@yaklabs-ai/plugin-protocol 0.13.5 → 0.13.7

package/dist/index.js

@@ -115,13 +115,28 @@ function precedingPersonMessages(entries, packet, count) {
 }
 
 // packages/plugin-protocol/dist/app-data-read.js
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
 // packages/plugin-protocol/dist/common.js
+import { z as z3 } from "zod";
+
+// packages/plugin-protocol/dist/json.js
 import { z as z2 } from "zod";
+var JsonValue = z2.lazy(() => z2.union([
+  z2.string(),
+  z2.number(),
+  z2.boolean(),
+  z2.null(),
+  z2.array(JsonValue),
+  z2.record(z2.string(), JsonValue)
+]));
+var JsonObject = z2.record(z2.string(), JsonValue);
+var JsonSchema = z2.record(z2.string(), JsonValue);
+
+// packages/plugin-protocol/dist/common.js
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.13.5";
+var KAY_PLUGIN_SDK_VERSION = "0.13.7";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.8.0",
   "0.8.1",
@@ -144,70 +159,62 @@ var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.13.1",
   "0.13.2",
   "0.13.3",
-  "0.13.4"
+  "0.13.4",
+  "0.13.5",
+  "0.13.6"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
   "kay.app",
   "kay.ui"
 ];
-var KayPluginProtocolVersion = z2.literal(KAY_PLUGIN_PROTOCOL_VERSION);
-var PluginTargetName = z2.enum(KAY_PLUGIN_TARGET_NAMES);
-var NonEmptyString = z2.string().trim().min(1);
-var JsonValue = z2.lazy(() => z2.union([
-  z2.string(),
-  z2.number(),
-  z2.boolean(),
-  z2.null(),
-  z2.array(JsonValue),
-  z2.record(z2.string(), JsonValue)
-]));
-var JsonObject = z2.record(z2.string(), JsonValue);
-var JsonSchema = z2.record(z2.string(), JsonValue);
+var KayPluginProtocolVersion = z3.literal(KAY_PLUGIN_PROTOCOL_VERSION);
+var PluginTargetName = z3.enum(KAY_PLUGIN_TARGET_NAMES);
+var NonEmptyString = z3.string().trim().min(1);
 var PLUGIN_ID_PATTERN = /^[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)*$/;
 var LOCAL_CONTRIBUTION_ID_PATTERN = /^[a-z][a-z0-9-]*$/;
 var PLUGIN_TOOL_NAME_PATTERN = /^[a-z][a-z0-9_-]*$/;
 var PACKAGE_ASSET_PATH_PATTERN = /^\.\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
 var KAY_EVENT_PUBLISHER_ID = "kay";
-var PluginId = z2.string().trim().regex(PLUGIN_ID_PATTERN).refine((id) => id !== KAY_EVENT_PUBLISHER_ID, {
+var PluginId = z3.string().trim().regex(PLUGIN_ID_PATTERN).refine((id) => id !== KAY_EVENT_PUBLISHER_ID, {
   message: `'${KAY_EVENT_PUBLISHER_ID}' is reserved for Bonsai's own event publisher`
 });
 var PluginNamespace = PluginId;
-var LocalContributionId = z2.string().trim().regex(LOCAL_CONTRIBUTION_ID_PATTERN);
-var GlobalContributionId = z2.string().trim().regex(PLUGIN_ID_PATTERN);
-var PluginToolName = z2.string().trim().regex(PLUGIN_TOOL_NAME_PATTERN);
+var LocalContributionId = z3.string().trim().regex(LOCAL_CONTRIBUTION_ID_PATTERN);
+var GlobalContributionId = z3.string().trim().regex(PLUGIN_ID_PATTERN);
+var PluginToolName = z3.string().trim().regex(PLUGIN_TOOL_NAME_PATTERN);
 var AuthServiceReference = GlobalContributionId;
 var AuthSchemeReference = GlobalContributionId;
-var AdapterSelectionKey = z2.string().trim().regex(PLUGIN_ID_PATTERN);
-var AdapterPlacement = z2.enum(["local-only", "anywhere"]);
-var UriScheme = z2.string().trim().regex(/^[a-z][a-z0-9+.-]*$/);
-var MimeTypeString = z2.string().trim().regex(/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/);
-var FileExtensionToken = z2.string().trim().regex(/^[a-z0-9]+$/);
+var AdapterSelectionKey = z3.string().trim().regex(PLUGIN_ID_PATTERN);
+var AdapterPlacement = z3.enum(["local-only", "anywhere"]);
+var UriScheme = z3.string().trim().regex(/^[a-z][a-z0-9+.-]*$/);
+var MimeTypeString = z3.string().trim().regex(/^[a-z0-9][a-z0-9!#$&^_.+-]*\/[a-z0-9][a-z0-9!#$&^_.+-]*$/);
+var FileExtensionToken = z3.string().trim().regex(/^[a-z0-9]+$/);
 var CliBinaryName = NonEmptyString.refine((value) => !value.includes("/"), {
