@jskit-ai/connectors-catalog 0.1.1

package/test/paddlePermissions.test.js

@@ -0,0 +1,101 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { paddleProvider } from "../src/server/paddle.js";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+
+test("Paddle maps reads to the captured permission and requires exact host approval without executing payments", async () => {
+  let approved = false;
+  const decisions = [];
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { paddle: {
+      provider: "paddle", accountMode: "shared", scopes: [], settings: { environment: "sandbox" },
+      authentication: { method: "api-key", secretRef: "env:PADDLE_API_KEY" },
+      assistantPolicy: { enabled: true, defaultPermission: "ask", actions: { "api.read": "never" } }
+    } } },
+    providers: [paddleProvider], executionMode: "assistant",
+    store: { withConnection: () => assert.fail("No grant access is needed for rejected or host-only actions") },
+    resolveReference: () => assert.fail("No credential is needed for policy checks"),
+    fetchImpl: () => assert.fail("Authorization must not execute a provider payment action"),
+    authorize: async (context, decision) => { decisions.push(decision); return { ...context, approved }; }
+  };
+  const runtime = createConnectionService(options);
+  const input = { context: { applicationId: "app", subjectId: "owner" }, integrationId: "paddle" };
+  await assert.rejects(runtime.invoke({ ...input, operation: "products.list", input: {} }), { code: "connector_access_denied" });
+  assert.equal(decisions.length, 0);
+  const action = { ...input, action: "products.create", input: { name: "Example", price: "1200", currency: "USD" } };
+  await assert.rejects(runtime.authorizeAssistantAction(action), { code: "connector_approval_required" });
+  assert.deepEqual(decisions[0].input, action.input);
+  assert.deepEqual(decisions[0].assistantPermission, { action: "products.create", decision: "ask" });
+  approved = true;
+  await runtime.authorizeAssistantAction(action);
+  await assert.rejects(runtime.authorizeAssistantAction({ ...action, action: "arbitrary.write" }), { code: "connector_operation_unknown" });
+  await assert.rejects(runtime.invoke({ ...input, operation: "unimplemented.payment", input: action.input }), { code: "connector_operation_unknown" });
+});
+
+test("Paddle product and recurring-price writes validate inputs and do not retry failures", async (t) => {
+  const { mkdtemp, rm } = await import("node:fs/promises");
+  const { tmpdir } = await import("node:os");
+  const { join } = await import("node:path");
+  const { createFileConnectionStore, createCredentialProtection } = await import("../../connectors-core/src/server/fileStorage.js");
+  const directory = await mkdtemp(join(tmpdir(), "paddle-writes-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const writes = [];
+  let fail = false;
+  const productId = `pro_${"a".repeat(26)}`;
+  const priceId = `pri_${"b".repeat(26)}`;
+  const webhookId = `ntfset_${"c".repeat(26)}`;
+  const webhookWrites = [];
+  const runtime = createConnectionService({
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { paddle: {
+      provider: "paddle", accountMode: "shared", scopes: [], settings: { environment: "sandbox" },
+      authentication: { method: "api-key", secretRef: "env:PADDLE_API_KEY" }
+    } } }, providers: [paddleProvider], authorize: async (owner) => owner,
+    store: createFileConnectionStore({ directory, protection: createCredentialProtection({ keys: { current: new Uint8Array(32).fill(5) }, activeKeyId: "current" }) }),
+    resolveReference: async () => "private-key",
+    fetchImpl: async (address, init) => {
+      const url = new URL(address);
+      assert.equal(url.origin, "https://sandbox-api.paddle.com");
+      assert.equal(new Headers(init.headers).get("authorization"), "Bearer private-key");
+      if (url.pathname.startsWith("/checkout-domains/")) {
+        assert.equal(init.method, "GET");
