@zixt/host 0.0.103 → 0.0.104

package/dist/index.js

@@ -28,7 +28,7 @@ import { homedir as homedir3 } from "node:os";
 // package.json
 var package_default = {
   name: "@zixt/host",
-  version: "0.0.103",
+  version: "0.0.104",
   type: "module",
   exports: {
     ".": "./src/client.ts",
@@ -15592,7 +15592,8 @@ var uniqueGithubOperations = external_exports.array(GithubOperation).max(100).su
 var ApiToolPackOperation = external_exports.enum([
   "operation.search",
   "operation.inspect",
-  "operation.call"
+  "operation.call",
+  "configuration.read"
 ]);
 var uniqueApiOperations = external_exports.array(ApiToolPackOperation).max(10).superRefine((operations, ctx) => {
   if (new Set(operations).size !== operations.length) {
@@ -15829,6 +15830,124 @@ var IntegrationCategory = external_exports.enum([
 var ApiHttpMethod = external_exports.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]);
 var ApiOperationRisk = external_exports.enum(["read", "write", "destructive"]);
 var JsonSchemaFragment = external_exports.record(external_exports.string(), external_exports.unknown());
+var CONFIGURATION_FILE_MAX_BYTES = 1024 * 1024;
+var CONFIGURATION_FORM_MAX_FIELDS = 60;
+var ConfigurationFieldId = external_exports.string().min(1).max(64).regex(/^[a-z][a-z0-9_]*$/, "Use lowercase letters, numbers, and underscores.");
+var ConfigurationFieldBase = {
+  id: ConfigurationFieldId,
+  label: external_exports.string().trim().min(1).max(120),
+  required: external_exports.boolean().default(false),
+  placeholder: external_exports.string().max(300).optional(),
+  hint: external_exports.string().max(1e3).optional(),
+  tooltip: external_exports.string().max(2e3).optional()
+};
+var ConfigurationField = external_exports.discriminatedUnion("type", [
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("text") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("textarea") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("url") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("email") }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("secret") }).strict(),
+  external_exports.object({
+    ...ConfigurationFieldBase,
+    type: external_exports.literal("number"),
+    minimum: external_exports.number().finite().optional(),
+    maximum: external_exports.number().finite().optional(),
+    step: external_exports.number().positive().finite().optional()
+  }).strict(),
+  external_exports.object({ ...ConfigurationFieldBase, type: external_exports.literal("checkbox") }).strict(),
+  external_exports.object({
+    ...ConfigurationFieldBase,
+    type: external_exports.literal("select"),
+    options: external_exports.array(
+      external_exports.object({
+        value: external_exports.string().min(1).max(200),
+        label: external_exports.string().trim().min(1).max(200)
+      }).strict()
+    ).min(1).max(100)
+  }).strict(),
+  external_exports.object({
+    ...ConfigurationFieldBase,
+    type: external_exports.literal("file"),
+    acceptedMediaTypes: external_exports.array(external_exports.string().min(1).max(200)).max(30).default([]),
+    maxBytes: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES).default(CONFIGURATION_FILE_MAX_BYTES)
+  }).strict()
+]);
+var ConfigurationSection = external_exports.object({
+  id: ConfigurationFieldId,
+  title: external_exports.string().trim().min(1).max(160),
+  description: external_exports.string().max(2e3).optional(),
+  showWhen: external_exports.object({ fieldId: ConfigurationFieldId, equals: external_exports.boolean() }).strict().optional(),
+  fields: external_exports.array(ConfigurationField).min(1).max(CONFIGURATION_FORM_MAX_FIELDS)
+}).strict();
+var ConfigurationForm = external_exports.object({ sections: external_exports.array(ConfigurationSection).min(1).max(30) }).strict().superRefine((form, context) => {
+  const sectionIds = form.sections.map(({ id }) => id);
+  if (new Set(sectionIds).size !== sectionIds.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["sections"],
+      message: "Section identifiers must be unique."