   message: "cli binding binary/alias must be a basename, not a path (no '/')"
 });
-var CliAuthEnvVarName = z2.string().trim().regex(/^[A-Z][A-Z0-9_]*$/);
-var PackageAssetPath = z2.string().trim().regex(PACKAGE_ASSET_PATH_PATTERN).refine((value) => !value.split("/").includes(".."), {
+var CliAuthEnvVarName = z3.string().trim().regex(/^[A-Z][A-Z0-9_]*$/);
+var PackageAssetPath = z3.string().trim().regex(PACKAGE_ASSET_PATH_PATTERN).refine((value) => !value.split("/").includes(".."), {
   message: "package asset path must not contain a '..' path segment"
 });
-var PluginSourceClass = z2.enum([
+var PluginSourceClass = z3.enum([
   "bundled",
   "org-shared",
   "user-local",
   "verified-marketplace",
   "freeform"
 ]);
-var ArtifactGenerationId = z2.string().trim().min(1).brand();
-var HttpsUrl = z2.url({ protocol: /^https$/ });
-var RegistrableDomain = z2.string().trim().regex(/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/);
+var ArtifactGenerationId = z3.string().trim().min(1).brand();
+var HttpsUrl = z3.url({ protocol: /^https$/ });
+var RegistrableDomain = z3.string().trim().regex(/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/);
 var HOST_LABEL_PATTERN = /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/;
 var MAX_HOST_LENGTH = 253;
 var MAX_HOST_LABEL_LENGTH = 63;
 var GitHostName = RegistrableDomain.max(MAX_HOST_LENGTH).refine((host) => host.split(".").every((label) => label.length <= MAX_HOST_LABEL_LENGTH && HOST_LABEL_PATTERN.test(label)), {
   message: "git host labels must be 1-63 characters and start and end with a letter or digit"
 });
-var GitBasicAuthUser = z2.string().trim().min(1).max(128).regex(/^[A-Za-z0-9._~-]+$/);
-var HttpStatusCode = z2.number().int().min(100).max(599);
+var GitBasicAuthUser = z3.string().trim().min(1).max(128).regex(/^[A-Za-z0-9._~-]+$/);
+var HttpStatusCode = z3.number().int().min(100).max(599);
 var SignedInStatusCode = HttpStatusCode.refine((status) => !(status < 200 || status >= 300 && status < 400), {
   message: "signedInStatuses cannot include 1xx or 3xx: the probe follows redirects and never observes them as a final status"
 });
@@ -238,57 +245,57 @@ function refineWebSessionScopeConfined(webSession, ctx) {
     });
   }
 }
-var JsonPointer = z2.string().trim().regex(/^(?:\/(?:[^/~]|~[01])*)*$/);
-var TargetEntrypoint = z2.strictObject({
+var JsonPointer = z3.string().trim().regex(/^(?:\/(?:[^/~]|~[01])*)*$/);
+var TargetEntrypoint = z3.strictObject({
   module: NonEmptyString,
   export: NonEmptyString.optional()
 });
 
 // packages/plugin-protocol/dist/app-data-read.js
-var AppDataVersionedSchema = z3.strictObject({
-  version: z3.number().int().positive(),
+var AppDataVersionedSchema = z4.strictObject({
+  version: z4.number().int().positive(),
   schema: JsonSchema
 });
-var AppDataSourceRead = z3.strictObject({
+var AppDataSourceRead = z4.strictObject({
   request: AppDataVersionedSchema,
   result: AppDataVersionedSchema
 });
 
 // packages/plugin-protocol/dist/artifact-provenance.js
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // packages/plugin-protocol/dist/session-provenance.js
-import { z as z4 } from "zod";
-var NonEmptyString2 = z4.string().min(1);
+import { z as z5 } from "zod";
+var NonEmptyString2 = z5.string().min(1);
 var SessionId = NonEmptyString2;
-var SessionRelationship = z4.discriminatedUnion("kind", [
+var SessionRelationship = z5.discriminatedUnion("kind", [
   /** Spawn lineage: this session is a subagent child of `sessionId`. */
-  z4.strictObject({ kind: z4.literal("child-of"), sessionId: SessionId }),
+  z5.strictObject({ kind: z5.literal("child-of"), sessionId: SessionId }),
   /**
    * This session was forked from a point in `sessionId`'s transcript — `/fork`, and every
    * hindsight followup. `atEntryId` pins the fork point when one was given.
