@jskit-ai/connectors-catalog 0.1.1

package/test/granola.test.js

@@ -0,0 +1,240 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { granolaProvider, registerGranolaClient } from "../src/server/granola.js";
+
+const noteId = "not_12345678901234";
+const folderId = "fol_12345678901234";
+const summary = { id: noteId, object: "note", title: null, owner: { name: null, email: "fixture@example.test" }, created_at: "2026-09-08T12:00:00Z", updated_at: "2026-09-08T13:00:00Z" };
+const folder = { id: folderId, object: "folder", name: "Fixture folder", parent_folder_id: null };
+const transcript = [{ speaker: { source: "microphone", diarization_label: "Speaker A" }, text: "Fixture text", start_time: "2026-09-08T12:00:00Z", end_time: "2026-09-08T12:00:01Z" }];
+const note = { ...summary, summary_text: "Fixture summary", summary_markdown: null, private_notes_text: null, private_notes_markdown: null, transcript: null };
+const context = { applicationId: "app-one", subjectId: "owner-one" };
+const args = { context, integrationId: "meetings" };
+
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "granola-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const state = { key: "grn_private-fixture-key", status: 200, value: undefined, hang: false };
+  const requests = [];
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { meetings: {
+      provider: "granola", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:GRANOLA_KEY" },
+      settings: { apiUrl: "https://invalid.test" }
+    } } },
+    providers: [{ ...granolaProvider, requestTimeoutMs: 50 }], authorize: async (owner) => owner,
+    resolveReference: async () => state.key,
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(9) }, activeKeyId: "current" }) }),
+    fetchImpl: async (address, init) => {
+      const url = new URL(String(address)); requests.push({ url, init });
+      assert.equal(url.origin, "https://public-api.granola.ai"); assert.equal(init.method, "GET"); assert.equal(init.redirect, "error"); assert.equal(init.credentials, "omit");
+      assert.equal(new Headers(init.headers).get("authorization"), `Bearer ${state.key}`);
+      assert.equal(url.searchParams.has("api_key"), false);
+      if (state.hang) return new Promise((_, reject) => {
+        const timer = setTimeout(() => reject(new Error("Missing abort")), 1000);
+        const abort = () => { clearTimeout(timer); reject(init.signal.reason); };
+        if (init.signal.aborted) abort(); else init.signal.addEventListener("abort", abort, { once: true });
+      });
+      if (state.status === 204) return new Response(null, { status: 204 });
+      if (typeof state.value === "string") return new Response(state.value, { status: state.status });
+      const value = url.pathname === "/v1/notes" ? { notes: [summary], hasMore: true, cursor: "next+=cursor" } :
+        url.pathname === "/v1/folders" ? { folders: [folder], hasMore: false, cursor: null } :
+          url.pathname.endsWith("/transcript") ? { transcript, hasMore: true, cursor: "transcript-next" } :
+            { ...note, transcript: url.searchParams.has("include") ? transcript : null };
+      return Response.json(state.value === undefined ? value : state.value, { status: state.status });
+    }
+  };
+  const service = createConnectionService(options);
+  return { service, options, directory, state, requests, connect: () => service.connectApiKey(args) };
+}
+
+test("Granola verifies a key, encrypts connection files and reads current bindings after restart", async (t) => {
+  const f = await fixture(t); assert.equal((await f.connect()).status, "connected");
+  assert.equal(f.requests[0].url.pathname, "/v1/notes"); assert.equal(f.requests[0].url.searchParams.get("page_size"), "10");
+  for (const name of await readdir(f.directory)) assert.equal((await readFile(path.join(f.directory, name), "utf8")).includes(f.state.key), false);
+  const restarted = createConnectionService(f.options); assert.equal((await restarted.status(args)).status, "connected");
+  f.state.key = "grn_rotated-key";
+  assert.deepEqual(await restarted.invoke({ ...args, operation: "notes.get", input: { note_id: noteId } }), note);
+  assert.equal(f.requests.at(-1).url.search, "");
+  await restarted.disconnect(args); assert.equal((await f.service.status(args)).status, "disconnected");
+  assert.equal(f.requests.length, 2);
+});
+
+test("Granola reads explicit filter and cursor pages and preserves null fields and anonymous speakers", async (t) => {
+  const f = await fixture(t); await f.connect();
+  const list = await f.service.invoke({ ...args, operation: "notes.list", input: {
+    created_after: "2026-09-01", created_before: "2026-09-09T12:00:00.001Z", updated_after: "2026-09-08T00:00:00Z", folder_id: folderId, cursor: "next+=cursor", page_size: 2
+  } });
+  assert.equal(list.notes[0].title, null); assert.equal(list.cursor, "next+=cursor");
+  assert.equal(f.requests.at(-1).url.searchParams.get("cursor"), "next+=cursor"); assert.equal(f.requests.at(-1).url.searchParams.get("folder_id"), folderId);
+  assert.deepEqual((await f.service.invoke({ ...args, operation: "folders.list", input: { page_size: 1 } })).folders, [folder]);
