@opengeni/core 4.3.3-canary.39786771332001 → 4.4.1

package/dist/domain/capabilities.d.ts

@@ -1,5 +1,5 @@
 import { type Settings } from "@opengeni/config";
-import { CapabilityCatalogItem, OPENGENI_BROWSER_EXTENSION_URL, type AccessGrant, type CapabilityCatalogResponse, type CapabilityInstallation, type CreateCapabilityCatalogItemRequest, type EnableCapabilityRequest, type McpPersonalConnectionDelegation } from "@opengeni/contracts";
+import { CapabilityCatalogItem, OPENGENI_BROWSER_EXTENSION_URL, type AccessGrant, type CapabilityCatalogResponse, type CapabilityInstallation, type CreateCapabilityCatalogItemRequest, type EnableCapabilityRequest, type McpPersonalConnectionDelegation, ToolAuthNeededPayload, type UserSetupBlocker } from "@opengeni/contracts";
 import { type SubscriptionCoreCodexAppsRequestAuth, type CodexCutoverDisposition, type Database, type ApiIntegrationRuntime, type EnabledMcpCapabilityServer } from "@opengeni/db";
 declare const officialMcpRegistryUrl = "https://registry.modelcontextprotocol.io";
 export declare function buildCapabilityCatalog(input: {
@@ -196,6 +196,17 @@ export { OPENGENI_BROWSER_EXTENSION_URL };
 export declare function nativeConnectionCapabilityRecommendations(options?: {
     connectedMachines?: boolean;
 }): CapabilityCatalogItem[];
+/**
+ * The `tool.auth_needed` payload of the setup card that fixes a person-fixable
+ * tool refusal (see USER_SETUP_BLOCKERS). Every tool and route that hits such a
+ * refusal posts this same card in the calling turn, so the person sees the fix
+ * on the first attempt. Null when the blocker's capability is not a native
+ * card this deployment can show.
+ */
+export declare function userSetupCardPayload(blocker: UserSetupBlocker, options: {
+    toolName: string;
+    requestedSandboxId?: string | null;
+}): ToolAuthNeededPayload | null;
 export declare function applyCapabilityEnablement(item: CapabilityCatalogItem, installation: CapabilityInstallation | undefined): CapabilityCatalogItem;
 export type CapabilityCatalogSearchMatch = {
     item: CapabilityCatalogItem;

package/dist/index.js

@@ -1068,7 +1068,8 @@ import {
   FIKEN_PROVIDER_DOMAIN as FIKEN_PROVIDER_DOMAIN2,
   FIRST_PARTY_MCP_TOOL_NAMES,
   OPENGENI_BROWSER_EXTENSION_URL,
-  assertOrganizationIntegrationAllowed
+  assertOrganizationIntegrationAllowed,
+  ToolAuthNeededPayload
 } from "@opengeni/contracts";
 import {
   CODEX_APPS_MCP_SERVER_ID,
@@ -2795,6 +2796,30 @@ function nativeConnectionCapabilityRecommendations(options = {}) {
   }
   return items;
 }
+function userSetupCardPayload(blocker, options) {
+  const item = nativeConnectionCapabilityRecommendations({ connectedMachines: true }).find(
+    (candidate) => candidate.id === blocker.capabilityId
+  );
+  if (!item) return null;
+  return ToolAuthNeededPayload.parse({
+    serverId: "opengeni",
+    toolName: options.toolName,
+    // Built-in capabilities are Opengeni's own; a blank domain must not fail the card.
+    providerDomain: item.providerDomain?.trim() || "opengeni.local",
+    reason: "missing_connection",
+    capability: {
+      id: item.id,
+      name: item.name,
+      kind: item.kind,
+      source: item.source,
+      action: "connect",
+      rationale: blocker.rationale,
+      requiredVariables: []
+    },
+    ...options.requestedSandboxId ? { requestedSandboxId: options.requestedSandboxId } : {},
+    ...blocker.purpose ? { purpose: blocker.purpose } : {}
+  });
+}
 function socialConnectionCounts(connections, provider) {
   const matching = connections.filter((connection) => connection.provider === provider);
   return {
@@ -31352,6 +31377,7 @@ export {
   updateSessionSkills,
   updateSessionTitle,
   updateSessionToolPolicy,
+  userSetupCardPayload,
   validateEditableArtifactActor,
   validateEditableArtifactMaterializationJob,
   validateEditableArtifactPinnedVersion,