@jskit-ai/connectors-catalog 0.1.1

package/test/databricks.test.js

@@ -0,0 +1,253 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { getProviderScopes, parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { databricksProvider } from "../src/server/databricks.js";
+
+const context = { applicationId: "app-one", subjectId: "owner-one" };
+const args = { context, integrationId: "warehouse" };
+const callback = "https://app.example.test/oauth/databricks/callback";
+const job = { job_id: 123, settings: { name: "Weekly inventory", tasks: [] } };
+
+async function fixture(t, grantType = "authorization_code", workspaceUrl = "https://dbc-abc123.cloud.databricks.com") {
+  const directory = await mkdtemp(path.join(tmpdir(), "databricks-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const machine = grantType === "client_credentials";
+  const scopes = machine ? ["jobs"] : ["all-apis", "offline_access"];
+  const configuration = { schemaVersion: 1, registrations: { databricks: { source: "own", grantType, clientId: "fixture-client",
+    clientSecretRef: "env:DATABRICKS_SECRET", tokenEndpointAuthMethod: machine ? "client_secret_basic" : "client_secret_post",
+    ...(machine ? {} : { callbackUrlRef: "env:DATABRICKS_CALLBACK" }) } }, integrations: {
+    warehouse: { provider: "databricks", accountMode: machine ? "shared" : "per-user", settings: { workspaceUrl }, scopes,
+      authentication: { method: "oauth2", registrationRef: "databricks" } }
+  } };
+  const state = { time: Date.now(), count: 0, value: undefined, status: 200, tokenPatch: {}, tokenStatus: 200, hang: false, secret: "private-client-secret" };
+  const requests = [];
+  const options = { configuration, providers: [{ ...databricksProvider, requestTimeoutMs: 50 }], authorize: async (owner) => owner,
+    now: () => state.time, resolveReference: async (reference) => {
+      if (reference === "env:DATABRICKS_SECRET") return state.secret;
+      assert.equal(machine, false, "A service account must never request a callback binding.");
+      assert.equal(reference, "env:DATABRICKS_CALLBACK");
+      return callback;
+    },
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(6) }, activeKeyId: "current" }) }),
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)); requests.push({ url, init });
+      assert.equal(url.origin, new URL(workspaceUrl).origin);
+      const headers = new Headers(init.headers);
+      if (url.pathname === "/oidc/v1/token") {
+        assert.equal(init.method, "POST");
+        const body = new URLSearchParams(init.body);
+        if (machine) {
+          assert.equal(body.get("grant_type"), "client_credentials");
+          assert.equal(body.get("scope"), scopes.join(" "));
+          const auth = headers.get("authorization"); assert.equal(auth.split(" ")[0], "Basic");
+          assert.deepEqual(Buffer.from(auth.split(" ")[1], "base64").toString().split(":").map(decodeURIComponent), ["fixture-client", state.secret]);
+          for (const key of ["redirect_uri", "code", "code_verifier", "client_secret", "refresh_token"]) assert.equal(body.has(key), false);
+        } else {
+          assert.equal(body.get("client_id"), "fixture-client"); assert.equal(body.get("client_secret"), state.secret);
+          if (body.get("grant_type") === "authorization_code") {
+            assert.equal(body.get("redirect_uri"), callback); assert.equal(body.get("code"), "private-code"); assert.ok(body.get("code_verifier"));
+          } else {
+            assert.equal(body.get("grant_type"), "refresh_token"); assert.equal(body.get("refresh_token"), `private-refresh-${state.count}`);
+          }
+        }
+        state.count++;
+        return Response.json(state.tokenStatus === 200 ? { access_token: `private-access-${state.count}`, token_type: "Bearer", expires_in: 120,
+          ...(machine ? {} : { refresh_token: `private-refresh-${state.count}`, scope: scopes.join(" ") }), ...state.tokenPatch }
+          : { error: machine ? "invalid_client" : "invalid_grant", error_description: "private-provider-error" }, { status: state.tokenStatus });
+      }
+      assert.equal(init.method, "GET"); assert.equal(init.redirect, "error");
+      assert.equal(headers.get("authorization"), `Bearer private-access-${state.count}`);
+      assert.match(url.pathname, /^\/api\/2\.2\/jobs\/(list|get)$/u);
+      if (state.hang) return new Promise((_, reject) => {
+        const timer = setTimeout(() => reject(new Error("Missing abort")), 1000);
+        const abort = () => { clearTimeout(timer); reject(init.signal.reason); };
+        if (init.signal.aborted) abort(); else init.signal.addEventListener("abort", abort, { once: true });
