@yaklabs-ai/plugin-protocol 0.13.4 → 0.13.5

package/dist/index.js

@@ -5,6 +5,12 @@ var KAY_APP_DATA_READ_REQUEST_MAX_BYTES = 64 * 1024;
 var KAY_APP_DATA_READ_RESULT_MAX_BYTES = 16 * 1024 * 1024;
 
 // packages/plugin-protocol/dist/transcript.js
+import { z } from "zod";
+var WorkBlockCoverageSchema = z.strictObject({
+  firstToolResultEntryId: z.string().min(1),
+  lastToolResultEntryId: z.string().min(1),
+  toolResultEntryIds: z.array(z.string().min(1)).min(1).max(4096)
+}).refine((value) => value.firstToolResultEntryId === value.toolResultEntryIds[0] && value.lastToolResultEntryId === value.toolResultEntryIds.at(-1) && new Set(value.toolResultEntryIds).size === value.toolResultEntryIds.length);
 function branchEntryIds(entries) {
   const last = entries[entries.length - 1];
   if (last === void 0)
@@ -109,13 +115,13 @@ function precedingPersonMessages(entries, packet, count) {
 }
 
 // packages/plugin-protocol/dist/app-data-read.js
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 
 // packages/plugin-protocol/dist/common.js
-import { z } from "zod";
+import { z as z2 } from "zod";
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.13.4";
+var KAY_PLUGIN_SDK_VERSION = "0.13.5";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.8.0",
   "0.8.1",
@@ -137,70 +143,71 @@ var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.13.0",
   "0.13.1",
   "0.13.2",
-  "0.13.3"
+  "0.13.3",
+  "0.13.4"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
   "kay.app",
   "kay.ui"
 ];
-var KayPluginProtocolVersion = z.literal(KAY_PLUGIN_PROTOCOL_VERSION);
-var PluginTargetName = z.enum(KAY_PLUGIN_TARGET_NAMES);
-var NonEmptyString = z.string().trim().min(1);
-var JsonValue = z.lazy(() => z.union([
-  z.string(),
-  z.number(),
-  z.boolean(),
-  z.null(),
-  z.array(JsonValue),
-  z.record(z.string(), JsonValue)
+var KayPluginProtocolVersion = z2.literal(KAY_PLUGIN_PROTOCOL_VERSION);
+var PluginTargetName = z2.enum(KAY_PLUGIN_TARGET_NAMES);
+var NonEmptyString = z2.string().trim().min(1);
+var JsonValue = z2.lazy(() => z2.union([
+  z2.string(),
+  z2.number(),
+  z2.boolean(),
+  z2.null(),
+  z2.array(JsonValue),
+  z2.record(z2.string(), JsonValue)
 ]));
-var JsonObject = z.record(z.string(), JsonValue);
-var JsonSchema = z.record(z.string(), JsonValue);
+var JsonObject = z2.record(z2.string(), JsonValue);
+var JsonSchema = z2.record(z2.string(), JsonValue);
 var PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*$/;
 var LOCAL_CONTRIBUTION_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
 var PLUGIN_TOOL_NAME_PATTERN = /^[a-z][a-z0-9_-]*$/;
 var PACKAGE_ASSET_PATH_PATTERN = /^\.\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
 var KAY_EVENT_PUBLISHER_ID = "kay";
-var PluginId = z.string().trim().regex(PLUGIN_ID_PATTERN).refine((id) => id !== KAY_EVENT_PUBLISHER_ID, {
+var PluginId = z2.string().trim().regex(PLUGIN_ID_PATTERN).refine((id) => id !== KAY_EVENT_PUBLISHER_ID, {
   message: `'${KAY_EVENT_PUBLISHER_ID}' is reserved for Bonsai's own event publisher`
 });
 var PluginNamespace = PluginId;
-var LocalContributionId = z.string().trim().regex(LOCAL_CONTRIBUTION_ID_PATTERN);
-var GlobalContributionId = z.string().trim().regex(PLUGIN_ID_PATTERN);
-var PluginToolName = z.string().trim().regex(PLUGIN_TOOL_NAME_PATTERN);
+var LocalContributionId = z2.string().trim().regex(LOCAL_CONTRIBUTION_ID_PATTERN);
+var GlobalContributionId = z2.string().trim().regex(PLUGIN_ID_PATTERN);
+var PluginToolName = z2.string().trim().regex(PLUGIN_TOOL_NAME_PATTERN);
 var AuthServiceReference = GlobalContributionId;
 var AuthSchemeReference = GlobalContributionId;
-var AdapterSelectionKey = z.string().trim().regex(PLUGIN_ID_PATTERN);
-var AdapterPlacement = z.enum(["local-only", "anywhere"]);
-var UriScheme = z.string().trim().regex(/^[a-z][a-z0-9+.-]*$/);
-var MimeTypeString = z.string().trim().regex(/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/);
-var FileExtensionToken = z.string().trim().regex(/^[a-z0-9]+$/);
+var AdapterSelectionKey = z2.string().trim().regex(PLUGIN_ID_PATTERN);
+var AdapterPlacement = z2.enum(["local-only", "anywhere"]);
+var UriScheme = z2.string().trim().regex(/^[a-z][a-z0-9+.-]*$/);
+var MimeTypeString = z2.string().trim().regex(/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/);
+var FileExtensionToken = z2.string().trim().regex(/^[a-z0-9]+$/);
 var CliBinaryName = NonEmptyString.refine((value) => !value.includes("/"), {
   message: "cli binding binary/alias must be a basename, not a path (no '/')"
 });
-var CliAuthEnvVarName = z.string().trim().regex(/^[A-Z][A-Z0-9_]*$/);
-var PackageAssetPath = z.string().trim().regex(PACKAGE_ASSET_PATH_PATTERN).refine((value) => !value.split("/").includes(".."), {
+var CliAuthEnvVarName = z2.string().trim().regex(/^[A-Z][A-Z0-9_]*$/);
+var PackageAssetPath = z2.string().trim().regex(PACKAGE_ASSET_PATH_PATTERN).refine((value) => !value.split("/").includes(".."), {
   message: "package asset path must not contain a '..' path segment"
 });
-var PluginSourceClass = z.enum([
+var PluginSourceClass = z2.enum([
   "bundled",
   "org-shared",
   "user-local",
   "verified-marketplace",
   "freeform"
 ]);
-var ArtifactGenerationId = z.string().trim().min(1).brand();
-var HttpsUrl = z.url({ protocol: /^https$/ });
-var RegistrableDomain = z.string().trim().regex(/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/);
+var ArtifactGenerationId = z2.string().trim().min(1).brand();
+var HttpsUrl = z2.url({ protocol: /^https$/ });
+var RegistrableDomain = z2.string().trim().regex(/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/);
 var HOST_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var MAX_HOST_LENGTH = 253;
 var MAX_HOST_LABEL_LENGTH = 63;
 var GitHostName = RegistrableDomain.max(MAX_HOST_LENGTH).refine((host) => host.split(".").every((label) => label.length <= MAX_HOST_LABEL_LENGTH && HOST_LABEL_PATTERN.test(label)), {
   message: "git host labels must be 1-63 characters and start and end with a letter or digit"
 });
-var GitBasicAuthUser = z.string().trim().min(1).max(128).regex(/^[A-Za-z0-9._~-]+$/);
-var HttpStatusCode = z.number().int().min(100).max(599);
+var GitBasicAuthUser = z2.string().trim().min(1).max(128).regex(/^[A-Za-z0-9._~-]+$/);
+var HttpStatusCode = z2.number().int().min(100).max(599);
 var SignedInStatusCode = HttpStatusCode.refine((status) => !(status < 200 || status >= 300 && status < 400), {
   message: "signedInStatuses cannot include 1xx or 3xx: the probe follows redirects and never observes them as a final status"
 });
@@ -231,57 +238,57 @@ function refineWebSessionScopeConfined(webSession, ctx) {
     });
   }
 }
-var JsonPointer = z.string().trim().regex(/^(?:\/(?:[^/~]|~[01])*)*$/);
-var TargetEntrypoint = z.strictObject({
+var JsonPointer = z2.string().trim().regex(/^(?:\/(?:[^/~]|~[01])*)*$/);
+var TargetEntrypoint = z2.strictObject({
   module: NonEmptyString,
   export: NonEmptyString.optional()
 });
 
 // packages/plugin-protocol/dist/app-data-read.js
-var AppDataVersionedSchema = z2.strictObject({
-  version: z2.number().int().positive(),
+var AppDataVersionedSchema = z3.strictObject({
+  version: z3.number().int().positive(),
   schema: JsonSchema
 });
-var AppDataSourceRead = z2.strictObject({
+var AppDataSourceRead = z3.strictObject({
   request: AppDataVersionedSchema,
   result: AppDataVersionedSchema
 });
 
 // packages/plugin-protocol/dist/artifact-provenance.js
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 
 // packages/plugin-protocol/dist/session-provenance.js
-import { z as z3 } from "zod";
-var NonEmptyString2 = z3.string().min(1);
+import { z as z4 } from "zod";
+var NonEmptyString2 = z4.string().min(1);
 var SessionId = NonEmptyString2;
-var SessionRelationship = z3.discriminatedUnion("kind", [
+var SessionRelationship = z4.discriminatedUnion("kind", [
   /** Spawn lineage: this session is a subagent child of `sessionId`. */
-  z3.strictObject({ kind: z3.literal("child-of"), sessionId: SessionId }),
+  z4.strictObject({ kind: z4.literal("child-of"), sessionId: SessionId }),
   /**
    * This session was forked from a point in `sessionId`'s transcript — `/fork`, and every
    * hindsight followup. `atEntryId` pins the fork point when one was given.
    */
-  z3.strictObject({
-    kind: z3.literal("forked-from"),
+  z4.strictObject({
+    kind: z4.literal("forked-from"),
     sessionId: SessionId,
     atEntryId: NonEmptyString2.optional()
   })
 ]);
-var SdkSessionDoor = z3.enum([
+var SdkSessionDoor = z4.enum([
   "sessions.create",
   "sessions.run",
   "hindsight.runFollowup",
   "agents.run"
 ]);
-var SessionCreator = z3.discriminatedUnion("kind", [
+var SessionCreator = z4.discriminatedUnion("kind", [
   /** A person, at the keyboard. `surface` names a scripted experience when one minted it. */
-  z3.strictObject({
-    kind: z3.literal("human"),
+  z4.strictObject({
+    kind: z4.literal("human"),
     surface: NonEmptyString2.optional()
   }),
   /** Another session's agent, through a tool call. */
-  z3.strictObject({
-    kind: z3.literal("agent"),
+  z4.strictObject({
+    kind: z4.literal("agent"),
     sessionId: SessionId,
     tool: NonEmptyString2,
     /**
@@ -299,8 +306,8 @@ var SessionCreator = z3.discriminatedUnion("kind", [
     toolCallId: NonEmptyString2.optional()
   }),
   /** A plugin, through one of its SDK doors. */
-  z3.strictObject({
-    kind: z3.literal("plugin"),
+  z4.strictObject({
+    kind: z4.literal("plugin"),
     pluginId: NonEmptyString2,
     door: SdkSessionDoor,
     callerSessionId: SessionId.optional()
@@ -314,8 +321,8 @@ var SessionCreator = z3.discriminatedUnion("kind", [
    * schedule nor a session-fact occurrence. Added 2026-08-19, when the automation producers
    * landed and a watcher's report session had nothing honest to stamp.
    */
-  z3.strictObject({
-    kind: z3.literal("trigger"),
+  z4.strictObject({
+    kind: z4.literal("trigger"),
     automationId: NonEmptyString2,
     /**
      * The AUTOMATION RUN that fired the binding (R2 provenance). Optional at
@@ -325,10 +332,10 @@ var SessionCreator = z3.discriminatedUnion("kind", [
      */
     runId: NonEmptyString2.optional(),
     bindingName: NonEmptyString2,
-    triggerKind: z3.enum(["cron", "time", "occurrence", "uri-change", "manual"])
+    triggerKind: z4.enum(["cron", "time", "occurrence", "uri-change", "manual"])
   }),
   /** The daemon itself, for one of its own capabilities. */
-  z3.strictObject({ kind: z3.literal("daemon"), capability: NonEmptyString2 })
+  z4.strictObject({ kind: z4.literal("daemon"), capability: NonEmptyString2 })
 ]);
 var AGENT_RUNTIME_SESSION_CREATOR_KINDS = [
   "human",
@@ -337,29 +344,30 @@ var AGENT_RUNTIME_SESSION_CREATOR_KINDS = [
   "trigger",
   "daemon"
 ];
-var SessionDefiner = z3.discriminatedUnion("layer", [
-  z3.strictObject({
-    layer: z3.literal("plugin"),
+var SessionDefiner = z4.discriminatedUnion("layer", [
+  z4.strictObject({
+    layer: z4.literal("plugin"),
     pluginId: NonEmptyString2,
     capability: NonEmptyString2,
     /** See the type docblock: unpopulated by design until #5230's children land. */
     version: NonEmptyString2.optional()
   }),
-  z3.strictObject({ layer: z3.literal("host"), capability: NonEmptyString2 })
+  z4.strictObject({ layer: z4.literal("host"), capability: NonEmptyString2 })
 ]);
-var SessionIntent = z3.enum(["interactive", "headless"]);
-var SessionCausedByEventShape = z3.strictObject({
+var SessionIntent = z4.enum(["interactive", "headless"]);
+var SessionCausedByEventShape = z4.strictObject({
   /** The plugin's own name for the subscribe handler that made this run, e.g. `"work-record"`. */
   handler: NonEmptyString2,
   /** Absent reads as `"session-event"` — see this type's own doc comment. */
-  kind: z3.enum(["session-event", "backfill"]).optional(),
+  kind: z4.enum(["session-event", "backfill"]).optional(),
   /** Required when `kind` is `"session-event"` or absent; must be omitted when `kind` is `"backfill"`. */
-  event: z3.strictObject({
+  event: z4.strictObject({
     /** {@link KayAppSessionEventType} in `@bonsai/plugin-sdk`, mirrored: a closed, extensible union. */
-    type: z3.enum([
+    type: z4.enum([
       "turn-settled",
       "phase-shift",
       "human-message",
+      "assistant-message",
       "ui-action"
     ]),
     entryId: NonEmptyString2,
@@ -384,8 +392,8 @@ var SessionCausedByEvent = SessionCausedByEventShape.refine((value) => (value.ki
   message: 'event must be omitted when kind is "backfill"',
   path: ["event"]
 });
-var SessionProvenanceRecord = z3.strictObject({
-  relationships: z3.array(SessionRelationship),
+var SessionProvenanceRecord = z4.strictObject({
+  relationships: z4.array(SessionRelationship),
   createdBy: SessionCreator,
   definedBy: SessionDefiner,
   intent: SessionIntent,
@@ -449,93 +457,93 @@ function isProvenanceJson(input) {
   }
   return true;
 }
-var Text = z4.string().min(1).refine((value) => !hasControlCharacter(value), {
+var Text = z5.string().min(1).refine((value) => !hasControlCharacter(value), {
   message: "Provenance text must not contain control characters"
 });
-var ArtifactProvenanceRevision = z4.strictObject({
+var ArtifactProvenanceRevision = z5.strictObject({
   storeId: Text,
   artifactId: Text,
   uri: Text.optional(),
   /** The enclosing commit is resolved by the reader, avoiding a self-referential commit hash. */
-  revision: z4.union([
+  revision: z5.union([
     Text,
-    z4.strictObject({ kind: z4.literal("enclosing-commit") }),
-    z4.null()
+    z5.strictObject({ kind: z5.literal("enclosing-commit") }),
+    z5.null()
   ]),
   operationId: Text.nullable(),
   /** Optional when the store identifies revisions without content addressing (including tombstones). */
-  digest: z4.strictObject({ algorithm: Text, value: Text }).optional()
+  digest: z5.strictObject({ algorithm: Text, value: Text }).optional()
 });
-var ArtifactProvenanceActor = z4.discriminatedUnion("kind", [
-  z4.strictObject({
-    kind: z4.literal("session"),
+var ArtifactProvenanceActor = z5.discriminatedUnion("kind", [
+  z5.strictObject({
+    kind: z5.literal("session"),
     sessionId: Text,
     runId: Text.nullable()
   }),
-  z4.strictObject({
-    kind: z4.literal("human"),
+  z5.strictObject({
+    kind: z5.literal("human"),
     userId: Text.optional(),
     surface: Text
   }),
-  z4.strictObject({
-    kind: z4.literal("plugin"),
+  z5.strictObject({
+    kind: z5.literal("plugin"),
     pluginId: Text,
     capability: Text
   }),
-  z4.strictObject({ kind: z4.literal("host"), capability: Text }),
-  z4.strictObject({ kind: z4.literal("import"), source: Text }),
-  z4.strictObject({ kind: z4.literal("unknown") })
+  z5.strictObject({ kind: z5.literal("host"), capability: Text }),
+  z5.strictObject({ kind: z5.literal("import"), source: Text }),
+  z5.strictObject({ kind: z5.literal("unknown") })
 ]);
-var ArtifactProvenanceCause = z4.discriminatedUnion("kind", [
-  z4.strictObject({
-    kind: z4.literal("session"),
+var ArtifactProvenanceCause = z5.discriminatedUnion("kind", [
+  z5.strictObject({
+    kind: z5.literal("session"),
     sessionId: Text,
     runId: Text.nullable()
   }),
-  z4.strictObject({
-    kind: z4.literal("session-event"),
+  z5.strictObject({
+    kind: z5.literal("session-event"),
     sessionId: Text,
     cause: SessionCausedByEvent
   }),
-  z4.strictObject({
-    kind: z4.literal("automation"),
+  z5.strictObject({
+    kind: z5.literal("automation"),
     automationId: Text,
     runId: Text.nullable()
   }),
-  z4.strictObject({ kind: z4.literal("operation"), operationId: Text })
+  z5.strictObject({ kind: z5.literal("operation"), operationId: Text })
 ]);
-var ArtifactProvenanceOperation = z4.strictObject({
+var ArtifactProvenanceOperation = z5.strictObject({
   id: Text.nullable(),
-  at: z4.iso.datetime().nullable(),
+  at: z5.iso.datetime().nullable(),
   name: Text,
   actor: ArtifactProvenanceActor,
   /** Null means no tool invocation; a known invocation with an unknown id records a gap. */
-  invocation: z4.strictObject({
+  invocation: z5.strictObject({
     tool: Text,
     toolCallId: Text.nullable(),
-    origin: z4.enum(["model", "host"])
+    origin: z5.enum(["model", "host"])
   }).nullable(),
   /** Known causes only; unavailable cause capture requires a gap, never a guessed creation cause. */
-  causes: z4.array(ArtifactProvenanceCause)
+  causes: z5.array(ArtifactProvenanceCause)
 });
-var ArtifactProvenanceReference = z4.discriminatedUnion("kind", [
-  z4.strictObject({
-    kind: z4.literal("session"),
+var ArtifactProvenanceReference = z5.discriminatedUnion("kind", [
+  z5.strictObject({
+    kind: z5.literal("session"),
     sessionId: Text,
     runId: Text.optional()
   }),
-  z4.strictObject({
-    kind: z4.literal("artifact"),
+  z5.strictObject({
+    kind: z5.literal("artifact"),
     revision: ArtifactProvenanceRevision
   }),
-  z4.strictObject({
-    kind: z4.literal("resource"),
+  z5.strictObject({
+    kind: z5.literal("resource"),
     uri: Text,
     revision: Text.nullable()
   })
 ]);
-var ArtifactProvenanceGap = z4.strictObject({
-  code: z4.enum([
+var ArtifactProvenanceGap = z5.strictObject({
+  code: z5.enum([
     "unknown",
     "capture-failed",
     "legacy-derived",
@@ -548,18 +556,18 @@ var ArtifactProvenanceGap = z4.strictObject({
     "invalid-record"
   ]),
   /** JSON Pointer into this envelope; the empty pointer covers the whole capture. */
-  at: z4.string().regex(/^(?:\/(?:[^~/]|~[01])*)*$/).refine((value) => !hasControlCharacter(value)),
+  at: z5.string().regex(/^(?:\/(?:[^~/]|~[01])*)*$/).refine((value) => !hasControlCharacter(value)),
   detail: Text.optional()
 }).refine((gap) => gap.at !== "" || gap.code === "capture-failed", {
   message: "Only a whole-capture failure may cover the entire envelope"
 });
-var ArtifactProvenanceSession = z4.strictObject({
+var ArtifactProvenanceSession = z5.strictObject({
   sessionId: Text,
-  basis: z4.enum(["recorded", "legacy-derived", "unverified-index", "missing"]),
+  basis: z5.enum(["recorded", "legacy-derived", "unverified-index", "missing"]),
   record: SessionProvenanceRecord.nullable()
 });
-var ArtifactProvenanceSource = z4.strictObject({
-  relationship: z4.enum([
+var ArtifactProvenanceSource = z5.strictObject({
+  relationship: z5.enum([
     "revision-of",
     "copied-from",
     "harvested-from",
@@ -569,8 +577,8 @@ var ArtifactProvenanceSource = z4.strictObject({
   ]),
   revision: ArtifactProvenanceRevision
 });
-var ArtifactProvenanceMutation = z4.strictObject({
-  kind: z4.enum([
+var ArtifactProvenanceMutation = z5.strictObject({
+  kind: z5.enum([
     "create",
     "update",
     "delete",
@@ -583,16 +591,16 @@ var ArtifactProvenanceMutation = z4.strictObject({
   target: ArtifactProvenanceRevision,
   /** Retained from the source on copies/acceptance; operation.actor is the persistence actor. */
   producer: ArtifactProvenanceOperation,
-  sources: z4.array(ArtifactProvenanceSource)
+  sources: z5.array(ArtifactProvenanceSource)
 });
-var Envelope = z4.strictObject({
-  version: z4.literal(ARTIFACT_PROVENANCE_VERSION),
+var Envelope = z5.strictObject({
+  version: z5.literal(ARTIFACT_PROVENANCE_VERSION),
   operation: ArtifactProvenanceOperation,
-  artifacts: z4.array(ArtifactProvenanceMutation).min(1),
-  sessions: z4.array(ArtifactProvenanceSession),
-  subjects: z4.array(ArtifactProvenanceReference),
-  evidence: z4.array(ArtifactProvenanceReference),
-  gaps: z4.array(ArtifactProvenanceGap)
+  artifacts: z5.array(ArtifactProvenanceMutation).min(1),
+  sessions: z5.array(ArtifactProvenanceSession),
+  subjects: z5.array(ArtifactProvenanceReference),
+  evidence: z5.array(ArtifactProvenanceReference),
+  gaps: z5.array(ArtifactProvenanceGap)
 });
 var UNKNOWN = [
   "unknown",
@@ -763,18 +771,18 @@ function validateEnvelope(envelope, context) {
   }
   checkGraph(envelope, gap, issue);
 }
-var ArtifactProvenanceEnvelopeV1 = z4.unknown().refine(isProvenanceJson, {
+var ArtifactProvenanceEnvelopeV1 = z5.unknown().refine(isProvenanceJson, {
   message: "Provenance must be plain, acyclic, lossless JSON without control characters"
 }).pipe(Envelope.superRefine(validateEnvelope));
 function parseArtifactProvenanceEnvelope(input) {
   return ArtifactProvenanceEnvelopeV1.parse(input);
 }
-var ArtifactProvenanceCaptureContextSchema = z4.strictObject({
+var ArtifactProvenanceCaptureContextSchema = z5.strictObject({
   operation: ArtifactProvenanceOperation,
-  sessions: z4.array(ArtifactProvenanceSession),
-  subjects: z4.array(ArtifactProvenanceReference),
-  evidence: z4.array(ArtifactProvenanceReference),
-  gaps: z4.array(ArtifactProvenanceGap)
+  sessions: z5.array(ArtifactProvenanceSession),
+  subjects: z5.array(ArtifactProvenanceReference),
+  evidence: z5.array(ArtifactProvenanceReference),
+  gaps: z5.array(ArtifactProvenanceGap)
 });
 function parseArtifactProvenanceCaptureContext(input) {
   return ArtifactProvenanceCaptureContextSchema.parse(input);
@@ -1072,39 +1080,39 @@ function finalizeArtifactProvenanceEnvelope(capture, artifacts) {
 }
 
