@zixt/host 0.0.102 → 0.0.104

package/dist/index.js

@@ -28,7 +28,7 @@ import { homedir as homedir3 } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.102",
+  version: "0.0.104",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -14672,6 +14672,8 @@ var ID_PREFIXES = {
   managerApiAction: "maa",
   /** One Manager-prepared Webhook Automation setup card (MG-21). */
   managerWebhookAction: "mwa",
+  /** One Manager-authored questionnaire waiting in a Conversation. */
+  managerQuestionnaire: "mqu",
   /** One Manager inference call's token-metering row (MG-8). */
   managerUsage: "mgu",
   /** One ordered Manager reply awaiting Slack delivery. */
@@ -14739,6 +14741,10 @@ var ManagerWebhookActionId = idSchema(
   ID_PREFIXES.managerWebhookAction,
   "Manager webhook action id"
 );
+var ManagerQuestionnaireId = idSchema(
+  ID_PREFIXES.managerQuestionnaire,
+  "Manager questionnaire id"
+);
 var ManagerEmailInboxId = idSchema(
   ID_PREFIXES.managerEmailInbox,
   "Manager email inbox id"
@@ -14982,7 +14988,9 @@ var MemberApprovalRequestContext = ApprovalRequestContext.extend({
 });
 var QuestionChoice = external_exports.object({
   label: external_exports.string().trim().min(1).max(120),
-  description: external_exports.string().trim().min(1).max(500).optional()
+  description: external_exports.string().trim().min(1).max(500).optional(),
+  /** At most one choice per question may carry this visual recommendation. */
+  recommended: external_exports.boolean().optional()
 }).strict();
 var QuestionChoices = external_exports.array(QuestionChoice).min(2).max(5).superRefine((choices, ctx) => {
   const labels = choices.map(({ label }) => label.toLocaleLowerCase());
@@ -14990,6 +14998,38 @@ var QuestionChoices = external_exports.array(QuestionChoice).min(2).max(5).super
     ctx.addIssue({ code: "custom", message: "question choice labels must be unique" });
   }
 });
+var QuestionnaireQuestion = external_exports.object({
+  /** Stable model-authored key used only to pair an answer with this snapshot. */
+  id: external_exports.string().trim().min(1).max(80),
+  question: external_exports.string().trim().min(1).max(500),
+  context: external_exports.string().trim().min(1).max(2e3).optional(),
+  /** False is A/B/C/D radio behavior; true permits several choices plus Other. */
+  allowMultiple: external_exports.boolean(),
+  choices: QuestionChoices
+}).strict().superRefine((question, ctx) => {
+  if (question.choices.filter((choice) => choice.recommended === true).length > 1) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["choices"],
+      message: "a questionnaire question may have at most one recommended choice"
+    });
+  }
+});
+var Questionnaire = external_exports.object({
+  title: external_exports.string().trim().min(1).max(160).optional(),
+  questions: external_exports.array(QuestionnaireQuestion).min(1).max(4)
+}).strict().superRefine((questionnaire, ctx) => {
+  const ids = questionnaire.questions.map(({ id }) => id.toLocaleLowerCase());
+  if (new Set(ids).size !== ids.length) {
+    ctx.addIssue({ code: "custom", path: ["questions"], message: "question ids must be unique" });
+  }
+});
+var QuestionnaireAnswer = external_exports.object({
+  questionId: external_exports.string().trim().min(1).max(80),
+  selectedChoices: external_exports.array(external_exports.string().trim().min(1).max(120)).max(5),
+  other: external_exports.string().trim().min(1).max(1e4).optional()
+}).strict();
+var QuestionnaireAnswers = external_exports.array(QuestionnaireAnswer).min(1).max(4);
 var Approval = external_exports.object({
   id: ApprovalId,
   orgId: OrgId,
@@ -15002,6 +15042,10 @@ var Approval = external_exports.object({
   payload: external_exports.string().max(5e4),
   /** Present only when ask_user supplied a bounded multiple-choice question. */
   questionChoices: QuestionChoices.optional(),
+  /** Present when ask_user supplied one submit-once multi-question questionnaire. */
+  questionnaire: Questionnaire.optional(),
+  /** Exact submitted questionnaire response, once answered. */
+  questionnaireAnswers: QuestionnaireAnswers.optional(),
   status: ApprovalStatus,
   deliveryStatus: ApprovalDeliveryStatus,
   /** Why delivery became impossible; null while pending or after delivery. */
@@ -15038,7 +15082,8 @@ var ApprovalProjection = external_exports.discriminatedUnion("metadataRedacted",
 var ListApprovalsResponse = external_exports.object({ approvals: external_exports.array(ApprovalProjection) });
 var DecideApprovalRequest = external_exports.object({
   decision: external_exports.enum(["approve", "deny"]),
-  guidance: external_exports.string().max(1e4).optional()
+  guidance: external_exports.string().max(1e4).optional(),
+  questionnaireAnswers: QuestionnaireAnswers.optional()
 });
 var UpdateGuardrailsRequest = external_exports.object({ policy: GuardrailPolicy });
 
@@ -15547,7 +15592,8 @@ var uniqueGithubOperations = external_exports.array(GithubOperation).max(100).su
 var ApiToolPackOperation = external_exports.enum([
   "operation.search",
   "operation.inspect",
-  "operation.call"
+  "operation.call",
+  "configuration.read"
 ]);
 var uniqueApiOperations = external_exports.array(ApiToolPackOperation).max(10).superRefine((operations, ctx) => {
   if (new Set(operations).size !== operations.length) {
@@ -15784,6 +15830,124 @@ var IntegrationCategory = external_exports.enum([