+    });
+  }
+  const fields = form.sections.flatMap(({ fields: fields2 }) => fields2);
+  if (fields.length > CONFIGURATION_FORM_MAX_FIELDS) {
+    context.addIssue({
+      code: "custom",
+      path: ["sections"],
+      message: `A connection form supports up to ${CONFIGURATION_FORM_MAX_FIELDS} fields.`
+    });
+  }
+  const fieldIds = fields.map(({ id }) => id);
+  if (new Set(fieldIds).size !== fieldIds.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["sections"],
+      message: "Field identifiers must be unique across the form."
+    });
+  }
+  const fieldsById = new Map(fields.map((field) => [field.id, field]));
+  for (const [fieldIndex, field] of fields.entries()) {
+    if (field.type === "number" && field.minimum !== void 0 && field.maximum !== void 0 && field.minimum > field.maximum) {
+      context.addIssue({
+        code: "custom",
+        path: ["fields", fieldIndex, "maximum"],
+        message: "Maximum must be greater than or equal to minimum."
+      });
+    }
+    if (field.type === "select" && new Set(field.options.map(({ value }) => value)).size !== field.options.length) {
+      context.addIssue({
+        code: "custom",
+        path: ["fields", fieldIndex, "options"],
+        message: "Option values must be unique."
+      });
+    }
+  }
+  for (const [sectionIndex, section] of form.sections.entries()) {
+    const condition = section.showWhen;
+    if (!condition) continue;
+    const controlling = fieldsById.get(condition.fieldId);
+    if (!controlling || controlling.type !== "checkbox") {
+      context.addIssue({
+        code: "custom",
+        path: ["sections", sectionIndex, "showWhen", "fieldId"],
+        message: "Conditional sections must depend on a checkbox field."
+      });
+    }
+    const controllingSection = form.sections.findIndex(
+      ({ fields: candidates }) => candidates.some(({ id }) => id === condition.fieldId)
+    );
+    if (controllingSection >= sectionIndex) {
+      context.addIssue({
+        code: "custom",
+        path: ["sections", sectionIndex, "showWhen", "fieldId"],
+        message: "A conditional section must depend on a checkbox in an earlier section."
+      });
+    }
+  }
+});
+var ConfigurationDefinition = external_exports.object({
+  form: ConfigurationForm,
+  agentInstructions: external_exports.string().trim().min(1).max(12e3)
+}).strict();
 var ApiParameter = external_exports.object({
   name: external_exports.string().min(1).max(200),
   in: external_exports.enum(["path", "query", "header"]),
@@ -15959,7 +16078,7 @@ var NormalizedApiDefinition = external_exports.object({
   servers: external_exports.array(ApiServer).min(1).max(30),
   defaultServerId: external_exports.string().min(1).max(100),
   authSchemes: external_exports.array(ApiAuthScheme).max(20),
-  operations: external_exports.array(ApiOperation).min(1)
+  operations: external_exports.array(ApiOperation)
 }).strict().superRefine((definition3, context) => {
   const unique = (items, path) => {
     if (new Set(items).size !== items.length) {
@@ -15997,13 +16116,14 @@ var IntegrationDefinitionSummary = external_exports.object({
   logoUrl: external_exports.url().max(2e3).nullable(),
   logoAssetId: IntegrationLogoId.nullable(),
   accent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
-  engine: external_exports.literal("api"),
+  engine: external_exports.enum(["api", "configuration"]),
   visibility: external_exports.enum(["global", "organization"]),
   ownerOrgId: OrgId.nullable(),
   isBaseTemplate: external_exports.boolean(),
   isBuiltIn: external_exports.boolean(),
   revision: external_exports.number().int().min(1),
   operationCount: external_exports.number().int().min(0),
+  fieldCount: external_exports.number().int().min(0),
   authKinds: external_exports.array(external_exports.enum(["none", "apiKey", "bearer", "basic", "oauth2"])).max(5),
   updatedAt: IsoDate
 }).strict();
@@ -16013,6 +16133,7 @@ var IntegrationDefinition = IntegrationDefinitionSummary.extend({
   allowCustomBaseUrl: external_exports.boolean(),
   requiresCustomBaseUrl: external_exports.boolean(),
   api: NormalizedApiDefinition,
+  configuration: ConfigurationDefinition.nullable(),
   publishedAt: IsoDate
 }).strict().superRefine((definition3, context) => {
   if (definition3.requiresCustomBaseUrl && !definition3.allowCustomBaseUrl) {
@@ -16022,6 +16143,20 @@ var IntegrationDefinition = IntegrationDefinitionSummary.extend({
       message: "A required organization server URL must also be allowed."