+        return Response.json({ data: { id: `chedom_${"d".repeat(26)}`, domain: "app.example.com", status: "action_required" } });
+      }
+      if (init.method === "GET") return Response.json({ data: [], meta: { pagination: { has_more: false } } });
+      if (init.method === "PATCH") {
+        assert.equal(url.pathname, `/notification-settings/${webhookId}`);
+        webhookWrites.push(JSON.parse(init.body));
+        return Response.json({ data: { id: webhookId, active: false, endpoint_secret_key: "private-signing-secret" } });
+      }
+      assert.equal(init.method, "POST");
+      writes.push({ path: url.pathname, body: JSON.parse(init.body) });
+      if (fail) return Response.json({ error: "private-key" }, { status: 500 });
+      return Response.json({ data: { id: url.pathname === "/products" ? productId : priceId } }, { status: 201 });
+    }
+  });
+  const input = { context: { applicationId: "app", subjectId: "owner" }, integrationId: "paddle" };
+  await runtime.connectApiKey(input);
+  const domain = await runtime.invoke({ ...input, operation: "checkoutDomains.get", input: { domain_id: `chedom_${"d".repeat(26)}` } });
+  assert.equal(domain.data.status, "action_required");
+  await assert.rejects(runtime.invoke({ ...input, operation: "checkoutDomains.get", input: { domain_id: "../../escape" } }), { code: "connector_input_invalid" });
+  const product = { name: "Example", tax_category: "saas" };
+  await runtime.invoke({ ...input, operation: "products.create", input: product });
+  const price = { product_id: productId, description: "Monthly subscription", unit_price: { amount: "1200", currency_code: "USD" }, billing_cycle: { interval: "month", frequency: 1 } };
+  await runtime.invoke({ ...input, operation: "prices.create", input: price });
+  assert.deepEqual(writes, [{ path: "/products", body: product }, { path: "/prices", body: price }]);
+  await assert.rejects(runtime.invoke({ ...input, operation: "prices.create", input: { ...price, unit_price: { amount: "12.50", currency_code: "USD" } } }));
+  await assert.rejects(runtime.invoke({ ...input, operation: "products.create", input: { name: "Missing tax category" } }));
+  assert.equal(writes.length, 2);
+  const webhook = await runtime.invoke({ ...input, operation: "webhooks.update", input: {
+    notification_setting_id: webhookId, active: false, subscribed_events: ["transaction.completed"], traffic_source: "simulation"
+  } });
+  assert.deepEqual(webhookWrites, [{ active: false, subscribed_events: ["transaction.completed"], traffic_source: "simulation" }]);
+  assert.equal(JSON.stringify(webhook).includes("private-signing-secret"), false);
+  await assert.rejects(runtime.invoke({ ...input, operation: "webhooks.update", input: { notification_setting_id: webhookId } }), { code: "connector_input_invalid" });
+  await assert.rejects(runtime.invoke({ ...input, operation: "webhooks.update", input: { notification_setting_id: "../../escape", active: false } }), { code: "connector_input_invalid" });
+  assert.equal(webhookWrites.length, 1);
+  fail = true;
+  await assert.rejects(runtime.invoke({ ...input, operation: "products.create", input: product }), (error) => {
+    assert.equal(error.message.includes("private-key"), false); return true;
+  });
+  assert.equal(writes.length, 3);
+});

package/test/perplexityComposition.test.js

@@ -0,0 +1,39 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createPerplexityAnswers } from "../patterns/ai-connections/example/perplexity-answer.js";
+
+const config = { schemaVersion: 1, registrations: {}, integrations: { research: {
+  provider: "perplexity", accountMode: "shared", scopes: [], authentication: { method: "api-key", secretRef: "env:RESEARCH_KEY" }
+} } };
+const input = { context: { applicationId: "app", subjectId: "user" }, integrationId: "research", model: "sonar", question: "What does the source say?" };
+test("Perplexity composition uses the saved slot for cited answers, streaming, cancellation and key rotation", async () => {
+  let key = "fixture-first"; const calls = [];