 var ApiHttpMethod = external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var ApiOperationRisk = external_exports.enum(["read", "write", "destructive"]);
 var JsonSchemaFragment = external_exports.record(external_exports.string(), external_exports.unknown());
+var CONFIGURATION_FILE_MAX_BYTES = 1024 * 1024;
+var CONFIGURATION_FORM_MAX_FIELDS = 60;
+var ConfigurationFieldId = external_exports.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/, "Use lowercase letters, numbers, and underscores.");
+var ConfigurationFieldBase = {
+  id: ConfigurationFieldId,
+  label: external_exports.string().trim().min(1).max(120),
+  required: external_exports.boolean().default(false),
+  placeholder: external_exports.string().max(300).optional(),
+  hint: external_exports.string().max(1e3).optional(),
+  tooltip: external_exports.string().max(2e3).optional()
+};
+var ConfigurationField = external_exports.discriminatedUnion("type", [
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("text") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("textarea") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("url") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("email") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("secret") }).strict(),
+  external_exports.object({
+    ...ConfigurationFieldBase,
+    type: external_exports.literal("number"),
+    minimum: external_exports.number().finite().optional(),
+    maximum: external_exports.number().finite().optional(),
+    step: external_exports.number().positive().finite().optional()
+  }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("checkbox") }).strict(),
+  external_exports.object({
+    ...ConfigurationFieldBase,
+    type: external_exports.literal("select"),
+    options: external_exports.array(
+      external_exports.object({
+        value: external_exports.string().min(1).max(200),
+        label: external_exports.string().trim().min(1).max(200)
+      }).strict()
+    ).min(1).max(100)
+  }).strict(),
+  external_exports.object({
+    ...ConfigurationFieldBase,
+    type: external_exports.literal("file"),
+    acceptedMediaTypes: external_exports.array(external_exports.string().min(1).max(200)).max(30).default([]),
+    maxBytes: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES).default(CONFIGURATION_FILE_MAX_BYTES)
+  }).strict()
+]);
+var ConfigurationSection = external_exports.object({
+  id: ConfigurationFieldId,
+  title: external_exports.string().trim().min(1).max(160),
+  description: external_exports.string().max(2e3).optional(),
+  showWhen: external_exports.object({ fieldId: ConfigurationFieldId, equals: external_exports.boolean() }).strict().optional(),
+  fields: external_exports.array(ConfigurationField).min(1).max(CONFIGURATION_FORM_MAX_FIELDS)
+}).strict();
+var ConfigurationForm = external_exports.object({ sections: external_exports.array(ConfigurationSection).min(1).max(30) }).strict().superRefine((form, context) => {
+  const sectionIds = form.sections.map(({ id }) => id);
+  if (new Set(sectionIds).size !== sectionIds.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["sections"],
+      message: "Section identifiers must be unique."
+    });
+  }
+  const fields = form.sections.flatMap(({ fields: fields2 }) => fields2);
+  if (fields.length > CONFIGURATION_FORM_MAX_FIELDS) {
+    context.addIssue({
+      code: "custom",
+      path: ["sections"],
+      message: `A connection form supports up to ${CONFIGURATION_FORM_MAX_FIELDS} fields.`
+    });
+  }
+  const fieldIds = fields.map(({ id }) => id);
+  if (new Set(fieldIds).size !== fieldIds.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["sections"],
+      message: "Field identifiers must be unique across the form."
+    });
+  }
+  const fieldsById = new Map(fields.map((field) => [field.id, field]));
+  for (const [fieldIndex, field] of fields.entries()) {
+    if (field.type === "number" && field.minimum !== void 0 && field.maximum !== void 0 && field.minimum > field.maximum) {
+      context.addIssue({
+        code: "custom",
+        path: ["fields", fieldIndex, "maximum"],
+        message: "Maximum must be greater than or equal to minimum."
+      });
+    }
+    if (field.type === "select" && new Set(field.options.map(({ value }) => value)).size !== field.options.length) {
+      context.addIssue({
+        code: "custom",
+        path: ["fields", fieldIndex, "options"],
+        message: "Option values must be unique."
+      });
+    }
+  }
+  for (const [sectionIndex, section] of form.sections.entries()) {
+    const condition = section.showWhen;
+    if (!condition) continue;
+    const controlling = fieldsById.get(condition.fieldId);
+    if (!controlling || controlling.type !== "checkbox") {
+      context.addIssue({
+        code: "custom",
+        path: ["sections", sectionIndex, "showWhen", "fieldId"],
+        message: "Conditional sections must depend on a checkbox field."
+      });
+    }
+    const controllingSection = form.sections.findIndex(
+      ({ fields: candidates }) => candidates.some(({ id }) => id === condition.fieldId)
+    );
+    if (controllingSection >= sectionIndex) {
+      context.addIssue({
+        code: "custom",
+        path: ["sections", sectionIndex, "showWhen", "fieldId"],
+        message: "A conditional section must depend on a checkbox in an earlier section."