    */
-  z4.strictObject({
-    kind: z4.literal("forked-from"),
+  z5.strictObject({
+    kind: z5.literal("forked-from"),
     sessionId: SessionId,
     atEntryId: NonEmptyString2.optional()
   })
 ]);
-var SdkSessionDoor = z4.enum([
+var SdkSessionDoor = z5.enum([
   "sessions.create",
   "sessions.run",
   "hindsight.runFollowup",
   "agents.run"
 ]);
-var SessionCreator = z4.discriminatedUnion("kind", [
+var SessionCreator = z5.discriminatedUnion("kind", [
   /** A person, at the keyboard. `surface` names a scripted experience when one minted it. */
-  z4.strictObject({
-    kind: z4.literal("human"),
+  z5.strictObject({
+    kind: z5.literal("human"),
     surface: NonEmptyString2.optional()
   }),
   /** Another session's agent, through a tool call. */
-  z4.strictObject({
-    kind: z4.literal("agent"),
+  z5.strictObject({
+    kind: z5.literal("agent"),
     sessionId: SessionId,
     tool: NonEmptyString2,
     /**
@@ -306,8 +313,8 @@ var SessionCreator = z4.discriminatedUnion("kind", [
     toolCallId: NonEmptyString2.optional()
   }),
   /** A plugin, through one of its SDK doors. */
-  z4.strictObject({
-    kind: z4.literal("plugin"),
+  z5.strictObject({
+    kind: z5.literal("plugin"),
     pluginId: NonEmptyString2,
     door: SdkSessionDoor,
     callerSessionId: SessionId.optional()
@@ -321,8 +328,8 @@ var SessionCreator = z4.discriminatedUnion("kind", [
    * schedule nor a session-fact occurrence. Added 2026-08-19, when the automation producers
    * landed and a watcher's report session had nothing honest to stamp.
    */
-  z4.strictObject({
-    kind: z4.literal("trigger"),
+  z5.strictObject({
+    kind: z5.literal("trigger"),
     automationId: NonEmptyString2,
     /**
      * The AUTOMATION RUN that fired the binding (R2 provenance). Optional at
@@ -332,10 +339,10 @@ var SessionCreator = z4.discriminatedUnion("kind", [
      */
     runId: NonEmptyString2.optional(),
     bindingName: NonEmptyString2,
-    triggerKind: z4.enum(["cron", "time", "occurrence", "uri-change", "manual"])
+    triggerKind: z5.enum(["cron", "time", "occurrence", "uri-change", "manual"])
   }),
   /** The daemon itself, for one of its own capabilities. */
-  z4.strictObject({ kind: z4.literal("daemon"), capability: NonEmptyString2 })
+  z5.strictObject({ kind: z5.literal("daemon"), capability: NonEmptyString2 })
 ]);
 var AGENT_RUNTIME_SESSION_CREATOR_KINDS = [
   "human",
@@ -344,26 +351,26 @@ var AGENT_RUNTIME_SESSION_CREATOR_KINDS = [
   "trigger",
   "daemon"
 ];
-var SessionDefiner = z4.discriminatedUnion("layer", [
-  z4.strictObject({
-    layer: z4.literal("plugin"),
+var SessionDefiner = z5.discriminatedUnion("layer", [
+  z5.strictObject({
+    layer: z5.literal("plugin"),
     pluginId: NonEmptyString2,
     capability: NonEmptyString2,
     /** See the type docblock: unpopulated by design until #5230's children land. */
     version: NonEmptyString2.optional()
   }),
-  z4.strictObject({ layer: z4.literal("host"), capability: NonEmptyString2 })
+  z5.strictObject({ layer: z5.literal("host"), capability: NonEmptyString2 })
 ]);
-var SessionIntent = z4.enum(["interactive", "headless"]);
-var SessionCausedByEventShape = z4.strictObject({
+var SessionIntent = z5.enum(["interactive", "headless"]);
+var SessionCausedByEventShape = z5.strictObject({
   /** The plugin's own name for the subscribe handler that made this run, e.g. `"work-record"`. */
   handler: NonEmptyString2,
   /** Absent reads as `"session-event"` — see this type's own doc comment. */
-  kind: z4.enum(["session-event", "backfill"]).optional(),
+  kind: z5.enum(["session-event", "backfill"]).optional(),
   /** Required when `kind` is `"session-event"` or absent; must be omitted when `kind` is `"backfill"`. */