+      });
+      if (state.status === 204) return new Response(null, { status: 204 });
+      if (typeof state.value === "string") return new Response(state.value, { status: state.status });
+      return Response.json(state.value === undefined ? url.pathname.endsWith("/get") ? job : { jobs: [job], next_page_token: "page+two=" } : state.value, { status: state.status });
+    }
+  };
+  const service = createConnectionService(options);
+  const start = async () => {
+    const { authorizationUrl } = await service.beginAuthorization({ ...args, verificationInput: { limit: 1 } });
+    const url = new URL(authorizationUrl); const returned = new URL(callback);
+    returned.searchParams.set("state", url.searchParams.get("state")); returned.searchParams.set("code", "private-code");
+    return { url, callbackUrl: returned.href };
+  };
+  const connect = async () => machine ? service.connectClientCredentials({ ...args, verificationInput: { limit: 1 } })
+    : service.completeAuthorization({ ...args, callbackUrl: (await start()).callbackUrl });
+  return { directory, service, state, options, requests, start, connect };
+}
+
+test("Databricks user consent pins the workspace, sends PKCE and persists encrypted restartable grants", async (t) => {
+  const f = await fixture(t); const start = await f.start();
+  assert.equal(start.url.href.split("?")[0], "https://dbc-abc123.cloud.databricks.com/oidc/v1/authorize");
+  assert.equal(start.url.searchParams.get("scope"), "all-apis offline_access");
+  assert.equal(start.url.searchParams.get("code_challenge_method"), "S256");
+  assert.equal(start.url.searchParams.has("client_secret"), false);
+  await f.service.completeAuthorization({ ...args, callbackUrl: start.callbackUrl });
+  for (const file of await readdir(f.directory)) {
+    const text = await readFile(path.join(f.directory, file), "utf8");
+    for (const secret of ["private-code", "private-client-secret", "private-access-1", "private-refresh-1"]) assert.equal(text.includes(secret), false);
+  }
+  const restarted = createConnectionService(f.options);
+  assert.equal((await restarted.status(args)).status, "connected");
+  assert.deepEqual(await restarted.invoke({ ...args, operation: "jobs.get", input: { job_id: 123 } }), job);
+});
+
+test("Databricks service principals use confidential grants on AWS, Azure and GCP without callbacks", async (t) => {
+  for (const origin of ["https://dbc-abc123.cloud.databricks.com", "https://adb-123456789.7.azuredatabricks.net", "https://123456789.7.gcp.databricks.com/"]) {
+    const f = await fixture(t, "client_credentials", origin); await f.connect();
+    const restarted = createConnectionService(f.options);
+    assert.equal((await restarted.status(args)).status, "connected");
+    assert.deepEqual((await restarted.status(args)).grantedScopes, ["jobs"]);
+    f.state.time += 85_000; // 35 seconds remain: refresh before Azure's 30-second refusal boundary.
+    f.state.secret = "rotated-client-secret";
+    await Promise.all([restarted.invoke({ ...args, operation: "jobs.list" }), restarted.invoke({ ...args, operation: "jobs.list" })]);
+    assert.equal(f.state.count, 2);
+    for (const file of await readdir(f.directory)) assert.equal((await readFile(path.join(f.directory, file), "utf8")).includes("private-access"), false);
+  }
+});
+
+test("Databricks returns bounded job pages, empty lists and nested detail continuation without running jobs", async (t) => {
+  const f = await fixture(t); await f.connect();
+  const before = f.requests.length;
+  await f.service.invoke({ ...args, operation: "jobs.list", input: { limit: 2, name: "Inventory & stock", expand_tasks: true, page_token: "page+two=" } });
+  assert.equal(f.requests.length, before + 1);
+  assert.equal(f.requests.at(-1).url.search, "?limit=2&expand_tasks=true&name=Inventory+%26+stock&page_token=page%2Btwo%3D");
+  for (const empty of [{}, { jobs: [] }]) {
+    f.state.value = empty; assert.deepEqual(await f.service.invoke({ ...args, operation: "jobs.list" }), empty);
+  }
+  f.state.value = { ...job, settings: { tasks: [] }, next_page_token: "details+next=" };
+  assert.deepEqual(await f.service.invoke({ ...args, operation: "jobs.get", input: { job_id: 123, include_trigger_state: true, page_token: "details+next=" } }), f.state.value);
+  assert.equal(f.requests.at(-1).url.search, "?job_id=123&include_trigger_state=true&page_token=details%2Bnext%3D");
+});
+
+test("Databricks rejects unsupported input, unsafe numeric identifiers, SQL and writes before transport", async (t) => {