     });
   }
+  if (definition3.engine === "api" && definition3.configuration !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["configuration"],
+      message: "API Integrations cannot include a configuration form."
+    });
+  }
+  if (definition3.engine === "configuration" && definition3.configuration === null) {
+    context.addIssue({
+      code: "custom",
+      path: ["configuration"],
+      message: "Configuration Integrations require a connection form."
+    });
+  }
 });
 var IntegrationCatalogQuery = external_exports.object({
   q: external_exports.string().max(200).optional(),
@@ -16101,6 +16236,31 @@ var UploadIntegrationLogoRequest = external_exports.object({
 }).strict();
 var UploadIntegrationLogoResponse = external_exports.object({ logoAssetId: IntegrationLogoId }).strict();
 var DeleteIntegrationDefinitionRequest = external_exports.object({ expectedRevision: external_exports.number().int().min(1) }).strict();
+var ConfigurationIntegrationMetadata = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  slug: external_exports.string().min(1).max(100).regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+  summary: external_exports.string().trim().min(1).max(500),
+  description: external_exports.string().trim().min(1).max(12e3),
+  publisher: external_exports.string().trim().min(1).max(120),
+  categories: external_exports.array(IntegrationCategory).min(1).max(5),
+  logoUrl: external_exports.url().max(2e3).nullable().default(null),
+  logoAssetId: IntegrationLogoId.nullable().default(null),
+  accent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
+  documentationUrl: external_exports.url().max(2e3).nullable().default(null)
+}).strict().superRefine((metadata, context) => {
+  if (metadata.logoUrl && metadata.logoAssetId) {
+    context.addIssue({
+      code: "custom",
+      path: ["logoAssetId"],
+      message: "Choose either a logo URL or an uploaded logo."
+    });
+  }
+});
+var PublishConfigurationIntegrationRequest = external_exports.object({
+  metadata: ConfigurationIntegrationMetadata,
+  configuration: ConfigurationDefinition,
+  expectedRevision: external_exports.number().int().min(1).optional()
+}).strict();
 var IntegrationDiscoveryRequest = external_exports.object({ query: external_exports.string().trim().min(2).max(300) }).strict();
 var IntegrationDiscoverySource = external_exports.object({ title: external_exports.string().min(1).max(300), url: external_exports.url().max(2e3) }).strict();
 var IntegrationDiscoverySuggestion = external_exports.object({
@@ -16142,6 +16302,82 @@ var IntegrationDiscoverySuggestion = external_exports.object({
   sources: external_exports.array(IntegrationDiscoverySource).min(1).max(12),
   warnings: external_exports.array(external_exports.string().min(1).max(1e3)).max(20)
 }).strict();
+var ConfigurationScalarValue = external_exports.union([
+  external_exports.string().max(2e4),
+  external_exports.number().finite(),
+  external_exports.boolean()
+]);
+var ConfigurationFileInput = external_exports.object({
+  name: external_exports.string().trim().min(1).max(240),
+  mediaType: external_exports.string().min(1).max(200),