+  assert.deepEqual((await f.service.invoke({ ...args, operation: "notes.get", input: { note_id: noteId, include: "transcript" } })).transcript, transcript);
+  const page = await f.service.invoke({ ...args, operation: "transcripts.list", input: { note_id: noteId, page_size: 100, cursor: "transcript-next" } });
+  assert.equal(page.transcript[0].speaker.attribution, undefined); assert.equal(page.transcript[0].speaker.diarization_label, "Speaker A");
+  assert.equal(f.requests.at(-1).url.pathname, `/v1/notes/${noteId}/transcript`); assert.equal(f.requests.length, 5);
+});
+
+test("Granola rejects invalid IDs, dates, page bounds, arbitrary destinations and writes before transport", async (t) => {
+  const f = await fixture(t); await f.connect(); const before = f.requests.length;
+  for (const input of [{ page_size: 31 }, { page_size: 0 }, { page_size: 1.5 }, { created_after: "2026-02-30" }, { created_after: "2026-09-01T25:00:00Z" },
+    { created_after: "2026-09-01T12:00:00+08:00" }, { updated_after: "tomorrow" }, { folder_id: "../secret" }, { cursor: " " }, { cursor: "x".repeat(8193) }, { url: "https://invalid.test" }]) {
+    await assert.rejects(f.service.invoke({ ...args, operation: "notes.list", input }), { code: "connector_input_invalid" });
+  }
+  for (const input of [{ note_id: "../secret" }, { note_id: "550e8400-e29b-41d4-a716-446655440000" }, { note_id: noteId, include: "all" }]) {
+    await assert.rejects(f.service.invoke({ ...args, operation: "notes.get", input }), { code: "connector_input_invalid" });
+  }
+  await assert.rejects(f.service.invoke({ ...args, operation: "transcripts.list", input: { note_id: noteId, page_size: 101 } }), { code: "connector_input_invalid" });
+  await assert.rejects(f.service.invoke({ ...args, operation: "notes.create" }), { code: "connector_operation_unknown" });
+  assert.equal(f.requests.length, before);
+});
+
+test("Granola accepts empty pages but rejects missing cursors, malformed summaries and mismatched note identities", async (t) => {
+  const f = await fixture(t); f.state.value = { notes: [], hasMore: false, cursor: null }; await f.connect();
+  for (const value of [null, "invalid JSON", {}, { notes: [], hasMore: true, cursor: null }, { notes: [null], hasMore: false, cursor: null },
+    { notes: [summary, summary], hasMore: true, cursor: "next" }, { notes: [], hasMore: "false", cursor: null }, { notes: [], hasMore: false }]) {
+    f.state.value = value;
+    await assert.rejects(f.service.invoke({ ...args, operation: "notes.list", input: { page_size: 1 } }), { code: "connector_response_invalid" });
+  }
+  f.state.value = { ...note, id: "not_abcdefghijklmn" };
+  await assert.rejects(f.service.invoke({ ...args, operation: "notes.get", input: { note_id: noteId } }), { code: "connector_response_invalid" });
+  f.state.value = { transcript: [{ text: "Missing speaker" }], hasMore: false, cursor: null };
+  await assert.rejects(f.service.invoke({ ...args, operation: "transcripts.list", input: { note_id: noteId } }), { code: "connector_response_invalid" });
+  f.state.value = { folders: [{ ...folder, parent_folder_id: "bad" }], hasMore: false, cursor: null };
+  await assert.rejects(f.service.invoke({ ...args, operation: "folders.list" }), { code: "connector_response_invalid" });
+  f.state.status = 204; await assert.rejects(f.service.invoke({ ...args, operation: "notes.list" }), { code: "connector_response_invalid" });
+});
+
+test("Granola distinguishes unavailable notes and oversized inline transcripts without exposing provider text or retrying", async (t) => {
+  const f = await fixture(t); await f.connect();
+  for (const [status, code] of [[403, "connector_permission_denied"], [404, "connector_resource_not_found"], [413, "connector_response_too_large"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    f.state.status = status; f.state.value = { error: { code: "TRANSCRIPT_TOO_LARGE", message: "sensitive provider text" } };
+    const before = f.requests.length;
+    await assert.rejects(f.service.invoke({ ...args, operation: "notes.get", input: { note_id: noteId, include: "transcript" } }), (error) => error.code === code && !error.message.includes("sensitive"));
+    assert.equal(f.requests.length, before + 1);
+  }
+  f.state.status = 200; f.state.value = undefined;
+  assert.deepEqual((await f.service.invoke({ ...args, operation: "transcripts.list", input: { note_id: noteId } })).transcript, transcript);
+  f.state.status = 401; await assert.rejects(f.service.invoke({ ...args, operation: "notes.list" }), { code: "connector_reconnect_required" });
+});
+
+test("Granola isolates owners, honors host policy and preserves a saved connection after failed replacement verification", async (t) => {
+  const f = await fixture(t); await f.connect();
+  for (const owner of [{ ...context, applicationId: "other" }, { ...context, subjectId: "other" }]) {
+    await assert.rejects(f.service.invoke({ ...args, context: owner, operation: "notes.list" }), { code: "connector_reconnect_required" });
+  }
+  const denied = createConnectionService({ ...f.options, authorize: async () => null });
+  await assert.rejects(denied.invoke({ ...args, operation: "notes.list" }), { code: "connector_access_denied" });
+  for (const key of ["plain-key", "grn_", "grn_secret\nvalue"]) {