+  const f = await fixture(t); await f.connect(); const before = f.requests.length;
+  for (const input of [{ limit: 0 }, { limit: 101 }, { limit: 1.5 }, { expand_tasks: "wrong" }, { page_token: "" },
+    { page_token: "x".repeat(8193) }, { name: "" }, { workspaceUrl: "https://other.test" }, { url: "https://other.test" }]) {
+    await assert.rejects(f.service.invoke({ ...args, operation: "jobs.list", input }), { code: "connector_input_invalid" });
+  }
+  for (const input of [{}, { job_id: 0 }, { job_id: -1 }, { job_id: 1.2 }, { job_id: Number.MAX_SAFE_INTEGER + 1 }]) {
+    await assert.rejects(f.service.invoke({ ...args, operation: "jobs.get", input }), { code: "connector_input_invalid" });
+  }
+  for (const operation of ["jobs.run", "jobs.create", "sql.execute"]) await assert.rejects(f.service.invoke({ ...args, operation }), { code: "connector_operation_unknown" });
+  assert.equal(f.requests.length, before);
+});
+
+test("Databricks verifies granted scopes and application ownership before reading a job", async (t) => {
+  const f = await fixture(t); await f.connect();
+  for (const owner of [{ ...context, subjectId: "another" }, { ...context, applicationId: "another" }]) {
+    await assert.rejects(f.service.invoke({ ...args, context: owner, operation: "jobs.list" }), { code: "connector_reconnect_required" });
+  }
+  const denied = createConnectionService({ ...f.options, authorize: async () => null });
+  await assert.rejects(denied.invoke({ ...args, operation: "jobs.list" }), { code: "connector_access_denied" });
+  assert.equal(f.requests.length, 2);
+  const insufficient = await fixture(t); insufficient.state.tokenPatch.scope = "offline_access";
+  await assert.rejects(insufficient.connect(), { code: "connector_scope_missing" });
+  assert.equal(insufficient.requests.length, 1);
+  assert.equal((await insufficient.service.status(args)).status, "disconnected");
+});
+
+test("Databricks persists renewal before failed reads and marks revoked grants for reconnection in both flows", async (t) => {
+  for (const type of ["authorization_code", "client_credentials"]) {
+    const f = await fixture(t, type); await f.connect(); f.state.time += 85_000; f.state.status = 429;
+    await assert.rejects(f.service.invoke({ ...args, operation: "jobs.list" }), { code: "connector_rate_limited" });
+    f.state.status = 200;
+    const restarted = createConnectionService(f.options); await restarted.invoke({ ...args, operation: "jobs.list" });
+    assert.equal(f.state.count, 2);
+    f.state.time += 85_000; f.state.tokenStatus = 400;
+    await assert.rejects(restarted.invoke({ ...args, operation: "jobs.list" }), (error) => error.code === "connector_reconnect_required" && !error.message.includes("private"));
+    assert.equal((await restarted.status(args)).status, "reconnect-required");
+  }
+});
+
+test("Databricks rejects malformed token lifetimes, scopes and refresh values before verification", async (t) => {
+  for (const tokenPatch of [{ expires_in: undefined }, { expires_in: 40 }, { expires_in: 1.5 }, { scope: "" },
+    { scope: "jobs\nall-apis" }, { refresh_token: "" }]) {
+    const f = await fixture(t); f.state.tokenPatch = tokenPatch;
+    await assert.rejects(f.connect(), { code: "connector_response_invalid" }); assert.equal(f.requests.length, 1);
+  }
+});
+
+test("Databricks pending consent cannot change workspace and cancelled, denied or replayed consent preserves saved access", async (t) => {
+  const f = await fixture(t); await f.connect(); const start = await f.start();
+  const changed = structuredClone(f.options.configuration); changed.integrations.warehouse.settings.workspaceUrl = "https://dbc-other.cloud.databricks.com";
+  const other = createConnectionService({ ...f.options, configuration: changed });
+  await assert.rejects(other.completeAuthorization({ ...args, callbackUrl: start.callbackUrl }), { code: "connector_attempt_invalid" });
+  const denied = await f.start(); const returned = new URL(denied.callbackUrl); returned.searchParams.delete("code"); returned.searchParams.set("error", "access_denied");
+  await assert.rejects(f.service.completeAuthorization({ ...args, callbackUrl: returned.href }), { code: "connector_consent_denied" });
+  await assert.rejects(f.service.completeAuthorization({ ...args, callbackUrl: denied.callbackUrl }), { code: "connector_attempt_invalid" });
+  const cancelled = await f.start(); await f.service.cancelAuthorization({ ...args, state: cancelled.url.searchParams.get("state") });
+  await assert.rejects(f.service.completeAuthorization({ ...args, callbackUrl: cancelled.callbackUrl }), { code: "connector_attempt_invalid" });