+  const result = { choices: [{ message: { content: "Answer [1]" } }], citations: ["https://example.test/source"], search_results: [{ url: "https://example.test/source" }], usage: { total_tokens: 10 } };
+  const chunks = [{ choices: [{ delta: { content: "Answer" } }] }, { choices: [], citations: result.citations }];
+  const answer = createPerplexityAnswers({ configuration: config, authorize: async owner => owner,
+    resolveReference: async (ref, owner, slot) => { assert.equal(ref, "env:RESEARCH_KEY"); assert.equal(owner.applicationId, "app"); assert.equal(slot.integrationId, "research"); return key; },
+    createClient: options => ({ chat: { completions: { create: async (body, request) => {
+      calls.push({ options, body, request });
+      return body.stream ? (async function* () { yield* chunks; })() : result;
+    } } } }) });
+  assert.deepEqual(await answer(input), result);
+  assert.equal(calls[0].options.apiKey, key); assert.equal(calls[0].options.baseURL, "https://api.perplexity.ai"); assert.equal(calls[0].options.maxRetries, 0);
+  assert.deepEqual(calls[0].body.messages, [{ role: "user", content: input.question }]);
+  key = "fixture-rotated"; const controller = new AbortController(); const received = [];
+  for await (const chunk of await answer({ ...input, stream: true, signal: controller.signal })) received.push(chunk);
+  assert.deepEqual(received, chunks); assert.equal(calls[1].options.apiKey, key); assert.equal(calls[1].request.signal, controller.signal);
+  controller.abort(); await assert.rejects(answer({ ...input, signal: controller.signal })); assert.equal(calls.length, 2);
+});
+test("Perplexity denies before secret lookup and never exposes missing or malformed bindings", async () => {
+  let lookups = 0; let clients = 0;
+  const options = { configuration: config, authorize: async () => null,
+    resolveReference: async () => { lookups++; throw new Error("private-fixture-secret"); }, createClient: () => { clients++; } };
+  await assert.rejects(createPerplexityAnswers(options)(input), { code: "connector_access_denied" });
+  assert.equal(lookups, 0);
+  const allowed = createPerplexityAnswers({ ...options, authorize: async owner => owner });
+  await assert.rejects(allowed({ ...input, integrationId: "constructor" }), { code: "connector_not_found" });
+  await assert.rejects(allowed({ ...input, question: "" }), { code: "connector_input_invalid" });
+  await assert.rejects(allowed(input), error => error.code === "connector_binding_missing" && !String(error).includes("private-fixture-secret"));
+  for (const key of ["", "MISSING", "bad\nkey"]) await assert.rejects(createPerplexityAnswers({ ...options, authorize: async owner => owner, resolveReference: async () => key })(input), { code: "connector_binding_missing" });
+  assert.equal(clients, 0);
+});

package/test/pipedriveOAuth.test.js

@@ -0,0 +1,140 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { pipedriveProvider } from "../src/server/pipedrive.js";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+
+async function fixture(t, fetchImpl) {
+  const directory = await mkdtemp(join(tmpdir(), "pipedrive-oauth-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(7) }, activeKeyId: "current" });
+  let now = Date.now();
+  const callback = "https://app.example/integrations/pipedrive/callback";
+  const configuration = { schemaVersion: 1, registrations: { crm: { source: "own", clientId: "client-id",
+    tokenEndpointAuthMethod: "client_secret_basic", clientSecretRef: "env:SECRET", callbackUrlRef: "env:CALLBACK" } },
+    integrations: { crm: { provider: "pipedrive", accountMode: "per-user", scopes: [],
+      authentication: { method: "oauth2", registrationRef: "crm" } } } };
+  const service = () => createConnectionService({ configuration, providers: [pipedriveProvider],
+    store: createFileConnectionStore({ directory, protection }), authorize: async (owner) => owner,
+    now: () => now, resolveReference: async (ref) => ref === "env:SECRET" ? "private-secret" : callback, fetchImpl });
