@yaklabs-ai/plugin-protocol 0.13.0 → 0.13.2

package/README.md

@@ -1,6 +1,6 @@
 # @yaklabs-ai/plugin-protocol
 
-The **`kay.plugin.v1` manifest schema** — the same Zod schema Kay's daemon uses
+The **`kay.plugin.v1` manifest schema** — the same Zod schema Bonsai's daemon uses
 to parse `kay-plugin.json` at load time.
 
 Published to the public npm registry under the MIT licence, always at the same
@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@kay/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.13.0"
+    "@kay/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.13.2"
   }
 }
 ```
@@ -37,22 +37,22 @@ if (!parsed.success) {
 
 A hand-rolled field check drifts from the contract it claims to enforce and
 passes while the host rejects the plugin at load. This is the host's own schema,
-so it cannot drift — and unlike resolving it out of a Kay checkout, it needs no
+so it cannot drift — and unlike resolving it out of a Bonsai checkout, it needs no
 clone, no build, and no `KAY_REPO` environment variable.
 
-## Version it against your Kay app
+## Version it against your Bonsai app
 
 The schema changes over time — it gains fields, and it can also **remove** one.
 Three skews follow, and only the first two fail on your machine:
 
-- Validating against a **newer** schema than your Kay app runs can accept a
+- Validating against a **newer** schema than your Bonsai app runs can accept a
   manifest the host will reject.
 - Validating against an **older** schema can reject a manifest the host would
   happily load.
 - Validating against an **older** schema can also _accept_ a field the host has
   since removed. `KayPluginManifestV1` parses with `strictObject`, so an
   unrecognized key is a hard rejection: your local validation goes green, and
-  Kay drops the plugin at load with a diagnostic you never see.
+  Bonsai drops the plugin at load with a diagnostic you never see.
 
-Keep this package in step with the Kay version you target — the third skew is
+Keep this package in step with the Bonsai version you target — the third skew is
 the one a green local run will not warn you about.

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -1417,7 +1417,7 @@ export declare type CliBinaryName = z.infer<typeof CliBinaryName>;
  *   catalog, pinned and checksum-verified. Credential injection is available, and
  *   gated on the binary actually being materialized in `vendoredToolsDir`
  *   (constraint 12, vendored-or-nothing).
- * - `"path"` — a binary the USER OR AGENT installed on `PATH`. Kay ships nothing,
+ * - `"path"` — a binary the USER OR AGENT installed on `PATH`. Bonsai ships nothing,
  *   pins nothing, and verifies nothing, so this binding is structurally barred from
  *   receiving a secret: `authEnvVar` must be absent, and `authService` must declare
  *   only `external-cli` schemes. `buildCliBindingRoster` throws on either violation.
@@ -1792,7 +1792,7 @@ export declare function finalizeArtifactProvenanceEnvelope(capture: ArtifactProv
  * The Basic-auth USERNAME a git host expects beside an injected token
  * (`x-access-token` for GitHub, `oauth2` for GitLab). The token is the password
  * half, so this is a fixed per-vendor literal rather than a user identity, and
- * it is the only per-vendor variance in Kay's git transport.
+ * it is the only per-vendor variance in Bonsai's git transport.
  *
  * Restricted to unreserved URL characters: a colon would move the `user:token`
  * boundary the `Authorization: Basic` header encodes, and whitespace or control
@@ -1965,15 +1965,15 @@ export declare const KAY_APP_DATA_READ_RESULT_MAX_BYTES: number;
 export declare const KAY_APP_DATA_SNAPSHOT_MAX_BYTES: number;
 
 /**
- * The publisher id Kay's own subsystems publish declared events under (skill
+ * The publisher id Bonsai's own subsystems publish declared events under (skill
  * changes, wallet notices, automation failures). A notification rule matches a
  * declared event by (publisher id, event local id), so no plugin may take this
- * id or it could publish events that Kay's default rules read as Kay's own.
+ * id or it could publish events that Bonsai's default rules read as Bonsai's own.