 // packages/plugin-protocol/dist/authority.js
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 
 // packages/plugin-protocol/dist/permissions.js
-import { z as z5 } from "zod";
-var AuthGrantOperation = z5.enum([
+import { z as z6 } from "zod";
+var AuthGrantOperation = z6.enum([
   "status",
   "connect",
   "disconnect",
   "resolve"
 ]);
-var AuthAccountSelector = z5.discriminatedUnion("kind", [
-  z5.strictObject({ kind: z5.literal("active") }),
-  z5.strictObject({ kind: z5.literal("account-id"), accountId: NonEmptyString }),
-  z5.strictObject({ kind: z5.literal("record-id"), recordId: NonEmptyString })
+var AuthAccountSelector = z6.discriminatedUnion("kind", [
+  z6.strictObject({ kind: z6.literal("active") }),
+  z6.strictObject({ kind: z6.literal("account-id"), accountId: NonEmptyString }),
+  z6.strictObject({ kind: z6.literal("record-id"), recordId: NonEmptyString })
 ]);
-var AuthScopeDefinition = z5.strictObject({
+var AuthScopeDefinition = z6.strictObject({
   id: NonEmptyString,
   label: NonEmptyString,
   description: NonEmptyString,
-  documentationUrl: z5.url().optional()
+  documentationUrl: z6.url().optional()
 });
-var ScopeNeed = z5.strictObject({
+var ScopeNeed = z6.strictObject({
   scope: NonEmptyString,
   reason: NonEmptyString.optional()
 });
-var ScopeAlternative = z5.strictObject({
-  allOf: z5.array(ScopeNeed).min(1)
+var ScopeAlternative = z6.strictObject({
+  allOf: z6.array(ScopeNeed).min(1)
 });
-var ScopeRequirement = z5.strictObject({
+var ScopeRequirement = z6.strictObject({
   purpose: NonEmptyString,
-  alternatives: z5.array(ScopeAlternative).min(1)
+  alternatives: z6.array(ScopeAlternative).min(1)
 });
-var AuthGrantRequestBase = z5.strictObject({
+var AuthGrantRequestBase = z6.strictObject({
   // A local (undotted) service must be declared in this same manifest; a
   // qualified (dotted) service names another plugin's global id and is an
   // external service dependency, recorded on the resolved contract's
@@ -1113,22 +1121,22 @@ var AuthGrantRequestBase = z5.strictObject({
   // Optional for backward compatibility with grants whose service has a
   // single unambiguous scheme. Local ids resolve under the service owner's
   // namespace; qualified ids are preserved.
-  schemes: z5.array(AuthSchemeReference).min(1).optional(),
-  operations: z5.array(AuthGrantOperation).min(1),
-  purposes: z5.array(NonEmptyString).optional(),
+  schemes: z6.array(AuthSchemeReference).min(1).optional(),
+  operations: z6.array(AuthGrantOperation).min(1),
+  purposes: z6.array(NonEmptyString).optional(),
   // Bridged by the runtime into an enforceable `CredentialGrant`:
   // `allowedScopes` is the caller's scope ENVELOPE and
   // `accountSelectors` map through. Absent `accountSelectors` resolves to the
   // narrowest bound (see `ResolvedAuthGrantRequest`); absent scope envelope
   // leaves the bridged grant scope-agnostic.
-  allowedScopes: z5.array(NonEmptyString).min(1).optional(),
+  allowedScopes: z6.array(NonEmptyString).min(1).optional(),
   // Legacy spelling for `allowedScopes`; new manifests should use the authority-shaped name.
-  requiredScopes: z5.array(NonEmptyString).min(1).optional(),
+  requiredScopes: z6.array(NonEmptyString).min(1).optional(),
   // Preferred proactive consent bundle; runtime resolution still uses `scopeRequirement`.
-  connectScopes: z5.array(NonEmptyString).min(1).optional(),
+  connectScopes: z6.array(NonEmptyString).min(1).optional(),
   scopeRequirement: ScopeRequirement.optional(),
-  scopeDefinitions: z5.array(AuthScopeDefinition).min(1).optional(),
-  accountSelectors: z5.array(AuthAccountSelector).min(1).optional()
+  scopeDefinitions: z6.array(AuthScopeDefinition).min(1).optional(),
+  accountSelectors: z6.array(AuthAccountSelector).min(1).optional()
 });
 function validateAuthGrantRequest(grant, ctx) {
   if (grant.allowedScopes !== void 0 && grant.requiredScopes !== void 0) {
@@ -1208,19 +1216,19 @@ function validateAuthGrantRequest(grant, ctx) {
   }
 }
 var AuthGrantRequest = AuthGrantRequestBase.superRefine(validateAuthGrantRequest);
-var StorageGrantRequest = z5.strictObject({
-  kind: z5.enum(["sqlite", "dataDir"]),
-  operations: z5.array(z5.enum(["open", "read", "write"])).min(1)
+var StorageGrantRequest = z6.strictObject({
+  kind: z6.enum(["sqlite", "dataDir"]),
+  operations: z6.array(z6.enum(["open", "read", "write"])).min(1)
 });
-var EventGrantRequest = z5.strictObject({
+var EventGrantRequest = z6.strictObject({
   event: NonEmptyString,
-  operations: z5.array(z5.enum(["subscribe", "publish"])).min(1)
+  operations: z6.array(z6.enum(["subscribe", "publish"])).min(1)
 });
-var EndpointGrantRequest = z5.strictObject({
+var EndpointGrantRequest = z6.strictObject({
   endpoint: LocalContributionId,
-  operations: z5.array(z5.enum(["register", "invoke"])).min(1)
+  operations: z6.array(z6.enum(["register", "invoke"])).min(1)
 });
-var WebSessionOrigin = z5.string().superRefine((value, ctx) => {
+var WebSessionOrigin = z6.string().superRefine((value, ctx) => {
   try {
     const url = new URL(value);
     if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.origin !== value) {
@@ -1233,7 +1241,7 @@ var WebSessionOrigin = z5.string().superRefine((value, ctx) => {
     ctx.addIssue({ code: "custom", message: "must be a valid HTTPS origin" });
   }
 });
-var WebSessionCsrfSourceUrl = z5.url({ protocol: /^https$/ }).superRefine((value, ctx) => {
+var WebSessionCsrfSourceUrl = z6.url({ protocol: /^https$/ }).superRefine((value, ctx) => {
   const url = new URL(value);
   if (url.username !== "" || url.password !== "" || url.hash !== "") {
     ctx.addIssue({
@@ -1281,10 +1289,10 @@ function webSessionPathWithinPrefix(pathname, pathPrefix) {
 }
 var WEB_SESSION_CSRF_SELECTOR_PATTERN = /^(?=.)(?:[a-zA-Z][a-zA-Z0-9-]*)?(?:#[a-zA-Z_][\w-]*|\[[a-zA-Z_:][\w:.-]*(?:=(?:"[^"]*"|'[^']*'|[\w-]+))?\])*$/u;
 var WebSessionCsrfSelector = NonEmptyString.regex(WEB_SESSION_CSRF_SELECTOR_PATTERN, "must be a compound simple selector: optional tag, then #id or [attr=value] predicates on that one element (no combinators, classes, or pseudo-classes)");
-var WebSessionGrantRequest = z5.strictObject({
+var WebSessionGrantRequest = z6.strictObject({
   origin: WebSessionOrigin,
-  pathPrefixes: z5.array(WebSessionPathPrefix).min(1),
-  csrf: z5.strictObject({
+  pathPrefixes: z6.array(WebSessionPathPrefix).min(1),
+  csrf: z6.strictObject({
     sourceUrl: WebSessionCsrfSourceUrl,
     selector: WebSessionCsrfSelector,
     attribute: NonEmptyString,
@@ -1293,14 +1301,14 @@ var WebSessionGrantRequest = z5.strictObject({
     bodyField: NonEmptyString.optional()
   }).optional()
 });
-var KnowledgeSearchGrantRequest = z5.strictObject({
-  scope: z5.literal("own-schemes")
+var KnowledgeSearchGrantRequest = z6.strictObject({
+  scope: z6.literal("own-schemes")
 });
-var KnownResourcesGrantRequest = z5.strictObject({
-  scope: z5.literal("own-modules")
+var KnownResourcesGrantRequest = z6.strictObject({
+  scope: z6.literal("own-modules")
 });
-var PluginAgentDefinitionPermissionRule = z5.strictObject({
-  effect: z5.enum(["allow", "deny", "ask"]),
+var PluginAgentDefinitionPermissionRule = z6.strictObject({
+  effect: z6.enum(["allow", "deny", "ask"]),
   /** Restrict to one tool name. */
   tool: NonEmptyString.optional(),
   /** Restrict to one classified capability key. */
@@ -1310,7 +1318,7 @@ var PluginAgentDefinitionPermissionRule = z5.strictObject({
   /** Restrict to matching resources (a path glob, or a URI-shaped policy address). */
   resource: NonEmptyString.optional(),
   /** Restrict the rule to one permission mode; omit to apply in all modes. */
-  mode: z5.enum(["default", "ask", "allow", "auto"]).optional()
+  mode: z6.enum(["default", "ask", "allow", "auto"]).optional()
 });
 var RETIRED_PERMISSION_ASK_KEYS = [
   "network",
@@ -1376,14 +1384,14 @@ function retiredPermissionAsksIn(rawManifest) {
   }
   return found;
 }
-var TargetPermissionWiring = z5.strictObject({
-  auth: z5.array(AuthGrantRequest).optional(),
-  storage: z5.array(StorageGrantRequest).optional(),
-  events: z5.array(EventGrantRequest).optional(),
-  endpoints: z5.array(EndpointGrantRequest).optional(),
-  webSession: z5.array(WebSessionGrantRequest).optional(),
-  knowledgeSearch: z5.array(KnowledgeSearchGrantRequest).optional(),
-  knownResources: z5.array(KnownResourcesGrantRequest).optional()
+var TargetPermissionWiring = z6.strictObject({
+  auth: z6.array(AuthGrantRequest).optional(),
+  storage: z6.array(StorageGrantRequest).optional(),
+  events: z6.array(EventGrantRequest).optional(),
+  endpoints: z6.array(EndpointGrantRequest).optional(),
+  webSession: z6.array(WebSessionGrantRequest).optional(),
+  knowledgeSearch: z6.array(KnowledgeSearchGrantRequest).optional(),
+  knownResources: z6.array(KnownResourcesGrantRequest).optional()
 }).superRefine((permissions, ctx) => {
   const rows = permissions.webSession ?? [];
   for (const [index, row] of rows.entries()) {
@@ -1401,9 +1409,9 @@ var TargetPermissionWiring = z5.strictObject({
     }
   }
 });
-var TargetPermissionSet = z5.preprocess(stripRetiredPermissionAsks, TargetPermissionWiring);
-var PluginPermissionManifest = z5.strictObject({
-  byTarget: z5.strictObject({
+var TargetPermissionSet = z6.preprocess(stripRetiredPermissionAsks, TargetPermissionWiring);
+var PluginPermissionManifest = z6.strictObject({
+  byTarget: z6.strictObject({
     "kay.agent": TargetPermissionSet.optional(),
     "kay.app": TargetPermissionSet.optional(),
     "kay.ui": TargetPermissionSet.optional()
@@ -1421,26 +1429,26 @@ var PluginPermissionManifest = z5.strictObject({
 });
 var ResolvedAuthGrantRequest = AuthGrantRequestBase.extend({
   service: GlobalContributionId,
-  schemes: z5.array(GlobalContributionId).min(1).optional(),
+  schemes: z6.array(GlobalContributionId).min(1).optional(),
   // Resolution fills an absent binding with the narrowest bound, so a resolved
   // grant ALWAYS carries an explicit, non-broadening account selector — the
   // runtime never has to invent a default and fail open.
-  accountSelectors: z5.array(AuthAccountSelector).min(1)
+  accountSelectors: z6.array(AuthAccountSelector).min(1)
 }).superRefine(validateAuthGrantRequest);
 var ResolvedEndpointGrantRequest = EndpointGrantRequest.extend({
   endpoint: GlobalContributionId
 });
-var ResolvedTargetGrantSet = z5.strictObject({
-  auth: z5.array(ResolvedAuthGrantRequest).optional(),
-  storage: z5.array(StorageGrantRequest).optional(),
-  events: z5.array(EventGrantRequest).optional(),
-  endpoints: z5.array(ResolvedEndpointGrantRequest).optional(),
-  webSession: z5.array(WebSessionGrantRequest).optional(),
-  knowledgeSearch: z5.array(KnowledgeSearchGrantRequest).optional(),
-  knownResources: z5.array(KnownResourcesGrantRequest).optional()
-});
-var ResolvedPluginGrants = z5.strictObject({
-  byTarget: z5.strictObject({
+var ResolvedTargetGrantSet = z6.strictObject({
+  auth: z6.array(ResolvedAuthGrantRequest).optional(),
+  storage: z6.array(StorageGrantRequest).optional(),
+  events: z6.array(EventGrantRequest).optional(),
+  endpoints: z6.array(ResolvedEndpointGrantRequest).optional(),
+  webSession: z6.array(WebSessionGrantRequest).optional(),
+  knowledgeSearch: z6.array(KnowledgeSearchGrantRequest).optional(),
+  knownResources: z6.array(KnownResourcesGrantRequest).optional()
+});
+var ResolvedPluginGrants = z6.strictObject({
+  byTarget: z6.strictObject({
     "kay.agent": ResolvedTargetGrantSet.optional(),
     "kay.app": ResolvedTargetGrantSet.optional(),
     "kay.ui": ResolvedTargetGrantSet.optional()
@@ -1448,24 +1456,24 @@ var ResolvedPluginGrants = z5.strictObject({
 });
 
