.list", "folders", "contacts/folders"], ["lists.list", "lists", "contacts/lists"],
+    ["senders.list", "senders", "senders"], ["campaigns.list", "campaigns", "emailCampaigns"], ["email.events", "events", "smtp/statistics/events"],
+    ["sms.events", "events", "transactionalSMS/statistics/events"]]) {
+    state.response = { [key]: operation.includes("events") ? [{ event: "hardBounces", messageId: "<accepted-1>", reason: "No mailbox" }] : [] };
+    assert.deepEqual(await invoke(operation), state.response); assert.equal(requests.at(-1).url.pathname, `/v3/${endpoint}`);
+  }
+  const before = requests.length;
+  for (const [operation, input] of [["email.send", { ...email, to: [] }], ["email.send", { sender, to: email.to }],
+    ["sms.send", { sender: "Too-long-name", recipient: "bad", type: "transactional", content: "Hi" }],
+    ["sms.send", { sender: "Test", recipient: "61400000000", type: "transactional", content: "Hi", templateId: 2 }],
+    ["contacts.update", { resource: "customer@example.test" }], ["domains.get", { resource: "https://evil.test/" }],
+    ["campaigns.create", { name: "Missing audience", sender, subject: "Test", htmlContent: "Hi", recipients: { listIds: [] } }],
+    ["events.create", { event_name: "bad name", identifiers: {} }]
+  ]) await assert.rejects(invoke(operation, input));
+  state.deny = true; await assert.rejects(invoke("campaigns.sendNow", { resource: 7 })); state.deny = false; assert.equal(requests.length, before);
+  state.response = { message: "accepted without ID" }; await assert.rejects(invoke("email.send", email), { code: "connector_response_invalid" });
+  for (const status of [400, 403, 429]) { state.status = status; await assert.rejects(invoke("email.send", email)); }
+  state.status = 200; state.fail = true; const uncertain = requests.length; await assert.rejects(invoke("email.send", email));
+  assert.equal(requests.length, uncertain + 1);
+});