  */
 export declare const KAY_EVENT_PUBLISHER_ID: "kay";
 
 /** Released SDK contracts still implemented by the host, alongside its current SDK. */
-export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly ["0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.9.0", "0.9.1", "0.10.0", "0.11.0", "0.11.1", "0.12.0", "0.12.1", "0.12.2", "0.12.3", "0.12.4", "0.12.5"];
+export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly ["0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.9.0", "0.9.1", "0.10.0", "0.11.0", "0.11.1", "0.12.0", "0.12.1", "0.12.2", "0.12.3", "0.12.4", "0.12.5", "0.13.0", "0.13.1"];
 
 export declare const KAY_PLUGIN_PROTOCOL_PACKAGE_NAME: "@kay/plugin-protocol";
 
@@ -1986,7 +1986,7 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * ── Why this is the compatibility axis, and the app version is not ──────────
  * A plugin never bundles the SDK: the host injects its own `@kay/plugin-sdk`
  * dist at import time. So the SDK surface a plugin was written against is the
- * thing that can break under it, and the Kay app version is only correlated
+ * thing that can break under it, and the Bonsai app version is only correlated
  * with that — it moves for reasons a plugin cannot observe.
  *
  * ── Two lines, deliberately, not one ────────────────────────────────────────
@@ -2115,8 +2115,8 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * failing.
  *
  * 0.12.0 replaces the vendor client `api.withJev` hands its callback. `use`
- * now receives Kay's own `JevClient` (`@kay/plugin-sdk/jev`): one method,
- * `classify({state, questions})`, in Kay's question and answer vocabulary
+ * now receives Bonsai's own `JevClient` (`@kay/plugin-sdk/jev`): one method,
+ * `classify({state, questions})`, in Bonsai's question and answer vocabulary
  * (yes/no is `bool` answering `probability`; instructions and criteria are
  * text; the state is a JSON object), rejecting with a classified
  * `JevCallError`. TypeSafe's `TypeSafeClient`, `SystemOneRequest`,
@@ -2178,7 +2178,7 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * that calls it declares `^0.12.5`, so an older host refuses a directory or repository plugin at
  * load instead of the call failing.
  *
- * 0.13.0 adds `@kay/plugin-sdk/fs`, Kay's own `node:fs/promises`: the same functions, arguments,
+ * 0.13.0 adds `@kay/plugin-sdk/fs`, Bonsai's own `node:fs/promises`: the same functions, arguments,
  * return types and errors, with every call run on the host's user-files workers under a deadline
  * (`ERR_KAY_FS_DEADLINE` and siblings when the host gives up or does not try), plus
  * `writeFileAtomic` and `withTimeout`. With no host installed it is Node's own module. It adds
@@ -2196,8 +2196,25 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * declared either). A plugin that imports
  * `@kay/plugin-sdk/fs` or calls `familyFolder` declares `^0.13.0`, so an older host refuses a
  * directory or repository plugin at load.
+ *
+ * 0.13.1 adds the signal engine to `@kay/plugin-sdk/signals`: `SignalDefinition`,
+ * `createSignalEngine` and `signalAnswersPass` (a plugin declares its Jev signals as data and the
+ * engine evaluates them, upstreams first, through `app.signals.observe`), plus `signalDigest`.
+ * `observe` gains three optional input fields, `subject`, `after` and `reuse`, and an observation
+ * and a read signal carry the stored `subject` and `upstreamId` back. Additive: a plugin compiled
+ * against 0.13.0 never sends or reads them. A plugin that imports the engine declares `^0.13.1`,
+ * so an older host refuses a directory or repository plugin at load.
+ *
+ * 0.13.2 adds `app.tools` (`KayAppTools`): `describe(sessionId, refs)` returns, for each tool name
+ * or address a live session can use, the text the agent sees for it, where it comes from, and
+ * whether it is one of Bonsai's own (`ownedByBonsai`). Checked per call against the new
+ * `tools.describe` claim. It also adds the manifest's top-level `ownedByBonsai` flag, honoured only
+ * for a plugin that ships with Bonsai. Additive: a plugin compiled against 0.13.1 never reads the
+ * member. A plugin that calls it declares `^0.13.2`, so an older host refuses a directory or
+ * repository plugin at load. The flag is new schema, so an older host refuses a manifest that sets
+ * it at parse, like 0.12.3's page open kind.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.13.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.13.2";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2520,10 +2537,10 @@ export declare interface KayPluginHostCompatibility {
     readonly sdkVersion: string;
     /** Older SDK releases whose runtime contracts this host still implements; absent means none. */
     readonly compatibleSdkVersions?: readonly string[];
-    /** The Kay app version. Advisory only — never a refusal. */
+    /** The Bonsai app version. Advisory only — never a refusal. */
     readonly appVersion: string;
     /**
-     * Whether the plugin ships WITH Kay. A bundled plugin is cut from this tree,
+     * Whether the plugin ships WITH Bonsai. A bundled plugin is cut from this tree,
      * so declaring no SDK range is a property of how it ships rather than a gap
      * its author left, and the undeclared-range advisory is suppressed for it.