 // packages/plugin-protocol/dist/authority.js
-var WhiteboardCapabilityScope = z6.enum(["own-types", "all-types"]);
-var WhiteboardCapabilityOperation = z6.enum([
+var WhiteboardCapabilityScope = z7.enum(["own-types", "all-types"]);
+var WhiteboardCapabilityOperation = z7.enum([
   "discover",
   "read",
   "create",
   "update",
   "remove"
 ]);
-var WhiteboardCapabilityClaimV1 = z6.strictObject({
-  target: z6.enum(["kay.agent", "kay.app"]),
-  slug: z6.enum([
+var WhiteboardCapabilityClaimV1 = z7.strictObject({
+  target: z7.enum(["kay.agent", "kay.app"]),
+  slug: z7.enum([
     "whiteboard.discover",
     "whiteboard.read",
     "whiteboard.create",
     "whiteboard.update",
     "whiteboard.remove"
   ]),
-  envelope: z6.strictObject({ scope: WhiteboardCapabilityScope })
+  envelope: z7.strictObject({ scope: WhiteboardCapabilityScope })
 }).superRefine((claim, ctx) => {
   if (claim.target === "kay.app" && claim.slug !== "whiteboard.discover" && claim.slug !== "whiteboard.read") {
     ctx.addIssue({
@@ -1475,91 +1483,91 @@ var WhiteboardCapabilityClaimV1 = z6.strictObject({
     });
   }
 });
-var PluginCapabilityClaimV1 = z6.discriminatedUnion("slug", [
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("sessions.run"),
-    envelope: z6.strictObject({})
+var PluginCapabilityClaimV1 = z7.discriminatedUnion("slug", [
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("sessions.run"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.agent"),
-    slug: z6.literal("network.connect"),
-    envelope: z6.strictObject({ connect: NonEmptyString })
+  z7.strictObject({
+    target: z7.literal("kay.agent"),
+    slug: z7.literal("network.connect"),
+    envelope: z7.strictObject({ connect: NonEmptyString })
   }),
-  z6.strictObject({
-    target: z6.literal("kay.agent"),
-    slug: z6.literal("web-session.request"),
-    envelope: z6.strictObject({
+  z7.strictObject({
+    target: z7.literal("kay.agent"),
+    slug: z7.literal("web-session.request"),
+    envelope: z7.strictObject({
       origin: NonEmptyString,
       pathPrefix: NonEmptyString
     })
   }),
-  z6.strictObject({
-    target: z6.literal("kay.agent"),
-    slug: z6.literal("web-session.download"),
-    envelope: z6.strictObject({
+  z7.strictObject({
+    target: z7.literal("kay.agent"),
+    slug: z7.literal("web-session.download"),
+    envelope: z7.strictObject({
       origin: NonEmptyString,
       pathPrefix: NonEmptyString
     })
   }),
-  z6.strictObject({
-    target: z6.literal("kay.agent"),
-    slug: z6.literal("process.spawn"),
-    envelope: z6.strictObject({
+  z7.strictObject({
+    target: z7.literal("kay.agent"),
+    slug: z7.literal("process.spawn"),
+    envelope: z7.strictObject({
       command: NonEmptyString,
       argvClass: NonEmptyString
     })
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("corpus.read"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("corpus.read"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
+  z7.strictObject({
     // Every plugin's recorded Jev signals, not only the caller's own: an empty envelope because
     // the grant itself is the visibility decision. Both first consumers (a session timeline, and
     // an agent loop turning signals into skills) read rows another plugin recorded.
-    target: z6.literal("kay.app"),
-    slug: z6.literal("signals.read"),
-    envelope: z6.strictObject({})
+    target: z7.literal("kay.app"),
+    slug: z7.literal("signals.read"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
+  z7.strictObject({
     // Read-only metadata about every managed skill: identity, versions, history, suggestions.
     // Never a skill's bytes (an agent reads those through `skill://`) and never a write. An
     // empty envelope because the grant itself is the visibility decision, as with `signals.read`.
-    target: z6.literal("kay.app"),
-    slug: z6.literal("skills.read"),
-    envelope: z6.strictObject({})
+    target: z7.literal("kay.app"),
+    slug: z7.literal("skills.read"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
+  z7.strictObject({
     // The text an agent sees for a tool or an address in a live session, where each comes from,
     // and whether it is one of Bonsai's own. Read-only and never a call. An empty envelope because
     // the grant itself is the visibility decision, as with `skills.read`.
-    target: z6.literal("kay.app"),
-    slug: z6.literal("tools.describe"),
-    envelope: z6.strictObject({})
+    target: z7.literal("kay.app"),
+    slug: z7.literal("tools.describe"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("workspace.command"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("workspace.command"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("sessions.create"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("sessions.create"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("sessions.update"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("sessions.update"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("models.complete"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("models.complete"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
+  z7.strictObject({
     // Held to `kay.app`, the daemon-lifetime tier, even though the same wrapper is exposed on
     // BOTH the `kay.app` and `kay.agent` plugin SDKs (and to host composition directly): a slug
     // pins exactly one target (see this file's module doc), so one shared claim is simpler and
@@ -1568,104 +1576,104 @@ var PluginCapabilityClaimV1 = z6.discriminatedUnion("slug", [
     // plugin's own pinned authority, which already spans both targets for every other capability
     // (`network.connect`/`tool-interception.register` are decided by the identical per-plugin
     // handle `kay.app`-target claims use).
-    target: z6.literal("kay.app"),
-    slug: z6.literal("jev.use"),
-    envelope: z6.strictObject({})
+    target: z7.literal("kay.app"),
+    slug: z7.literal("jev.use"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("automations.write"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("automations.write"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("automations.run"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("automations.run"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("workflows.define"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("workflows.define"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("session-events.subscribe"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("session-events.subscribe"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("agents.run"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("agents.run"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("dynamic-context.register"),
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("dynamic-context.register"),
     // The declared `contributes.contextContributors` localId, which doubles as the contributor's
     // section tag at the model boundary — so the row a human consents to names the section.
-    envelope: z6.strictObject({ contributor: NonEmptyString })
+    envelope: z7.strictObject({ contributor: NonEmptyString })
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("app-data.register"),
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("app-data.register"),
     /** The declared `contributes.dataSources` localId. */
-    envelope: z6.strictObject({ source: NonEmptyString })
+    envelope: z7.strictObject({ source: NonEmptyString })
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("account.assert"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("account.assert"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("account.update"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("account.update"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.app"),
-    slug: z6.literal("agents.permissions"),
-    envelope: z6.strictObject({
+  z7.strictObject({
+    target: z7.literal("kay.app"),
+    slug: z7.literal("agents.permissions"),
+    envelope: z7.strictObject({
       /** The definition's local id — WHICH agent these rules are authored onto. */
       agent: NonEmptyString,
       /** `definition.permissions`, in declaration order (order is semantic; first match wins). */
-      rules: z6.array(PluginAgentDefinitionPermissionRule),
+      rules: z7.array(PluginAgentDefinitionPermissionRule),
       /** `definition.permissionsFallback`, in declaration order. */
-      fallback: z6.array(PluginAgentDefinitionPermissionRule)
+      fallback: z7.array(PluginAgentDefinitionPermissionRule)
     })
   }),
-  z6.strictObject({
-    target: z6.literal("kay.agent"),
-    slug: z6.literal("tool-interception.register"),
-    envelope: z6.strictObject({})
+  z7.strictObject({
+    target: z7.literal("kay.agent"),
+    slug: z7.literal("tool-interception.register"),
+    envelope: z7.strictObject({})
   }),
-  z6.strictObject({
-    target: z6.literal("kay.agent"),
-    slug: z6.literal("interaction.surface"),
+  z7.strictObject({
+    target: z7.literal("kay.agent"),
+    slug: z7.literal("interaction.surface"),
     /** The one Bonsai-shipped interaction surface this plugin may drive; one claim per surface. */
-    envelope: z6.strictObject({ surface: z6.enum(["browser-pane", "desktop"]) })
+    envelope: z7.strictObject({ surface: z7.enum(["browser-pane", "desktop"]) })
   }),
-  z6.strictObject({
-    target: z6.literal("plugin"),
-    slug: z6.literal("config.declare-section"),
+  z7.strictObject({
+    target: z7.literal("plugin"),
+    slug: z7.literal("config.declare-section"),
     /** The settings-document section key, e.g. `models` or `plugins.com.acme.thing`. */
-    envelope: z6.strictObject({ section: NonEmptyString })
+    envelope: z7.strictObject({ section: NonEmptyString })
   }),
-  z6.strictObject({
-    target: z6.literal("plugin"),
-    slug: z6.literal("auth.own-service"),
+  z7.strictObject({
+    target: z7.literal("plugin"),
+    slug: z7.literal("auth.own-service"),
     /** The minted global service id this plugin would own, e.g. `google.account`. */
-    envelope: z6.strictObject({ service: NonEmptyString })
+    envelope: z7.strictObject({ service: NonEmptyString })
   }),
-  z6.strictObject({
-    target: z6.literal("plugin"),
-    slug: z6.literal("auth.shared-identity"),
+  z7.strictObject({
+    target: z7.literal("plugin"),
+    slug: z7.literal("auth.shared-identity"),
     /** The foreign global service id whose identity this plugin would resolve against. */
-    envelope: z6.strictObject({ service: NonEmptyString })
+    envelope: z7.strictObject({ service: NonEmptyString })
   }),
-  z6.strictObject({
-    target: z6.literal("plugin"),
-    slug: z6.literal("cli.bind"),
+  z7.strictObject({
+    target: z7.literal("plugin"),
+    slug: z7.literal("cli.bind"),
     /** The binary basename a resolved credential would be injected into. */
-    envelope: z6.strictObject({ binary: NonEmptyString })
+    envelope: z7.strictObject({ binary: NonEmptyString })
   }),
   WhiteboardCapabilityClaimV1
 ]);
@@ -1710,28 +1718,28 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "whiteboard.update",
   "whiteboard.remove"
 ];
-var PluginCapabilityRefusalLayer = z6.enum(["grant", "binding"]);
-var PluginCapabilityRefusalCode = z6.enum([
+var PluginCapabilityRefusalLayer = z7.enum(["grant", "binding"]);
+var PluginCapabilityRefusalCode = z7.enum([
   "not-granted",
   "grant-read-failed",
   "binding-missing",
   "argv-outside-class"
 ]);
-var PluginCapabilityRefusalV1 = z6.strictObject({
+var PluginCapabilityRefusalV1 = z7.strictObject({
   claim: PluginCapabilityClaimV1,
   layer: PluginCapabilityRefusalLayer,
   code: PluginCapabilityRefusalCode,
   message: NonEmptyString,
   artifactGenerationId: ArtifactGenerationId.optional()
 });
-var PluginCapabilityDecisionV1 = z6.discriminatedUnion("kind", [
-  z6.strictObject({
-    kind: z6.literal("allowed"),
+var PluginCapabilityDecisionV1 = z7.discriminatedUnion("kind", [
+  z7.strictObject({
+    kind: z7.literal("allowed"),
     claim: PluginCapabilityClaimV1,
     artifactGenerationId: ArtifactGenerationId.optional()
   }),
-  z6.strictObject({
-    kind: z6.literal("refused"),
+  z7.strictObject({
+    kind: z7.literal("refused"),
     refusal: PluginCapabilityRefusalV1
   })
 ]);
@@ -2105,6 +2113,14 @@ function isSupportedSemverRange(range) {
 }
 