-  event: z4.strictObject({
+  event: z5.strictObject({
     /** {@link KayAppSessionEventType} in `@bonsai/plugin-sdk`, mirrored: a closed, extensible union. */
-    type: z4.enum([
+    type: z5.enum([
       "turn-settled",
       "phase-shift",
       "human-message",
@@ -392,8 +399,8 @@ var SessionCausedByEvent = SessionCausedByEventShape.refine((value) => (value.ki
   message: 'event must be omitted when kind is "backfill"',
   path: ["event"]
 });
-var SessionProvenanceRecord = z4.strictObject({
-  relationships: z4.array(SessionRelationship),
+var SessionProvenanceRecord = z5.strictObject({
+  relationships: z5.array(SessionRelationship),
   createdBy: SessionCreator,
   definedBy: SessionDefiner,
   intent: SessionIntent,
@@ -457,93 +464,93 @@ function isProvenanceJson(input) {
   }
   return true;
 }
-var Text = z5.string().min(1).refine((value) => !hasControlCharacter(value), {
+var Text = z6.string().min(1).refine((value) => !hasControlCharacter(value), {
   message: "Provenance text must not contain control characters"
 });
-var ArtifactProvenanceRevision = z5.strictObject({
+var ArtifactProvenanceRevision = z6.strictObject({
   storeId: Text,
   artifactId: Text,
   uri: Text.optional(),
   /** The enclosing commit is resolved by the reader, avoiding a self-referential commit hash. */
-  revision: z5.union([
+  revision: z6.union([
     Text,
-    z5.strictObject({ kind: z5.literal("enclosing-commit") }),
-    z5.null()
+    z6.strictObject({ kind: z6.literal("enclosing-commit") }),
+    z6.null()
   ]),
   operationId: Text.nullable(),
   /** Optional when the store identifies revisions without content addressing (including tombstones). */
-  digest: z5.strictObject({ algorithm: Text, value: Text }).optional()
+  digest: z6.strictObject({ algorithm: Text, value: Text }).optional()
 });
-var ArtifactProvenanceActor = z5.discriminatedUnion("kind", [
-  z5.strictObject({
-    kind: z5.literal("session"),
+var ArtifactProvenanceActor = z6.discriminatedUnion("kind", [
+  z6.strictObject({
+    kind: z6.literal("session"),
     sessionId: Text,
     runId: Text.nullable()
   }),
-  z5.strictObject({
-    kind: z5.literal("human"),
+  z6.strictObject({
+    kind: z6.literal("human"),
     userId: Text.optional(),
     surface: Text
   }),
-  z5.strictObject({
-    kind: z5.literal("plugin"),
+  z6.strictObject({
+    kind: z6.literal("plugin"),
     pluginId: Text,
     capability: Text
   }),
-  z5.strictObject({ kind: z5.literal("host"), capability: Text }),
-  z5.strictObject({ kind: z5.literal("import"), source: Text }),
-  z5.strictObject({ kind: z5.literal("unknown") })
+  z6.strictObject({ kind: z6.literal("host"), capability: Text }),
+  z6.strictObject({ kind: z6.literal("import"), source: Text }),
+  z6.strictObject({ kind: z6.literal("unknown") })
 ]);
-var ArtifactProvenanceCause = z5.discriminatedUnion("kind", [
-  z5.strictObject({
-    kind: z5.literal("session"),
+var ArtifactProvenanceCause = z6.discriminatedUnion("kind", [
+  z6.strictObject({
+    kind: z6.literal("session"),
     sessionId: Text,
     runId: Text.nullable()
   }),
-  z5.strictObject({
-    kind: z5.literal("session-event"),
+  z6.strictObject({
+    kind: z6.literal("session-event"),
     sessionId: Text,
     cause: SessionCausedByEvent
   }),
-  z5.strictObject({
-    kind: z5.literal("automation"),
+  z6.strictObject({
+    kind: z6.literal("automation"),
     automationId: Text,
     runId: Text.nullable()
   }),
-  z5.strictObject({ kind: z5.literal("operation"), operationId: Text })
+  z6.strictObject({ kind: z6.literal("operation"), operationId: Text })
 ]);
-var ArtifactProvenanceOperation = z5.strictObject({
+var ArtifactProvenanceOperation = z6.strictObject({
   id: Text.nullable(),