+      });
+    }
+  }
+});
+var ConfigurationDefinition = external_exports.object({
+  form: ConfigurationForm,
+  agentInstructions: external_exports.string().trim().min(1).max(12e3)
+}).strict();
 var ApiParameter = external_exports.object({
   name: external_exports.string().min(1).max(200),
   in: external_exports.enum(["path", "query", "header"]),
@@ -15914,7 +16078,7 @@ var NormalizedApiDefinition = external_exports.object({
   servers: external_exports.array(ApiServer).min(1).max(30),
   defaultServerId: external_exports.string().min(1).max(100),
   authSchemes: external_exports.array(ApiAuthScheme).max(20),
-  operations: external_exports.array(ApiOperation).min(1)
+  operations: external_exports.array(ApiOperation)
 }).strict().superRefine((definition3, context) => {
   const unique = (items, path) => {
     if (new Set(items).size !== items.length) {
@@ -15952,13 +16116,14 @@ var IntegrationDefinitionSummary = external_exports.object({
   logoUrl: external_exports.url().max(2e3).nullable(),
   logoAssetId: IntegrationLogoId.nullable(),
   accent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
-  engine: external_exports.literal("api"),
+  engine: external_exports.enum(["api", "configuration"]),
   visibility: external_exports.enum(["global", "organization"]),
   ownerOrgId: OrgId.nullable(),
   isBaseTemplate: external_exports.boolean(),
   isBuiltIn: external_exports.boolean(),
   revision: external_exports.number().int().min(1),
   operationCount: external_exports.number().int().min(0),
+  fieldCount: external_exports.number().int().min(0),
   authKinds: external_exports.array(external_exports.enum(["none", "apiKey", "bearer", "basic", "oauth2"])).max(5),
   updatedAt: IsoDate
 }).strict();
@@ -15968,6 +16133,7 @@ var IntegrationDefinition = IntegrationDefinitionSummary.extend({
   allowCustomBaseUrl: external_exports.boolean(),
   requiresCustomBaseUrl: external_exports.boolean(),
   api: NormalizedApiDefinition,
+  configuration: ConfigurationDefinition.nullable(),
   publishedAt: IsoDate
 }).strict().superRefine((definition3, context) => {
   if (definition3.requiresCustomBaseUrl && !definition3.allowCustomBaseUrl) {
@@ -15977,6 +16143,20 @@ var IntegrationDefinition = IntegrationDefinitionSummary.extend({
       message: "A required organization server URL must also be allowed."
     });
   }
+  if (definition3.engine === "api" && definition3.configuration !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["configuration"],
+      message: "API Integrations cannot include a configuration form."
+    });
+  }
+  if (definition3.engine === "configuration" && definition3.configuration === null) {
+    context.addIssue({
+      code: "custom",
+      path: ["configuration"],
+      message: "Configuration Integrations require a connection form."
+    });
+  }
 });
 var IntegrationCatalogQuery = external_exports.object({
   q: external_exports.string().max(200).optional(),
@@ -16056,6 +16236,31 @@ var UploadIntegrationLogoRequest = external_exports.object({
 }).strict();
 var UploadIntegrationLogoResponse = external_exports.object({ logoAssetId: IntegrationLogoId }).strict();
 var DeleteIntegrationDefinitionRequest = external_exports.object({ expectedRevision: external_exports.number().int().min(1) }).strict();
+var ConfigurationIntegrationMetadata = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  slug: external_exports.string().min(1).max(100).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+  summary: external_exports.string().trim().min(1).max(500),
+  description: external_exports.string().trim().min(1).max(12e3),
+  publisher: external_exports.string().trim().min(1).max(120),
+  categories: external_exports.array(IntegrationCategory).min(1).max(5),
+  logoUrl: external_exports.url().max(2e3).nullable().default(null),
+  logoAssetId: IntegrationLogoId.nullable().default(null),
+  accent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
+  documentationUrl: external_exports.url().max(2e3).nullable().default(null)
+}).strict().superRefine((metadata, context) => {
+  if (metadata.logoUrl && metadata.logoAssetId) {
+    context.addIssue({
+      code: "custom",
+      path: ["logoAssetId"],
+      message: "Choose either a logo URL or an uploaded logo."