+  const input = (subjectId) => ({ context: { applicationId: "app", subjectId }, integrationId: "crm" });
+  async function connect(subjectId) {
+    const runtime = service();
+    const start = await runtime.beginAuthorization(input(subjectId));
+    const url = new URL(start.authorizationUrl);
+    assert.equal(url.origin + url.pathname, "https://oauth.pipedrive.com/oauth/authorize");
+    assert.equal(url.searchParams.get("redirect_uri"), callback);
+    assert.equal(url.searchParams.has("code_challenge"), false);
+    return { runtime, completion: { ...input(subjectId), callbackUrl: `${callback}?code=${subjectId}&state=${url.searchParams.get("state")}` } };
+  }
+  return { service, input, connect, callback, advance: () => { now += 61_000; } };
+}
+
+test("Pipedrive keeps each company's OAuth route and rotated tokens across restarts", async (t) => {
+  const requests = [];
+  const rotations = { alice: 0, bob: 0 };
+  const f = await fixture(t, async (address, init) => {
+    const url = new URL(address);
+    const headers = new Headers(init.headers);
+    if (url.origin === "https://oauth.pipedrive.com") {
+      assert.equal(url.pathname, "/oauth/token");
+      assert.match(headers.get("content-type"), /^application\/x-www-form-urlencoded/);
+      assert.equal(headers.get("authorization"), `Basic ${Buffer.from("client-id:private-secret").toString("base64")}`);
+      const body = new URLSearchParams(init.body);
+      const subject = body.get("code") || body.get("refresh_token").split(":")[0];
+      assert.equal(body.has("client_secret"), false);
+      assert.equal(body.has("code_verifier"), false);
+      if (body.get("grant_type") === "authorization_code") assert.equal(body.get("redirect_uri"), f.callback);
+      else assert.equal(body.get("refresh_token"), `${subject}:${rotations[subject]}`);
+      rotations[subject]++;
+      return Response.json({ token_type: "bearer", access_token: `${subject}:${rotations[subject]}`,
+        refresh_token: `${subject}:${rotations[subject]}`, expires_in: 60, scope: "base",
+        api_domain: `https://${subject}.pipedrive.com` });
+    }
+    const subject = url.hostname.split(".")[0];
+    assert.ok(Object.hasOwn(rotations, subject));
+    assert.equal(url.pathname, "/api/v1/users/me");
+    assert.equal(headers.get("authorization"), `Bearer ${subject}:${rotations[subject]}`);
+    assert.equal(headers.has("x-api-token"), false);
+    requests.push(subject);
+    return Response.json({ success: true, data: { id: subject === "alice" ? 1 : 2 } });
+  });
+  for (const subject of ["alice", "bob"]) {
+    const { runtime, completion } = await f.connect(subject);
+    const result = await runtime.completeAuthorization(completion);
+    assert.equal(result.status, "connected");
+    assert.equal(result.providerData, undefined);
+    await assert.rejects(runtime.completeAuthorization(completion));
+  }
+  for (let i = 0; i < 2; i++) {
+    f.advance();
+    for (const subject of ["alice", "bob"]) {
+      await f.service().invoke({ ...f.input(subject), operation: "profile.read", input: {} });
+    }
+  }
+  assert.deepEqual(rotations, { alice: 3, bob: 3 });
+  assert.deepEqual(requests, ["alice", "bob", "alice", "bob", "alice", "bob"]);
+  await assert.rejects(f.service().invoke({ ...f.input("eve"), operation: "profile.read", input: {} }));
+});
+
+test("Pipedrive rejects missing or foreign company addresses before sending bearer credentials", async (t) => {
+  for (const api_domain of [undefined, "https://evil.example", "https://alice.pipedrive.com.evil.example", "https://alice.pipedrive.com/path", "http://alice.pipedrive.com", "https://user@alice.pipedrive.com", "https://alice.pipedrive.com:443"]) {
+    let requests = 0;
+    const f = await fixture(t, async (address) => {
+      assert.equal(String(address), "https://oauth.pipedrive.com/oauth/token");
+      requests++;
+      return Response.json({ token_type: "bearer", access_token: "private-token", refresh_token: "refresh", api_domain });
+    });
+    const { runtime, completion } = await f.connect("alice");