      *
@@ -3321,6 +3338,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
         minKayVersion: z.ZodOptional<z.ZodString>;
         sdk: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
+    ownedByBonsai: z.ZodOptional<z.ZodBoolean>;
     dependencies: z.ZodOptional<z.ZodObject<{
         plugins: z.ZodOptional<z.ZodArray<z.ZodString>>;
     }, z.core.$strict>>;
@@ -3533,7 +3551,7 @@ export declare type KayVersionString = z.infer<typeof KayVersionString>;
  *
  * Distinct from raw session-transcript streaming (`app.corpus`, authorized per call by the
  * `corpus.read` claim) and from `registerSearchProvider` (a plugin registering a backend behind
- * Kay's own web-search tool) — this grant is the reverse direction: a plugin READING the shared
+ * Bonsai's own web-search tool) — this grant is the reverse direction: a plugin READING the shared
  * knowledge index that OTHER ingest lanes (skills, URIs) already populate, confined to its own
  * address space.
  */
@@ -3712,7 +3730,7 @@ export declare interface ParsedSemver {
 
 export declare function parseKayPluginManifestV1(value: unknown): KayPluginManifestV1;
 
-/** Parses one origin-agnostic, loadable Kay React app package. */
+/** Parses one origin-agnostic, loadable Bonsai React app package. */
 export declare function parseKayUiAppPackageV1(input: unknown): KayUiAppPackageV1;
 
 export declare function parseKayUiBundleIndexV1(input: unknown): KayUiBundleIndexV1;
@@ -3723,7 +3741,7 @@ export declare function parseResolvedPluginContractV1(value: unknown): ResolvedP
 export declare function parseSemver(value: string): ParsedSemver | undefined;
 
 /** Every capability slug {@link PluginCapabilityClaimV1} can express, for exhaustive table checks. */
-export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "corpus.read", "signals.read", "skills.read", "workspace.command", "sessions.create", "sessions.update", "models.complete", "jev.use", "automations.write", "automations.run", "workflows.define", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove"];
+export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "corpus.read", "signals.read", "skills.read", "tools.describe", "workspace.command", "sessions.create", "sessions.update", "models.complete", "jev.use", "automations.write", "automations.run", "workflows.define", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove"];
 
 /** The root `<svg>` attribute a tile icon declares itself with. */
 export declare const PLUGIN_ICON_SHAPE_ATTRIBUTE = "data-icon-shape";
@@ -4151,6 +4169,10 @@ export declare const PluginCapabilityClaimV1: z.ZodDiscriminatedUnion<[z.ZodObje
     target: z.ZodLiteral<"kay.app">;
     slug: z.ZodLiteral<"skills.read">;
     envelope: z.ZodObject<{}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    target: z.ZodLiteral<"kay.app">;
+    slug: z.ZodLiteral<"tools.describe">;
+    envelope: z.ZodObject<{}, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
     target: z.ZodLiteral<"kay.app">;
     slug: z.ZodLiteral<"workspace.command">;
@@ -4359,6 +4381,10 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"skills.read">;
         envelope: z.ZodObject<{}, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"kay.app">;
+        slug: z.ZodLiteral<"tools.describe">;
+        envelope: z.ZodObject<{}, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"workspace.command">;
@@ -4562,6 +4588,10 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
             target: z.ZodLiteral<"kay.app">;
             slug: z.ZodLiteral<"skills.read">;
             envelope: z.ZodObject<{}, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            target: z.ZodLiteral<"kay.app">;
+            slug: z.ZodLiteral<"tools.describe">;
+            envelope: z.ZodObject<{}, z.core.$strict>;
         }, z.core.$strict>, z.ZodObject<{
             target: z.ZodLiteral<"kay.app">;
             slug: z.ZodLiteral<"workspace.command">;
@@ -4828,6 +4858,10 @@ export declare const PluginCapabilityRefusalV1: z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"skills.read">;
         envelope: z.ZodObject<{}, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"kay.app">;
+        slug: z.ZodLiteral<"tools.describe">;
+        envelope: z.ZodObject<{}, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"workspace.command">;
@@ -5491,7 +5525,7 @@ export declare type PluginProvisioningRequirement = z.infer<typeof PluginProvisi
  *
  * ── What this schema deliberately does NOT validate ─────────────────────────────────────────
  * Structure and bounds only. WHICH installer commands are legal, and whether a git locator is
- * canonical/safe, are Kay-layer POLICY that already has exactly one home each
+ * canonical/safe, are Bonsai-layer POLICY that already has exactly one home each
  * (`installer-skill-source.ts`'s executable allowlist, `remote-skill-source.ts`'s locator
  * hygiene). Re-stating either here would fork the policy: this package would then hold a second
  * answer that drifts from the one the daemon enforces. The daemon applies those validators to a
@@ -5523,7 +5557,7 @@ export declare type PluginSkillSourceDeclaration = z.infer<typeof PluginSkillSou
  * generation `freeform`.
