@yaklabs-ai/plugin-protocol 0.13.10 → 0.14.1

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.13.10"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.14.1"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.13.10",
+  "version": "0.14.1",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -1273,6 +1273,7 @@ export declare type AuthGrantFrontDoor = z.infer<typeof AuthGrantFrontDoor>;
 
 export declare const AuthGrantOperation: z.ZodEnum<{
     status: "status";
+    list: "list";
     connect: "connect";
     disconnect: "disconnect";
     resolve: "resolve";
@@ -1285,6 +1286,7 @@ export declare const AuthGrantRequest: z.ZodObject<{
     schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     operations: z.ZodArray<z.ZodEnum<{
         status: "status";
+        list: "list";
         connect: "connect";
         disconnect: "disconnect";
         resolve: "resolve";
@@ -2095,7 +2097,7 @@ export declare const KAY_EVENT_PUBLISHER_ID: "kay";
 declare const KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES: readonly ["unsupported-protocol", "sdk-range-unsatisfied", "sdk-range-unsupported", "host-sdk-version-invalid"];
 
 /** Released SDK contracts still implemented by the host, alongside its current SDK. */
-export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly ["0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.9.0", "0.9.1", "0.10.0", "0.11.0", "0.11.1", "0.12.0", "0.12.1", "0.12.2", "0.12.3", "0.12.4", "0.12.5", "0.13.0", "0.13.1", "0.13.2", "0.13.3", "0.13.4", "0.13.5", "0.13.6", "0.13.7", "0.13.8", "0.13.9"];
+export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly ["0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.9.0", "0.9.1", "0.10.0", "0.11.0", "0.11.1", "0.12.0", "0.12.1", "0.12.2", "0.12.3", "0.12.4", "0.12.5", "0.13.0", "0.13.1", "0.13.2", "0.13.3", "0.13.4", "0.13.5", "0.13.6", "0.13.7", "0.13.8", "0.13.9", "0.13.10", "0.14.0"];
 
 /** The file whose presence makes a directory a plugin. A directory without one is not a plugin. */
 export declare const KAY_PLUGIN_MANIFEST_FILENAME = "kay-plugin.json";
@@ -2408,8 +2410,23 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * connects a shared identity through (`gmail` over `google.account`), with an optional file picker.
  * Additive: a manifest without them parses unchanged. A plugin that declares one declares
  * `^0.13.10`, so an older host refuses it at load with that reason rather than a schema error.
+ *
+ * 0.14.0 removes `withJev`: `api.withJev` on `kay.agent`, `app.withJev` on `kay.app`, the
+ * `@bonsai/plugin-sdk/jev` subpath and every `Jev*` type it exported. A plugin uses `api.systemOne`
+ * / `app.systemOne` (`@bonsai/plugin-sdk/system-one`) instead. The `jev.use` capability claim is
+ * renamed `systemOne.use`, and stored grants are rewritten to the new slug. The signals subpath
+ * types its own surface now: observe options by `KayAppSignalObserveOptions`, state by
+ * `KayAppSignalState`, and questions and answers by `DecideQuestions` and `DecideAnswer`. For the
+ * api surface this is a clean break with no shim and deliberately NOT a load refusal, like 0.13.0:
+ * every earlier release stays in the retention list, so a plugin compiled against 0.13.x that
+ * reads `api.withJev` gets `undefined` at the call, and one that imports a value from
+ * `@bonsai/plugin-sdk/jev` fails at load. No plugin used either.
+ *
+ * 0.14.1 adds the owned-service `kay.app` auth list operation and `listAccounts`.
+ * Existing resolve-only `has` callers retain account bounds and now probe metadata without
+ * resolving credentials. Plugins using list declare `^0.14.1` so older hosts refuse at load.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.13.10";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.14.1";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -3352,6 +3369,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     operations: z.ZodArray<z.ZodEnum<{
                         status: "status";
+                        list: "list";
                         connect: "connect";
                         disconnect: "disconnect";
                         resolve: "resolve";
@@ -3446,6 +3464,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     operations: z.ZodArray<z.ZodEnum<{
                         status: "status";
+                        list: "list";
                         connect: "connect";
                         disconnect: "disconnect";
                         resolve: "resolve";
@@ -3540,6 +3559,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
                     operations: z.ZodArray<z.ZodEnum<{
                         status: "status";
+                        list: "list";
                         connect: "connect";
                         disconnect: "disconnect";
                         resolve: "resolve";
@@ -4064,7 +4084,7 @@ export declare function parseResolvedPluginContractV1(value: unknown): ResolvedP
 export declare function parseSemver(value: string): ParsedSemver | undefined;
 