+    });
+  }
+});
+var PublishConfigurationIntegrationRequest = external_exports.object({
+  metadata: ConfigurationIntegrationMetadata,
+  configuration: ConfigurationDefinition,
+  expectedRevision: external_exports.number().int().min(1).optional()
+}).strict();
 var IntegrationDiscoveryRequest = external_exports.object({ query: external_exports.string().trim().min(2).max(300) }).strict();
 var IntegrationDiscoverySource = external_exports.object({ title: external_exports.string().min(1).max(300), url: external_exports.url().max(2e3) }).strict();
 var IntegrationDiscoverySuggestion = external_exports.object({
@@ -16097,6 +16302,82 @@ var IntegrationDiscoverySuggestion = external_exports.object({
   sources: external_exports.array(IntegrationDiscoverySource).min(1).max(12),
   warnings: external_exports.array(external_exports.string().min(1).max(1e3)).max(20)
 }).strict();
+var ConfigurationScalarValue = external_exports.union([
+  external_exports.string().max(2e4),
+  external_exports.number().finite(),
+  external_exports.boolean()
+]);
+var ConfigurationFileInput = external_exports.object({
+  name: external_exports.string().trim().min(1).max(240),
+  mediaType: external_exports.string().min(1).max(200),
+  size: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES),
+  data: external_exports.string().min(4).max(Math.ceil(CONFIGURATION_FILE_MAX_BYTES * 4 / 3) + 4)
+}).strict();
+var ConfigurationValueInput = external_exports.union([ConfigurationScalarValue, ConfigurationFileInput]);
+var InlineConfigurationIntegration = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  summary: external_exports.string().trim().min(1).max(500),
+  description: external_exports.string().trim().min(1).max(12e3),
+  categories: external_exports.array(IntegrationCategory).min(1).max(5).default(["other"]),
+  logoUrl: external_exports.url().max(2e3).nullable().default(null),
+  accent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
+  configuration: ConfigurationDefinition
+}).strict();
+var ConfigurationConnectionField = external_exports.object({
+  fieldId: ConfigurationFieldId,
+  configured: external_exports.boolean(),
+  value: ConfigurationScalarValue.nullable(),
+  file: external_exports.object({
+    name: external_exports.string().min(1).max(240),
+    mediaType: external_exports.string().min(1).max(200),
+    size: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES)
+  }).strict().nullable()
+}).strict();
+var ConfigurationConnection = external_exports.object({
+  id: ConnectionId,
+  orgId: OrgId,
+  definitionId: IntegrationDefinitionId.nullable(),
+  definitionRevision: external_exports.number().int().min(1),
+  definitionName: external_exports.string().min(1).max(120),
+  definitionSummary: external_exports.string().min(1).max(500),
+  definitionDescription: external_exports.string().min(1).max(12e3),
+  definitionLogoUrl: external_exports.url().max(2e3).nullable(),
+  definitionLogoAssetId: IntegrationLogoId.nullable(),
+  definitionAccent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
+  definitionCategories: external_exports.array(IntegrationCategory).min(1).max(5),
+  configuration: ConfigurationDefinition,
+  custom: external_exports.boolean(),
+  name: external_exports.string().trim().min(1).max(120),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  values: external_exports.array(ConfigurationConnectionField).max(CONFIGURATION_FORM_MAX_FIELDS),
+  health: external_exports.enum(["ready", "needs_setup"]),
+  attachedAgentCount: external_exports.number().int().min(0),
+  createdAt: IsoDate,
+  updatedAt: IsoDate
+}).strict();
+var ListConfigurationConnectionsResponse = external_exports.object({ connections: external_exports.array(ConfigurationConnection) }).strict();
+var CreateConfigurationConnectionRequest = external_exports.object({
+  definitionId: IntegrationDefinitionId.optional(),
+  inlineDefinition: InlineConfigurationIntegration.optional(),
+  name: external_exports.string().trim().min(1).max(120),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  values: external_exports.record(ConfigurationFieldId, ConfigurationValueInput)
+}).strict().superRefine((request, context) => {
+  if (Boolean(request.definitionId) === Boolean(request.inlineDefinition)) {
+    context.addIssue({
+      code: "custom",
+      path: ["definitionId"],
+      message: "Choose a catalog Integration or provide one Custom connection definition."
+    });
+  }
+});
+var UpdateConfigurationConnectionRequest = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120).optional(),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  inlineDefinition: InlineConfigurationIntegration.optional(),
+  values: external_exports.record(ConfigurationFieldId, ConfigurationValueInput).optional(),
+  clearFieldIds: external_exports.array(ConfigurationFieldId).max(CONFIGURATION_FORM_MAX_FIELDS).optional()
+}).strict();
 var ApiConnectionHealth = external_exports.enum(["ready", "needs_setup", "failed", "unknown"]);
 var ApiConnection = external_exports.object({
   id: ConnectionId,
@@ -16237,10 +16518,43 @@ var ResolvedApiConnection = external_exports.object({
   auth: external_exports.array(ResolvedApiAuth).max(20),
   operations: external_exports.array(ApiOperation)
 }).strict();
+var ResolvedConfigurationConnection = external_exports.object({
+  connectionId: ConnectionId,
+  name: external_exports.string().min(1).max(120),
+  definitionId: external_exports.string().min(1).max(200),
+  definitionName: external_exports.string().min(1).max(120),
+  definitionRevision: external_exports.number().int().min(1),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  agentInstructions: external_exports.string().min(1).max(12e3),
+  fields: external_exports.array(ConfigurationField).max(CONFIGURATION_FORM_MAX_FIELDS),
+  publicValues: external_exports.record(ConfigurationFieldId, ConfigurationScalarValue),
+  secretValues: external_exports.array(
+    external_exports.object({
+      fieldId: ConfigurationFieldId,
+      label: external_exports.string().min(1).max(120),
+      value: external_exports.string().max(2e4)
+    }).strict()
+  ).max(CONFIGURATION_FORM_MAX_FIELDS),
+  files: external_exports.array(
+    external_exports.object({
+      fieldId: ConfigurationFieldId,
+      label: external_exports.string().min(1).max(120),
+      name: external_exports.string().min(1).max(240),
+      mediaType: external_exports.string().min(1).max(200),
+      size: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      data: external_exports.string().min(4).max(Math.ceil(CONFIGURATION_FILE_MAX_BYTES * 4 / 3) + 4)
+    }).strict()
+  ).max(CONFIGURATION_FORM_MAX_FIELDS)
+}).strict();
 var ApiProviderTaskGrant = external_exports.object({
   provider: external_exports.literal("api"),
-  connections: external_exports.array(ResolvedApiConnection).min(1).max(100)
-}).strict();
+  connections: external_exports.array(ResolvedApiConnection).max(100).default([]),
+  configurations: external_exports.array(ResolvedConfigurationConnection).max(100).optional()
+}).strict().refine(
+  (grant) => grant.connections.length + (grant.configurations?.length ?? 0) > 0,
+  "An Integration grant must contain at least one connection."