-  at: z5.iso.datetime().nullable(),
+  at: z6.iso.datetime().nullable(),
   name: Text,
   actor: ArtifactProvenanceActor,
   /** Null means no tool invocation; a known invocation with an unknown id records a gap. */
-  invocation: z5.strictObject({
+  invocation: z6.strictObject({
     tool: Text,
     toolCallId: Text.nullable(),
-    origin: z5.enum(["model", "host"])
+    origin: z6.enum(["model", "host"])
   }).nullable(),
   /** Known causes only; unavailable cause capture requires a gap, never a guessed creation cause. */
-  causes: z5.array(ArtifactProvenanceCause)
+  causes: z6.array(ArtifactProvenanceCause)
 });
-var ArtifactProvenanceReference = z5.discriminatedUnion("kind", [
-  z5.strictObject({
-    kind: z5.literal("session"),
+var ArtifactProvenanceReference = z6.discriminatedUnion("kind", [
+  z6.strictObject({
+    kind: z6.literal("session"),
     sessionId: Text,
     runId: Text.optional()
   }),
-  z5.strictObject({
-    kind: z5.literal("artifact"),
+  z6.strictObject({
+    kind: z6.literal("artifact"),
     revision: ArtifactProvenanceRevision
   }),
-  z5.strictObject({
-    kind: z5.literal("resource"),
+  z6.strictObject({
+    kind: z6.literal("resource"),
     uri: Text,
     revision: Text.nullable()
   })
 ]);
-var ArtifactProvenanceGap = z5.strictObject({
-  code: z5.enum([
+var ArtifactProvenanceGap = z6.strictObject({
+  code: z6.enum([
     "unknown",
     "capture-failed",
     "legacy-derived",
@@ -556,18 +563,18 @@ var ArtifactProvenanceGap = z5.strictObject({
     "invalid-record"
   ]),
   /** JSON Pointer into this envelope; the empty pointer covers the whole capture. */
-  at: z5.string().regex(/^(?:\/(?:[^~/]|~[01])*)*$/).refine((value) => !hasControlCharacter(value)),
+  at: z6.string().regex(/^(?:\/(?:[^~/]|~[01])*)*$/).refine((value) => !hasControlCharacter(value)),
   detail: Text.optional()
 }).refine((gap) => gap.at !== "" || gap.code === "capture-failed", {
   message: "Only a whole-capture failure may cover the entire envelope"
 });
-var ArtifactProvenanceSession = z5.strictObject({
+var ArtifactProvenanceSession = z6.strictObject({
   sessionId: Text,
-  basis: z5.enum(["recorded", "legacy-derived", "unverified-index", "missing"]),
+  basis: z6.enum(["recorded", "legacy-derived", "unverified-index", "missing"]),
   record: SessionProvenanceRecord.nullable()
 });
-var ArtifactProvenanceSource = z5.strictObject({
-  relationship: z5.enum([
+var ArtifactProvenanceSource = z6.strictObject({
+  relationship: z6.enum([
     "revision-of",
     "copied-from",
     "harvested-from",
@@ -577,8 +584,8 @@ var ArtifactProvenanceSource = z5.strictObject({
   ]),
   revision: ArtifactProvenanceRevision
 });
-var ArtifactProvenanceMutation = z5.strictObject({
-  kind: z5.enum([
+var ArtifactProvenanceMutation = z6.strictObject({
+  kind: z6.enum([
     "create",
     "update",
     "delete",
@@ -591,16 +598,16 @@ var ArtifactProvenanceMutation = z5.strictObject({
   target: ArtifactProvenanceRevision,
   /** Retained from the source on copies/acceptance; operation.actor is the persistence actor. */
   producer: ArtifactProvenanceOperation,
-  sources: z5.array(ArtifactProvenanceSource)
+  sources: z6.array(ArtifactProvenanceSource)
 });
-var Envelope = z5.strictObject({
-  version: z5.literal(ARTIFACT_PROVENANCE_VERSION),
+var Envelope = z6.strictObject({
+  version: z6.literal(ARTIFACT_PROVENANCE_VERSION),
   operation: ArtifactProvenanceOperation,
-  artifacts: z5.array(ArtifactProvenanceMutation).min(1),
-  sessions: z5.array(ArtifactProvenanceSession),
-  subjects: z5.array(ArtifactProvenanceReference),
-  evidence: z5.array(ArtifactProvenanceReference),
-  gaps: z5.array(ArtifactProvenanceGap)
+  artifacts: z6.array(ArtifactProvenanceMutation).min(1),