+    await assert.rejects(runtime.completeAuthorization(completion), { code: "connector_response_invalid" });
+    await assert.rejects(runtime.completeAuthorization(completion));
+    await assert.rejects(runtime.invoke({ ...f.input("alice"), operation: "profile.read", input: {} }));
+    assert.equal(requests, 1);
+  }
+});
+
+test("Pipedrive requires reconnection if refresh changes the company destination", async (t) => {
+  let exchanges = 0;
+  let apiRequests = 0;
+  const f = await fixture(t, async (address) => {
+    if (String(address) === "https://oauth.pipedrive.com/oauth/token") {
+      exchanges++;
+      return Response.json({ token_type: "bearer", access_token: "private-token", refresh_token: "refresh", expires_in: 60,
+        api_domain: `https://${exchanges === 1 ? "alice" : "other"}.pipedrive.com` });
+    }
+    apiRequests++;
+    return Response.json({ success: true, data: { id: 1 } });
+  });
+  const { runtime, completion } = await f.connect("alice");
+  await runtime.completeAuthorization(completion);
+  f.advance();
+  await assert.rejects(f.service().invoke({ ...f.input("alice"), operation: "profile.read", input: {} }), { code: "connector_reconnect_required" });
+  assert.equal(apiRequests, 1);
+  assert.equal((await f.service().status(f.input("alice"))).status, "reconnect-required");
+});
+
+test("Pipedrive CRM calls cannot escape the company bound to each OAuth grant", async t => {
+  const seen = [];
+  const f = await fixture(t, async (address, init) => {
+    const url = new URL(address);
+    if (url.origin === "https://oauth.pipedrive.com") {
+      const subject = new URLSearchParams(init.body).get("code");
+      return Response.json({ token_type: "bearer", access_token: subject, refresh_token: subject, expires_in: 3600, api_domain: `https://${subject}.pipedrive.com` });
+    }
+    const subject = url.hostname.split(".")[0];
+    assert.equal(new Headers(init.headers).get("authorization"), `Bearer ${subject}`);
+    if (url.pathname === "/api/v1/users/me") return Response.json({ success: true, data: { id: 1 } });
+    seen.push({ subject, path: url.pathname, body: init.body });
+    return Response.json({ success: true, data: { id: 2, title: "New lead" } });
+  });
+  for (const subject of ["alice", "bob"]) {
+    const { runtime, completion } = await f.connect(subject); await runtime.completeAuthorization(completion);
+    await f.service().invoke({ ...f.input(subject), operation: "deals.create", input: { title: "New lead" } });
+  }
+  assert.deepEqual(seen.map(x => [x.subject, x.path]), [["alice", "/api/v2/deals"], ["bob", "/api/v2/deals"]]);
+  await assert.rejects(f.service().invoke({ ...f.input("eve"), operation: "deals.get", input: { id: 2 } }), { code: "connector_reconnect_required" });
+  assert.equal(seen.length, 2);
+});

package/test/posthog.test.js

@@ -0,0 +1,200 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { mkdtemp, readdir, readFile, rm } from "node:fs/promises";
+import path from "node:path";
+import { tmpdir } from "node:os";
+import { createConnectionService } from "../../connectors-core/src/server/index.js";
+import { createFileConnectionStore, createCredentialProtection } from "../../connectors-core/src/server/fileStorage.js";
+import { parseIntegrationConfiguration } from "../../connectors-core/src/shared/configuration.js";
+import { posthogProvider } from "../src/server/posthog.js";
+
+const context = { applicationId: "app-one", subjectId: "analytics-team" };
+const input = { context, integrationId: "analytics" };
+const verificationInput = { distinct_id: "explicit-user" };
+const flags = { flags: { checkout: { key: "checkout", enabled: true, variant: "control",
+  reason: { code: "condition_match" }, metadata: { id: 10, version: 1, payload: { colour: "blue" } } } },
+errorsWhileComputingFlags: false, requestId: "fixture-request" };
+
+async function fixture(t, region = "eu") {
+  const directory = await mkdtemp(path.join(tmpdir(), "posthog-connector-"));