+    f.state.key = key; await assert.rejects(f.connect(), { code: "connector_binding_missing" });
+  }
+  assert.equal(f.requests.length, 1); assert.equal((await f.service.status(args)).status, "reconnect-required");
+  f.state.key = "grn_replacement"; f.state.status = 401;
+  await assert.rejects(f.connect(), { code: "connector_reconnect_required" });
+  f.state.key = "grn_private-fixture-key"; f.state.status = 200;
+  assert.equal((await f.service.status(args)).status, "connected");
+  await f.service.invoke({ ...args, operation: "notes.list" });
+});
+
+test("Granola cancellation and timeout reach the provider without replay", async (t) => {
+  const f = await fixture(t); await f.connect(); f.state.hang = true;
+  const abort = new AbortController(); const pending = f.service.invoke({ ...args, operation: "notes.list", signal: abort.signal });
+  setTimeout(() => abort.abort(), 10);
+  await assert.rejects(pending, { code: "connector_cancelled" });
+  await assert.rejects(f.service.invoke({ ...args, operation: "notes.list" }), { code: "connector_provider_timeout" });
+  assert.equal(f.requests.length, 3);
+});
+
+test("Granola guide validates the shared reference-only configuration and does not offer API-key mode as per-user OAuth", async () => {
+  const guide = await readFile(new URL("../docs/granola.md", import.meta.url), "utf8"); const json = guide.match(/```json\n([\s\S]*?)\n```/u)[1];
+  assert.equal(parseIntegrationConfiguration(json, { providers: [granolaProvider] }).integrations.meetings.provider, "granola");
+  for (const change of [{ accountMode: "per-user" }, { authentication: { method: "api-key", secretRef: "grn_raw-secret" } },
+    { scopes: ["all-workspace-notes"] }]) {
+    const invalid = JSON.parse(json); Object.assign(invalid.integrations.meetings, change);
+    assert.throws(() => parseIntegrationConfiguration(JSON.stringify(invalid), { providers: [granolaProvider] }));
+  }
+});
+
+
+test("Granola MCP OAuth verifies tools, refreshes after restart and cannot call API-key operations", async (t) => {
+  const f = await fixture(t);
+  const callback = "http://127.0.0.1:4930/granola/callback";
+  const calls = []; let time = Date.now();
+  const scopes = ["openid", "profile", "email", "offline_access"];
+  const options = { ...f.options, now: () => time,
+    configuration: { schemaVersion: 1, registrations: { granola: { source: "own", clientId: "fixture-client",
+      clientSecretRef: "env:GRANOLA_SECRET", callbackUrlRef: "env:GRANOLA_CALLBACK" } }, integrations: {
+      meetings: { provider: "granola", accountMode: "assistant", scopes, authentication: { method: "oauth2", registrationRef: "granola" } }
+    } }, resolveReference: async (ref) => ref === "env:GRANOLA_SECRET" ? "fixture-secret" : callback,
+    fetchImpl: async (address, init) => {
+      const url = String(address); calls.push({ url, init });
+      if (url === "https://mcp-auth.granola.ai/oauth2/token") {
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_secret"), "fixture-secret");
+        assert.equal(body.get("resource"), "https://mcp.granola.ai/mcp");
+        const refresh = body.get("grant_type") === "refresh_token";
+        if (refresh) assert.equal(body.get("refresh_token"), "fixture-refresh");
+        else { assert(body.get("code_verifier")); assert.equal(body.get("redirect_uri"), callback); }
+        return Response.json({ access_token: refresh ? "refreshed-access" : "fixture-access", refresh_token: "fixture-refresh",
+          token_type: "Bearer", expires_in: 60, scope: scopes.join(" ") });
+      }
+      assert.equal(url, "https://mcp.granola.ai/mcp");
+      assert.match(new Headers(init.headers).get("authorization"), /^Bearer (fixture-access|refreshed-access)$/u);
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      const message = JSON.parse(init.body); calls.at(-1).message = message;
+      if (message.id === undefined) return new Response(null, { status: 202 });
+      const result = message.method === "initialize" ? { protocolVersion: message.params.protocolVersion,
+        capabilities: { tools: {} }, serverInfo: { name: "fixture", version: "1" } } :
+        message.method === "tools/list" ? { tools: [] } : { content: [{ type: "text", text: "Fixture note" }] };
+      return Response.json({ jsonrpc: "2.0", id: message.id, result });
+    }
+  };
+  const service = createConnectionService(options);
+  const start = await service.beginAuthorization(args); const url = new URL(start.authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://mcp-auth.granola.ai/oauth2/authorize");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  const completion = { ...args, callbackUrl: `${callback}?state=${url.searchParams.get("state")}&code=fixture` };
+  assert.equal((await service.completeAuthorization(completion)).status, "connected");
+  assert.equal(calls.some((call) => call.message?.method === "tools/call"), false);
+  const before = calls.length;
+  await assert.rejects(service.invoke({ ...args, operation: "notes.list" }), { code: "connector_mode_unavailable" });
+  assert.equal(calls.length, before);
+  await assert.rejects(service.completeAuthorization(completion));
+  time += 61000;
+  const restarted = createConnectionService(options);