 /** Every capability slug {@link PluginCapabilityClaimV1} can express, for exhaustive table checks. */
-export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "corpus.read", "signals.read", "skills.read", "tools.describe", "workspace.command", "sessions.create", "sessions.update", "models.complete", "jev.use", "automations.write", "automations.run", "workflows.define", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "mcp.host-server", "prompt.resident", "skills.declared-source", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove"];
+export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "corpus.read", "signals.read", "skills.read", "tools.describe", "workspace.command", "sessions.create", "sessions.update", "models.complete", "systemOne.use", "automations.write", "automations.run", "workflows.define", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "mcp.host-server", "prompt.resident", "skills.declared-source", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove"];
 
 /** Diagnostic messages carry plugin-controlled text (parse errors, module errors); bound it so a
  *  hostile or accidental multi-megabyte error can never blow up a log line or a render surface. */
@@ -4581,7 +4601,7 @@ export declare const PluginCapabilityClaimV1: z.ZodDiscriminatedUnion<[z.ZodObje
     envelope: z.ZodObject<{}, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
     target: z.ZodLiteral<"kay.app">;
-    slug: z.ZodLiteral<"jev.use">;
+    slug: z.ZodLiteral<"systemOne.use">;
     envelope: z.ZodObject<{}, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
     target: z.ZodLiteral<"kay.app">;
@@ -4817,7 +4837,7 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
         envelope: z.ZodObject<{}, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
-        slug: z.ZodLiteral<"jev.use">;
+        slug: z.ZodLiteral<"systemOne.use">;
         envelope: z.ZodObject<{}, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
@@ -5048,7 +5068,7 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
             envelope: z.ZodObject<{}, z.core.$strict>;
         }, z.core.$strict>, z.ZodObject<{
             target: z.ZodLiteral<"kay.app">;
-            slug: z.ZodLiteral<"jev.use">;
+            slug: z.ZodLiteral<"systemOne.use">;
             envelope: z.ZodObject<{}, z.core.$strict>;
         }, z.core.$strict>, z.ZodObject<{
             target: z.ZodLiteral<"kay.app">;
@@ -5342,7 +5362,7 @@ export declare const PluginCapabilityRefusalV1: z.ZodObject<{
         envelope: z.ZodObject<{}, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
-        slug: z.ZodLiteral<"jev.use">;
+        slug: z.ZodLiteral<"systemOne.use">;
         envelope: z.ZodObject<{}, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
@@ -5783,6 +5803,7 @@ export declare const PluginPermissionManifest: z.ZodObject<{
                 schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 operations: z.ZodArray<z.ZodEnum<{
                     status: "status";
+                    list: "list";
                     connect: "connect";
                     disconnect: "disconnect";
                     resolve: "resolve";
@@ -5877,6 +5898,7 @@ export declare const PluginPermissionManifest: z.ZodObject<{
                 schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 operations: z.ZodArray<z.ZodEnum<{
                     status: "status";
+                    list: "list";
                     connect: "connect";
                     disconnect: "disconnect";
                     resolve: "resolve";
@@ -5971,6 +5993,7 @@ export declare const PluginPermissionManifest: z.ZodObject<{
                 schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
                 operations: z.ZodArray<z.ZodEnum<{
                     status: "status";
+                    list: "list";
                     connect: "connect";
                     disconnect: "disconnect";
                     resolve: "resolve";
@@ -6393,6 +6416,15 @@ export declare const RegistrableDomain: z.ZodString;
 
 export declare type RegistrableDomain = z.infer<typeof RegistrableDomain>;
 