 // packages/plugin-protocol/dist/compatibility.js
+function kayPluginHostCompatibility(appVersion) {
+  return {
+    protocolVersion: KAY_PLUGIN_PROTOCOL_VERSION,
+    sdkVersion: KAY_PLUGIN_SDK_VERSION,
+    compatibleSdkVersions: KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS,
+    appVersion
+  };
+}
 function isCompatible(report) {
   return report.refusal === void 0;
 }
@@ -2191,30 +2207,30 @@ function checkKayPluginHostCompatibility(compatibility, host) {
 }
 
 // packages/plugin-protocol/dist/contributions.js
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var OptionalDisplayName = NonEmptyString.optional();
-var UriFilesystemBacking = z7.strictObject({
-  root: z7.literal("dataDir")
+var UriFilesystemBacking = z8.strictObject({
+  root: z8.literal("dataDir")
 });
-var ToolContribution = z7.strictObject({
+var ToolContribution = z8.strictObject({
   localId: LocalContributionId,
   toolName: PluginToolName,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional()
 });
-var ConverterContribution = z7.strictObject({
+var ConverterContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional(),
   /** MIME types this converter claims — contract data for introspection and
    *  collision checks; runtime match behavior stays the converter's `matches()`. */
-  mimeTypes: z7.array(MimeTypeString).min(1),
+  mimeTypes: z8.array(MimeTypeString).min(1),
   /** Extension fallbacks (no dot) used when a probe has no usable MIME type. */
-  extensions: z7.array(FileExtensionToken).min(1).optional()
+  extensions: z8.array(FileExtensionToken).min(1).optional()
 });
-var UriModuleContribution = z7.strictObject({
+var UriModuleContribution = z8.strictObject({
   localId: LocalContributionId,
-  schemes: z7.array(UriScheme).min(1),
+  schemes: z8.array(UriScheme).min(1),
   displayName: OptionalDisplayName,
   // The plugin only requests a projection. The daemon binds the effective root
   // and retains access control at finalization.
@@ -2233,30 +2249,30 @@ var UriModuleContribution = z7.strictObject({
   // `knownResources` permission grant (`api.knownResources`). Present-means-on
   // (`true` or absent; `false` is not a state). Decision record:
   // `lab/user-plugins/decisions/014-known-resources-ledger.md`.
-  knownResources: z7.literal(true).optional()
+  knownResources: z8.literal(true).optional()
 });
 var AppUriModuleContribution = UriModuleContribution.omit({
   authService: true,
   filesystemBacking: true,
   knownResources: true
 });
-var AppDataSourceContribution = z7.strictObject({
+var AppDataSourceContribution = z8.strictObject({
   localId: LocalContributionId,
-  scope: z7.enum(["runtime", "account", "session"]),
-  snapshot: z7.strictObject({
-    version: z7.number().int().positive(),
+  scope: z8.enum(["runtime", "account", "session"]),
+  snapshot: z8.strictObject({
+    version: z8.number().int().positive(),
     schema: JsonSchema
   }),
-  change: z7.strictObject({
-    version: z7.number().int().positive(),
+  change: z8.strictObject({
+    version: z8.number().int().positive(),
     schema: JsonSchema,
     /** Review-only claim; source schemas and behavioral tests enforce it because the daemon treats changes as opaque. */
-    semantics: z7.discriminatedUnion("kind", [
-      z7.strictObject({ kind: z7.literal("incremental") }),
-      z7.strictObject({
-        kind: z7.literal("snapshot-replacement"),
-        maxEncodedBytes: z7.number().int().positive(),
-        rationale: z7.string().trim().min(1).max(1024)
+    semantics: z8.discriminatedUnion("kind", [
+      z8.strictObject({ kind: z8.literal("incremental") }),
+      z8.strictObject({
+        kind: z8.literal("snapshot-replacement"),
+        maxEncodedBytes: z8.number().int().positive(),
+        rationale: z8.string().trim().min(1).max(1024)
       })
     ]).optional()
   }),
@@ -2270,28 +2286,28 @@ var AppDataSourceContribution = z7.strictObject({
     });
   }
 });
-var WhiteboardTypeStorage = z7.discriminatedUnion("kind", [
-  z7.strictObject({ kind: z7.literal("json") }),
-  z7.strictObject({ kind: z7.literal("payload") }),
-  z7.strictObject({
-    kind: z7.literal("markdown"),
+var WhiteboardTypeStorage = z8.discriminatedUnion("kind", [
+  z8.strictObject({ kind: z8.literal("json") }),
+  z8.strictObject({ kind: z8.literal("payload") }),
+  z8.strictObject({
+    kind: z8.literal("markdown"),
     bodyField: NonEmptyString
   })
 ]);
-var WhiteboardTypeContribution = z7.strictObject({
+var WhiteboardTypeContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
-  schemaVersion: z7.number().int().positive(),
+  schemaVersion: z8.number().int().positive(),
   storage: WhiteboardTypeStorage,
   valueSchema: JsonSchema,
-  presentation: z7.strictObject({
+  presentation: z8.strictObject({
     app: LocalContributionId
   }).optional()
 });
-var AppDataMaterializerContribution = z7.strictObject({
+var AppDataMaterializerContribution = z8.strictObject({
   source: LocalContributionId
 });
-var ArtifactUriModuleContribution = z7.strictObject({
+var ArtifactUriModuleContribution = z8.strictObject({
   localId: LocalContributionId,
   /** The single `scheme://` this module owns; also the on-disk artifact kind. */
   scheme: UriScheme,
@@ -2305,17 +2321,17 @@ var ArtifactUriModuleContribution = z7.strictObject({
    * composes its description from the plugin's own display name + scheme — a per-scheme label
    * would have no path to matter, so it is intentionally omitted rather than accepted-and-ignored.
    */
-  editable: z7.boolean().optional(),
+  editable: z8.boolean().optional(),
   /** Opt in to `list` over the kind's stored names. Default false. Mirrors
    * `CreateArtifactUriModuleOptions.listable`. */
-  listable: z7.boolean().optional(),
+  listable: z8.boolean().optional(),
   /**
    * Opt in to `delete` for same-session entries. Default false. Deletion
    * unlinks the stored file — no trash tier; a kind that wants recoverable
    * deletion is not artifact-backed. Mirrors
    * `CreateArtifactUriModuleOptions.deletable`.
    */
-  deletable: z7.boolean().optional(),
+  deletable: z8.boolean().optional(),
   /**
    * Opt in to the `{ content, mode: "append" }` write envelope, which extends
    * stored text instead of replacing it (concurrent-appender-safe: the host
@@ -2323,7 +2339,7 @@ var ArtifactUriModuleContribution = z7.strictObject({
    * keep their verbatim round-trip. Mirrors
    * `CreateArtifactUriModuleOptions.appendable`.
    */
-  appendable: z7.boolean().optional(),
+  appendable: z8.boolean().optional(),
   /**
    * Which sessions share one storage namespace. Default `"session"` — the existing
    * per-session behavior (each session gets its own kind directory; other sessions'
@@ -2334,14 +2350,14 @@ var ArtifactUriModuleContribution = z7.strictObject({
    * the scope; the host derives the family root from provenance it already holds, so
    * family identity never crosses the SDK boundary.
    */
-  storageScope: z7.enum(["session", "family"]).optional()
+  storageScope: z8.enum(["session", "family"]).optional()
 });
-var CliBindingContribution = z7.strictObject({
+var CliBindingContribution = z8.strictObject({
   localId: LocalContributionId,
   binary: CliBinaryName,
-  aliases: z7.array(CliBinaryName).optional(),
+  aliases: z8.array(CliBinaryName).optional(),
   /** Where the binary comes from. Omitted ⇒ `"vendored"` (decision 007). */
-  provider: z7.enum(["vendored", "path"]).optional(),
+  provider: z8.enum(["vendored", "path"]).optional(),
   // A local ref (no dot) must name an auth service declared in this same
   // manifest; a qualified ref (dotted, e.g. `google.account`) names another
   // plugin's already-minted global id and is recorded, not resolved, here (see
@@ -2354,20 +2370,20 @@ var CliBindingContribution = z7.strictObject({
    * MUST be absent for a `path` binding, which can never receive a token.
    */
   authEnvVar: CliAuthEnvVarName.optional(),
-  readOnly: z7.array(NonEmptyString),
-  write: z7.array(NonEmptyString)
+  readOnly: z8.array(NonEmptyString),
+  write: z8.array(NonEmptyString)
 });
-var GitHostContribution = z7.strictObject({
+var GitHostContribution = z8.strictObject({
   host: GitHostName,
   authService: LocalContributionId,
   basicAuthUser: GitBasicAuthUser
 });
-var ResourceContribution = z7.strictObject({
+var ResourceContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional()
 });
-var SkillContribution = z7.strictObject({
+var SkillContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   /** Model-visible one-liner: when to reach for this skill. */
@@ -2375,18 +2391,18 @@ var SkillContribution = z7.strictObject({
   /** The SKILL.md-style file inside the package carrying the full instructions. */
   path: PackageAssetPath
 });
-var PluginSkillSourceDeclaration = z7.discriminatedUnion("channel", [
-  z7.strictObject({
-    channel: z7.literal("installer"),
+var PluginSkillSourceDeclaration = z8.discriminatedUnion("channel", [
+  z8.strictObject({
+    channel: z8.literal("installer"),
     localId: LocalContributionId,
     displayName: OptionalDisplayName,
     /** The package-runner executable, e.g. `npx` — checked against the daemon's allowlist. */
     command: NonEmptyString,
     /** Its argv, e.g. `["skills", "add", "clerk/skills"]`. */
-    args: z7.array(NonEmptyString)
+    args: z8.array(NonEmptyString)
   }),
-  z7.strictObject({
-    channel: z7.literal("git-clone"),
+  z8.strictObject({
+    channel: z8.literal("git-clone"),
     localId: LocalContributionId,
     displayName: OptionalDisplayName,
     /** The repository locator — canonicalized and hygiene-checked by the daemon. */
@@ -2397,17 +2413,17 @@ var PluginSkillSourceDeclaration = z7.discriminatedUnion("channel", [
     subdir: NonEmptyString.optional()
   })
 ]);
-var SearchProviderContribution = z7.strictObject({
+var SearchProviderContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
-  schemes: z7.array(UriScheme).optional()
+  schemes: z8.array(UriScheme).optional()
 });
-var InteractionDriverContribution = z7.strictObject({
+var InteractionDriverContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
-  kind: z7.enum(["browser", "computer-use"])
+  kind: z8.enum(["browser", "computer-use"])
 });
-var EntityResolverContribution = z7.strictObject({
+var EntityResolverContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   /** The `kay.agent` URI module (this manifest's own `contributes.uriModules[].localId`) whose
@@ -2415,24 +2431,24 @@ var EntityResolverContribution = z7.strictObject({
   uriModule: LocalContributionId,
   /** `person` | `channel` | `repo` | `pull-request` | ... -- drives avatar-first vs glyph-first row
    *  anatomy (N10-R2) and lets the renderer request a narrower `entityTypes` filter. */
-  entityTypes: z7.array(NonEmptyString).min(1),
+  entityTypes: z8.array(NonEmptyString).min(1),
   /** The URI namespace/route `search()` is called against, e.g. `slack://directory` or
    *  `github://search/repositories` -- the resolver's fixed search scope; the live user query is
    *  the `search()` call's `query` param, never concatenated into this string. */
   uriHint: NonEmptyString
 });
-var AgentRenderContribution = z7.strictObject({
+var AgentRenderContribution = z8.strictObject({
   localId: LocalContributionId,
-  resultKinds: z7.array(NonEmptyString).min(1)
+  resultKinds: z8.array(NonEmptyString).min(1)
 });
-var EndpointContribution = z7.strictObject({
+var EndpointContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   requestSchema: JsonSchema.optional(),
   responseSchema: JsonSchema.optional()
 });
 var MCP_SERVER_LOCAL_HTTP_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
-var McpServerUrl = z7.string().trim().min(1).refine((value) => {
+var McpServerUrl = z8.string().trim().min(1).refine((value) => {
   let parsed;
   try {
     parsed = new URL(value);
@@ -2445,8 +2461,8 @@ var McpServerUrl = z7.string().trim().min(1).refine((value) => {
 }, {
   message: "mcp server url must be https://, or http:// only for localhost/127.0.0.1 test servers"
 });
-var McpServerAuthMode = z7.enum(["oauth", "none"]);
-var McpServerContribution = z7.strictObject({
+var McpServerAuthMode = z8.enum(["oauth", "none"]);
+var McpServerContribution = z8.strictObject({
   url: McpServerUrl,
   auth: McpServerAuthMode.optional(),
   authService: LocalContributionId.optional()
@@ -2459,28 +2475,28 @@ var McpServerContribution = z7.strictObject({
     });
   }
 });
-var McpServerContributions = z7.record(LocalContributionId, McpServerContribution);
-var AppEventSubscription = z7.strictObject({
+var McpServerContributions = z8.record(LocalContributionId, McpServerContribution);
+var AppEventSubscription = z8.strictObject({
   localId: LocalContributionId,
   event: NonEmptyString
 });
-var ContextContributorContribution = z7.strictObject({
+var ContextContributorContribution = z8.strictObject({
   localId: LocalContributionId.max(64),
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional()
 });
-var PluginEventDefinitionContribution = z7.strictObject({
+var PluginEventDefinitionContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional(),
-  version: z7.number().int().positive().default(1),
+  version: z8.number().int().positive().default(1),
   payloadSchema: JsonSchema
 });
-var PluginNotificationRuleContribution = z7.strictObject({
+var PluginNotificationRuleContribution = z8.strictObject({
   localId: LocalContributionId,
   /** The same-plugin `eventDefinitions` local id this rule matches. */
   event: LocalContributionId,
-  where: z7.array(JsonObject).optional(),
+  where: z8.array(JsonObject).optional(),
   rule: JsonObject
 });
 var PLUGIN_NOTIFICATION_RULE_HOST_KEYS = [
@@ -2488,67 +2504,67 @@ var PLUGIN_NOTIFICATION_RULE_HOST_KEYS = [
   "match",
   "sender"
 ];
-var UiEventSubscriptionContribution = z7.strictObject({
+var UiEventSubscriptionContribution = z8.strictObject({
   localId: LocalContributionId,
   event: NonEmptyString
 });
-var DeviceDelegationContribution = z7.strictObject({
+var DeviceDelegationContribution = z8.strictObject({
   localId: LocalContributionId,
-  device: z7.enum(["microphone"]),
-  delegateAs: z7.enum(["clip", "stream", "status"])
+  device: z8.enum(["microphone"]),
+  delegateAs: z8.enum(["clip", "stream", "status"])
 });
-var CorpusContribution = z7.strictObject({
+var CorpusContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
-  access: z7.enum(["read"]).default("read")
+  access: z8.enum(["read"]).default("read")
 });
-var UiCommandContribution = z7.strictObject({
+var UiCommandContribution = z8.strictObject({
   localId: LocalContributionId,
   title: NonEmptyString,
   icon: NonEmptyString.optional(),
   placement: NonEmptyString.optional()
 });
-var UiSlotContribution = z7.strictObject({
+var UiSlotContribution = z8.strictObject({
   localId: LocalContributionId,
   slot: NonEmptyString,
   title: NonEmptyString.optional()
 });
-var SettingsPanelContribution = z7.strictObject({
+var SettingsPanelContribution = z8.strictObject({
   localId: LocalContributionId,
   title: NonEmptyString,
   configSection: NonEmptyString.optional()
 });
-var ResultRendererContribution = z7.strictObject({
+var ResultRendererContribution = z8.strictObject({
   localId: LocalContributionId,
-  resultKinds: z7.array(NonEmptyString).min(1)
+  resultKinds: z8.array(NonEmptyString).min(1)
 });
-var ReferenceOpenBehavior = z7.discriminatedUnion("kind", [
-  z7.strictObject({ kind: z7.literal("working-document") }),
-  z7.strictObject({ kind: z7.literal("browser-pane") }),
+var ReferenceOpenBehavior = z8.discriminatedUnion("kind", [
+  z8.strictObject({ kind: z8.literal("working-document") }),
+  z8.strictObject({ kind: z8.literal("browser-pane") }),
   /**
    * Open one of the presenting plugin's OWN registered pages (`registerPage`'s
    * descriptor id) with the reference's canonical URI as the page's `objectId`.
    * Needs no web address, so a plugin-only resource (`user-todo://items/3`) can pill.
    */
-  z7.strictObject({ kind: z7.literal("page"), pageId: NonEmptyString })
+  z8.strictObject({ kind: z8.literal("page"), pageId: NonEmptyString })
 ]);
-var ReferencePresentationVariant = z7.strictObject({
+var ReferencePresentationVariant = z8.strictObject({
   resourceKind: NonEmptyString,
   presentationPluginId: PluginId.optional()
 });
-var ReferencePresentationVariants = z7.record(MimeTypeString, ReferencePresentationVariant);
-var InlineSvg = z7.string().max(64 * 1024).refine((value) => /^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?<svg[\s>]/iu.test(value), { message: "brandIcon must be inline SVG markup." });
-var ReferencePresentationUrlClaim = z7.strictObject({
-  kind: z7.literal("urlPattern"),
-  pattern: z7.strictObject({
-    protocol: z7.enum(["http", "https"]),
+var ReferencePresentationVariants = z8.record(MimeTypeString, ReferencePresentationVariant);
+var InlineSvg = z8.string().max(64 * 1024).refine((value) => /^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?<svg[\s>]/iu.test(value), { message: "brandIcon must be inline SVG markup." });
+var ReferencePresentationUrlClaim = z8.strictObject({
+  kind: z8.literal("urlPattern"),
+  pattern: z8.strictObject({
+    protocol: z8.enum(["http", "https"]),
     hostname: NonEmptyString,
-    pathname: z7.string().optional(),
-    search: z7.string().optional()
+    pathname: z8.string().optional(),
+    search: z8.string().optional()
   }),
   brandIcon: InlineSvg.optional()
 });
-var ReferencePresentationContribution = z7.strictObject({
+var ReferencePresentationContribution = z8.strictObject({
   localId: LocalContributionId,
   uriModule: LocalContributionId,
   resourceKind: NonEmptyString,
@@ -2556,7 +2572,7 @@ var ReferencePresentationContribution = z7.strictObject({
   /** MIME-specific resource kinds; absent keys use the base presentation. */
   variants: ReferencePresentationVariants.optional(),
   /** Lexical public URL claims used only for host-rendered browser presentations. */
-  claims: z7.array(ReferencePresentationUrlClaim).optional()
+  claims: z8.array(ReferencePresentationUrlClaim).optional()
 }).superRefine((value, ctx) => {
   if (value.claims !== void 0 && value.claims.length > 0 && value.open.kind !== "browser-pane") {
     ctx.addIssue({
@@ -2566,12 +2582,12 @@ var ReferencePresentationContribution = z7.strictObject({
     });
   }
 });
-var RichViewContribution = z7.strictObject({
+var RichViewContribution = z8.strictObject({
   localId: LocalContributionId,
   title: NonEmptyString,
   route: NonEmptyString.optional()
 });
-var KayUiAppHostCapability = z7.enum([
+var KayUiAppHostCapability = z8.enum([
   "navigation.open-session",
   "cost.read",
   // Server-rated organization billing, distinct from local/provider cost.
@@ -2602,9 +2618,9 @@ var KayUiAppHostCapability = z7.enum([
   // rearrange the workspace but never remove something the user would have to notice going missing.
   "workspace.arrange"
 ]);
-var UiAppCapabilities = z7.strictObject({
-  endpoints: z7.array(LocalContributionId).optional(),
-  host: z7.array(KayUiAppHostCapability).optional()
+var UiAppCapabilities = z8.strictObject({
+  endpoints: z8.array(LocalContributionId).optional(),
+  host: z8.array(KayUiAppHostCapability).optional()
 }).superRefine((capabilities, ctx) => {
   for (const field of ["endpoints", "host"]) {
     const seen = /* @__PURE__ */ new Set();
@@ -2620,47 +2636,47 @@ var UiAppCapabilities = z7.strictObject({
     }
   }
 });
-var UiAppContribution = z7.strictObject({
+var UiAppContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
   description: NonEmptyString.optional(),
   icon: PackageAssetPath.optional(),
-  runtime: z7.literal("kay.react-app.v1"),
-  sdk: z7.strictObject({ range: NonEmptyString }),
+  runtime: z8.literal("kay.react-app.v1"),
+  sdk: z8.strictObject({ range: NonEmptyString }),
   entrypoint: TargetEntrypoint,
-  styles: z7.array(PackageAssetPath).optional(),
-  assets: z7.array(PackageAssetPath).optional(),
+  styles: z8.array(PackageAssetPath).optional(),
+  assets: z8.array(PackageAssetPath).optional(),
   capabilities: UiAppCapabilities.optional()
 });
-var ThemeContribution = z7.strictObject({
+var ThemeContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
-  appearance: z7.enum(["light", "dark"]),
+  appearance: z8.enum(["light", "dark"]),
   tokens: PackageAssetPath
 });
-var CommandHandler = z7.discriminatedUnion("kind", [
-  z7.strictObject({ kind: z7.literal("skill"), skill: LocalContributionId }),
-  z7.strictObject({
-    kind: z7.literal("tool"),
+var CommandHandler = z8.discriminatedUnion("kind", [
+  z8.strictObject({ kind: z8.literal("skill"), skill: LocalContributionId }),
+  z8.strictObject({
+    kind: z8.literal("tool"),
     tool: PluginToolName,
     /** Positional mapping from tokenized `argsText` onto the tool's own input fields — see this
      *  union's doc for the exact tokenize/map/last-field-absorbs rule. */
-    argumentFields: z7.array(NonEmptyString)
+    argumentFields: z8.array(NonEmptyString)
   }),
-  z7.strictObject({
-    kind: z7.literal("endpoint"),
+  z8.strictObject({
+    kind: z8.literal("endpoint"),
     endpoint: LocalContributionId
   })
 ]);
-var CommandContribution = z7.strictObject({
+var CommandContribution = z8.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString,
-  aliases: z7.array(LocalContributionId).optional(),
+  aliases: z8.array(LocalContributionId).optional(),
   argumentHint: NonEmptyString.optional(),
   handler: CommandHandler
 });
-var PluginContributionKind = z7.enum([
+var PluginContributionKind = z8.enum([
   "tool",
   "converter",
   "uriModule",
@@ -2735,7 +2751,7 @@ function resolveAdapterId(globalId, declaredAdapterId) {
 }
 