+  sessions: z6.array(ArtifactProvenanceSession),
+  subjects: z6.array(ArtifactProvenanceReference),
+  evidence: z6.array(ArtifactProvenanceReference),
+  gaps: z6.array(ArtifactProvenanceGap)
 });
 var UNKNOWN = [
   "unknown",
@@ -771,18 +778,18 @@ function validateEnvelope(envelope, context) {
   }
   checkGraph(envelope, gap, issue);
 }
-var ArtifactProvenanceEnvelopeV1 = z5.unknown().refine(isProvenanceJson, {
+var ArtifactProvenanceEnvelopeV1 = z6.unknown().refine(isProvenanceJson, {
   message: "Provenance must be plain, acyclic, lossless JSON without control characters"
 }).pipe(Envelope.superRefine(validateEnvelope));
 function parseArtifactProvenanceEnvelope(input) {
   return ArtifactProvenanceEnvelopeV1.parse(input);
 }
-var ArtifactProvenanceCaptureContextSchema = z5.strictObject({
+var ArtifactProvenanceCaptureContextSchema = z6.strictObject({
   operation: ArtifactProvenanceOperation,
-  sessions: z5.array(ArtifactProvenanceSession),
-  subjects: z5.array(ArtifactProvenanceReference),
-  evidence: z5.array(ArtifactProvenanceReference),
-  gaps: z5.array(ArtifactProvenanceGap)
+  sessions: z6.array(ArtifactProvenanceSession),
+  subjects: z6.array(ArtifactProvenanceReference),
+  evidence: z6.array(ArtifactProvenanceReference),
+  gaps: z6.array(ArtifactProvenanceGap)
 });
 function parseArtifactProvenanceCaptureContext(input) {
   return ArtifactProvenanceCaptureContextSchema.parse(input);
@@ -1080,39 +1087,39 @@ function finalizeArtifactProvenanceEnvelope(capture, artifacts) {
 }
 
 // packages/plugin-protocol/dist/authority.js
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 
 // packages/plugin-protocol/dist/permissions.js
-import { z as z6 } from "zod";
-var AuthGrantOperation = z6.enum([
+import { z as z7 } from "zod";
+var AuthGrantOperation = z7.enum([
   "status",
   "connect",
   "disconnect",
   "resolve"
 ]);
-var AuthAccountSelector = z6.discriminatedUnion("kind", [
-  z6.strictObject({ kind: z6.literal("active") }),
-  z6.strictObject({ kind: z6.literal("account-id"), accountId: NonEmptyString }),
-  z6.strictObject({ kind: z6.literal("record-id"), recordId: NonEmptyString })
+var AuthAccountSelector = z7.discriminatedUnion("kind", [
+  z7.strictObject({ kind: z7.literal("active") }),
+  z7.strictObject({ kind: z7.literal("account-id"), accountId: NonEmptyString }),
+  z7.strictObject({ kind: z7.literal("record-id"), recordId: NonEmptyString })
 ]);
-var AuthScopeDefinition = z6.strictObject({
+var AuthScopeDefinition = z7.strictObject({
   id: NonEmptyString,
   label: NonEmptyString,
   description: NonEmptyString,
-  documentationUrl: z6.url().optional()
+  documentationUrl: z7.url().optional()
 });
-var ScopeNeed = z6.strictObject({
+var ScopeNeed = z7.strictObject({
   scope: NonEmptyString,
   reason: NonEmptyString.optional()
 });
-var ScopeAlternative = z6.strictObject({
-  allOf: z6.array(ScopeNeed).min(1)
+var ScopeAlternative = z7.strictObject({
+  allOf: z7.array(ScopeNeed).min(1)
 });
-var ScopeRequirement = z6.strictObject({
+var ScopeRequirement = z7.strictObject({
   purpose: NonEmptyString,
-  alternatives: z6.array(ScopeAlternative).min(1)
+  alternatives: z7.array(ScopeAlternative).min(1)
 });
-var AuthGrantRequestBase = z6.strictObject({
+var AuthGrantRequestBase = z7.strictObject({
   // A local (undotted) service must be declared in this same manifest; a
   // qualified (dotted) service names another plugin's global id and is an
   // external service dependency, recorded on the resolved contract's
@@ -1121,22 +1128,22 @@ var AuthGrantRequestBase = z6.strictObject({
   // Optional for backward compatibility with grants whose service has a
   // single unambiguous scheme. Local ids resolve under the service owner's
   // namespace; qualified ids are preserved.