+/**
+ * Capability slugs renamed since release, old slug to new. A stored grant naming an old slug is
+ * rewritten to the new one (a read folds it; the boot migration rewrites the stored row), never
+ * ignored: unlike a retired slug it still confers the capability.
+ */
+export declare const RENAMED_PLUGIN_CAPABILITY_SLUGS: {
+    readonly "jev.use": "systemOne.use";
+};
+
 /**
  * Id namespaces a directory plugin may never claim. `herd.` is the kernel's first-party namespace
  * (`HERD_RESERVED_ID_PREFIX`: the kernel's extension loader throws on it without a first-party
@@ -6423,6 +6455,7 @@ export declare function resolveAdapterId(globalId: GlobalContributionId, declare
 export declare const ResolvedAuthGrantRequest: z.ZodObject<{
     operations: z.ZodArray<z.ZodEnum<{
         status: "status";
+        list: "list";
         connect: "connect";
         disconnect: "disconnect";
         resolve: "resolve";
@@ -7193,6 +7226,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 auth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     operations: z.ZodArray<z.ZodEnum<{
                         status: "status";
+                        list: "list";
                         connect: "connect";
                         disconnect: "disconnect";
                         resolve: "resolve";
@@ -7287,6 +7321,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 auth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     operations: z.ZodArray<z.ZodEnum<{
                         status: "status";
+                        list: "list";
                         connect: "connect";
                         disconnect: "disconnect";
                         resolve: "resolve";
@@ -7381,6 +7416,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 auth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                     operations: z.ZodArray<z.ZodEnum<{
                         status: "status";
+                        list: "list";
                         connect: "connect";
                         disconnect: "disconnect";
                         resolve: "resolve";
@@ -7714,6 +7750,7 @@ export declare const ResolvedPluginGrants: z.ZodObject<{
             auth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 operations: z.ZodArray<z.ZodEnum<{
                     status: "status";
+                    list: "list";
                     connect: "connect";
                     disconnect: "disconnect";
                     resolve: "resolve";
@@ -7808,6 +7845,7 @@ export declare const ResolvedPluginGrants: z.ZodObject<{
             auth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 operations: z.ZodArray<z.ZodEnum<{
                     status: "status";
+                    list: "list";
                     connect: "connect";
                     disconnect: "disconnect";
                     resolve: "resolve";
@@ -7902,6 +7940,7 @@ export declare const ResolvedPluginGrants: z.ZodObject<{
             auth: z.ZodOptional<z.ZodArray<z.ZodObject<{
                 operations: z.ZodArray<z.ZodEnum<{
                     status: "status";
+                    list: "list";
                     connect: "connect";
                     disconnect: "disconnect";
                     resolve: "resolve";
@@ -8103,6 +8142,7 @@ export declare const ResolvedTargetGrantSet: z.ZodObject<{
     auth: z.ZodOptional<z.ZodArray<z.ZodObject<{
         operations: z.ZodArray<z.ZodEnum<{
             status: "status";
+            list: "list";
             connect: "connect";
             disconnect: "disconnect";
             resolve: "resolve";
@@ -8853,6 +8893,7 @@ export declare const TargetPermissionSet: z.ZodPreprocess<z.ZodObject<{
         schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
         operations: z.ZodArray<z.ZodEnum<{
             status: "status";
+            list: "list";
             connect: "connect";
             disconnect: "disconnect";
             resolve: "resolve";
@@ -8979,6 +9020,7 @@ export declare const TargetPermissionWiring: z.ZodObject<{
         schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
         operations: z.ZodArray<z.ZodEnum<{
             status: "status";
+            list: "list";
             connect: "connect";
             disconnect: "disconnect";
             resolve: "resolve";