+  assert.deepEqual(await restarted.invoke({ ...args, operation: "tools.list" }), { tools: [] });
+  assert.equal(calls.filter((call) => call.url.endsWith("/token")).length, 2);
+  assert.deepEqual(await restarted.invoke({ ...args, operation: "tools.call", input: { name: "get_account_info", arguments: {} } }),
+    { content: [{ type: "text", text: "Fixture note" }] });
+  await restarted.disconnect(args); assert.equal((await restarted.status(args)).status, "disconnected");
+  const key = await fixture(t); await key.connect(); const keyRequests = key.requests.length;
+  await assert.rejects(key.service.invoke({ ...args, operation: "tools.list" }), { code: "connector_mode_unavailable" });
+  assert.equal(key.requests.length, keyRequests);
+});
+
+test("Granola registers the host callback through the existing MCP registration contract", async () => {
+  const requests = [];
+  const result = await registerGranolaClient({ clientName: "Fixture host", callbackUrl: "https://app.example/integrations/granola/callback" }, {
+    fetchImpl: async (url, init) => {
+      requests.push({ url: String(url), body: JSON.parse(init.body) });
+      return Response.json({ ...JSON.parse(init.body), client_id: "client", client_secret: "secret" });
+    }
+  });
+  assert.deepEqual(result, { clientId: "client", clientSecret: "secret" });
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].url, "https://mcp-auth.granola.ai/oauth2/register");
+  assert.deepEqual(requests[0].body.redirect_uris, ["https://app.example/integrations/granola/callback"]);
+  assert.equal(requests[0].body.token_endpoint_auth_method, "client_secret_post");
+});
+
+test("Granola API keys cannot store OAuth identity scopes", () => {
+  const configuration = { schemaVersion: 1, registrations: {}, integrations: { meetings: {
+    provider: "granola", accountMode: "shared", scopes: ["openid"], authentication: { method: "api-key", secretRef: "env:GRANOLA_KEY" }
+  } } };
+  assert.throws(() => parseIntegrationConfiguration(JSON.stringify(configuration), { providers: [granolaProvider] }), error => Boolean(error.fieldErrors?.["integrations.meetings.scopes"]));
+});

package/test/hex.test.js

@@ -0,0 +1,253 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { hexProvider, registerHexClient } from "../src/server/hex.js";
+
+const context = { applicationId: "assistant-host", subjectId: "account-owner" };
+const input = { context, integrationId: "analysis" };
+const callback = "http://127.0.0.1:4919/hex/callback";
+const scopes = ["openid", "profile", "email", "offline_access"];
+const discovery = { tools: [{ name: "search_projects", inputSchema: { type: "object", properties: { query: { type: "string" } } } }] };
+
+async function fixture(t, endpoint = "standard") {
+  const directory = await mkdtemp(path.join(tmpdir(), "hex-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(3) }, activeKeyId: "current" });
+  const origin = { standard: "https://app.hex.tech", eu: "https://eu.hex.tech", hipaa: "https://hc.hex.tech" }[endpoint];
+  const issuer = origin.replace("https://", "https://auth.");
+  const state = { time: Date.now(), scopes, status: 200, list: discovery, call: { content: [{ type: "text", text: "Fixture project results" }] } };
+  const requests = [];
+  const options = {
+    configuration: { schemaVersion: 1, registrations: { hex: { source: "own", clientId: "fixture-client",
+      clientSecretRef: "env:HEX_CLIENT_SECRET", callbackUrlRef: "env:HEX_CALLBACK" } }, integrations: {
+      analysis: { provider: "hex", accountMode: "assistant", scopes, settings: { endpoint },
+        authentication: { method: "oauth2", registrationRef: "hex" } }
+    } },
+    providers: [hexProvider], store: createFileConnectionStore({ directory, protection }), now: () => state.time,
+    authorize: async (owner, request) => request.operation === "tools.call" &&
+      (request.input.name !== "search_projects" || request.input.arguments.query !== "sales question") ? null : owner,
+    resolveReference: async (reference) => reference === "env:HEX_CLIENT_SECRET" ? "fixture-client-secret" : callback,
+    fetchImpl: async (address, init) => {
+      init.signal.throwIfAborted();
+      const url = String(address);
+      requests.push({ url, init, headers: new Headers(init.headers) });
+      if (url === `${issuer}/oauth2/token`) {
+        if (state.tokenError) return Response.json({ error: state.tokenError, error_description: "fixture-client-secret" }, { status: 400 });
+        const refresh = new URLSearchParams(init.body).get("grant_type") === "refresh_token";
+        return Response.json({ token_type: "Bearer", access_token: refresh ? "refreshed-access" : "initial-access",
+          refresh_token: refresh ? "rotated-refresh" : "initial-refresh", expires_in: 60, scope: state.scopes.join(" ") });
+      }
+      assert.equal(url, `${origin}/mcp`);
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      if (state.status !== 200) return new Response("initial-access fixture-client-secret", { status: state.status,
+        headers: { "WWW-Authenticate": 'Bearer resource_metadata="https://unexpected.invalid/auth"' } });
+      const message = JSON.parse(init.body);
+      requests.at(-1).message = message;