+  assert.equal((await f.service.status(args)).status, "connected"); assert.equal(f.requests.length, 2);
+});
+
+test("Databricks grants cannot move to a different workspace, client or service scope without reconnection", async (t) => {
+  const f = await fixture(t, "client_credentials"); await f.connect();
+  for (const mutate of [(value) => { value.integrations.warehouse.settings.workspaceUrl = "https://dbc-other.cloud.databricks.com"; },
+    (value) => { value.registrations.databricks.clientId = "other-client"; }, (value) => { value.integrations.warehouse.scopes = ["all-apis"]; }]) {
+    const configuration = structuredClone(f.options.configuration); mutate(configuration);
+    const changed = createConnectionService({ ...f.options, configuration });
+    assert.equal((await changed.status(args)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...args, operation: "jobs.list" }), { code: "connector_reconnect_required" });
+  }
+  assert.equal(f.requests.length, 2);
+});
+
+test("Databricks rejects malformed job successes, mismatched IDs and overfull pages and redacts provider errors", async (t) => {
+  const f = await fixture(t); await f.connect();
+  for (const value of [null, [], "not-json", { jobs: null }, { jobs: [{ job_id: 1.5 }] }, { jobs: [{ job_id: Number.MAX_SAFE_INTEGER + 1 }] },
+    { jobs: [{ ...job, settings: [] }] }, { jobs: [job, job] }, { error_code: "PRIVATE_ERROR", message: "private-provider-error" },
+    { jobs: [], next_page_token: 123 }]) {
+    f.state.value = value;
+    await assert.rejects(f.service.invoke({ ...args, operation: "jobs.list", input: { limit: 1 } }), (error) =>
+      ["connector_response_invalid", "connector_provider_failed"].includes(error.code) && !error.message.includes("private"), JSON.stringify(value));
+  }
+  f.state.value = { ...job, job_id: 456 };
+  await assert.rejects(f.service.invoke({ ...args, operation: "jobs.get", input: { job_id: 123 } }), { code: "connector_response_invalid" });
+  f.state.value = undefined; f.state.status = 204;
+  await assert.rejects(f.service.invoke({ ...args, operation: "jobs.list" }), { code: "connector_response_invalid" });
+  for (const [status, code] of [[403, "connector_permission_denied"], [500, "connector_provider_failed"], [429, "connector_rate_limited"], [401, "connector_reconnect_required"]]) {
+    f.state.status = status; f.state.value = { message: "private-provider-error" };
+    await assert.rejects(f.service.invoke({ ...args, operation: "jobs.list" }), (error) => error.code === code && !error.message.includes("private"));
+  }
+});
+
+test("Databricks bounds cancellation and timeout and disconnects locally", async (t) => {
+  const f = await fixture(t, "client_credentials"); await f.connect(); f.state.hang = true;
+  const controller = new AbortController(); const pending = f.service.invoke({ ...args, operation: "jobs.list", signal: controller.signal });
+  setTimeout(() => controller.abort(), 10); await assert.rejects(pending, { code: "connector_cancelled" });
+  await assert.rejects(f.service.invoke({ ...args, operation: "jobs.list" }), { code: "connector_provider_timeout" });
+  await f.service.disconnect(args); assert.equal((await f.service.status(args)).status, "disconnected"); assert.equal(f.requests.length, 4);
+});
+
+test("Databricks guide, CLI parser and shared fields agree on grant-specific inputs and workspace origins", async () => {
+  const guide = await readFile(new URL("../docs/databricks.md", import.meta.url), "utf8");
+  const blocks = [...guide.matchAll(/```json\n([\s\S]*?)\n```/gu)].map((match) => JSON.parse(match[1]));
+  const parse = (value) => parseIntegrationConfiguration(JSON.stringify(value), { providers: [databricksProvider] });
+  assert.deepEqual(parse(blocks[0]), blocks[0]);
+  const user = structuredClone(blocks[0]); user.registrations["databricks-service"] = blocks[1];
+  user.integrations.warehouse.accountMode = "per-user"; user.integrations.warehouse.scopes = ["all-apis", "offline_access"];
+  assert.deepEqual(parse(user), user);
+  assert.deepEqual(getProviderScopes(databricksProvider).map((scope) => scope.value), ["all-apis", "offline_access"]);
+  assert.deepEqual(getProviderScopes(databricksProvider, {}, "client_credentials").map((scope) => scope.value), ["all-apis", "jobs"]);
+  for (const workspaceUrl of ["", "http://dbc-abc123.cloud.databricks.com", "https://accounts.cloud.databricks.com", "https://accounts.azuredatabricks.net",
+    "https://dbc-abc123.cloud.databricks.com.attacker.test", "https://dbc-abc123.cloud.databricks.com/path", "https://dbc-abc123.cloud.databricks.com/?o=1",