-  schemes: z6.array(AuthSchemeReference).min(1).optional(),
-  operations: z6.array(AuthGrantOperation).min(1),
-  purposes: z6.array(NonEmptyString).optional(),
+  schemes: z7.array(AuthSchemeReference).min(1).optional(),
+  operations: z7.array(AuthGrantOperation).min(1),
+  purposes: z7.array(NonEmptyString).optional(),
   // Bridged by the runtime into an enforceable `CredentialGrant`:
   // `allowedScopes` is the caller's scope ENVELOPE and
   // `accountSelectors` map through. Absent `accountSelectors` resolves to the
   // narrowest bound (see `ResolvedAuthGrantRequest`); absent scope envelope
   // leaves the bridged grant scope-agnostic.
-  allowedScopes: z6.array(NonEmptyString).min(1).optional(),
+  allowedScopes: z7.array(NonEmptyString).min(1).optional(),
   // Legacy spelling for `allowedScopes`; new manifests should use the authority-shaped name.
-  requiredScopes: z6.array(NonEmptyString).min(1).optional(),
+  requiredScopes: z7.array(NonEmptyString).min(1).optional(),
   // Preferred proactive consent bundle; runtime resolution still uses `scopeRequirement`.
-  connectScopes: z6.array(NonEmptyString).min(1).optional(),
+  connectScopes: z7.array(NonEmptyString).min(1).optional(),
   scopeRequirement: ScopeRequirement.optional(),
-  scopeDefinitions: z6.array(AuthScopeDefinition).min(1).optional(),
-  accountSelectors: z6.array(AuthAccountSelector).min(1).optional()
+  scopeDefinitions: z7.array(AuthScopeDefinition).min(1).optional(),
+  accountSelectors: z7.array(AuthAccountSelector).min(1).optional()
 });
 function validateAuthGrantRequest(grant, ctx) {
   if (grant.allowedScopes !== void 0 && grant.requiredScopes !== void 0) {
@@ -1216,19 +1223,19 @@ function validateAuthGrantRequest(grant, ctx) {
   }
 }
 var AuthGrantRequest = AuthGrantRequestBase.superRefine(validateAuthGrantRequest);
-var StorageGrantRequest = z6.strictObject({
-  kind: z6.enum(["sqlite", "dataDir"]),
-  operations: z6.array(z6.enum(["open", "read", "write"])).min(1)
+var StorageGrantRequest = z7.strictObject({
+  kind: z7.enum(["sqlite", "dataDir"]),
+  operations: z7.array(z7.enum(["open", "read", "write"])).min(1)
 });
-var EventGrantRequest = z6.strictObject({
+var EventGrantRequest = z7.strictObject({
   event: NonEmptyString,
-  operations: z6.array(z6.enum(["subscribe", "publish"])).min(1)
+  operations: z7.array(z7.enum(["subscribe", "publish"])).min(1)
 });
-var EndpointGrantRequest = z6.strictObject({
+var EndpointGrantRequest = z7.strictObject({
   endpoint: LocalContributionId,
-  operations: z6.array(z6.enum(["register", "invoke"])).min(1)
+  operations: z7.array(z7.enum(["register", "invoke"])).min(1)
 });
-var WebSessionOrigin = z6.string().superRefine((value, ctx) => {
+var WebSessionOrigin = z7.string().superRefine((value, ctx) => {
   try {
     const url = new URL(value);
     if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "" || url.origin !== value) {
@@ -1241,7 +1248,7 @@ var WebSessionOrigin = z6.string().superRefine((value, ctx) => {
     ctx.addIssue({ code: "custom", message: "must be a valid HTTPS origin" });
   }