+      if (message.id === undefined) return new Response(null, { status: 202 });
+      const result = message.method === "initialize" ? { protocolVersion: message.params.protocolVersion,
+        capabilities: { tools: {} }, serverInfo: { name: "hex-fixture", version: "1" } }
+        : message.method === "tools/list" ? state.list : state.call;
+      if (state.pause && message.method === "tools/call") {
+        state.started();
+        return new Promise((resolve, reject) => init.signal.addEventListener("abort", () => reject(init.signal.reason), { once: true }));
+      }
+      return Response.json({ jsonrpc: "2.0", id: message.id, result }, { headers: { "Mcp-Session-Id": "hex-session" } });
+    }
+  };
+  const service = createConnectionService(options);
+  const complete = async (start, extra = "code=fixture-code") => service.completeAuthorization({ ...input,
+    callbackUrl: `${callback}?state=${new URL(start.authorizationUrl).searchParams.get("state")}&${extra}` });
+  return { service, options, state, requests, origin, issuer, directory, protection, complete };
+}
+
+for (const endpoint of ["standard", "eu", "hipaa"]) {
+  test(`Hex ${endpoint} uses endpoint-specific PKCE and resource-bound grants, verifies discovery and refreshes after file restart`, async (t) => {
+    const { service, options, requests, state, origin, issuer, complete, directory, protection } = await fixture(t, endpoint);
+    const start = await service.beginAuthorization(input);
+    const url = new URL(start.authorizationUrl);
+    assert.equal(url.origin + url.pathname, `${issuer}/oauth2/authorize`);
+    assert.equal(url.searchParams.get("resource"), `${origin}/mcp`);
+    assert.equal(url.searchParams.get("scope"), scopes.join(" "));
+    assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+    assert.equal(requests.length, 0);
+    assert.equal((await complete(start)).status, "connected");
+    const grant = requests.find((request) => request.url === `${issuer}/oauth2/token`);
+    const body = new URLSearchParams(grant.init.body);
+    assert.equal(body.get("resource"), `${origin}/mcp`);
+    assert.equal(body.get("client_secret"), "fixture-client-secret");
+    assert.equal(body.get("redirect_uri"), callback);
+    assert(body.get("code_verifier"));
+    assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 0);
+    for (const request of requests.filter(({ url }) => url.endsWith("/mcp"))) {
+      assert.equal(request.headers.get("authorization"), "Bearer initial-access");
+      assert.equal(request.init.redirect, "error");
+      assert.equal(request.init.credentials, "omit");
+    }
+    const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+    state.time += 61_000;
+    assert.deepEqual(await restarted.invoke({ ...input, operation: "tools.list" }), discovery);
+    const refresh = new URLSearchParams(requests.findLast(({ url }) => url.endsWith("/token")).init.body);
+    assert.equal(refresh.get("resource"), `${origin}/mcp`);
+    assert.equal(refresh.get("refresh_token"), "initial-refresh");
+    assert.equal(requests.at(-1).headers.get("authorization"), "Bearer refreshed-access");
+    assert.equal(requests.at(-1).init.method, "DELETE");
+    for (const name of await readdir(directory)) {
+      const stored = await readFile(path.join(directory, name), "utf8");
+      for (const secret of ["initial-access", "refreshed-access", "initial-refresh", "rotated-refresh", "fixture-client-secret", body.get("code_verifier")]) assert(!stored.includes(secret));
+    }
+    const count = requests.length;
+    await assert.rejects(complete(start), { code: "connector_attempt_invalid" });
+    for (const owner of [{ ...context, applicationId: "another-host" }, { ...context, subjectId: "another-owner" }]) {
+      await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "tools.list" }), { code: "connector_reconnect_required" });
+    }
+    assert.equal(requests.length, count);
+    await restarted.disconnect(input);
+    assert.equal((await service.status(input)).status, "disconnected");
+    assert.equal(requests.length, count);
+  });
+}
+
+test("Hex configuration and changed endpoints cannot bypass account ownership or reuse a pending grant", async (t) => {
+  const { options, service, complete, requests } = await fixture(t);
+  const parse = (config) => parseIntegrationConfiguration(JSON.stringify(config), { providers: [hexProvider] });
+  for (const [field, value] of [["accountMode", "shared"], ["accountMode", "per-user"], ["scopes", ["admin"]], ["settings", { endpoint: "https://unexpected.invalid" }]]) {
+    const config = structuredClone(options.configuration);
+    config.integrations.analysis[field] = value;
+    assert.throws(() => parse(config));
+  }
+  const start = await service.beginAuthorization(input);
+  const config = structuredClone(options.configuration);
+  config.integrations.analysis.settings.endpoint = "eu";
+  const changed = createConnectionService({ ...options, configuration: config });
+  await assert.rejects(changed.completeAuthorization({ ...input, callbackUrl: `${callback}?code=x&state=${new URL(start.authorizationUrl).searchParams.get("state")}` }), { code: "connector_attempt_invalid" });
+  assert.equal(requests.length, 0);
+  await complete(await service.beginAuthorization(input));