package/dist/index.js

@@ -136,7 +136,7 @@ var JsonSchema = z2.record(z2.string(), JsonValue);
 // packages/plugin-protocol/dist/common.js
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.13.10";
+var KAY_PLUGIN_SDK_VERSION = "0.14.1";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.8.0",
   "0.8.1",
@@ -164,7 +164,9 @@ var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.13.6",
   "0.13.7",
   "0.13.8",
-  "0.13.9"
+  "0.13.9",
+  "0.13.10",
+  "0.14.0"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -1121,6 +1123,7 @@ function resolveAdapterId(globalId, declaredAdapterId) {
 // packages/plugin-protocol/dist/permissions.js
 var AuthGrantOperation = z7.enum([
   "status",
+  "list",
   "connect",
   "disconnect",
   "resolve"
@@ -1644,16 +1647,16 @@ var PluginCapabilityClaimV1 = z8.discriminatedUnion("slug", [
     envelope: z8.strictObject({})
   }),
   z8.strictObject({
-    // Held to `kay.app`, the daemon-lifetime tier, even though the same wrapper is exposed on
+    // Held to `kay.app`, the daemon-lifetime tier, even though the same System One client is exposed on
     // BOTH the `kay.app` and `kay.agent` plugin SDKs (and to host composition directly): a slug
     // pins exactly one target (see this file's module doc), so one shared claim is simpler and
     // more honest than a second, `kay.agent`-scoped sibling slug for the identical capability.
-    // `kay.agent`'s `api.withJev` authorizes against this SAME claim through the calling
+    // `kay.agent`'s `api.systemOne` authorizes against this SAME claim through the calling
     // plugin's own pinned authority, which already spans both targets for every other capability
     // (`network.connect`/`tool-interception.register` are decided by the identical per-plugin
-    // handle `kay.app`-target claims use).
+    // handle `kay.app`-target claims use). `app.systemOne` authorizes against it the same way.
     target: z8.literal("kay.app"),
-    slug: z8.literal("jev.use"),
+    slug: z8.literal("systemOne.use"),
     envelope: z8.strictObject({})
   }),
   z8.strictObject({
@@ -1776,6 +1779,9 @@ var RETIRED_PLUGIN_CAPABILITY_SLUGS = [
   "filesystem.read",
   "filesystem.write"
 ];
+var RENAMED_PLUGIN_CAPABILITY_SLUGS = {
+  "jev.use": "systemOne.use"
+};
 var PLUGIN_CAPABILITY_SLUGS = [
   "sessions.run",
   "network.connect",
@@ -1790,7 +1796,7 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "sessions.create",
   "sessions.update",
   "models.complete",
-  "jev.use",
+  "systemOne.use",
   "automations.write",
   "automations.run",
   "workflows.define",
@@ -1898,7 +1904,7 @@ function sameClaim(a, b) {
     case "tools.describe":
     case "workspace.command":
     case "models.complete":
-    case "jev.use":
+    case "systemOne.use":
     case "automations.write":
     case "automations.run":
     case "workflows.define":
@@ -1968,7 +1974,7 @@ function envelopePairs(a, b) {
     case "tools.describe":
     case "workspace.command":
     case "models.complete":
-    case "jev.use":
+    case "systemOne.use":
     case "automations.write":
     case "automations.run":
     case "workflows.define":
@@ -5418,6 +5424,7 @@ export {
   PluginToolName,
   PluginWebSessionDeclaration,
   PluginWebSessionProbe,
+  RENAMED_PLUGIN_CAPABILITY_SLUGS,
   RESERVED_DIRECTORY_PLUGIN_ID_PREFIXES,
   RETIRED_COMPATIBILITY_KEYS,
   RETIRED_PERMISSION_ASK_KEYS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.13.10",
+  "version": "0.14.1",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",