+  t.after(() => rm(directory, { recursive: true, force: true }));
+  const protection = createCredentialProtection({ keys: { current: new Uint8Array(32).fill(9) }, activeKeyId: "current" });
+  const requests = [];
+  const state = { token: "phc_fixture_public_token", status: 200, response: flags };
+  const options = {
+    configuration: { schemaVersion: 1, registrations: {}, integrations: { analytics: {
+      provider: "posthog", accountMode: "shared", scopes: [],
+      authentication: { method: "api-key", secretRef: "env:POSTHOG_PROJECT_TOKEN" },
+      settings: { region, projectId: "12345" }, extensions: { fromCli: true }
+    } } },
+    providers: [posthogProvider], authorize: async (owner) => owner,
+    store: createFileConnectionStore({ directory, protection }),
+    resolveReference: async (reference) => { assert.equal(reference, "env:POSTHOG_PROJECT_TOKEN"); return state.token; },
+    fetchImpl: async (address, init) => {
+      requests.push({ url: new URL(String(address)), init, headers: new Headers(init.headers), body: JSON.parse(init.body) });
+      return Response.json(state.response, { status: state.status });
+    }
+  };
+  return { service: createConnectionService(options), options, requests, directory, protection, state };
+}
+
+for (const region of ["eu", "us"]) {
+  test(`PostHog verifies flags in ${region} and retains file ownership across restart and token rotation`, async (t) => {
+    assert.deepEqual(posthogProvider.verificationFields.filter((field) => field.required).map((field) => field.name), Object.keys(verificationInput));
+    const { service, options, requests, directory, protection, state } = await fixture(t, region);
+    const connected = await service.connectApiKey({ ...input, verificationInput });
+    assert.equal(connected.status, "connected");
+    const first = requests[0];
+    assert.equal(first.url.href, `https://${region}.i.posthog.com/flags?v=2`);
+    assert.equal(first.init.method, "POST");
+    assert.equal(first.init.redirect, "error");
+    assert.equal(first.headers.get("content-type"), "application/json");
+    assert.equal(first.headers.has("authorization"), false);
+    assert.match(first.headers.get("user-agent"), /^jskit-connectors\/.+posthog-node\//u);
+    assert.deepEqual(first.body, { ...verificationInput, api_key: state.token });
+    for (const name of await readdir(directory)) {
+      const stored = await readFile(path.join(directory, name), "utf8");
+      assert.doesNotThrow(() => JSON.parse(stored));
+      assert.equal(stored.includes(state.token), false);
+      assert.equal(stored.includes(verificationInput.distinct_id), false);
+    }
+    const restarted = createConnectionService({ ...options, store: createFileConnectionStore({ directory, protection }) });
+    assert.deepEqual(await restarted.status(input), connected);
+    state.token = "phc_rotated_public_token";
+    assert.deepEqual(await restarted.invoke({ ...input, operation: "flags.evaluate", input: verificationInput }), flags);
+    assert.equal(requests.at(-1).body.api_key, state.token);
+    for (const owner of [{ ...context, applicationId: "other-app" }, { ...context, subjectId: "other-team" }]) {
+      await assert.rejects(restarted.invoke({ ...input, context: owner, operation: "flags.evaluate", input: verificationInput }), { code: "connector_reconnect_required" });
+    }
+    assert.equal(requests.length, 2);
+    await restarted.disconnect(input);
+    assert.equal((await service.status(input)).status, "disconnected");
+  });
+}
+
+test("PostHog validates project identity and region using the same portable schema as its form", async (t) => {
+  const { options, requests } = await fixture(t);
+  const parse = (configuration) => parseIntegrationConfiguration(JSON.stringify(configuration), { providers: [posthogProvider] });
+  const configuration = structuredClone(options.configuration);
+  delete configuration.integrations.analytics.settings.region;
+  assert.deepEqual(parse(configuration), options.configuration);