+  assert.equal((await changed.status(input)).status, "reconnect-required");
+  const count = requests.length;
+  await assert.rejects(changed.invoke({ ...input, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  assert.equal(requests.length, count);
+});
+
+test("Hex authorizes exact tools and arguments, preserves tool errors and cancels without replay", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await complete(await service.beginAuthorization(input));
+  const count = requests.length;
+  for (const payload of [{ name: "delete_chart", arguments: {} }, { name: "search_projects", arguments: { query: "private question" } }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload }), { code: "connector_access_denied" });
+  }
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list", input: { url: "https://unexpected.invalid" } }), { code: "connector_input_invalid" });
+  assert.equal(requests.length, count);
+  const payload = { name: "search_projects", arguments: { query: "sales question" } };
+  state.call = { content: [{ type: "text", text: "No matching project" }], isError: true };
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.call", input: payload }), state.call);
+  assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/call").message.params, payload);
+  state.pause = true;
+  const started = new Promise((resolve) => { state.started = resolve; });
+  const controller = new AbortController();
+  const pending = assert.rejects(service.invoke({ ...input, operation: "tools.call", input: payload, signal: controller.signal }), { code: "connector_cancelled" });
+  await started;
+  controller.abort();
+  await pending;
+  assert.equal(requests.filter(({ message }) => message?.method === "tools/call").length, 2);
+  assert.equal(requests.at(-1).init.method, "DELETE");
+});
+
+test("Hex denied consent, missing requested identity permissions and malformed discovery never create a grant", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  await assert.rejects(complete(await service.beginAuthorization(input), "error=access_denied"), { code: "connector_consent_denied" });
+  assert.equal(requests.length, 0);
+  state.scopes = ["profile"];
+  await assert.rejects(complete(await service.beginAuthorization(input)), { code: "connector_scope_missing" });
+  assert.equal(requests.length, 1);
+  state.scopes = scopes;
+  state.list = { wrong: [] };
+  await assert.rejects(complete(await service.beginAuthorization(input)), { code: "connector_provider_failed" });
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("Hex HTTP and refresh failures are sanitized and do not follow authentication metadata", async (t) => {
+  const { service, complete, requests, state, origin, issuer } = await fixture(t);
+  for (const [status, code] of [[401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    await assert.rejects(complete(await service.beginAuthorization(input)), (error) => {
+      assert.equal(error.code, code);
+      assert(!error.message.includes("fixture-client-secret"));
+      assert.equal(error.cause, undefined);
+      return true;
+    });
+  }
+  assert(requests.every(({ url }) => url === `${origin}/mcp` || url === `${issuer}/oauth2/token`));
+  state.status = 200;
+  await complete(await service.beginAuthorization(input));
+  state.time += 61_000;
+  state.tokenError = "invalid_grant";
+  await assert.rejects(service.invoke({ ...input, operation: "tools.list" }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});
+
+test("Hex registration uses the SDK and exact selected endpoint with explicit confidential client metadata", async () => {
+  for (const endpoint of ["standard", "eu", "hipaa"]) {
+    const requests = [];
+    const result = await registerHexClient({ endpoint, clientName: "My assistant", callbackUrl: callback, scopes }, {
+      fetchImpl: async (url, init) => {
+        requests.push({ url: String(url), init });
+        return Response.json({ ...JSON.parse(init.body), client_id: "created-client", client_secret: "created-secret", client_secret_expires_at: 0 });
+      }
+    });
+    assert.deepEqual(result, { clientId: "created-client", clientSecret: "created-secret", clientSecretExpiresAt: 0 });
+    assert.equal(requests.length, 1);
+    assert.equal(requests[0].url, `https://auth.${{ standard: "app.hex.tech", eu: "eu.hex.tech", hipaa: "hc.hex.tech" }[endpoint]}/oauth2/register`);
+    assert.equal(requests[0].init.redirect, "error");
+    assert.equal(requests[0].init.credentials, "omit");
+    assert.deepEqual(JSON.parse(requests[0].init.body), { client_name: "My assistant", redirect_uris: [callback], token_endpoint_auth_method: "client_secret_post",
+      grant_types: ["authorization_code", "refresh_token"], response_types: ["code"], scope: scopes.join(" ") });
+  }
+});
+
+test("Hex registration rejects invalid input before HTTP and sanitizes ambiguous provider results without retry", async () => {
+  const valid = { clientName: "CLI client", callbackUrl: callback, scopes };
+  let requests = 0;
+  const options = { fetchImpl: async () => { requests++; throw new Error("secret-provider-response"); } };
+  for (const fields of [{ endpoint: "other" }, { callbackUrl: "http://remote.example/callback" }, { callbackUrl: "https://user:secret@example.test/callback" },