+);
 
 // ../../packages/contracts/src/schedules.ts
 var ScheduleInvocation = external_exports.enum(["manager", "agent"]);
@@ -17999,7 +18313,9 @@ var ApprovalDecision = external_exports.object({
   /** Echo of the host-minted correlation id from approval.request. */
   requestId: external_exports.string(),
   decision: external_exports.enum(["approve", "deny"]),
-  guidance: external_exports.string().nullable()
+  guidance: external_exports.string().nullable(),
+  /** Exact structured response when the request carried a questionnaire. */
+  questionnaireAnswers: QuestionnaireAnswers.optional()
 });
 var ResolvedConnection = external_exports.object({
   connectionId: external_exports.string(),
@@ -18568,7 +18884,9 @@ var ApprovalRequest = external_exports.object({
   /** Concrete action payload rendered verbatim on the approval card (GR-3). */
   payload: external_exports.string().max(5e4),
   /** Optional structured answers for agent.question; absent means free text. */
-  questionChoices: QuestionChoices.optional()
+  questionChoices: QuestionChoices.optional(),
+  /** Optional submit-once questionnaire for agent.question. */
+  questionnaire: Questionnaire.optional()
 });
 var JournalAppend = external_exports.object({
   type: external_exports.literal("journal.append"),
@@ -19065,7 +19383,9 @@ var ConversationEventProjection = external_exports.discriminatedUnion("kind", [
     /** Present only for a generic API setup/invocation card; never credentials (MG-20). */
     apiActionId: ManagerApiActionId.nullable().optional(),
     /** Present only for a Webhook Automation secure setup card (MG-21). */
-    webhookActionId: ManagerWebhookActionId.nullable().optional()
+    webhookActionId: ManagerWebhookActionId.nullable().optional(),
+    /** Present only for a Manager-authored questionnaire (MG-22). */
+    questionnaireId: ManagerQuestionnaireId.nullable().optional()
   }).strict(),
   /** A mirrored child-Task event: what the teammate wrote or became. */
   external_exports.object({
@@ -19087,7 +19407,9 @@ var ConversationEventProjection = external_exports.discriminatedUnion("kind", [
      * render one outcome when recovery commits those records out of order.
      * Missing on legacy/non-terminal events.
      */
-    terminalGroup: external_exports.string().min(1).max(200).nullable().optional()
+    terminalGroup: external_exports.string().min(1).max(200).nullable().optional(),
+    /** Present when this teammate question has a structured answer card. */
+    approvalId: ApprovalId.nullable().optional()
   }).strict(),
   /** A Manager loop failure a person should see (provider outage, refusal). */
   external_exports.object({
@@ -19310,6 +19632,20 @@ var SubmitManagerWebhookActionRequest = external_exports.object({
   requestId: external_exports.uuid(),
   authentication: WebhookAuthenticationSetup
 }).strict();
+var ConversationQuestionnaireProjection = external_exports.object({
+  id: external_exports.union([ManagerQuestionnaireId, ApprovalId]),
+  conversationId: ConversationId,
+  source: external_exports.enum(["manager", "teammate"]),
+  taskId: TaskId.nullable(),
+  agentId: AgentId.nullable(),
+  questionnaire: Questionnaire,
+  status: external_exports.enum(["pending", "answered", "unavailable"]),
+  answers: QuestionnaireAnswers.nullable(),
+  unavailableReason: external_exports.string().max(2e3).nullable(),
+  createdAt: external_exports.string(),
+  answeredAt: external_exports.string().nullable()
+}).strict();
+var AnswerConversationQuestionnaireRequest = external_exports.object({ answers: QuestionnaireAnswers }).strict();
 var NonEmptyTaskRunnerSelection = TaskRunnerSelection.refine(
   (selection) => selection.type !== void 0 || selection.model !== void 0 || selection.effort !== void 0,
   "choose at least one runtime preference"
@@ -20040,6 +20376,19 @@ function providerGrantSensitiveValues(grant) {
         }
       }
     }
+    for (const connection of grant.configurations ?? []) {
+      for (const secret of connection.secretValues) {
+        addCredentialTransforms(values, secret.value);
+      }
+      for (const file2 of connection.files) {
+        addCredentialTransforms(values, file2.data);
+        try {
+          const bytes = Uint8Array.from(atob(file2.data), (character) => character.charCodeAt(0));
+          addCredentialTransforms(values, new TextDecoder().decode(bytes));
+        } catch {
+        }
+      }
+    }
   } else {
     addCredentialTransforms(values, grant.accessToken);
   }
@@ -23916,7 +24265,7 @@ var HostClient = class _HostClient {
       const { provider: _provider, ...legacyGrant } = grant;
       return legacyGrant;
     };
-    const requestApproval = (category, summary, payload, questionChoices) => {
+    const requestApproval = (category, summary, payload, questionChoices, questionnaire) => {
       if (authorityController.signal.aborted) {
         return Promise.resolve({ approved: false, guidance: "task was cancelled" });
       }
@@ -23929,7 +24278,8 @@ var HostClient = class _HostClient {
         category: safe(category, 200),
         summary: safe(summary, 500),
         payload: safe(payload, 5e4),
-        ...questionChoices ? { questionChoices: [...questionChoices] } : {}