+  for (const projectId of [undefined, "", "abc", "-1", "0", "1.2", "1".repeat(21)]) {
+    configuration.integrations.analytics.settings.projectId = projectId;
+    assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.analytics.settings.projectId"]));
+  }
+  configuration.integrations.analytics.settings = { region: "attacker.invalid", projectId: "12345" };
+  assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.analytics.settings.region"]));
+  configuration.integrations.analytics.settings.region = "eu";
+  configuration.integrations.analytics.authentication.secretRef = "phc_raw_project_token";
+  assert.throws(() => parse(configuration), (error) => Boolean(error.fieldErrors["integrations.analytics.authentication.secretRef"]));
+  assert.equal(requests.length, 0);
+});
+
+test("PostHog never invents a verification subject or substitutes private analytics credentials", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  for (const invalid of [undefined, {}, { distinct_id: "" }, { distinct_id: "x".repeat(201) }, { distinct_id: "user", api_key: "phc_other" }]) {
+    await assert.rejects(service.connectApiKey({ ...input, verificationInput: invalid }), { code: "connector_input_invalid" });
+  }
+  for (const token of ["phx_personal_token", "phs_project_secret", "pha_oauth_token", "phr_refresh_token", "phc_", "phc_bad\nheader"]) {
+    state.token = token;
+    await assert.rejects(service.connectApiKey({ ...input, verificationInput }), { code: "connector_binding_missing" });
+  }
+  assert.deepEqual(await service.status(input), { status: "unconfigured", configurationError: "connector_binding_missing" });
+  state.token = "phc_valid_project_token";
+  assert.equal(requests.length, 0);
+  assert.equal((await service.status(input)).status, "disconnected");
+});
+
+test("PostHog requires re-verification after project or region changes and blocks other API origins", async (t) => {
+  const { service, options, requests } = await fixture(t);
+  await service.connectApiKey({ ...input, verificationInput });
+  for (const [field, value] of [["projectId", "999"], ["region", "us"]]) {
+    const configuration = structuredClone(options.configuration);
+    configuration.integrations.analytics.settings[field] = value;
+    const changed = createConnectionService({ ...options, configuration });
+    assert.equal((await changed.status(input)).status, "reconnect-required");
+    await assert.rejects(changed.invoke({ ...input, operation: "flags.evaluate", input: verificationInput }), { code: "connector_reconnect_required" });
+  }
+  for (const origin of ["https://us.i.posthog.com", "https://eu.posthog.com", "https://attacker.invalid"]) {
+    const wrongHost = createConnectionService({ ...options, providers: [{ ...posthogProvider, operations: {
+      "flags.evaluate": { scopes: [], request: () => ({ method: "POST", url: `${origin}/flags?v=2`, body: verificationInput }) }
+    } }] });
+    await assert.rejects(wrongHost.invoke({ ...input, operation: "flags.evaluate", input: verificationInput }), { code: "connector_destination_invalid" });
+  }
+  assert.equal(requests.length, 1);
+});
+
+test("PostHog preserves flag metadata and subject properties without accepting credential or URL overrides", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey({ ...input, verificationInput });
+  const values = { distinct_id: "user+&=42", groups: { company: "company-42" }, person_properties: { plan: "paid", enabled: false } };
+  assert.deepEqual(await service.invoke({ ...input, operation: "flags.evaluate", input: values }), flags);
+  assert.deepEqual(requests.at(-1).body, { ...values, api_key: state.token });
+  assert.equal(requests.at(-1).url.search, "?v=2");
+  assert.equal(Object.hasOwn(values, "api_key"), false);
+  for (const invalid of [{ ...values, api_key: "phc_other" }, { ...values, url: "https://attacker.invalid" }, { ...values, groups: [] }, { ...values, person_properties: "plan=paid" }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "flags.evaluate", input: invalid }), { code: "connector_input_invalid" });