+  size: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES),
+  data: external_exports.string().min(4).max(Math.ceil(CONFIGURATION_FILE_MAX_BYTES * 4 / 3) + 4)
+}).strict();
+var ConfigurationValueInput = external_exports.union([ConfigurationScalarValue, ConfigurationFileInput]);
+var InlineConfigurationIntegration = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120),
+  summary: external_exports.string().trim().min(1).max(500),
+  description: external_exports.string().trim().min(1).max(12e3),
+  categories: external_exports.array(IntegrationCategory).min(1).max(5).default(["other"]),
+  logoUrl: external_exports.url().max(2e3).nullable().default(null),
+  accent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
+  configuration: ConfigurationDefinition
+}).strict();
+var ConfigurationConnectionField = external_exports.object({
+  fieldId: ConfigurationFieldId,
+  configured: external_exports.boolean(),
+  value: ConfigurationScalarValue.nullable(),
+  file: external_exports.object({
+    name: external_exports.string().min(1).max(240),
+    mediaType: external_exports.string().min(1).max(200),
+    size: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES)
+  }).strict().nullable()
+}).strict();
+var ConfigurationConnection = external_exports.object({
+  id: ConnectionId,
+  orgId: OrgId,
+  definitionId: IntegrationDefinitionId.nullable(),
+  definitionRevision: external_exports.number().int().min(1),
+  definitionName: external_exports.string().min(1).max(120),
+  definitionSummary: external_exports.string().min(1).max(500),
+  definitionDescription: external_exports.string().min(1).max(12e3),
+  definitionLogoUrl: external_exports.url().max(2e3).nullable(),
+  definitionLogoAssetId: IntegrationLogoId.nullable(),
+  definitionAccent: external_exports.string().regex(/^#[0-9A-Fa-f]{6}$/),
+  definitionCategories: external_exports.array(IntegrationCategory).min(1).max(5),
+  configuration: ConfigurationDefinition,
+  custom: external_exports.boolean(),
+  name: external_exports.string().trim().min(1).max(120),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  values: external_exports.array(ConfigurationConnectionField).max(CONFIGURATION_FORM_MAX_FIELDS),
+  health: external_exports.enum(["ready", "needs_setup"]),
+  attachedAgentCount: external_exports.number().int().min(0),
+  createdAt: IsoDate,
+  updatedAt: IsoDate
+}).strict();
+var ListConfigurationConnectionsResponse = external_exports.object({ connections: external_exports.array(ConfigurationConnection) }).strict();
+var CreateConfigurationConnectionRequest = external_exports.object({
+  definitionId: IntegrationDefinitionId.optional(),
+  inlineDefinition: InlineConfigurationIntegration.optional(),
+  name: external_exports.string().trim().min(1).max(120),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  values: external_exports.record(ConfigurationFieldId, ConfigurationValueInput)
+}).strict().superRefine((request, context) => {
+  if (Boolean(request.definitionId) === Boolean(request.inlineDefinition)) {
+    context.addIssue({
+      code: "custom",
+      path: ["definitionId"],
+      message: "Choose a catalog Integration or provide one Custom connection definition."