 // packages/plugin-protocol/dist/manifest.js
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // packages/plugin-protocol/dist/synthetic-contributions.js
 function resolveConfigSectionContributionLocalId(section) {
@@ -2755,34 +2771,34 @@ var KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS = [
   "native:renderer.contributions.changed"
 ];
 var KAY_UI_NATIVE_EVENT_ALLOWLIST = new Set(KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS);
-var KayAgentTargetManifest = z8.strictObject({
+var KayAgentTargetManifest = z9.strictObject({
   entrypoint: TargetEntrypoint,
-  contributes: z8.strictObject({
-    tools: z8.array(ToolContribution).optional(),
-    converters: z8.array(ConverterContribution).optional(),
-    uriModules: z8.array(UriModuleContribution).optional(),
+  contributes: z9.strictObject({
+    tools: z9.array(ToolContribution).optional(),
+    converters: z9.array(ConverterContribution).optional(),
+    uriModules: z9.array(UriModuleContribution).optional(),
     // Host-composed artifact-backed schemes (see `ArtifactUriModuleContribution`): the plugin
     // declares scheme + editability; the daemon binds each to the kernel's artifact lifecycle
     // per session. Separate from `uriModules` (plugin-implemented backends) precisely because
     // the plugin registers NOTHING for these at activation.
-    artifactUriModules: z8.array(ArtifactUriModuleContribution).optional(),
-    cliBindings: z8.array(CliBindingContribution).optional(),
+    artifactUriModules: z9.array(ArtifactUriModuleContribution).optional(),
+    cliBindings: z9.array(CliBindingContribution).optional(),
     // Which git hosts this plugin's credential serves (see `GitHostContribution`): a
     // declaration, so a plugin for any git backend gets credentialed clones without
     // the daemon learning its name. Sibling of `cliBindings` because both answer the
     // same question — which of this plugin's auth services a host-side consumer
     // resolves — for two different transports.
-    gitHosts: z8.array(GitHostContribution).optional(),
-    resources: z8.array(ResourceContribution).optional(),
-    skills: z8.array(SkillContribution).optional(),
-    searchProviders: z8.array(SearchProviderContribution).optional(),
-    interactionDrivers: z8.array(InteractionDriverContribution).optional(),
-    entityResolvers: z8.array(EntityResolverContribution).optional(),
-    renderers: z8.array(AgentRenderContribution).optional(),
+    gitHosts: z9.array(GitHostContribution).optional(),
+    resources: z9.array(ResourceContribution).optional(),
+    skills: z9.array(SkillContribution).optional(),
+    searchProviders: z9.array(SearchProviderContribution).optional(),
+    interactionDrivers: z9.array(InteractionDriverContribution).optional(),
+    entityResolvers: z9.array(EntityResolverContribution).optional(),
+    renderers: z9.array(AgentRenderContribution).optional(),
     // Handler restricted to skill | tool by the manifest-level refinement below (see
     // `CommandContribution`'s doc for why the restriction is not expressed in the type, and
     // `CommandHandler`'s doc for why there is no promptTemplate variant to declare here).
-    commands: z8.array(CommandContribution).optional()
+    commands: z9.array(CommandContribution).optional()
   }).optional(),
   /**
    * The plugin's primer skill — the `localId` of one of its own declared
@@ -2793,6 +2809,16 @@ var KayAgentTargetManifest = z8.strictObject({
    * composition (host-side), so the field stays optional.
    */
   primer: LocalContributionId.optional(),
+  /**
+   * The plugin's onboarding skill — the `localId` of one of its own declared
+   * `contributes.skills[]` entries, designating the instructions that turn the plugin's first
+   * connection into context Bonsai keeps (notes in Memory, projects, a skill, rules). Like
+   * `primer`, a pointer at an existing contribution that the manifest's superRefine validates;
+   * unlike `primer` it has no reserved name and no synthesized fallback, so a plugin with nothing
+   * to hydrate declares nothing. The skill is neutral: it works in any session, and Bonsai's
+   * first-run layer adds its own lines around it. At most one per plugin.
+   */
+  onboarding: LocalContributionId.optional(),
   /**
    * The plugin's prompt doc — a package-relative path (by convention `./prompt.md`) to
    * a free-form Markdown section the host renders INTO the agent's system prompt, under
@@ -2818,55 +2844,55 @@ var KayAgentTargetManifest = z8.strictObject({
    * acquisition, not declared here, so there is nothing for the resolved contract to mint a
    * `globalId` for at parse time.
    */
-  skillSources: z8.array(PluginSkillSourceDeclaration).optional()
+  skillSources: z9.array(PluginSkillSourceDeclaration).optional()
 });
-var KayAppTargetManifest = z8.strictObject({
+var KayAppTargetManifest = z9.strictObject({
   // Optional, like `kay.ui`'s: a target may carry only declarative `contributes` (e.g. a plugin
   // that ships nothing but `mcpServers`) with no app-lifetime module for the host to load.
   entrypoint: TargetEntrypoint.optional(),
-  contributes: z8.strictObject({
+  contributes: z9.strictObject({
     // Session tools implemented by the app-lifetime activation (registered once, injected into
     // every session with a host-stamped session context) — the tool counterpart of `uriModules`
     // below. Same descriptor shape as kay.agent tools; `toolName` shares ONE flat session
     // namespace with them (enforced by the manifest-level refinement below).
-    tools: z8.array(ToolContribution).optional(),
-    endpoints: z8.array(EndpointContribution).optional(),
-    uriModules: z8.array(AppUriModuleContribution).optional(),
-    dataSources: z8.array(AppDataSourceContribution).optional(),
-    whiteboardTypes: z8.array(WhiteboardTypeContribution).optional(),
-    eventDefinitions: z8.array(PluginEventDefinitionContribution).optional(),
+    tools: z9.array(ToolContribution).optional(),
+    endpoints: z9.array(EndpointContribution).optional(),
+    uriModules: z9.array(AppUriModuleContribution).optional(),
+    dataSources: z9.array(AppDataSourceContribution).optional(),
+    whiteboardTypes: z9.array(WhiteboardTypeContribution).optional(),
+    eventDefinitions: z9.array(PluginEventDefinitionContribution).optional(),
     // Default notification rules over this plugin's own `eventDefinitions`; seeded by the host
     // (see `PluginNotificationRuleContribution`).
-    notificationRules: z8.array(PluginNotificationRuleContribution).optional(),
-    eventSubscriptions: z8.array(AppEventSubscription).optional(),
-    deviceDelegations: z8.array(DeviceDelegationContribution).optional(),
-    corpusConsumers: z8.array(CorpusContribution).optional(),
-    contextContributors: z8.array(ContextContributorContribution).optional(),
+    notificationRules: z9.array(PluginNotificationRuleContribution).optional(),
+    eventSubscriptions: z9.array(AppEventSubscription).optional(),
+    deviceDelegations: z9.array(DeviceDelegationContribution).optional(),
+    corpusConsumers: z9.array(CorpusContribution).optional(),
+    contextContributors: z9.array(ContextContributorContribution).optional(),
     // Vendored MCP servers this plugin ships (see `McpServerContributions`). Bundled-plugin-only
     // in practice; this package cannot see plugin origin, so that ceiling is enforced at
     // composition, not here (see ARCHITECTURE.md "Validation Law").
     mcpServers: McpServerContributions.optional(),
     // Handler restricted to endpoint-only by the manifest-level refinement below.
-    commands: z8.array(CommandContribution).optional()
+    commands: z9.array(CommandContribution).optional()
   }).optional()
 });
-var KayUiTargetManifest = z8.strictObject({
+var KayUiTargetManifest = z9.strictObject({
   entrypoint: TargetEntrypoint.optional(),
-  contributes: z8.strictObject({
-    commands: z8.array(UiCommandContribution).optional(),
-    slots: z8.array(UiSlotContribution).optional(),
-    settingsPanels: z8.array(SettingsPanelContribution).optional(),
-    resultRenderers: z8.array(ResultRendererContribution).optional(),
-    referencePresentations: z8.array(ReferencePresentationContribution).optional(),
-    views: z8.array(RichViewContribution).optional(),
-    apps: z8.array(UiAppContribution).optional(),
-    themes: z8.array(ThemeContribution).optional(),
-    eventSubscriptions: z8.array(UiEventSubscriptionContribution).optional(),
-    dataMaterializers: z8.array(AppDataMaterializerContribution).optional()
+  contributes: z9.strictObject({
+    commands: z9.array(UiCommandContribution).optional(),
+    slots: z9.array(UiSlotContribution).optional(),
+    settingsPanels: z9.array(SettingsPanelContribution).optional(),
+    resultRenderers: z9.array(ResultRendererContribution).optional(),
+    referencePresentations: z9.array(ReferencePresentationContribution).optional(),
+    views: z9.array(RichViewContribution).optional(),
+    apps: z9.array(UiAppContribution).optional(),
+    themes: z9.array(ThemeContribution).optional(),
+    eventSubscriptions: z9.array(UiEventSubscriptionContribution).optional(),
+    dataMaterializers: z9.array(AppDataMaterializerContribution).optional()
   }).optional()
 });
-var PluginConfigScope = z8.enum(["global", "project", "agent"]);
-var PluginConfigSectionManifest = z8.strictObject({
+var PluginConfigScope = z9.enum(["global", "project", "agent"]);
+var PluginConfigSectionManifest = z9.strictObject({
   section: NonEmptyString.optional(),
   schema: JsonSchema,
   /**
@@ -2884,25 +2910,25 @@ var PluginConfigSectionManifest = z8.strictObject({
    * is the baseline every section has; `agent` has no runtime mapping (the
    * agent/entity fold is downstream of the document protocol).
    */
-  scopes: z8.array(PluginConfigScope).optional()
+  scopes: z9.array(PluginConfigScope).optional()
 });
-var PluginConfigManifest = z8.array(PluginConfigSectionManifest).min(1);
+var PluginConfigManifest = z9.array(PluginConfigSectionManifest).min(1);
 function configSectionKeysForManifest(manifest) {
   return manifest.config?.map((config) => config.section ?? `plugins.${manifest.id}`) ?? [];
 }
-var PluginStorageManifest = z8.strictObject({
-  sqlite: z8.strictObject({
-    enabled: z8.boolean(),
-    ownerTarget: z8.literal("kay.app").optional(),
+var PluginStorageManifest = z9.strictObject({
+  sqlite: z9.strictObject({
+    enabled: z9.boolean(),
+    ownerTarget: z9.literal("kay.app").optional(),
     migrations: NonEmptyString.optional()
   }).optional(),
-  dataDir: z8.strictObject({
-    enabled: z8.boolean(),
-    ownerTarget: z8.literal("kay.app").optional()
+  dataDir: z9.strictObject({
+    enabled: z9.boolean(),
+    ownerTarget: z9.literal("kay.app").optional()
   }).optional()
 });
-var PluginOAuthClientSupplier = z8.enum(["kay", "user"]);
-var PluginProvisioningProbe = z8.strictObject({
+var PluginOAuthClientSupplier = z9.enum(["kay", "user"]);
+var PluginProvisioningProbe = z9.strictObject({
   /**
    * The API endpoint that answers the question. The host sends the service's OWN credential here,
    * so this must belong to the provider that minted it — enforced by the daemon against the
@@ -2910,13 +2936,13 @@ var PluginProvisioningProbe = z8.strictObject({
    */
   url: HttpsUrl,
   /** Absent ⇒ `GET`. */
-  method: z8.enum(["GET"]).optional(),
+  method: z9.enum(["GET"]).optional(),
   /**
    * The statuses that make the response a VERDICT at all. Anything else (a 401 from a stale
    * token, a 5xx, a rate limit) means the probe learned nothing and reports `unknown` — never
    * `unsatisfied`, which would tell a user to go fix setup that is fine.
    */
-  verdictStatuses: z8.array(SignedInStatusCode).min(1),
+  verdictStatuses: z9.array(SignedInStatusCode).min(1),
   /**
    * Dot-path to a JSON array in the response body that must be NON-EMPTY for the requirement to
    * count as satisfied (e.g. `installations`). Absent means a verdict status alone is enough.
@@ -2925,7 +2951,7 @@ var PluginProvisioningProbe = z8.strictObject({
    */
   nonEmptyArrayAt: NonEmptyString.optional()
 });
-var PluginProvisioningRequirement = z8.strictObject({
+var PluginProvisioningRequirement = z9.strictObject({
   /** Stable id, unique within the scheme. */
   id: LocalContributionId,
   /** Human-facing requirement name, e.g. "GitHub App installation". */
@@ -2942,7 +2968,7 @@ var PluginProvisioningRequirement = z8.strictObject({
   probe: PluginProvisioningProbe
 });
 var PluginProvisioningField = {
-  provisioning: z8.array(PluginProvisioningRequirement).optional()
+  provisioning: z9.array(PluginProvisioningRequirement).optional()
 };
 var PluginAuthSchemeDescriptionFields = {
   /** Human-facing flow name; the runtime scheme name is the fallback. */
@@ -2955,19 +2981,19 @@ var PluginAuthSchemeDescriptionFields = {
    */
   summary: NonEmptyString.optional()
 };
-var PluginAuthSchemeOAuthPkce = z8.strictObject({
+var PluginAuthSchemeOAuthPkce = z9.strictObject({
   ...PluginProvisioningField,
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z8.literal("oauth2"),
-  exchange: z8.literal("pkce"),
+  kind: z9.literal("oauth2"),
+  exchange: z9.literal("pkce"),
   /**
    * Unordered SET of who may supply the client — non-empty, and every entry must be distinct
    * (fail-closed re-assertion of the kernel's construction-time dedupe: TS exhaustiveness never
    * runs on an untrusted manifest, so a hand-built `["kay","kay"]` must be refused here, not
    * silently normalized).
    */
-  clientSuppliers: z8.array(PluginOAuthClientSupplier).nonempty().superRefine((suppliers, ctx) => {
+  clientSuppliers: z9.array(PluginOAuthClientSupplier).nonempty().superRefine((suppliers, ctx) => {
     if (new Set(suppliers).size !== suppliers.length) {
       ctx.addIssue({
         code: "custom",
@@ -2975,70 +3001,70 @@ var PluginAuthSchemeOAuthPkce = z8.strictObject({
       });
     }
   }),
-  scopes: z8.array(NonEmptyString).optional()
+  scopes: z9.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeOAuthConfidential = z8.strictObject({
+var PluginAuthSchemeOAuthConfidential = z9.strictObject({
   ...PluginProvisioningField,
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z8.literal("oauth2"),
-  exchange: z8.literal("confidential"),
+  kind: z9.literal("oauth2"),
+  exchange: z9.literal("confidential"),
   /** Absent means `["kay"]` — a confidential exchange's secret may only ever be Bonsai's. */
-  clientSuppliers: z8.tuple([z8.literal("kay")]).optional(),
-  scopes: z8.array(NonEmptyString).optional()
+  clientSuppliers: z9.tuple([z9.literal("kay")]).optional(),
+  scopes: z9.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeOAuth2 = z8.discriminatedUnion("exchange", [
+var PluginAuthSchemeOAuth2 = z9.discriminatedUnion("exchange", [
   PluginAuthSchemeOAuthPkce,
   PluginAuthSchemeOAuthConfidential
 ]);
-var PluginAuthSchemeApiKey = z8.strictObject({
+var PluginAuthSchemeApiKey = z9.strictObject({
   ...PluginProvisioningField,
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z8.literal("api-key"),
-  scopes: z8.array(NonEmptyString).optional()
+  kind: z9.literal("api-key"),
+  scopes: z9.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeDelegated = z8.strictObject({
+var PluginAuthSchemeDelegated = z9.strictObject({
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z8.literal("delegated"),
-  scopes: z8.array(NonEmptyString).optional()
+  kind: z9.literal("delegated"),
+  scopes: z9.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeExternalCli = z8.strictObject({
+var PluginAuthSchemeExternalCli = z9.strictObject({
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z8.literal("external-cli"),
-  scopes: z8.array(NonEmptyString).optional()
+  kind: z9.literal("external-cli"),
+  scopes: z9.array(NonEmptyString).optional()
 });
-var PluginAuthScheme = z8.discriminatedUnion("kind", [
+var PluginAuthScheme = z9.discriminatedUnion("kind", [
   PluginAuthSchemeOAuth2,
   PluginAuthSchemeApiKey,
   PluginAuthSchemeDelegated,
   PluginAuthSchemeExternalCli
 ]);
-var PluginWebSessionProbe = z8.strictObject({
+var PluginWebSessionProbe = z9.strictObject({
   url: HttpsUrl,
   /** Absent ⇒ `GET`. `POST` sends an empty JSON object body. */
-  method: z8.enum(["GET", "POST"]).optional(),
-  signedInStatuses: z8.array(SignedInStatusCode).min(1)
+  method: z9.enum(["GET", "POST"]).optional(),
+  signedInStatuses: z9.array(SignedInStatusCode).min(1)
 });
-var PluginWebSessionDeclaration = z8.strictObject({
+var PluginWebSessionDeclaration = z9.strictObject({
   /** `required`: capabilities degrade without the site login; `recommended`: it only smooths UX. */
-  importance: z8.enum(["required", "recommended"]),
+  importance: z9.enum(["required", "recommended"]),
   loginUrl: HttpsUrl,
-  cookieDomains: z8.array(RegistrableDomain).min(1),
+  cookieDomains: z9.array(RegistrableDomain).min(1),
   probe: PluginWebSessionProbe,
-  oauthVenue: z8.enum(["embedded", "external"])
+  oauthVenue: z9.enum(["embedded", "external"])
 }).superRefine(refineWebSessionScopeConfined);
-var PluginAuthService = z8.strictObject({
+var PluginAuthService = z9.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
-  schemes: z8.array(PluginAuthScheme).min(1),
-  purposes: z8.array(NonEmptyString).min(1),
+  schemes: z9.array(PluginAuthScheme).min(1),
+  purposes: z9.array(NonEmptyString).min(1),
   webSession: PluginWebSessionDeclaration.optional()
 });
-var PluginAuthManifest = z8.strictObject({
-  services: z8.array(PluginAuthService).optional()
+var PluginAuthManifest = z9.strictObject({
+  services: z9.array(PluginAuthService).optional()
 });
 var RETIRED_COMPATIBILITY_KEYS = ["policy"];
 function stripRetiredCompatibilityKeys(value) {
@@ -3050,8 +3076,8 @@ function stripRetiredCompatibilityKeys(value) {
     delete remaining[key];
   return remaining;
 }
-var PluginCompatibilityManifest = z8.preprocess(stripRetiredCompatibilityKeys, z8.strictObject({
-  supportedProtocols: z8.array(KayPluginProtocolVersion).optional(),
+var PluginCompatibilityManifest = z9.preprocess(stripRetiredCompatibilityKeys, z9.strictObject({
+  supportedProtocols: z9.array(KayPluginProtocolVersion).optional(),
   minKayVersion: NonEmptyString.optional(),
   sdk: NonEmptyString.optional()
 }));
@@ -3067,8 +3093,8 @@ function retiredCompatibilityKeysIn(rawManifest) {
 var KayVersionString = NonEmptyString.regex(SEMVER_PATTERN, {
   message: "version must be semver, for example 1.2.3"
 });
-var KayPluginManifestV1 = z8.strictObject({
-  protocol: z8.literal(KAY_PLUGIN_PROTOCOL_VERSION),
+var KayPluginManifestV1 = z9.strictObject({
+  protocol: z9.literal(KAY_PLUGIN_PROTOCOL_VERSION),
   id: PluginId,
   displayName: NonEmptyString,
   version: KayVersionString,
@@ -3098,8 +3124,8 @@ var KayPluginManifestV1 = z8.strictObject({
   icon: PackageAssetPath.optional(),
   iconDark: PackageAssetPath.optional(),
   namespace: PluginNamespace.optional(),
-  targets: z8.strictObject({
-    kay: z8.strictObject({
+  targets: z9.strictObject({
+    kay: z9.strictObject({
       agent: KayAgentTargetManifest.optional(),
       app: KayAppTargetManifest.optional(),
       ui: KayUiTargetManifest.optional()
@@ -3116,15 +3142,15 @@ var KayPluginManifestV1 = z8.strictObject({
    * schemes then report `ownedByBonsai`. Honoured only for a plugin that ships with Bonsai: the
    * host reads any other plugin's flag as false. Absent ⇒ false.
    */
-  ownedByBonsai: z8.boolean().optional(),
+  ownedByBonsai: z9.boolean().optional(),
   /**
    * Explicit plugin-level dependencies — other plugins this plugin requires to be present in the
    * composed roster. At composition time the runtime checks each id against the accepted
    * registration list and derives a provenance-complete dependency graph (together with implicit
    * auth-service edges from `consumesAuthServices`). Absent ⇒ no explicit dependencies.
    */
-  dependencies: z8.strictObject({
-    plugins: z8.array(PluginId).optional()
+  dependencies: z9.strictObject({
+    plugins: z9.array(PluginId).optional()
   }).optional()
 }).superRefine((manifest, ctx) => {
   const authServices = new Set(manifest.auth?.services?.map((service) => service.localId) ?? []);
@@ -3321,16 +3347,22 @@ var KayPluginManifestV1 = z8.strictObject({
       converterMimeTypes.set(mimeType, converter.localId);
     }
   }
+  const declaredSkillIds = new Set((manifest.targets?.kay?.agent?.contributes?.skills ?? []).map((skill) => skill.localId));
   const agentPrimer = manifest.targets?.kay?.agent?.primer;
-  if (agentPrimer !== void 0) {
-    const declaredSkillIds = new Set((manifest.targets?.kay?.agent?.contributes?.skills ?? []).map((skill) => skill.localId));
-    if (!declaredSkillIds.has(agentPrimer)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["targets", "kay", "agent", "primer"],
-        message: `primer '${agentPrimer}' does not name a declared kay.agent skill contribution`
-      });
-    }
+  if (agentPrimer !== void 0 && !declaredSkillIds.has(agentPrimer)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["targets", "kay", "agent", "primer"],
+      message: `primer '${agentPrimer}' does not name a declared kay.agent skill contribution`
+    });
+  }
+  const agentOnboarding = manifest.targets?.kay?.agent?.onboarding;
+  if (agentOnboarding !== void 0 && !declaredSkillIds.has(agentOnboarding)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["targets", "kay", "agent", "onboarding"],
+      message: `onboarding '${agentOnboarding}' does not name a declared kay.agent skill contribution`
+    });
   }
   for (const skill of manifest.targets?.kay?.agent?.contributes?.skills ?? []) {
     if (skill.localId === "primer" && agentPrimer !== "primer") {
@@ -3787,37 +3819,46 @@ function pushContributionIds(output, path, items) {
   }
 }
 