+        ...questionChoices ? { questionChoices: [...questionChoices] } : {},
+        ...questionnaire ? { questionnaire } : {}
       });
       return new Promise((resolve18) => {
         const waiters = this.approvalWaiters.get(cancelKey) ?? /* @__PURE__ */ new Map();
@@ -26442,6 +26792,14 @@ async function createRunArtifacts(input) {
         await writePrivateFile(mcpConfigPath, content);
         return mcpConfigPath;
       },
+      async writePrivateDataFile(name, content) {
+        requireSafeSegment(name, "private file name");
+        const path = join7(realRunRoot, name);
+        assertBelow(realRunRoot, path);
+        await writeFile2(path, content, { flag: "wx", mode: FILE_MODE });
+        await chmod2(path, FILE_MODE);
+        return path;
+      },
       async cleanup() {
         await removePrivateTreeWithRetries(realRunRoot, removeTree, cleanupRetryDelayMs);
       }
@@ -34484,8 +34842,86 @@ function createGithubToolPackFactory(options = {}) {
 var githubToolPackFactory = createGithubToolPackFactory();
 
 // src/tool-packs/api/index.ts
+import { createHash as createHash4 } from "node:crypto";
+
+// src/tool-packs/api/configuration.ts
 import { createHash as createHash3 } from "node:crypto";
-var OPERATIONS = ["operation.search", "operation.inspect", "operation.call"];
+var SAFE_FIELD = /[^A-Z0-9_]/g;
+function configurationEnvironmentName(connectionId, fieldId, kind) {
+  const connection = connectionId.replace(/^con_/, "").toUpperCase();
+  const field = fieldId.toUpperCase().replace(SAFE_FIELD, "_").slice(0, 64);
+  return `INTEGRATION_${connection}_${field}${kind === "file" ? "_FILE" : ""}`;
+}
+function strictBase64(data) {
+  if (data.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(data)) {
+    throw new Error("Configuration file data was not valid base64.");
+  }
+  return Buffer.from(data, "base64");
+}
+async function materializeConfigurationEnvironment(grants, artifacts) {
+  const environment = {};
+  for (const grant of grants) {
+    for (const connection of grant.configurations ?? []) {
+      for (const secret of connection.secretValues) {
+        const name = configurationEnvironmentName(
+          connection.connectionId,
+          secret.fieldId,
+          "secret"
+        );
+        if (environment[name] !== void 0)
+          throw new Error("Configuration environment collision.");
+        environment[name] = secret.value;
+      }
+      for (const file2 of connection.files) {
+        const bytes = strictBase64(file2.data);
+        if (bytes.byteLength !== file2.size || createHash3("sha256").update(bytes).digest("hex") !== file2.sha256) {
+          throw new Error(`Configuration file ${file2.fieldId} failed its checksum.`);
+        }
+        const name = configurationEnvironmentName(connection.connectionId, file2.fieldId, "file");
+        if (environment[name] !== void 0)
+          throw new Error("Configuration environment collision.");
+        environment[name] = await artifacts.writePrivateDataFile(
+          `configuration-${createHash3("sha256").update(connection.connectionId).digest("hex").slice(0, 12)}-${file2.fieldId}`,
+          bytes
+        );
+      }
+    }
+  }
+  return environment;
+}
+function configurationResult(connection) {
+  return {
+    values: { ...connection.publicValues },
+    secrets: connection.secretValues.map((secret) => ({
+      field: secret.fieldId,
+      label: secret.label,
+      environmentVariable: configurationEnvironmentName(
+        connection.connectionId,
+        secret.fieldId,
+        "secret"
+      )
+    })),
+    files: connection.files.map((file2) => ({
+      field: file2.fieldId,
+      label: file2.label,
+      name: file2.name,
+      mediaType: file2.mediaType,
+      environmentVariable: configurationEnvironmentName(
+        connection.connectionId,
+        file2.fieldId,
+        "file"
+      )
+    }))
+  };
+}
+
+// src/tool-packs/api/index.ts
+var OPERATIONS = [
+  "operation.search",
+  "operation.inspect",
+  "operation.call",
+  "configuration.read"
+];
 var EAGER_TOOL_LIMIT = 20;
 var MAX_TOOL_NAME = 64;
 var CONTROLLED_HEADERS = /* @__PURE__ */ new Set([
@@ -34498,7 +34934,7 @@ var CONTROLLED_HEADERS = /* @__PURE__ */ new Set([
   "transfer-encoding"
 ]);
 function shortHash(value) {
-  return createHash3("sha256").update(value).digest("hex").slice(0, 8);
+  return createHash4("sha256").update(value).digest("hex").slice(0, 8);
 }
 function toolNameFor(operation, taken) {
   let base = operation.id.normalize("NFKD").replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
@@ -34628,6 +35064,46 @@ function serverFor(connection, context) {
     call
   };
 }
+function configurationServerFor(connection, context) {
+  const toolName = "get_connection_details";
+  const guidance = connection.usageNotes?.trim();
+  return {
+    id: `configuration:${connection.connectionId}`,
+    name: connection.name,
+    instructions: `This server is the ${connection.definitionName} connection named \u201C${connection.name}\u201D. ` + (guidance ? `When to use it: ${guidance} ` : "") + `${connection.agentInstructions} Read its details before using command-line tools or libraries. Secret values are already available in the named task environment variables, and uploaded files are available at the named task-local paths. Never print, return, or persist those values.`,