+    { callbackUrl: "https://example.test/callback?other=1" }, { scopes: [] }, { scopes: ["profile"] }, { scopes: ["openid", "openid"] }, { clientName: "" }]) {
+    await assert.rejects(registerHexClient({ ...valid, ...fields }, options));
+  }
+  assert.equal(requests, 0);
+  await assert.rejects(registerHexClient(valid, options), (error) => {
+    assert.equal(error.code, "connector_registration_failed");
+    assert.equal(error.cause, undefined);
+    assert(!error.message.includes("secret-provider-response"));
+    return true;
+  });
+  assert.equal(requests, 1);
+  for (const changes of [{ client_secret: undefined }, { token_endpoint_auth_method: "none" }, { redirect_uris: ["https://unexpected.invalid"] }]) {
+    await assert.rejects(registerHexClient(valid, { fetchImpl: async (url, init) => Response.json({ ...JSON.parse(init.body),
+      client_id: "client", client_secret: "secret", ...changes }) }), { code: "connector_registration_failed" });
+  }
+  const controller = new AbortController();
+  controller.abort();
+  await assert.rejects(registerHexClient(valid, { ...options, signal: controller.signal }), { code: "connector_registration_interrupted" });
+  assert.equal(requests, 1);
+});
+
+test("Hex discovery preserves cursors and empty pages without calling a tool, and the guide imports through the shared parser", async (t) => {
+  const { service, complete, requests, state } = await fixture(t);
+  state.list = { tools: [], nextCursor: "opaque-next" };
+  await complete(await service.beginAuthorization(input));
+  assert.deepEqual(await service.invoke({ ...input, operation: "tools.list", input: { cursor: "opaque-next" } }), state.list);
+  assert.deepEqual(requests.findLast(({ message }) => message?.method === "tools/list").message.params, { cursor: "opaque-next" });
+  assert.equal(requests.some(({ message }) => message?.method === "tools/call"), false);
+  const guide = await readFile(new URL("../docs/hex.md", import.meta.url), "utf8");
+  const json = guide.match(/```json\n([\s\S]*?)\n```/u)[1];
+  const config = parseIntegrationConfiguration(json, { providers: [hexProvider] });
+  assert.equal(config.integrations.analysis.settings.endpoint, "standard");
+  assert.equal(config.integrations.analysis.accountMode, "assistant");
+  delete config.integrations.analysis.settings;
+  assert.equal(parseIntegrationConfiguration(JSON.stringify(config), { providers: [hexProvider] }).integrations.analysis.settings.endpoint, "standard");
+});

package/test/heygen.test.js

@@ -0,0 +1,121 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { heygenProvider, registerHeyGenClient } from "../src/server/heygen.js";
+
+const context = { applicationId: "app-one", subjectId: "owner-one" };
+const args = { context, integrationId: "meetings" };
+async function fixture(t) {
+  const directory = await mkdtemp(path.join(tmpdir(), "heygen-oauth-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const requests = [];
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { meetings: {
+      provider: "heygen", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:HEYGEN_KEY" }
+    } } },
+    providers: [heygenProvider], authorize: async (owner) => owner,
+    resolveReference: async () => "fixture-api-key",
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(7) }, activeKeyId: "current" }) }),
+    fetchImpl: async (url, init) => {
+      requests.push(String(url));
+      assert.equal(String(url), "https://api.heygen.com/v3/users/me");
+      assert.equal(new Headers(init.headers).get("x-api-key"), "fixture-api-key");
+      return Response.json({ data: { username: "fixture" } });
+    }
+  };
+  const service = createConnectionService(options);
+  return { service, options, requests, connect: () => service.connectApiKey(args) };
+}
+
+test("HeyGen MCP OAuth verifies tools, refreshes after restart and cannot call API-key operations", async (t) => {
+  const f = await fixture(t);
+  const callback = "http://127.0.0.1:4930/heygen/callback";
+  const calls = []; let time = Date.now();
+  const scopes = ["openid", "profile", "email"];
+  const tools = [
+    { name: "create_video_agent", description: "Controlled creation fixture", inputSchema: { type: "object", properties: { prompt: { type: "string" } }, required: ["prompt"] } },
+    { name: "get_video_agent_session", description: "Controlled status fixture", inputSchema: { type: "object", properties: { session_id: { type: "string" } }, required: ["session_id"] } }
+  ];
+  const options = { ...f.options, now: () => time,
+    authorize: async (owner, request) => request.operation === "tools.call" && ![
+      "create_video_agent", "get_video_agent_session"
+    ].includes(request.input.name) ? null : owner,
+    configuration: { schemaVersion: 1, registrations: { heygen: { source: "own", clientId: "fixture-client",
+      clientSecretRef: "env:HEYGEN_SECRET", callbackUrlRef: "env:HEYGEN_CALLBACK" } }, integrations: {
+      meetings: { provider: "heygen", accountMode: "assistant", scopes, authentication: { method: "oauth2", registrationRef: "heygen" } }
+    } }, resolveReference: async (ref) => ref === "env:HEYGEN_SECRET" ? "fixture-secret" : callback,