+    });
+  }
+});
+var UpdateConfigurationConnectionRequest = external_exports.object({
+  name: external_exports.string().trim().min(1).max(120).optional(),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  inlineDefinition: InlineConfigurationIntegration.optional(),
+  values: external_exports.record(ConfigurationFieldId, ConfigurationValueInput).optional(),
+  clearFieldIds: external_exports.array(ConfigurationFieldId).max(CONFIGURATION_FORM_MAX_FIELDS).optional()
+}).strict();
 var ApiConnectionHealth = external_exports.enum(["ready", "needs_setup", "failed", "unknown"]);
 var ApiConnection = external_exports.object({
   id: ConnectionId,
@@ -16282,10 +16518,43 @@ var ResolvedApiConnection = external_exports.object({
   auth: external_exports.array(ResolvedApiAuth).max(20),
   operations: external_exports.array(ApiOperation)
 }).strict();
+var ResolvedConfigurationConnection = external_exports.object({
+  connectionId: ConnectionId,
+  name: external_exports.string().min(1).max(120),
+  definitionId: external_exports.string().min(1).max(200),
+  definitionName: external_exports.string().min(1).max(120),
+  definitionRevision: external_exports.number().int().min(1),
+  usageNotes: external_exports.string().max(4e3).optional(),
+  agentInstructions: external_exports.string().min(1).max(12e3),
+  fields: external_exports.array(ConfigurationField).max(CONFIGURATION_FORM_MAX_FIELDS),
+  publicValues: external_exports.record(ConfigurationFieldId, ConfigurationScalarValue),
+  secretValues: external_exports.array(
+    external_exports.object({
+      fieldId: ConfigurationFieldId,
+      label: external_exports.string().min(1).max(120),
+      value: external_exports.string().max(2e4)
+    }).strict()
+  ).max(CONFIGURATION_FORM_MAX_FIELDS),
+  files: external_exports.array(
+    external_exports.object({
+      fieldId: ConfigurationFieldId,
+      label: external_exports.string().min(1).max(120),
+      name: external_exports.string().min(1).max(240),
+      mediaType: external_exports.string().min(1).max(200),
+      size: external_exports.number().int().min(1).max(CONFIGURATION_FILE_MAX_BYTES),
+      sha256: external_exports.string().regex(/^[a-f0-9]{64}$/),
+      data: external_exports.string().min(4).max(Math.ceil(CONFIGURATION_FILE_MAX_BYTES * 4 / 3) + 4)
+    }).strict()
+  ).max(CONFIGURATION_FORM_MAX_FIELDS)
+}).strict();
 var ApiProviderTaskGrant = external_exports.object({
   provider: external_exports.literal("api"),
-  connections: external_exports.array(ResolvedApiConnection).min(1).max(100)
-}).strict();
+  connections: external_exports.array(ResolvedApiConnection).max(100).default([]),
+  configurations: external_exports.array(ResolvedConfigurationConnection).max(100).optional()
+}).strict().refine(
+  (grant) => grant.connections.length + (grant.configurations?.length ?? 0) > 0,
+  "An Integration grant must contain at least one connection."
+);
 
 // ../../packages/contracts/src/schedules.ts
 var ScheduleInvocation = external_exports.enum(["manager", "agent"]);
@@ -20107,6 +20376,19 @@ function providerGrantSensitiveValues(grant) {
         }
       }
     }
+    for (const connection of grant.configurations ?? []) {
+      for (const secret of connection.secretValues) {
+        addCredentialTransforms(values, secret.value);
+      }
+      for (const file2 of connection.files) {
+        addCredentialTransforms(values, file2.data);
+        try {
+          const bytes = Uint8Array.from(atob(file2.data), (character) => character.charCodeAt(0));
+          addCredentialTransforms(values, new TextDecoder().decode(bytes));
+        } catch {
+        }
+      }
+    }
   } else {
     addCredentialTransforms(values, grant.accessToken);
   }
@@ -26510,6 +26792,14 @@ async function createRunArtifacts(input) {
         await writePrivateFile(mcpConfigPath, content);
         return mcpConfigPath;
       },
+      async writePrivateDataFile(name, content) {
+        requireSafeSegment(name, "private file name");
+        const path = join7(realRunRoot, name);
+        assertBelow(realRunRoot, path);
+        await writeFile2(path, content, { flag: "wx", mode: FILE_MODE });
+        await chmod2(path, FILE_MODE);
+        return path;