  *
  * Five classes, ordered loosely by how much the host knows about the author:
- * `bundled` (compiled into Kay), `org-shared` (distributed inside the user's
+ * `bundled` (compiled into Bonsai), `org-shared` (distributed inside the user's
  * organization), `user-local` (the user put it in their own plugins root),
  * `verified-marketplace` (a reviewed marketplace artifact), `freeform`
  * (anything else — today, a plugin repository generation). Two of them
@@ -5531,7 +5565,7 @@ export declare type PluginSkillSourceDeclaration = z.infer<typeof PluginSkillSou
  *
  * IT DECIDES NOTHING. There is no ceiling table keyed on this and no capability a class grants or
  * withholds: authority is the user's grant ledger, one exact claim at a time, plus the one rule
- * that a plugin Kay itself bundles holds every grant. A future gate that wants to read this is a
+ * that a plugin Bonsai itself bundles holds every grant. A future gate that wants to read this is a
  * new decision to argue for, not a use this type already sanctions.
  */
 export declare const PluginSourceClass: z.ZodEnum<{

package/dist/index.js

@@ -115,7 +115,7 @@ import { z as z2 } from "zod";
 import { z } from "zod";
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@kay/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.13.0";
+var KAY_PLUGIN_SDK_VERSION = "0.13.2";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.8.0",
   "0.8.1",
@@ -133,7 +133,9 @@ var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.12.2",
   "0.12.3",
   "0.12.4",
-  "0.12.5"
+  "0.12.5",
+  "0.13.0",
+  "0.13.1"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -1527,6 +1529,14 @@ var PluginCapabilityClaimV1 = z6.discriminatedUnion("slug", [
     slug: z6.literal("skills.read"),
     envelope: z6.strictObject({})
   }),
+  z6.strictObject({
+    // The text an agent sees for a tool or an address in a live session, where each comes from,
+    // and whether it is one of Bonsai's own. Read-only and never a call. An empty envelope because
+    // the grant itself is the visibility decision, as with `skills.read`.
+    target: z6.literal("kay.app"),
+    slug: z6.literal("tools.describe"),
+    envelope: z6.strictObject({})
+  }),
   z6.strictObject({
     target: z6.literal("kay.app"),
     slug: z6.literal("workspace.command"),
@@ -1628,7 +1638,7 @@ var PluginCapabilityClaimV1 = z6.discriminatedUnion("slug", [
   z6.strictObject({
     target: z6.literal("kay.agent"),
     slug: z6.literal("interaction.surface"),
-    /** The one Kay-shipped interaction surface this plugin may drive; one claim per surface. */
+    /** The one Bonsai-shipped interaction surface this plugin may drive; one claim per surface. */
     envelope: z6.strictObject({ surface: z6.enum(["browser-pane", "desktop"]) })
   }),
   z6.strictObject({
@@ -1670,6 +1680,7 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "corpus.read",
   "signals.read",
   "skills.read",
+  "tools.describe",
   "workspace.command",
   "sessions.create",
   "sessions.update",
@@ -1776,6 +1787,7 @@ function sameClaim(a, b) {
     case "corpus.read":
     case "signals.read":
     case "skills.read":
+    case "tools.describe":
     case "workspace.command":
     case "models.complete":
     case "jev.use":
@@ -1840,6 +1852,7 @@ function envelopePairs(a, b) {
     case "corpus.read":
     case "signals.read":
     case "skills.read":
+    case "tools.describe":
     case "workspace.command":
     case "models.complete":
     case "jev.use":
@@ -2102,7 +2115,7 @@ function checkKayPluginHostCompatibility(compatibility, host) {
       return {
         refusal: {
           code: "unsupported-protocol",
-          message: `declares support for ${declared} but this Kay speaks ${host.protocolVersion}`
+          message: `declares support for ${declared} but this Bonsai speaks ${host.protocolVersion}`
         },
         advisories
       };
@@ -2113,19 +2126,19 @@ function checkKayPluginHostCompatibility(compatibility, host) {
     if (parseSemver(minKayVersion) === void 0) {
       advisories.push({
         code: "min-kay-version-unparseable",