+    "https://dbc-abc123.cloud.databricks.com/#page", "https://user@dbc-abc123.cloud.databricks.com", "https://dbc-abc123.cloud.databricks.com:8443",
+    "https://dbc-abc123.cloud.databricks.com/../", "https://127.0.0.1", "https://us-east4.gcp.databricks.com"]) {
+    const invalid = structuredClone(blocks[0]); invalid.integrations.warehouse.settings.workspaceUrl = workspaceUrl;
+    assert.throws(() => parse(invalid), (error) => Boolean(error.fieldErrors["integrations.warehouse.settings.workspaceUrl"]));
+  }
+  for (const [key, value] of [["callbackUrlRef", callback], ["clientSecretRef", "raw-secret"], ["tokenEndpointAuthMethod", "client_secret_basic"]]) {
+    const invalid = structuredClone(user); invalid.registrations["databricks-service"][key] = value;
+    assert.throws(() => parse(invalid), (error) => Boolean(error.fieldErrors[`registrations.databricks-service.${key}`]));
+  }
+});

package/test/dbt-semantic-layer.test.js

@@ -0,0 +1,221 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { dbtSemanticLayerProvider } from "../src/server/dbt-semantic-layer.js";
+
+const context = { applicationId: "metrics-app", subjectId: "analytics-team" };
+const input = { context, integrationId: "metrics" };
+const environmentId = "9007199254740993";
+const metric = { name: "order_total", description: null, type: "SIMPLE" };
+const page = (items, values = {}) => ({ items, pageNum: 1, pageSize: 20, totalItems: items.length, totalPages: items.length ? 1 : 0, ...values });
+async function fixture(t, host = "semantic-layer.cloud.getdbt.com") {
+  const directory = await mkdtemp(path.join(tmpdir(), "dbt-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const state = { key: "fixture-dbt-token", status: 200, response: undefined, hang: false, resolutions: 0 };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { metrics: {
+      provider: "dbt-semantic-layer", displayName: "Warehouse metadata", accountMode: "shared", scopes: [],
+      settings: { host, environmentId }, authentication: { method: "api-key", secretRef: "env:DBT_SERVICE_TOKEN" }, extensions: { fromCli: true }
+    } }, extensions: { retained: true } },
+    providers: [{ ...dbtSemanticLayerProvider, requestTimeoutMs: 50 }],
+    authorize: async (owner) => owner,
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(9) }, activeKeyId: "current" }) }),
+    resolveReference: async (reference) => { state.resolutions++; assert.equal(reference, "env:DBT_SERVICE_TOKEN"); return state.key; },
+    fetchImpl: async (address, init) => {
+      init.signal.throwIfAborted();
+      const body = JSON.parse(init.body);
+      requests.push({ url: String(address), init, body, headers: new Headers(init.headers) });
+      if (state.hang) {
+        state.started?.();
+        return new Promise((_, reject) => {
+          if (init.signal.aborted) reject(init.signal.reason);
+          else init.signal.addEventListener("abort", () => reject(init.signal.reason), { once: true });
+        });
+      }
+      let data = { environmentInfo: { dialect: "SNOWFLAKE" } };
+      for (const [name, items] of [["metricsPaginated", [metric]], ["dimensionsPaginated", [{ name: "metric_time", description: "Metric date", type: "TIME" }]], ["savedQueriesPaginated", [{ name: "orders", description: null }]]]) {
+        if (body.query.includes(name)) data = { [name]: page(items, { pageNum: body.variables.pageNum, pageSize: body.variables.pageSize }) };
+      }
+      return Response.json(state.response === undefined ? { data } : state.response, { status: state.status });
+    }
+  };
+  return { service: createConnectionService(options), options, state, requests, directory };
+}
+
+test("dbt verifies only environment metadata and preserves file-backed ownership, references and exact large IDs", async (t) => {
+  const f = await fixture(t);
+  const connected = await f.service.connectApiKey(input);
+  assert.equal(connected.status, "connected"); assert.equal(f.requests.length, 1);
+  const request = f.requests[0];
+  assert.equal(request.url, "https://semantic-layer.cloud.getdbt.com/api/graphql");
+  assert.equal(request.init.method, "POST"); assert.equal(request.init.redirect, "error"); assert.equal(request.init.credentials, "omit");
+  assert.equal(request.headers.get("authorization"), "Bearer fixture-dbt-token");
+  assert.deepEqual(request.body.variables, { environmentId });
+  assert.match(request.body.query, /\$environmentId: BigInt!/u); assert(!request.body.query.includes("mutation"));
+  for (const name of await readdir(f.directory)) assert(!(await readFile(path.join(f.directory, name), "utf8")).includes(f.state.key));