+      },
       async cleanup() {
         await removePrivateTreeWithRetries(realRunRoot, removeTree, cleanupRetryDelayMs);
       }
@@ -34552,8 +34842,86 @@ function createGithubToolPackFactory(options = {}) {
 var githubToolPackFactory = createGithubToolPackFactory();
 
 // src/tool-packs/api/index.ts
+import { createHash as createHash4 } from "node:crypto";
+
+// src/tool-packs/api/configuration.ts
 import { createHash as createHash3 } from "node:crypto";
-var OPERATIONS = ["operation.search", "operation.inspect", "operation.call"];
+var SAFE_FIELD = /[^A-Z0-9_]/g;
+function configurationEnvironmentName(connectionId, fieldId, kind) {
+  const connection = connectionId.replace(/^con_/, "").toUpperCase();
+  const field = fieldId.toUpperCase().replace(SAFE_FIELD, "_").slice(0, 64);
+  return `INTEGRATION_${connection}_${field}${kind === "file" ? "_FILE" : ""}`;
+}
+function strictBase64(data) {
+  if (data.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(data)) {
+    throw new Error("Configuration file data was not valid base64.");
+  }
+  return Buffer.from(data, "base64");
+}
+async function materializeConfigurationEnvironment(grants, artifacts) {
+  const environment = {};
+  for (const grant of grants) {
+    for (const connection of grant.configurations ?? []) {
+      for (const secret of connection.secretValues) {
+        const name = configurationEnvironmentName(
+          connection.connectionId,
+          secret.fieldId,
+          "secret"
+        );
+        if (environment[name] !== void 0)
+          throw new Error("Configuration environment collision.");
+        environment[name] = secret.value;
+      }
+      for (const file2 of connection.files) {
+        const bytes = strictBase64(file2.data);
+        if (bytes.byteLength !== file2.size || createHash3("sha256").update(bytes).digest("hex") !== file2.sha256) {
+          throw new Error(`Configuration file ${file2.fieldId} failed its checksum.`);
+        }
+        const name = configurationEnvironmentName(connection.connectionId, file2.fieldId, "file");
+        if (environment[name] !== void 0)
+          throw new Error("Configuration environment collision.");
+        environment[name] = await artifacts.writePrivateDataFile(
+          `configuration-${createHash3("sha256").update(connection.connectionId).digest("hex").slice(0, 12)}-${file2.fieldId}`,
+          bytes
+        );
+      }
+    }
+  }
+  return environment;
+}
+function configurationResult(connection) {
+  return {
+    values: { ...connection.publicValues },
+    secrets: connection.secretValues.map((secret) => ({
+      field: secret.fieldId,
+      label: secret.label,
+      environmentVariable: configurationEnvironmentName(
+        connection.connectionId,
+        secret.fieldId,
+        "secret"
+      )
+    })),
+    files: connection.files.map((file2) => ({
+      field: file2.fieldId,
+      label: file2.label,
+      name: file2.name,
+      mediaType: file2.mediaType,
+      environmentVariable: configurationEnvironmentName(
+        connection.connectionId,
+        file2.fieldId,
+        "file"
+      )
+    }))
+  };
+}
+
+// src/tool-packs/api/index.ts
+var OPERATIONS = [
+  "operation.search",
+  "operation.inspect",
+  "operation.call",
+  "configuration.read"
+];
 var EAGER_TOOL_LIMIT = 20;
 var MAX_TOOL_NAME = 64;
 var CONTROLLED_HEADERS = /* @__PURE__ */ new Set([
@@ -34566,7 +34934,7 @@ var CONTROLLED_HEADERS = /* @__PURE__ */ new Set([
   "transfer-encoding"
 ]);
 function shortHash(value) {
-  return createHash3("sha256").update(value).digest("hex").slice(0, 8);
+  return createHash4("sha256").update(value).digest("hex").slice(0, 8);
 }
 function toolNameFor(operation, taken) {
   let base = operation.id.normalize("NFKD").replace(/[^A-Za-z0-9_-]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
@@ -34696,6 +35064,46 @@ function serverFor(connection, context) {
     call
   };
 }
+function configurationServerFor(connection, context) {
+  const toolName = "get_connection_details";
+  const guidance = connection.usageNotes?.trim();
+  return {
+    id: `configuration:${connection.connectionId}`,
+    name: connection.name,