+// packages/plugin-protocol/dist/plugin-directory-verdict.js
+import { z as z11 } from "zod";
+
+// packages/plugin-protocol/dist/plugin-load-diagnostic.js
+var PLUGIN_DIAGNOSTIC_MESSAGE_CAP = 300;
+function boundPluginDiagnosticMessage(message) {
+  return message.length <= PLUGIN_DIAGNOSTIC_MESSAGE_CAP ? message : `${message.slice(0, PLUGIN_DIAGNOSTIC_MESSAGE_CAP - 1)}\u2026`;
+}
+
 // packages/plugin-protocol/dist/resolved-contract.js
-import { z as z9 } from "zod";
-var ResolvedPluginContributionId = z9.strictObject({
+import { z as z10 } from "zod";
+var ResolvedPluginContributionId = z10.strictObject({
   target: PluginTargetName,
   kind: PluginContributionKind,
   localId: LocalContributionId,
   globalId: GlobalContributionId
 });
-var ResolvedKayAgentTool = z9.strictObject({
+var ResolvedKayAgentTool = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   toolName: PluginToolName
 });
 var ResolvedKayAppTool = ResolvedKayAgentTool;
-var ResolvedKayAppDataSource = z9.strictObject({
+var ResolvedKayAppDataSource = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  scope: z9.enum(["runtime", "account", "session"]),
-  snapshot: z9.strictObject({
-    version: z9.number().int().positive(),
-    schema: z9.record(z9.string(), z9.unknown())
+  scope: z10.enum(["runtime", "account", "session"]),
+  snapshot: z10.strictObject({
+    version: z10.number().int().positive(),
+    schema: z10.record(z10.string(), z10.unknown())
   }),
-  change: z9.strictObject({
-    version: z9.number().int().positive(),
-    schema: z9.record(z9.string(), z9.unknown()),
-    semantics: z9.discriminatedUnion("kind", [
-      z9.strictObject({ kind: z9.literal("incremental") }),
-      z9.strictObject({
-        kind: z9.literal("snapshot-replacement"),
-        maxEncodedBytes: z9.number().int().positive(),
-        rationale: z9.string().trim().min(1).max(1024)
+  change: z10.strictObject({
+    version: z10.number().int().positive(),
+    schema: z10.record(z10.string(), z10.unknown()),
+    semantics: z10.discriminatedUnion("kind", [
+      z10.strictObject({ kind: z10.literal("incremental") }),
+      z10.strictObject({
+        kind: z10.literal("snapshot-replacement"),
+        maxEncodedBytes: z10.number().int().positive(),
+        rationale: z10.string().trim().min(1).max(1024)
       })
     ]).optional()
   }),
@@ -3831,66 +3872,66 @@ var ResolvedKayAppDataSource = z9.strictObject({
     });
   }
 });
-var ResolvedKayAppWhiteboardType = z9.strictObject({
+var ResolvedKayAppWhiteboardType = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   displayName: NonEmptyString,
-  schemaVersion: z9.number().int().positive(),
+  schemaVersion: z10.number().int().positive(),
   storage: WhiteboardTypeStorage,
   valueSchema: JsonSchema,
-  presentation: z9.strictObject({
+  presentation: z10.strictObject({
     app: GlobalContributionId
   }).optional()
 });
-var ResolvedKayAppMcpServer = z9.strictObject({
+var ResolvedKayAppMcpServer = z10.strictObject({
   name: LocalContributionId,
   pluginId: PluginId,
   url: McpServerUrl,
   auth: McpServerAuthMode,
   authServiceId: GlobalContributionId.optional()
 });
-var ResolvedKayAgentUriModule = z9.strictObject({
+var ResolvedKayAgentUriModule = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  schemes: z9.array(UriScheme).min(1),
+  schemes: z10.array(UriScheme).min(1),
   filesystemBacking: UriFilesystemBacking.optional(),
   /** Mirrors `UriModuleContribution.knownResources` (host-side recording opt-in). */
-  knownResources: z9.literal(true).optional()
+  knownResources: z10.literal(true).optional()
 });
-var ResolvedKayAgentArtifactUriModule = z9.strictObject({
+var ResolvedKayAgentArtifactUriModule = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   scheme: UriScheme,
-  editable: z9.boolean(),
-  listable: z9.boolean(),
-  deletable: z9.boolean(),
-  appendable: z9.boolean(),
-  storageScope: z9.enum(["session", "family"])
+  editable: z10.boolean(),
+  listable: z10.boolean(),
+  deletable: z10.boolean(),
+  appendable: z10.boolean(),
+  storageScope: z10.enum(["session", "family"])
 });
-var ResolvedKayAgentEntityResolver = z9.strictObject({
+var ResolvedKayAgentEntityResolver = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   displayName: NonEmptyString.optional(),
   uriModule: GlobalContributionId,
-  entityTypes: z9.array(NonEmptyString).min(1),
+  entityTypes: z10.array(NonEmptyString).min(1),
   uriHint: NonEmptyString
 });
-var ResolvedKayAgentGitHostClaim = z9.strictObject({
+var ResolvedKayAgentGitHostClaim = z10.strictObject({
   host: GitHostName,
   authServiceId: GlobalContributionId,
   /** Manifest-declared order; the clone ladder tries them in sequence. */
-  authSchemeIds: z9.array(GlobalContributionId).min(1),
+  authSchemeIds: z10.array(GlobalContributionId).min(1),
   /** Non-secret display copy for the claiming service, for clone failure text. */
-  authServiceDisplayName: z9.string(),
+  authServiceDisplayName: z10.string(),
   basicAuthUser: GitBasicAuthUser
 });
-var ResolvedKayAgentConverter = z9.strictObject({
+var ResolvedKayAgentConverter = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  mimeTypes: z9.array(MimeTypeString).min(1),
-  extensions: z9.array(FileExtensionToken).min(1).optional()
+  mimeTypes: z10.array(MimeTypeString).min(1),
+  extensions: z10.array(FileExtensionToken).min(1).optional()
 });
-var ResolvedReferencePresentation = z9.strictObject({
+var ResolvedReferencePresentation = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   uriModule: GlobalContributionId,
@@ -3898,9 +3939,9 @@ var ResolvedReferencePresentation = z9.strictObject({
   open: ReferenceOpenBehavior,
   /** MIME-specific resource kinds; absent keys use the base presentation. */
   variants: ReferencePresentationVariants.optional(),
-  claims: z9.array(ReferencePresentationUrlClaim).optional()
+  claims: z10.array(ReferencePresentationUrlClaim).optional()
 });
-var ResolvedPluginProvisioningRequirement = z9.strictObject({
+var ResolvedPluginProvisioningRequirement = z10.strictObject({
   id: LocalContributionId,
   displayName: NonEmptyString,
   description: NonEmptyString,
@@ -3910,15 +3951,15 @@ var ResolvedPluginProvisioningRequirement = z9.strictObject({
    * URL degrades to "Reconnect" in the UI instead of a broken link.
    */
   remediationUrl: HttpsUrl.optional(),
-  probe: z9.strictObject({
+  probe: z10.strictObject({
     url: HttpsUrl,
-    method: z9.enum(["GET"]),
-    verdictStatuses: z9.array(SignedInStatusCode).min(1),
+    method: z10.enum(["GET"]),
+    verdictStatuses: z10.array(SignedInStatusCode).min(1),
     nonEmptyArrayAt: NonEmptyString.optional()
   })
 });
 var ResolvedProvisioningField = {
-  provisioning: z9.array(ResolvedPluginProvisioningRequirement).optional()
+  provisioning: z10.array(ResolvedPluginProvisioningRequirement).optional()
 };
 var ResolvedPluginAuthSchemeDescriptionFields = {
   displayName: NonEmptyString.optional(),
@@ -3930,96 +3971,96 @@ var ResolvedPluginAuthSchemeOAuthBase = {
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z9.literal("oauth2"),
-  scopes: z9.array(z9.string()).optional()
+  kind: z10.literal("oauth2"),
+  scopes: z10.array(z10.string()).optional()
 };
-var ResolvedPluginAuthSchemeOAuthPkce = z9.strictObject({
+var ResolvedPluginAuthSchemeOAuthPkce = z10.strictObject({
   ...ResolvedPluginAuthSchemeOAuthBase,
-  exchange: z9.literal("pkce"),
-  clientSuppliers: z9.array(PluginOAuthClientSupplier).nonempty()
+  exchange: z10.literal("pkce"),
+  clientSuppliers: z10.array(PluginOAuthClientSupplier).nonempty()
 });
-var ResolvedPluginAuthSchemeOAuthConfidential = z9.strictObject({
+var ResolvedPluginAuthSchemeOAuthConfidential = z10.strictObject({
   ...ResolvedPluginAuthSchemeOAuthBase,
-  exchange: z9.literal("confidential"),
-  clientSuppliers: z9.tuple([z9.literal("kay")])
+  exchange: z10.literal("confidential"),
+  clientSuppliers: z10.tuple([z10.literal("kay")])
 });
-var ResolvedPluginAuthSchemeOAuth2 = z9.discriminatedUnion("exchange", [
+var ResolvedPluginAuthSchemeOAuth2 = z10.discriminatedUnion("exchange", [
   ResolvedPluginAuthSchemeOAuthPkce,
   ResolvedPluginAuthSchemeOAuthConfidential
 ]);
-var ResolvedPluginAuthSchemeApiKey = z9.strictObject({
+var ResolvedPluginAuthSchemeApiKey = z10.strictObject({
   ...ResolvedProvisioningField,
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z9.literal("api-key"),
-  scopes: z9.array(z9.string()).optional()
+  kind: z10.literal("api-key"),
+  scopes: z10.array(z10.string()).optional()
 });
-var ResolvedPluginAuthSchemeDelegated = z9.strictObject({
+var ResolvedPluginAuthSchemeDelegated = z10.strictObject({
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z9.literal("delegated"),
-  scopes: z9.array(z9.string()).optional()
+  kind: z10.literal("delegated"),
+  scopes: z10.array(z10.string()).optional()
 });
-var ResolvedPluginAuthSchemeExternalCli = z9.strictObject({
+var ResolvedPluginAuthSchemeExternalCli = z10.strictObject({
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z9.literal("external-cli"),
-  scopes: z9.array(z9.string()).optional()
+  kind: z10.literal("external-cli"),
+  scopes: z10.array(z10.string()).optional()
 });
-var ResolvedPluginAuthScheme = z9.discriminatedUnion("kind", [
+var ResolvedPluginAuthScheme = z10.discriminatedUnion("kind", [
   ResolvedPluginAuthSchemeOAuth2,
   ResolvedPluginAuthSchemeApiKey,
   ResolvedPluginAuthSchemeDelegated,
   ResolvedPluginAuthSchemeExternalCli
 ]);
-var ResolvedPluginWebSession = z9.strictObject({
-  importance: z9.enum(["required", "recommended"]),
+var ResolvedPluginWebSession = z10.strictObject({
+  importance: z10.enum(["required", "recommended"]),
   loginUrl: HttpsUrl,
-  cookieDomains: z9.array(RegistrableDomain).min(1),
-  probe: z9.strictObject({
+  cookieDomains: z10.array(RegistrableDomain).min(1),
+  probe: z10.strictObject({
     url: HttpsUrl,
-    method: z9.enum(["GET", "POST"]),
-    signedInStatuses: z9.array(SignedInStatusCode).min(1)
+    method: z10.enum(["GET", "POST"]),
+    signedInStatuses: z10.array(SignedInStatusCode).min(1)
   }),
-  oauthVenue: z9.enum(["embedded", "external"])
+  oauthVenue: z10.enum(["embedded", "external"])
 }).superRefine(refineWebSessionScopeConfined);
-var ResolvedPluginAuthService = z9.strictObject({
+var ResolvedPluginAuthService = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  displayName: z9.string(),
-  schemes: z9.array(ResolvedPluginAuthScheme).min(1),
-  purposes: z9.array(z9.string()).min(1),
+  displayName: z10.string(),
+  schemes: z10.array(ResolvedPluginAuthScheme).min(1),
+  purposes: z10.array(z10.string()).min(1),
   /** The service's browser half, when the manifest declares one. */
   webSession: ResolvedPluginWebSession.optional()
 });
-var ResolvedKayUiAppEndpointCapability = z9.strictObject({
+var ResolvedKayUiAppEndpointCapability = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId
 });
-var ResolvedKayUiApp = z9.strictObject({
+var ResolvedKayUiApp = z10.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   displayName: NonEmptyString,
   description: NonEmptyString.optional(),
   icon: PackageAssetPath.optional(),
-  runtime: z9.literal("kay.react-app.v1"),
-  sdk: z9.strictObject({ range: NonEmptyString }),
+  runtime: z10.literal("kay.react-app.v1"),
+  sdk: z10.strictObject({ range: NonEmptyString }),
   entrypoint: TargetEntrypoint,
-  styles: z9.array(PackageAssetPath).optional(),
-  assets: z9.array(PackageAssetPath).optional(),
-  capabilities: z9.strictObject({
-    endpoints: z9.array(ResolvedKayUiAppEndpointCapability).optional(),
-    host: z9.array(KayUiAppHostCapability).optional()
+  styles: z10.array(PackageAssetPath).optional(),
+  assets: z10.array(PackageAssetPath).optional(),
+  capabilities: z10.strictObject({
+    endpoints: z10.array(ResolvedKayUiAppEndpointCapability).optional(),
+    host: z10.array(KayUiAppHostCapability).optional()
   }).optional()
 });
-var ResolvedPluginContractV1 = z9.strictObject({
-  protocol: z9.literal("kay.plugin.v1"),
+var ResolvedPluginContractV1 = z10.strictObject({
+  protocol: z10.literal("kay.plugin.v1"),
   pluginId: PluginId,
   namespace: PluginNamespace,
-  contributions: z9.array(ResolvedPluginContributionId),
+  contributions: z10.array(ResolvedPluginContributionId),
   // The deduplicated set of qualified (dotted) external auth-service ids this
   // plugin references, from agent uriModule `authService` refs, cliBinding
   // `authService` refs, and auth-grant `service` refs. Always present — a plugin
@@ -4027,30 +4068,30 @@ var ResolvedPluginContractV1 = z9.strictObject({
   // is a recorded dependency, not a resolution: there is no runtime plugin
   // loader in v1, so nothing here verifies the reference resolves within a
   // composed roster (a composition-time concern owned elsewhere).
-  consumesAuthServices: z9.array(GlobalContributionId),
+  consumesAuthServices: z10.array(GlobalContributionId),
   // The explicit plugin-level dependency ids declared in `dependencies.plugins` on the manifest,
   // deduped and validated at parse time. Always present; a plugin with no explicit dependencies
   // carries an empty array. Composition checks each id against the accepted roster and derives the
   // full dependency graph together with auth-inferred edges from `consumesAuthServices`.
-  explicitDependencies: z9.array(PluginId),
+  explicitDependencies: z10.array(PluginId),
   // The auth services this plugin OWNS, carrying the global ids its harness
   // target must register and the credential authority keys on. Always present;
   // a plugin that declares no `auth.services` carries an empty array. The dual
   // of `consumesAuthServices` (services it merely references).
-  authServices: z9.array(ResolvedPluginAuthService),
+  authServices: z10.array(ResolvedPluginAuthService),
   grants: ResolvedPluginGrants.optional(),
-  kayAgentUriModules: z9.array(ResolvedKayAgentUriModule).optional(),
-  kayAgentArtifactUriModules: z9.array(ResolvedKayAgentArtifactUriModule).optional(),
-  kayAgentEntityResolvers: z9.array(ResolvedKayAgentEntityResolver).optional(),
-  kayAgentGitHostClaims: z9.array(ResolvedKayAgentGitHostClaim).optional(),
-  kayAgentTools: z9.array(ResolvedKayAgentTool).optional(),
-  kayAppTools: z9.array(ResolvedKayAppTool).optional(),
-  kayAppDataSources: z9.array(ResolvedKayAppDataSource).optional(),
-  kayAppWhiteboardTypes: z9.array(ResolvedKayAppWhiteboardType).optional(),
-  kayAppMcpServers: z9.array(ResolvedKayAppMcpServer).optional(),
-  kayAgentConverters: z9.array(ResolvedKayAgentConverter).optional(),
-  referencePresentations: z9.array(ResolvedReferencePresentation).optional(),
-  kayUiApps: z9.array(ResolvedKayUiApp).optional()
+  kayAgentUriModules: z10.array(ResolvedKayAgentUriModule).optional(),
+  kayAgentArtifactUriModules: z10.array(ResolvedKayAgentArtifactUriModule).optional(),
+  kayAgentEntityResolvers: z10.array(ResolvedKayAgentEntityResolver).optional(),
+  kayAgentGitHostClaims: z10.array(ResolvedKayAgentGitHostClaim).optional(),
+  kayAgentTools: z10.array(ResolvedKayAgentTool).optional(),
+  kayAppTools: z10.array(ResolvedKayAppTool).optional(),
+  kayAppDataSources: z10.array(ResolvedKayAppDataSource).optional(),
+  kayAppWhiteboardTypes: z10.array(ResolvedKayAppWhiteboardType).optional(),
+  kayAppMcpServers: z10.array(ResolvedKayAppMcpServer).optional(),
+  kayAgentConverters: z10.array(ResolvedKayAgentConverter).optional(),
+  referencePresentations: z10.array(ResolvedReferencePresentation).optional(),
+  kayUiApps: z10.array(ResolvedKayUiApp).optional()
 });
 function narrowestAccountSelectors() {
   return [{ kind: "active" }];
@@ -4468,29 +4509,217 @@ function safeResolveKayPluginContractV1(manifest) {
   }
 }
 