+    fetchImpl: async (address, init) => {
+      const url = String(address); calls.push({ url, init });
+      if (url === "https://api2.heygen.com/v1/oauth/token") {
+        const body = new URLSearchParams(init.body);
+        assert.equal(body.get("client_secret"), "fixture-secret");
+        assert.equal(body.get("resource"), "https://mcp.heygen.com");
+        const refresh = body.get("grant_type") === "refresh_token";
+        if (refresh) assert.equal(body.get("refresh_token"), "fixture-refresh");
+        else { assert(body.get("code_verifier")); assert.equal(body.get("redirect_uri"), callback); }
+        return Response.json({ access_token: refresh ? "refreshed-access" : "fixture-access", refresh_token: "fixture-refresh",
+          token_type: "Bearer", expires_in: 60, scope: scopes.join(" ") });
+      }
+      assert.equal(url, "https://mcp.heygen.com/mcp/v1/");
+      assert.match(new Headers(init.headers).get("authorization"), /^Bearer (fixture-access|refreshed-access)$/u);
+      if (init.method === "DELETE") return new Response(null, { status: 204 });
+      if (init.method === "GET") return new Response(null, { status: 405 });
+      const message = JSON.parse(init.body); calls.at(-1).message = message;
+      if (message.id === undefined) return new Response(null, { status: 202 });
+      const result = message.method === "initialize" ? { protocolVersion: message.params.protocolVersion,
+        capabilities: { tools: {} }, serverInfo: { name: "fixture", version: "1" } } :
+        message.method === "tools/list" ? { tools } : { content: [{ type: "text", text: JSON.stringify(
+          message.params.name === "create_video_agent" ? { session_id: "fixture-session", status: "pending" } :
+          { session_id: "fixture-session", status: "completed", video_url: "https://media.example/fixture.mp4" }
+        ) }] };
+      return Response.json({ jsonrpc: "2.0", id: message.id, result });
+    }
+  };
+  const service = createConnectionService(options);
+  const start = await service.beginAuthorization(args); const url = new URL(start.authorizationUrl);
+  assert.equal(url.origin + url.pathname, "https://api2.heygen.com/v1/oauth/authorize");
+  assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+  const completion = { ...args, callbackUrl: `${callback}?state=${url.searchParams.get("state")}&code=fixture` };
+  assert.equal((await service.completeAuthorization(completion)).status, "connected");
+  assert.equal(calls.some((call) => call.message?.method === "tools/call"), false);
+  const before = calls.length;
+  await assert.rejects(service.invoke({ ...args, operation: "profile.read" }), { code: "connector_mode_unavailable" });
+  assert.equal(calls.length, before);
+  await assert.rejects(service.completeAuthorization(completion));
+  time += 61000;
+  const restarted = createConnectionService(options);
+  assert.deepEqual(await restarted.invoke({ ...args, operation: "tools.list" }), { tools });
+  assert.equal(calls.filter((call) => call.url.endsWith("/token")).length, 2);
+  const creation = await restarted.invoke({ ...args, operation: "tools.call", input: { name: "create_video_agent", arguments: { prompt: "A booking reminder" } } });
+  assert.equal(JSON.parse(creation.content[0].text).session_id, "fixture-session");
+  assert.deepEqual(calls.filter(call => call.message?.method === "tools/call").at(-1).message.params,
+    { name: "create_video_agent", arguments: { prompt: "A booking reminder" } });
+  const status = await restarted.invoke({ ...args, operation: "tools.call", input: { name: "get_video_agent_session", arguments: { session_id: "fixture-session" } } });
+  assert.equal(JSON.parse(status.content[0].text).status, "completed");
+  const beforeDenied = calls.length;
+  await assert.rejects(restarted.invoke({ ...args, operation: "tools.call", input: { name: "delete_video", arguments: { video_id: "other-user" } } }));
+  assert.equal(calls.length, beforeDenied);
+  await restarted.disconnect(args); assert.equal((await restarted.status(args)).status, "disconnected");
+  const key = await fixture(t); await key.connect(); const keyRequests = key.requests.length;
+  await assert.rejects(key.service.invoke({ ...args, operation: "tools.list" }), { code: "connector_mode_unavailable" });
+  assert.equal(key.requests.length, keyRequests);
+});
+
+test("HeyGen registers the host callback through the existing MCP registration contract", async () => {
+  const requests = [];
+  const result = await registerHeyGenClient({ clientName: "Fixture host", callbackUrl: "https://app.example/integrations/heygen/callback" }, {
+    fetchImpl: async (url, init) => {
+      requests.push({ url: String(url), body: JSON.parse(init.body) });
+      return Response.json({ ...JSON.parse(init.body), client_id: "client", client_secret: "secret" });
+    }
+  });
+  assert.deepEqual(result, { clientId: "client", clientSecret: "secret" });
+  assert.equal(requests.length, 1);
+  assert.equal(requests[0].url, "https://api2.heygen.com/v1/oauth/register");
+  assert.deepEqual(requests[0].body.redirect_uris, ["https://app.example/integrations/heygen/callback"]);
+  assert.equal(requests[0].body.token_endpoint_auth_method, "client_secret_post");
+});