+  const restarted = createConnectionService(f.options);
+  assert.deepEqual(await restarted.status(input), connected);
+  for (const owner of [{ ...context, applicationId: "other" }, { ...context, subjectId: "other" }]) {
+    await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "metrics.list" }), { code: "connector_reconnect_required" });
+  }
+  assert.equal(f.requests.length, 1);
+  f.state.key = "rotated-dbt-token";
+  await restarted.invoke({ ...input, operation: "metrics.list" });
+  assert.equal(f.requests.at(-1).headers.get("authorization"), "Bearer rotated-dbt-token");
+  await restarted.disconnect(input); assert.equal((await f.service.status(input)).status, "disconnected");
+});
+
+test("dbt uses each declared regional, single-tenant and multi-cell host without following caller-supplied URLs", async (t) => {
+  for (const host of ["semantic-layer.emea.dbt.com", "semantic-layer.au.dbt.com", "semantic-layer.account123.getdbt.com", "account123.semantic-layer.us1.dbt.com"]) {
+    const f = await fixture(t, host); await f.service.connectApiKey(input);
+    assert.equal(f.requests[0].url, `https://${host}/api/graphql`);
+  }
+});
+
+test("dbt metadata pages are explicit, accept empty pages and preserve future metric types and nullable descriptions", async (t) => {
+  const f = await fixture(t); await f.service.connectApiKey(input);
+  for (const [operation, key, extra] of [["metrics.list", "metricsPaginated", {}], ["dimensions.list", "dimensionsPaginated", { metrics: [{ name: "order_total" }] }], ["savedQueries.list", "savedQueriesPaginated", {}]]) {
+    const values = { pageNum: 2, pageSize: 3, search: "order\" \\ query", ...extra };
+    const items = key === "savedQueriesPaginated" ? [{ name: "orders", description: "" }] : [{ ...metric, type: "FUTURE_TYPE" }];
+    f.state.response = { data: { [key]: page(items, { pageNum: 2, pageSize: 3, totalItems: 4, totalPages: 2 }) } };
+    const before = f.requests.length;
+    assert.deepEqual(await f.service.invoke({ ...input, operation, input: values }), f.state.response);
+    assert.deepEqual(f.requests.at(-1).body.variables, { ...values, environmentId });
+    assert.equal(f.requests.at(-1).body.query.includes(values.search), false); assert.equal(f.requests.length, before + 1);
+    f.state.response = { data: { [key]: page([]) } };
+    assert.deepEqual(await f.service.invoke({ ...input, operation, input: extra }), f.state.response);
+  }
+});
+
+test("dbt rejects malformed IDs, hosts, credential literals and unimplemented auth modes through the CLI parser", async (t) => {
+  const f = await fixture(t);
+  const parse = (configuration) => parseIntegrationConfiguration(JSON.stringify(configuration), { providers: [dbtSemanticLayerProvider] });
+  const parsed = parse(f.options.configuration);
+  assert.equal(parsed.integrations.metrics.settings.environmentId, environmentId);
+  assert.deepEqual(parsed.extensions, { retained: true }); assert.deepEqual(parsed.integrations.metrics.extensions, { fromCli: true });
+  const bad = (change) => {
+    const config = structuredClone(f.options.configuration); Object.assign(config.integrations.metrics, change);
+    assert.throws(() => parse(config), (error) => Boolean(error.fieldErrors) && !error.fieldErrors.configuration);
+  };
+  for (const host of ["", "https://semantic-layer.cloud.getdbt.com", "semantic-layer.cloud.getdbt.com:443", "semantic-layer.cloud.getdbt.com/", "semantic-layer.cloud.getdbt.com?x=1", "semantic-layer.cloud.getdbt.com.evil.test", "127.0.0.1", "metadata.internal", "SEMANTIC-LAYER.cloud.getdbt.com", "semantic-layer.-bad.dbt.com"]) bad({ settings: { host, environmentId } });
+  for (const id of ["", 123, "01", "0", "-1", "1.5", "1e15", " 123", "1".repeat(39)]) bad({ settings: { host: f.options.configuration.integrations.metrics.settings.host, environmentId: id } });
+  for (const secretRef of ["dbtc_raw-token", "https://secret.test/key", ""]) bad({ authentication: { method: "api-key", secretRef } });
+  bad({ accountMode: "per-user" }); bad({ scopes: ["metadata"] }); bad({ authentication: { method: "oauth2", registrationRef: "dbt" } });
+  const assistant = structuredClone(f.options.configuration); assistant.integrations.metrics.accountMode = "assistant"; assert.equal(parse(assistant).integrations.metrics.accountMode, "assistant");
+  assert.equal(f.requests.length, 0);
+});
+
+test("dbt validates pagination and nested metric inputs before transport and rejects arbitrary queries", async (t) => {
+  const f = await fixture(t); await f.service.connectApiKey(input); const before = f.requests.length;