+// packages/plugin-protocol/dist/plugin-directory-verdict.js
+var KAY_PLUGIN_MANIFEST_FILENAME = "kay-plugin.json";
+var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 64 * 1024;
+var RESERVED_DIRECTORY_PLUGIN_ID_PREFIXES = ["herd.", "kay."];
+async function judgeKayPluginDirectory(input) {
+  const { tree, root, dir, host } = input;
+  const file = KAY_PLUGIN_MANIFEST_FILENAME;
+  const hostSdkVersion = host?.sdkVersion;
+  const warnings = [];
+  const refuse = (stage, code, message) => ({
+    outcome: "refused",
+    hostSdkVersion,
+    refusal: { stage, root, dir, code, message: boundPluginDiagnosticMessage(message) },
+    warnings
+  });
+  let manifestEntry;
+  try {
+    manifestEntry = await tree.entry(file);
+  } catch (error) {
+    return refuse("source-scan", "unreadable-dir", `could not stat ${file}: ${errorText(error)}`);
+  }
+  if (manifestEntry === void 0) {
+    return input.revision === void 0 ? { outcome: "not-a-plugin", hostSdkVersion } : refuse("manifest-parse", "committed-manifest-missing", `commit ${input.revision} has no top-level ${file}; add and commit it`);
+  }
+  if (manifestEntry.kind !== "file") {
+    return refuse("source-scan", "irregular-manifest", `${file} is not a regular file (a symlink, directory, or special file is not a manifest)`);
+  }
+  if (manifestEntry.size > KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES) {
+    return refuse("source-scan", "oversize-manifest", `${file} is ${manifestEntry.size} bytes, exceeding the ${KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES}-byte cap`);
+  }
+  let raw;
+  try {
+    raw = await tree.readText(file);
+  } catch (error) {
+    return refuse("source-scan", "unreadable-manifest", `could not read ${file}: ${errorText(error)}`);
+  }
+  if (raw.trim() === "") {
+    return refuse("manifest-parse", "empty-manifest", `${file} is empty or whitespace-only`);
+  }
+  let json;
+  try {
+    json = JSON.parse(raw);
+  } catch (error) {
+    return refuse("manifest-parse", "invalid-json", `${file} is not valid JSON: ${errorText(error)}`);
+  }
+  const head = ReadableManifestHead.safeParse(json);
+  if (host !== void 0 && head.success && head.data.compatibility) {
+    const { refusal } = checkKayPluginHostCompatibility(head.data.compatibility, host);
+    if (refusal !== void 0) {
+      return refuse("contract-resolve", refusal.code, `${namedIn(head.data)} ${refusal.message}`);
+    }
+  }
+  const parsed = KayPluginManifestV1.safeParse(json);
+  if (!parsed.success) {
+    return refuse("manifest-parse", "manifest-schema-invalid", `${file} failed manifest validation: ${firstIssue(parsed.error.issues)}`);
+  }
+  const manifest = parsed.data;
+  const retiredKeys = retiredCompatibilityKeysIn(json);
+  if (retiredKeys.length > 0) {
+    warnings.push({
+      stage: "manifest-parse",
+      root,
+      dir,
+      code: "retired-compatibility-key",
+      message: boundPluginDiagnosticMessage(`${file} sets compatibility ${retiredKeys.map((key) => `'${key}'`).join(", ")}, which Bonsai no longer reads; the plugin loaded without it. Declare the SDK range you support with \`compatibility.sdk\` instead.`)
+    });
+  }
+  for (const retired of retiredPermissionAsksIn(json)) {
+    const named = [
+      ...retired.keys.map((key) => `'${key}'`),
+      ...retired.webSessionOperations ? ["'webSession[].operations'"] : []
+    ].join(", ");
+    warnings.push({
+      stage: "manifest-parse",
+      root,
+      dir,
+      code: "retired-permission-ask",
+      message: boundPluginDiagnosticMessage(`${file} declares ${named} under permissions.byTarget['${retired.target}'], which Bonsai no longer reads (since SDK 0.8.0 the call is the ask and the user's grants decide); the plugin loaded without them. Delete them from the manifest.`)
+    });
+  }
+  const reservedPrefix = RESERVED_DIRECTORY_PLUGIN_ID_PREFIXES.find((prefix) => manifest.id.startsWith(prefix));
+  if (reservedPrefix !== void 0) {
+    return refuse("contract-resolve", "reserved-id-namespace", `plugin id '${manifest.id}' claims the reserved '${reservedPrefix}*' id namespace, which only bundled/kernel plugins may use; a directory plugin must choose its own id`);
+  }
+  const resolved = safeResolveKayPluginContractV1(manifest);
+  if (!resolved.success) {
+    return refuse("contract-resolve", "contract-unresolvable", `contract could not be resolved: ${resolved.error.message}`);
+  }
+  const realDirectory = await tree.realDirectory();
+  if (realDirectory === void 0) {
+    return refuse("source-scan", "unreadable-dir", "could not resolve the real path of the plugin directory");
+  }
+  for (const reference of referencedPaths(manifest)) {
+    if (!await tree.isInside(realDirectory, reference.path)) {
+      return refuse("contract-resolve", "path-escapes-plugin-dir", `${reference.label} path '${reference.path}' resolves outside the plugin directory (no symlink escapes, no traversal)`);
+    }
+  }
+  return {
+    outcome: "loads",
+    hostSdkVersion,
+    manifest,
+    contract: resolved.data,
+    warnings,
+    advisories: host === void 0 ? [] : kayPluginCompatibilityAdvisories({ manifest, host, root })
+  };
+}
+function kayPluginCompatibilityAdvisories(input) {
+  const { manifest, host, root } = input;
+  const report = checkKayPluginHostCompatibility(manifest.compatibility, {
+    ...host,
+    bundled: input.bundled === true
+  });
+  return report.advisories.map((advisory) => ({
+    stage: "source-scan",
+    root,
+    code: advisory.code,
+    message: boundPluginDiagnosticMessage(`${manifest.displayName} (${manifest.id}) ${advisory.message}`)
+  }));
+}
+var ReadableCompatibility = z11.object({
+  supportedProtocols: z11.array(z11.string()).optional().catch(void 0),
+  minKayVersion: NonEmptyString.optional().catch(void 0),
+  sdk: NonEmptyString.optional().catch(void 0)
+});
+var ReadableManifestHead = z11.object({
+  id: z11.string().optional().catch(void 0),
+  displayName: z11.string().optional().catch(void 0),
+  compatibility: ReadableCompatibility.optional().catch(void 0)
+});
+function namedIn(head) {
+  if (head.id === void 0)
+    return KAY_PLUGIN_MANIFEST_FILENAME;
+  return head.displayName === void 0 ? head.id : `${head.displayName} (${head.id})`;
+}
+function referencedPaths(manifest) {
+  const refs = [];
+  const kayAgent = manifest.targets?.kay?.agent;
+  if (kayAgent !== void 0) {
+    refs.push({
+      label: "kay.agent entrypoint",
+      path: kayAgent.entrypoint.module
+    });
+  }
+  const kayApp = manifest.targets?.kay?.app;
+  if (kayApp?.entrypoint !== void 0) {
+    refs.push({ label: "kay.app entrypoint", path: kayApp.entrypoint.module });
+  }
+  if (manifest.icon !== void 0) {
+    refs.push({ label: "icon", path: manifest.icon });
+  }
+  if (manifest.iconDark !== void 0) {
+    refs.push({ label: "iconDark", path: manifest.iconDark });
+  }
+  for (const skill of kayAgent?.contributes?.skills ?? []) {
+    refs.push({ label: `skill '${skill.localId}'`, path: skill.path });
+  }
+  const kayUi = manifest.targets?.kay?.ui;
+  if (kayUi?.entrypoint !== void 0) {
+    refs.push({ label: "kay.ui entrypoint", path: kayUi.entrypoint.module });
+  }
+  for (const app of kayUi?.contributes?.apps ?? []) {
+    refs.push({
+      label: `kay.ui app '${app.localId}' entrypoint`,
+      path: app.entrypoint.module
+    });
+    for (const style of app.styles ?? []) {
+      refs.push({ label: `kay.ui app '${app.localId}' style`, path: style });
+    }
+    for (const asset of app.assets ?? []) {
+      refs.push({ label: `kay.ui app '${app.localId}' asset`, path: asset });
+    }
+    if (app.icon !== void 0) {
+      refs.push({ label: `kay.ui app '${app.localId}' icon`, path: app.icon });
+    }
+  }
+  return refs;
+}
+function firstIssue(issues) {
+  const issue = issues[0];
+  if (issue === void 0)
+    return "unknown validation error";
+  const at = issue.path.length > 0 ? issue.path.join(".") : "<root>";
+  return `${at}: ${issue.message}`;
+}
+function errorText(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
 // packages/plugin-protocol/dist/session-health.js
-import { z as z10 } from "zod";
+import { z as z12 } from "zod";
 var SESSION_HEALTH_EXTENSION_ID = "kay.session-health";
 var SESSION_HEALTH_ENTRY_NAME = "session_health";
 var SESSION_HEALTH_CUSTOM_TYPE = `ext:${SESSION_HEALTH_EXTENSION_ID}:${SESSION_HEALTH_ENTRY_NAME}`;
 var SESSION_HEALTH_CLASSIFIER_IDS = ["jev"];
-var sessionHealthEntrySchema = z10.object({
-  v: z10.literal(1),
-  verdict: z10.enum(["well", "bad", "unknown"]),
+var sessionHealthEntrySchema = z12.object({
+  v: z12.literal(1),
+  verdict: z12.enum(["well", "bad", "unknown"]),
   /**
    * The model's calibrated confidence in `well`, 0..1, or null when the
    * classifier declined to produce one. Never exported raw: the telemetry
    * event carries only the decile bucket.
    */
-  p_well: z10.number().min(0).max(1).nullable(),
-  classifier: z10.enum(SESSION_HEALTH_CLASSIFIER_IDS),
-  classifier_version: z10.string().min(1).max(64),
-  judged_at: z10.number().int().nonnegative(),
-  user_entry_id: z10.string().min(1).max(256),
-  through_entry_id: z10.string().min(1).max(256),
-  usage: z10.strictObject({
-    input_tokens: z10.number().int().nonnegative(),
-    output_tokens: z10.number().int().nonnegative()
+  p_well: z12.number().min(0).max(1).nullable(),
+  classifier: z12.enum(SESSION_HEALTH_CLASSIFIER_IDS),
+  classifier_version: z12.string().min(1).max(64),
+  judged_at: z12.number().int().nonnegative(),
+  user_entry_id: z12.string().min(1).max(256),
+  through_entry_id: z12.string().min(1).max(256),
+  usage: z12.strictObject({
+    input_tokens: z12.number().int().nonnegative(),
+    output_tokens: z12.number().int().nonnegative()
   }).optional()
 });
 function sessionHealthPWellDecile(pWell) {
@@ -4500,36 +4729,36 @@ function sessionHealthPWellDecile(pWell) {
 }
 