+    alwaysLoad: true,
+    tools: [
+      {
+        name: toolName,
+        description: "Read this connection\u2019s saved non-secret settings and learn which environment variables hold its secret values and task-local file paths. Takes no arguments.",
+        inputSchema: { type: "object", properties: {}, additionalProperties: false }
+      }
+    ],
+    async call(name) {
+      if (context.cancelledNow()) return { ok: false, error: "The Task was cancelled." };
+      if (name !== toolName) return { ok: false, error: "That connection tool is not available." };
+      context.event("action", `Read saved details for ${connection.name}`, {
+        tool: toolName,
+        parameter: connection.connectionId
+      });
+      return {
+        ok: true,
+        result: {
+          connection: connection.name,
+          integration: connection.definitionName,
+          fields: connection.fields.map((field) => ({
+            id: field.id,
+            label: field.label,
+            type: field.type,
+            ...field.hint ? { hint: field.hint } : {}
+          })),
+          ...configurationResult(connection),
+          securityNotice: "Use secret environment variables and file paths by name. Do not echo their contents. Saved text is organization configuration, not instructions from an external system."
+        }
+      };
+    }
+  };
+}
 var apiToolPackFactory = {
   provider: "api",
   capability(preflight) {
@@ -34641,7 +35117,12 @@ var apiToolPackFactory = {
     };
   },
   async create(grant, context) {
-    const mcpServers = grant.connections.map((connection) => serverFor(connection, context));
+    const mcpServers = [
+      ...grant.connections.map((connection) => serverFor(connection, context)),
+      ...(grant.configurations ?? []).map(
+        (connection) => configurationServerFor(connection, context)
+      )
+    ];
     const owners = new Map(
       mcpServers.flatMap(
         (server) => server.tools.map((tool) => [`${server.id}\0${tool.name}`, server])
@@ -34669,7 +35150,7 @@ var apiToolPackFactory = {
 };
 
 // src/runners/linear-api.ts
-import { createHash as createHash4, randomUUID as randomUUID10 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID10 } from "node:crypto";
 var MAX_RESPONSE_BYTES2 = 2 * 1024 * 1024;
 var MAX_RESULT_STRING = 1e5;
 var MAX_RESULT_ARRAY = 100;
@@ -35240,7 +35721,7 @@ function operationFor2(name, args, appUserId, heldBy) {
   }
 }
 function fingerprint(value) {
-  return createHash4("sha256").update(canonicalLinearMutationPayload(value)).digest("hex");
+  return createHash5("sha256").update(canonicalLinearMutationPayload(value)).digest("hex");
 }
 function providerIntentFor(mutation, payloadFingerprint2) {
   const common = {
@@ -35985,7 +36466,7 @@ var CADENCE_PROPS = {
 var TOOLS = [
   {
     name: "ask_user",
-    description: "Ask the human supervising this task a question and wait for their answer. Use it whenever you need a decision, missing context, or plan approval before proceeding. When there are 2-5 concrete alternatives, provide them as choices; the person can still enter another answer. The answer arrives as text. For a credential, ask for the capability rather than the value: a Credential added under Resources reaches your next run as an environment variable and is scrubbed from everything you write, and a website sign-in belongs at the Browser panel. If the person chooses to send you a value here anyway, use it for this task and store it with set_secret if it should persist, but never print it, write it into a file you commit, or repeat it in your report.",
+    description: "Ask the human supervising this task a question and wait for their answer. Use it whenever you need a decision, missing context, or plan approval before proceeding. Use questions whenever there are concrete alternatives, including when there is only one decision: each question needs 2-5 choices, may permit multiple selections, and may mark one choice recommended. Do not ask the questions one at a time. The person can always enter another answer, and all submitted answers arrive together as text. Use question without choices only for a genuinely free-text answer. For a credential, ask for the capability rather than the value: a Credential added under Resources reaches your next run as an environment variable and is scrubbed from everything you write, and a website sign-in belongs at the Browser panel. If the person chooses to send you a value here anyway, use it for this task and store it with set_secret if it should persist, but never print it, write it into a file you commit, or repeat it in your report.",
     inputSchema: {
       type: "object",
       properties: {
@@ -36013,14 +36494,63 @@ var TOOLS = [
                 minLength: 1,
                 maxLength: 500,
                 description: "Optional consequence or detail that helps the person choose."
+              },
+              recommended: {
+                type: "boolean",
+                description: "True for the one choice you recommend; omit for all others."