+  for (const values of [{ pageNum: 0 }, { pageNum: 1.5 }, { pageNum: 2_147_483_648 }, { pageSize: 0 }, { pageSize: 101 }, { pageSize: 1.5 }, { search: "x".repeat(513) }, { environmentId: "other" }, { host: "other.test" }, { query: "mutation { createQuery }" }]) {
+    await assert.rejects(f.service.invoke({ ...input, operation: "metrics.list", input: values }), { code: "connector_input_invalid" });
+  }
+  for (const metrics of [undefined, [], ["order_total"], [{}], [{ name: "" }], [{ name: "x".repeat(513) }], [{ name: "orders", sql: "other" }], Array.from({ length: 101 }, () => ({ name: "orders" }))]) {
+    await assert.rejects(f.service.invoke({ ...input, operation: "dimensions.list", input: { metrics } }), { code: "connector_input_invalid" });
+  }
+  await assert.rejects(f.service.invoke({ ...input, operation: "query.create" }), { code: "connector_operation_unknown" });
+  assert.equal(f.requests.length, before);
+});
+
+test("dbt rejects malformed metadata and inconsistent pages instead of accepting a false connection", async (t) => {
+  const f = await fixture(t);
+  for (const value of [null, {}, { data: null }, { data: { environmentInfo: null } }, { data: { environmentInfo: { dialect: 4 } } }, { data: { environmentInfo: { dialect: "" } } }, { data: { environmentInfo: { dialect: "DIALECT" } }, errors: {} }]) {
+    f.state.response = value;
+    await assert.rejects(f.service.connectApiKey(input), { code: "connector_response_invalid" });
+    assert.notEqual((await f.service.status(input)).status, "connected");
+  }
+  f.state.response = undefined; await f.service.connectApiKey(input);
+  for (const result of [null, page([{}]), page([{ name: "metric", description: null }]), page([metric], { pageNum: 2 }), page([metric], { pageSize: 2 }), page([metric], { totalItems: 0 }), page([metric], { totalPages: -1 }), page([metric], { totalItems: 1.5 }), page([null])]) {
+    f.state.response = { data: { metricsPaginated: result } };
+    await assert.rejects(f.service.invoke({ ...input, operation: "metrics.list" }), { code: "connector_response_invalid" });
+  }
+  f.state.response = { data: { metricsPaginated: page([metric, metric], { pageSize: 1 }) } };
+  await assert.rejects(f.service.invoke({ ...input, operation: "metrics.list", input: { pageSize: 1 } }), { code: "connector_response_invalid" });
+});
+
+test("dbt provider errors including partial GraphQL data are redacted without guessing authentication from message text", async (t) => {
+  const f = await fixture(t); await f.service.connectApiKey(input);
+  for (const [status, code] of [[403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"], [401, "connector_reconnect_required"]]) {
+    f.state.status = status; f.state.response = { error: f.state.key };
+    await assert.rejects(f.service.invoke({ ...input, operation: "metrics.list" }), (error) => error.code === code && !JSON.stringify(error).includes(f.state.key) && error.cause === undefined);
+  }
+  assert.equal((await f.service.status(input)).status, "reconnect-required");
+  f.state.status = 200; f.state.response = undefined; await f.service.connectApiKey(input);
+  f.state.response = { data: { metricsPaginated: page([metric]) }, errors: [{ message: f.state.key }] };
+  await assert.rejects(f.service.invoke({ ...input, operation: "metrics.list" }), (error) => error.code === "connector_provider_failed" && !error.message.includes(f.state.key));
+});
+
+test("dbt changing environment, host or token reference requires verification for the new configuration", async (t) => {
+  const f = await fixture(t); await f.service.connectApiKey(input); const before = f.requests.length;
+  for (const change of [{ settings: { host: "semantic-layer.au.dbt.com", environmentId } }, { settings: { host: f.options.configuration.integrations.metrics.settings.host, environmentId: "1" } }, { authentication: { method: "api-key", secretRef: "env:OTHER_TOKEN" } }]) {
+    const configuration = structuredClone(f.options.configuration); Object.assign(configuration.integrations.metrics, change);
+    const changed = createConnectionService({ ...f.options, configuration });
+    assert.equal((await changed.status(input)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...input, operation: "metrics.list" }), { code: "connector_reconnect_required" });
+  }
+  assert.equal(f.requests.length, before);
+});
+
+test("dbt abort and timeout interrupt requests without replay or automatic page traversal", async (t) => {
+  const f = await fixture(t); await f.service.connectApiKey(input); const before = f.requests.length;
+  const controller = new AbortController(); controller.abort();