 // packages/plugin-protocol/dist/resource-invocations.js
-import { z as z11 } from "zod";
-var CorpusResourceKind = z11.enum([
+import { z as z13 } from "zod";
+var CorpusResourceKind = z13.enum([
   "skill",
   "context-file",
   "prompt-command"
 ]);
-var CorpusResourceInvocationCursor = z11.strictObject({
-  at: z11.iso.datetime({ offset: true }),
-  eventId: z11.string().min(1)
+var CorpusResourceInvocationCursor = z13.strictObject({
+  at: z13.iso.datetime({ offset: true }),
+  eventId: z13.string().min(1)
 });
-var CorpusResourceInvocationQuery = z11.strictObject({
+var CorpusResourceInvocationQuery = z13.strictObject({
   kind: CorpusResourceKind,
-  since: z11.iso.datetime({ offset: true }),
-  until: z11.iso.datetime({ offset: true }),
+  since: z13.iso.datetime({ offset: true }),
+  until: z13.iso.datetime({ offset: true }),
   after: CorpusResourceInvocationCursor.optional(),
-  limit: z11.number().int().min(1).max(1e3).optional(),
-  rootCreatedByKind: z11.enum(AGENT_RUNTIME_SESSION_CREATOR_KINDS).optional()
+  limit: z13.number().int().min(1).max(1e3).optional(),
+  rootCreatedByKind: z13.enum(AGENT_RUNTIME_SESSION_CREATOR_KINDS).optional()
 }).refine((value) => Date.parse(value.since) < Date.parse(value.until), {
   message: "since must precede until"
 });
 
 // packages/plugin-protocol/dist/ui-app-package.js
-import { z as z12 } from "zod";
+import { z as z14 } from "zod";
 var KAY_UI_APP_PACKAGE_PROTOCOL = "kay.ui.app-package.v1";
 var KAY_UI_BUNDLE_INDEX_PROTOCOL = "kay.ui.bundle-index.v1";
-var KayUiBundleOutputPath = z12.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.startsWith("./") && !value.includes("\\") && !value.split("/").includes(".."), { message: "bundle output path must stay relative to the bundle root" });
-var KayUiBundleIndexV1 = z12.strictObject({
-  protocol: z12.literal(KAY_UI_BUNDLE_INDEX_PROTOCOL),
+var KayUiBundleOutputPath = z14.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.startsWith("./") && !value.includes("\\") && !value.split("/").includes(".."), { message: "bundle output path must stay relative to the bundle root" });
+var KayUiBundleIndexV1 = z14.strictObject({
+  protocol: z14.literal(KAY_UI_BUNDLE_INDEX_PROTOCOL),
   entryPath: KayUiBundleOutputPath,
-  files: z12.array(z12.strictObject({
+  files: z14.array(z14.strictObject({
     path: KayUiBundleOutputPath,
     mediaType: NonEmptyString
   })).min(1)
@@ -4556,19 +4785,19 @@ var KayUiBundleIndexV1 = z12.strictObject({
 function parseKayUiBundleIndexV1(input) {
   return KayUiBundleIndexV1.parse(input);
 }
-var KayUiAppPackageFile = z12.strictObject({
+var KayUiAppPackageFile = z14.strictObject({
   path: PackageAssetPath,
   mediaType: NonEmptyString,
-  bytes: z12.instanceof(Uint8Array).refine((bytes) => bytes.byteLength > 0, {
+  bytes: z14.instanceof(Uint8Array).refine((bytes) => bytes.byteLength > 0, {
     message: "app package file bytes must not be empty"
   })
 });
-var KayUiAppPackageV1 = z12.strictObject({
-  protocol: z12.literal(KAY_UI_APP_PACKAGE_PROTOCOL),
+var KayUiAppPackageV1 = z14.strictObject({
+  protocol: z14.literal(KAY_UI_APP_PACKAGE_PROTOCOL),
   appLocalId: LocalContributionId,
   entry: KayUiAppPackageFile,
-  styles: z12.array(KayUiAppPackageFile).optional(),
-  assets: z12.array(KayUiAppPackageFile).optional()
+  styles: z14.array(KayUiAppPackageFile).optional(),
+  assets: z14.array(KayUiAppPackageFile).optional()
 }).superRefine((appPackage, ctx) => {
   if (appPackage.entry.mediaType !== "application/javascript") {
     ctx.addIssue({
@@ -4605,16 +4834,16 @@ function parseKayUiAppPackageV1(input) {
 }
 
 // packages/plugin-protocol/dist/whiteboard.js
-import { z as z13 } from "zod";
+import { z as z15 } from "zod";
 var WhiteboardValue = JsonValue;
-var WhiteboardEntryEnvelope = z13.strictObject({
+var WhiteboardEntryEnvelope = z15.strictObject({
   id: NonEmptyString,
   typeId: GlobalContributionId,
-  schemaVersion: z13.number().int().positive(),
-  title: z13.string(),
+  schemaVersion: z15.number().int().positive(),
+  title: z15.string(),
   authorSessionId: NonEmptyString.nullable()
 });
-var WhiteboardEntrySummary = z13.strictObject({
+var WhiteboardEntrySummary = z15.strictObject({
   name: NonEmptyString,
   entry: WhiteboardEntryEnvelope,
   revision: NonEmptyString
@@ -4622,31 +4851,31 @@ var WhiteboardEntrySummary = z13.strictObject({
 var WhiteboardEntrySnapshot = WhiteboardEntrySummary.extend({
   value: WhiteboardValue
 });
-var WhiteboardDiagnostic = z13.strictObject({
+var WhiteboardDiagnostic = z15.strictObject({
   ruleId: NonEmptyString,
-  severity: z13.enum(["error", "warning"]),
+  severity: z15.enum(["error", "warning"]),
   message: NonEmptyString
 });
-var WhiteboardEntryInfo = z13.strictObject({
+var WhiteboardEntryInfo = z15.strictObject({
   name: NonEmptyString,
   revision: NonEmptyString,
   entry: WhiteboardEntryEnvelope.optional(),
-  state: z13.enum(["available", "unavailable", "unsupported-version", "invalid"]),
-  mutable: z13.boolean(),
-  diagnostics: z13.array(z13.string())
+  state: z15.enum(["available", "unavailable", "unsupported-version", "invalid"]),
+  mutable: z15.boolean(),
+  diagnostics: z15.array(z15.string())
 });
 var WhiteboardEntryInspection = WhiteboardEntryInfo.extend({
   value: WhiteboardValue.optional(),
-  text: z13.string(),
-  truncated: z13.boolean()
+  text: z15.string(),
+  truncated: z15.boolean()
 });
-var WhiteboardTypeInfo = z13.strictObject({
+var WhiteboardTypeInfo = z15.strictObject({
   typeId: GlobalContributionId,
   displayName: NonEmptyString,
-  schemaVersion: z13.number().int().positive(),
-  available: z13.boolean(),
+  schemaVersion: z15.number().int().positive(),
+  available: z15.boolean(),
   /** A plugin-owned readonly presentation; absent types use the host fallback. */
-  presentation: z13.strictObject({
+  presentation: z15.strictObject({
     app: GlobalContributionId
   }).optional()
 });
@@ -4714,6 +4943,8 @@ export {
   KAY_APP_DATA_SNAPSHOT_MAX_BYTES,
   KAY_EVENT_PUBLISHER_ID,
   KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS,
+  KAY_PLUGIN_MANIFEST_FILENAME,
+  KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES,
   KAY_PLUGIN_PROTOCOL_PACKAGE_NAME,
   KAY_PLUGIN_PROTOCOL_VERSION,
   KAY_PLUGIN_SDK_VERSION,
@@ -4742,6 +4973,7 @@ export {
   MimeTypeString,
   NonEmptyString,
   PLUGIN_CAPABILITY_SLUGS,
+  PLUGIN_DIAGNOSTIC_MESSAGE_CAP,
   PLUGIN_ICON_SHAPE_ATTRIBUTE,
   PLUGIN_NOTIFICATION_RULE_HOST_KEYS,
   PackageAssetPath,
@@ -4774,6 +5006,7 @@ export {
   PluginToolName,
   PluginWebSessionDeclaration,
   PluginWebSessionProbe,
+  RESERVED_DIRECTORY_PLUGIN_ID_PREFIXES,
   RETIRED_COMPATIBILITY_KEYS,
   RETIRED_PERMISSION_ASK_KEYS,
   RETIRED_PLUGIN_CAPABILITY_SLUGS,
@@ -4860,6 +5093,7 @@ export {
   WhiteboardTypeInfo,
   WhiteboardTypeStorage,
   WhiteboardValue,
+  boundPluginDiagnosticMessage,
   captureArtifactProvenance,
   captureFailedContext,
   checkKayPluginHostCompatibility,
@@ -4874,6 +5108,9 @@ export {
   isQualifiedAuthSchemeRef,
   isQualifiedAuthServiceRef,
   isSupportedSemverRange,
+  judgeKayPluginDirectory,
+  kayPluginCompatibilityAdvisories,
+  kayPluginHostCompatibility,
   kayUiEventSubscriptionsFromManifest,
   mintOperation,
   normalizeNetworkConnectHost,