-        message: `declares a minimum Kay version of "${minKayVersion}", which is not a version Kay can compare`
+        message: `declares a minimum Bonsai version of "${minKayVersion}", which is not a version Bonsai can compare`
       });
     } else {
       const order = compareSemver(host.appVersion, minKayVersion);
       if (order === void 0) {
         advisories.push({
           code: "min-kay-version-unparseable",
-          message: `asks for Kay ${minKayVersion} or newer, which cannot be checked against this Kay's version "${host.appVersion}"`
+          message: `asks for Bonsai ${minKayVersion} or newer, which cannot be checked against this Bonsai's version "${host.appVersion}"`
         });
       } else if (order < 0) {
         advisories.push({
           code: "min-kay-version-unmet",
-          message: `asks for Kay ${minKayVersion} or newer; this is ${host.appVersion}`
+          message: `asks for Bonsai ${minKayVersion} or newer; this is ${host.appVersion}`
         });
       }
     }
@@ -2135,7 +2148,7 @@ function checkKayPluginHostCompatibility(compatibility, host) {
     if (host.bundled !== true) {
       advisories.push({
         code: "sdk-range-undeclared",
-        message: `declares no compatibility.sdk range; this Kay ships plugin SDK ${host.sdkVersion}`
+        message: `declares no compatibility.sdk range; this Bonsai ships plugin SDK ${host.sdkVersion}`
       });
     }
     return { refusal: void 0, advisories };
@@ -2149,7 +2162,7 @@ function checkKayPluginHostCompatibility(compatibility, host) {
     return {
       refusal: {
         code: "host-sdk-version-invalid",
-        message: `cannot be checked: this Kay reports plugin SDK "${invalidVersion}", which is not valid semver`
+        message: `cannot be checked: this Bonsai reports plugin SDK "${invalidVersion}", which is not valid semver`
       },
       advisories
     };
@@ -2158,7 +2171,7 @@ function checkKayPluginHostCompatibility(compatibility, host) {
     return {
       refusal: {
         code: "sdk-range-unsupported",
-        message: `declares an SDK range of "${range}", which Kay cannot interpret (use a caret, tilde, or comparator range such as ^${host.sdkVersion})`
+        message: `declares an SDK range of "${range}", which Bonsai cannot interpret (use a caret, tilde, or comparator range such as ^${host.sdkVersion})`
       },
       advisories
     };
@@ -2167,7 +2180,7 @@ function checkKayPluginHostCompatibility(compatibility, host) {
     return {
       refusal: {
         code: "sdk-range-unsatisfied",
-        message: `needs plugin SDK ${range}, this Kay ships ${host.sdkVersion}`
+        message: `needs plugin SDK ${range}, this Bonsai ships ${host.sdkVersion}`
       },
       advisories
     };
@@ -2968,7 +2981,7 @@ var PluginAuthSchemeOAuthConfidential = z8.strictObject({
   localId: LocalContributionId,
   kind: z8.literal("oauth2"),
   exchange: z8.literal("confidential"),
-  /** Absent means `["kay"]` — a confidential exchange's secret may only ever be Kay's. */
+  /** Absent means `["kay"]` — a confidential exchange's secret may only ever be Bonsai's. */
   clientSuppliers: z8.tuple([z8.literal("kay")]).optional(),
   scopes: z8.array(NonEmptyString).optional()
 });
@@ -3095,6 +3108,13 @@ var KayPluginManifestV1 = z8.strictObject({
   auth: PluginAuthManifest.optional(),
   permissions: PluginPermissionManifest.optional(),
   compatibility: PluginCompatibilityManifest.optional(),
+  /**
+   * Whether this plugin is part of Bonsai's own workbench (memory, sessions, the workspace) rather
+   * than a connection to the user's outside world or a general-purpose tool. Its tools and URI
+   * schemes then report `ownedByBonsai`. Honoured only for a plugin that ships with Bonsai: the
+   * host reads any other plugin's flag as false. Absent ⇒ false.
+   */
+  ownedByBonsai: z8.boolean().optional(),
   /**
    * Explicit plugin-level dependencies — other plugins this plugin requires to be present in the
    * composed roster. At composition time the runtime checks each id against the accepted

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",