+  }
+  assert.equal(requests.length, 2);
+  state.response = { flags: {}, errorsWhileComputingFlags: false };
+  assert.deepEqual(await service.invoke({ ...input, operation: "flags.evaluate", input: values }), state.response);
+});
+
+test("PostHog HTTP-200 flag quota and partial failures never imply a usable verified connection", async (t) => {
+  const { service, state } = await fixture(t);
+  for (const [response, code] of [
+    [{ flags: {}, errorsWhileComputingFlags: false, quotaLimited: ["feature_flags"] }, "connector_quota_limited"],
+    [{ ...flags, errorsWhileComputingFlags: true }, "connector_provider_failed"],
+    [{ flags: {} }, "connector_response_invalid"],
+    [{ ...flags, flags: [] }, "connector_response_invalid"],
+    [{ ...flags, quotaLimited: "feature_flags" }, "connector_response_invalid"],
+    [{ ...flags, flags: { checkout: { enabled: "yes" } } }, "connector_response_invalid"],
+    [{ ...flags, flags: { checkout: { enabled: true, variant: {} } } }, "connector_response_invalid"]
+  ]) {
+    state.response = response;
+    await assert.rejects(service.connectApiKey({ ...input, verificationInput }), { code });
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+});
+
+test("PostHog capture is an explicit separate operation and preserves acceptance and quota information", async (t) => {
+  const { service, requests, state } = await fixture(t);
+  await service.connectApiKey({ ...input, verificationInput });
+  state.response = { status: "Ok", quota_limited: ["events"] };
+  const values = { event: "checkout_completed", distinct_id: "user-one", properties: { value: 19, currency: "EUR" } };
+  assert.deepEqual(await service.invoke({ ...input, operation: "events.capture", input: values }), state.response);
+  assert.equal(requests.at(-1).url.href, "https://eu.i.posthog.com/i/v0/e/");
+  assert.deepEqual(requests.at(-1).body, { ...values, api_key: state.token });
+  for (const invalid of [{ ...values, event: "" }, { event: "checkout" }, { ...values, api_key: "phc_other" }, { ...values, properties: { token: "phc_other" } }, { ...values, properties: { distinct_id: "other-user" } }]) {
+    await assert.rejects(service.invoke({ ...input, operation: "events.capture", input: invalid }), { code: "connector_input_invalid" });
+  }
+  assert.equal(requests.length, 2);
+  state.response = { status: "Ok" };
+  await service.invoke({ ...input, operation: "events.capture", input: { event: "page_opened", distinct_id: "user-one" } });
+  assert.deepEqual(requests.at(-1).body.properties, {});
+  for (const malformed of [{}, { status: "Error" }, { status: "Ok", quota_limited: "events" }]) {
+    state.response = malformed;
+    await assert.rejects(service.invoke({ ...input, operation: "events.capture", input: values }), { code: "connector_response_invalid" });
+  }
+});
+
+test("PostHog rejects HTTP failures without leaking response bodies and marks a rejected token for reconnection", async (t) => {
+  const { service, state } = await fixture(t);
+  for (const [status, code] of [[401, "connector_reconnect_required"], [403, "connector_permission_denied"], [429, "connector_rate_limited"], [500, "connector_provider_failed"]]) {
+    state.status = status;
+    state.response = { detail: state.token };
+    await assert.rejects(service.connectApiKey({ ...input, verificationInput }), (error) => {
+      assert.equal(error.code, code);
+      assert.equal(error.message.includes(state.token), false);
+      assert.equal(JSON.stringify(error).includes(state.token), false);
+      return true;
+    });
+    assert.equal((await service.status(input)).status, "disconnected");
+  }
+  state.status = 200;
+  state.response = flags;
+  await service.connectApiKey({ ...input, verificationInput });
+  state.status = 401;
+  await assert.rejects(service.invoke({ ...input, operation: "flags.evaluate", input: verificationInput }), { code: "connector_reconnect_required" });
+  assert.equal((await service.status(input)).status, "reconnect-required");
+});