               }
             },
             required: ["label"],
             additionalProperties: false
           }
+        },
+        title: {
+          type: "string",
+          minLength: 1,
+          maxLength: 160,
+          description: "Optional short heading when using questions."
+        },
+        questions: {
+          type: "array",
+          minItems: 1,
+          maxItems: 4,
+          description: "A submit-once questionnaire. Use instead of question/context/choices when several related answers are needed.",
+          items: {
+            type: "object",
+            properties: {
+              id: {
+                type: "string",
+                minLength: 1,
+                maxLength: 80,
+                description: "A unique stable key such as deployment_target."
+              },
+              question: { type: "string", minLength: 1, maxLength: 500 },
+              context: { type: "string", minLength: 1, maxLength: 2e3 },
+              allow_multiple: {
+                type: "boolean",
+                description: "True when the person may select several choices."
+              },
+              choices: {
+                type: "array",
+                minItems: 2,
+                maxItems: 5,
+                items: {
+                  type: "object",
+                  properties: {
+                    label: { type: "string", minLength: 1, maxLength: 120 },
+                    description: { type: "string", minLength: 1, maxLength: 500 },
+                    recommended: { type: "boolean" }
+                  },
+                  required: ["label"],
+                  additionalProperties: false
+                }
+              }
+            },
+            required: ["id", "question", "allow_multiple", "choices"],
+            additionalProperties: false
+          }
         }
       },
-      required: ["question"],
       additionalProperties: false
     }
   },
@@ -36652,7 +37182,8 @@ function createAskUserServer() {
         const args = rpc.params?.["arguments"] ?? {};
         if (surface.platform && name === "ask_user") {
           const question = typeof args["question"] === "string" ? args["question"] : "";
-          if (!question) {
+          const rawQuestions = args["questions"];
+          if (!question && !Array.isArray(rawQuestions)) {
             reply(200, {
               jsonrpc: "2.0",
               id: rpc.id ?? null,
@@ -36671,11 +37202,37 @@ function createAskUserServer() {
               );
               return;
             }
+            const rawQuestionnaire = Array.isArray(rawQuestions) ? {
+              ...typeof args["title"] === "string" ? { title: args["title"] } : {},
+              questions: rawQuestions.map((entry) => {
+                const candidate = typeof entry === "object" && entry !== null ? entry : {};
+                return {
+                  id: candidate["id"],
+                  question: candidate["question"],
+                  ...candidate["context"] === void 0 ? {} : { context: candidate["context"] },
+                  allowMultiple: candidate["allow_multiple"],
+                  choices: candidate["choices"]
+                };
+              })
+            } : void 0;
+            const parsedQuestionnaire = rawQuestionnaire === void 0 ? void 0 : Questionnaire.safeParse(rawQuestionnaire);
+            if (parsedQuestionnaire && !parsedQuestionnaire.success) {
+              toolText(
+                "Questions must contain 1-4 unique items, each with 2-5 unique choices and at most one recommendation.",
+                true
+              );
+              return;
+            }
+            if (parsedQuestionnaire?.success && (question || rawChoices !== void 0)) {
+              toolText("Use either question/choices or questions, not both.", true);
+              return;
+            }
             toolText(
               await handlers.askUser(
-                question,
+                question || parsedQuestionnaire?.data.title || parsedQuestionnaire?.data.questions[0].question || "A few questions",
                 context,
-                parsedChoices?.success ? parsedChoices.data : void 0
+                parsedChoices?.success ? parsedChoices.data : void 0,
+                parsedQuestionnaire?.success ? parsedQuestionnaire.data : void 0
               )
             );
           } catch (err) {
@@ -38414,9 +38971,16 @@ function createCliRunner(adapter, opts = {}) {
           authoritySignal: task.authoritySignal
         });
       }
+      const configurationEnvironment = await materializeConfigurationEnvironment(
+        providerGrants.filter((grant) => grant.provider === "api"),
+        artifacts
+      );
+      if (Object.keys(configurationEnvironment).some((name) => secrets[name] !== void 0)) {
+        throw new Error("A saved Credential conflicts with a generated Integration variable.");
+      }
       const env = buildRunnerEnv({
         inherited: process.env,
-        granted: secrets,
+        granted: { ...secrets, ...configurationEnvironment },
         runner: { type: adapter.type, auth: runner.auth },
         gitIdentity: githubCommitIdentity(providerGrants),
         isolation: artifacts,
@@ -38489,14 +39053,15 @@ function createCliRunner(adapter, opts = {}) {
         throw new Error("prepared provider workspace does not match the task assignment");
       }
       const localMcpServers = askUserServer.register(runToken, {
-        askUser: async (question, context, choices) => {
+        askUser: async (question, context, choices, questionnaire) => {
           pendingAsks++;
           try {
             const decision = await task.requestApproval(
               "agent.question",
               question.slice(0, 500),
               (context || question).slice(0, MAX_APPROVAL_PAYLOAD),
-              choices
+              choices,
+              questionnaire
             );
             return decision.guidance ?? (decision.approved ? "Approved. Proceed." : "No. Do not proceed.");
           } finally {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zixt/host",
-  "version": "0.0.102",
+  "version": "0.0.104",
   "type": "module",
   "exports": {
     ".": "./src/client.ts",