+    instructions: `This server is the ${connection.definitionName} connection named \u201C${connection.name}\u201D. ` + (guidance ? `When to use it: ${guidance} ` : "") + `${connection.agentInstructions} Read its details before using command-line tools or libraries. Secret values are already available in the named task environment variables, and uploaded files are available at the named task-local paths. Never print, return, or persist those values.`,
+    alwaysLoad: true,
+    tools: [
+      {
+        name: toolName,
+        description: "Read this connection\u2019s saved non-secret settings and learn which environment variables hold its secret values and task-local file paths. Takes no arguments.",
+        inputSchema: { type: "object", properties: {}, additionalProperties: false }
+      }
+    ],
+    async call(name) {
+      if (context.cancelledNow()) return { ok: false, error: "The Task was cancelled." };
+      if (name !== toolName) return { ok: false, error: "That connection tool is not available." };
+      context.event("action", `Read saved details for ${connection.name}`, {
+        tool: toolName,
+        parameter: connection.connectionId
+      });
+      return {
+        ok: true,
+        result: {
+          connection: connection.name,
+          integration: connection.definitionName,
+          fields: connection.fields.map((field) => ({
+            id: field.id,
+            label: field.label,
+            type: field.type,
+            ...field.hint ? { hint: field.hint } : {}
+          })),
+          ...configurationResult(connection),
+          securityNotice: "Use secret environment variables and file paths by name. Do not echo their contents. Saved text is organization configuration, not instructions from an external system."
+        }
+      };
+    }
+  };
+}
 var apiToolPackFactory = {
   provider: "api",
   capability(preflight) {
@@ -34709,7 +35117,12 @@ var apiToolPackFactory = {
     };
   },
   async create(grant, context) {
-    const mcpServers = grant.connections.map((connection) => serverFor(connection, context));
+    const mcpServers = [
+      ...grant.connections.map((connection) => serverFor(connection, context)),
+      ...(grant.configurations ?? []).map(
+        (connection) => configurationServerFor(connection, context)
+      )
+    ];
     const owners = new Map(
       mcpServers.flatMap(
         (server) => server.tools.map((tool) => [`${server.id}\0${tool.name}`, server])
@@ -34737,7 +35150,7 @@ var apiToolPackFactory = {
 };
 
 // src/runners/linear-api.ts
-import { createHash as createHash4, randomUUID as randomUUID10 } from "node:crypto";
+import { createHash as createHash5, randomUUID as randomUUID10 } from "node:crypto";
 var MAX_RESPONSE_BYTES2 = 2 * 1024 * 1024;
 var MAX_RESULT_STRING = 1e5;
 var MAX_RESULT_ARRAY = 100;
@@ -35308,7 +35721,7 @@ function operationFor2(name, args, appUserId, heldBy) {
   }
 }
 function fingerprint(value) {
-  return createHash4("sha256").update(canonicalLinearMutationPayload(value)).digest("hex");
+  return createHash5("sha256").update(canonicalLinearMutationPayload(value)).digest("hex");
 }
 function providerIntentFor(mutation, payloadFingerprint2) {
   const common = {
@@ -38558,9 +38971,16 @@ function createCliRunner(adapter, opts = {}) {
           authoritySignal: task.authoritySignal
         });
       }
+      const configurationEnvironment = await materializeConfigurationEnvironment(
+        providerGrants.filter((grant) => grant.provider === "api"),
+        artifacts
+      );
+      if (Object.keys(configurationEnvironment).some((name) => secrets[name] !== void 0)) {
+        throw new Error("A saved Credential conflicts with a generated Integration variable.");
+      }
       const env = buildRunnerEnv({
         inherited: process.env,
-        granted: secrets,
+        granted: { ...secrets, ...configurationEnvironment },
         runner: { type: adapter.type, auth: runner.auth },
         gitIdentity: githubCommitIdentity(providerGrants),
         isolation: artifacts,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zixt/host",
-  "version": "0.0.103",
+  "version": "0.0.104",
   "type": "module",
   "exports": {
     ".": "./src/client.ts",