+  await assert.rejects(f.service.invoke({ ...input, operation: "metrics.list", signal: controller.signal }), { code: "connector_cancelled" });
+  assert.equal(f.requests.length, before);
+  f.state.hang = true; const started = new Promise((resolve) => { f.state.started = resolve; }); const running = new AbortController();
+  const pending = assert.rejects(f.service.invoke({ ...input, operation: "metrics.list", signal: running.signal }), { code: "connector_cancelled" });
+  await started; running.abort(); await pending;
+  await assert.rejects(f.service.invoke({ ...input, operation: "metrics.list" }), { code: "connector_provider_timeout" });
+  assert.equal(f.requests.length, before + 2);
+});
+
+test("dbt guide JSON is the actual CLI format and rejects missing or unsafe secret bindings before requests", async (t) => {
+  const guide = await readFile(new URL("../docs/dbt-semantic-layer.md", import.meta.url), "utf8");
+  const text = guide.match(/```json\n([\s\S]*?)\n```/u)[1];
+  const configuration = parseIntegrationConfiguration(text, { providers: [dbtSemanticLayerProvider] });
+  assert.equal(configuration.integrations.metrics.settings.environmentId, "70506183142324");
+  assert.equal(configuration.integrations.metrics.authentication.secretRef, "env:DBT_SERVICE_TOKEN");
+  const f = await fixture(t);
+  for (const key of [undefined, "", "key with spaces", "key\nheader"]) {
+    f.state.key = key; await assert.rejects(f.service.connectApiKey(input), { code: "connector_binding_missing" });
+  }
+  assert.equal(f.requests.length, 0);
+});
+
+
+test("dbt runs bounded metric queries with dimensions and time filters, then decodes explicit result pages without resubmitting", async (t) => {
+  const f = await fixture(t); await f.service.connectApiKey(input);
+  const values = { metrics: [{ name: "order_total", alias: "revenue" }], groupBy: [{ name: "metric_time", grain: "MONTH" }], where: [{ sql: "{{ Dimension('metric_time') }} >= '2026-01-01'" }], limit: 100 };
+  f.state.response = { data: { createQuery: { queryId: "query-123" } } };
+  assert.deepEqual(await f.service.invoke({ ...input, operation: "queries.create", input: values }), f.state.response);
+  assert.deepEqual(f.requests.at(-1).body.variables, { ...values, environmentId });
+  assert(!f.requests.at(-1).body.query.includes(values.where[0].sql));
+  const before = f.requests.length;
+  for (const bad of [{ ...values, metrics: [] }, { ...values, limit: 10001 }, { ...values, groupBy: [{ name: "metric_time", grain: "INVALID" }] }, { ...values, environmentId: "another" }]) {
+    await assert.rejects(f.service.invoke({ ...input, operation: "queries.create", input: bad }), { code: "connector_input_invalid" });
+  }
+  assert.equal(f.requests.length, before);
+  f.state.response = { data: { query: { status: "RUNNING", error: null, totalPages: null, jsonResult: null } } };
+  assert.equal((await f.service.invoke({ ...input, operation: "queries.get", input: { queryId: "query-123" } })).data.query.status, "RUNNING");
+  const table = { schema: { fields: [{ name: "revenue", type: "number" }] }, data: [{ revenue: 123.5 }] };
+  f.state.response = { data: { query: { status: "SUCCESSFUL", error: null, totalPages: 2, jsonResult: JSON.stringify(table) } } };
+  const result = await f.service.invoke({ ...input, operation: "queries.get", input: { queryId: "query-123", pageNum: 2 } });
+  assert.deepEqual(result.data.query.jsonResult, table);
+  assert.deepEqual(f.requests.at(-1).body.variables, { queryId: "query-123", pageNum: 2, environmentId });
+  assert.match(f.requests.at(-1).body.query, /encoded: false/u);
+  for (const jsonResult of ["{", "null", "[]", JSON.stringify({ schema: { fields: [] }, data: Array(1025).fill({}) }), "x".repeat(5 * 1024 * 1024 + 1), null]) {
+    f.state.response = { data: { query: { status: "SUCCESSFUL", error: null, totalPages: 1, jsonResult } } };
+    await assert.rejects(f.service.invoke({ ...input, operation: "queries.get", input: { queryId: "query-123" } }), { code: "connector_response_invalid" });
+  }
+  f.state.response = { data: { query: { status: "FAILED", error: f.state.key, totalPages: null, jsonResult: null } } };
+  await assert.rejects(f.service.invoke({ ...input, operation: "queries.get", input: { queryId: "query-123" } }), error => error.code === "connector_provider_failed" && !error.message.includes(f.state.key));
+  f.state.status = 500;
+  const failedBefore = f.requests.length;
+  await assert.rejects(f.service.invoke({ ...input, operation: "queries.create", input: values }), { code: "connector_provider_failed" });
+  assert.equal(f.requests.length, failedBefore + 1);
+});