 });
-var WebSessionCsrfSourceUrl = z6.url({ protocol: /^https$/ }).superRefine((value, ctx) => {
+var WebSessionCsrfSourceUrl = z7.url({ protocol: /^https$/ }).superRefine((value, ctx) => {
   const url = new URL(value);
   if (url.username !== "" || url.password !== "" || url.hash !== "") {
     ctx.addIssue({
@@ -1289,10 +1296,10 @@ function webSessionPathWithinPrefix(pathname, pathPrefix) {
 }
 var WEB_SESSION_CSRF_SELECTOR_PATTERN = /^(?=.)(?:[a-zA-Z][a-zA-Z0-9-]*)?(?:#[a-zA-Z_][\w-]*|\[[a-zA-Z_:][\w:.-]*(?:=(?:"[^"]*"|'[^']*'|[\w-]+))?\])*$/u;
 var WebSessionCsrfSelector = NonEmptyString.regex(WEB_SESSION_CSRF_SELECTOR_PATTERN, "must be a compound simple selector: optional tag, then #id or [attr=value] predicates on that one element (no combinators, classes, or pseudo-classes)");
-var WebSessionGrantRequest = z6.strictObject({
+var WebSessionGrantRequest = z7.strictObject({
   origin: WebSessionOrigin,
-  pathPrefixes: z6.array(WebSessionPathPrefix).min(1),
-  csrf: z6.strictObject({
+  pathPrefixes: z7.array(WebSessionPathPrefix).min(1),
+  csrf: z7.strictObject({
     sourceUrl: WebSessionCsrfSourceUrl,
     selector: WebSessionCsrfSelector,
     attribute: NonEmptyString,
@@ -1301,14 +1308,14 @@ var WebSessionGrantRequest = z6.strictObject({
     bodyField: NonEmptyString.optional()
   }).optional()
 });
-var KnowledgeSearchGrantRequest = z6.strictObject({
-  scope: z6.literal("own-schemes")
+var KnowledgeSearchGrantRequest = z7.strictObject({
+  scope: z7.literal("own-schemes")
 });
-var KnownResourcesGrantRequest = z6.strictObject({
-  scope: z6.literal("own-modules")
+var KnownResourcesGrantRequest = z7.strictObject({
+  scope: z7.literal("own-modules")
 });
-var PluginAgentDefinitionPermissionRule = z6.strictObject({
-  effect: z6.enum(["allow", "deny", "ask"]),
+var PluginAgentDefinitionPermissionRule = z7.strictObject({
+  effect: z7.enum(["allow", "deny", "ask"]),
   /** Restrict to one tool name. */
   tool: NonEmptyString.optional(),
   /** Restrict to one classified capability key. */
@@ -1318,7 +1325,7 @@ var PluginAgentDefinitionPermissionRule = z6.strictObject({
   /** Restrict to matching resources (a path glob, or a URI-shaped policy address). */
   resource: NonEmptyString.optional(),
   /** Restrict the rule to one permission mode; omit to apply in all modes. */
-  mode: z6.enum(["default", "ask", "allow", "auto"]).optional()
+  mode: z7.enum(["default", "ask", "allow", "auto"]).optional()
 });
 var RETIRED_PERMISSION_ASK_KEYS = [
   "network",
@@ -1384,14 +1391,14 @@ function retiredPermissionAsksIn(rawManifest) {
   }
   return found;
 }
-var TargetPermissionWiring = z6.strictObject({
-  auth: z6.array(AuthGrantRequest).optional(),
-  storage: z6.array(StorageGrantRequest).optional(),
-  events: z6.array(EventGrantRequest).optional(),
-  endpoints: z6.array(EndpointGrantRequest).optional(),
-  webSession: z6.array(WebSessionGrantRequest).optional(),
-  knowledgeSearch: z6.array(KnowledgeSearchGrantRequest).optional(),
-  knownResources: z6.array(KnownResourcesGrantRequest).optional()
+var TargetPermissionWiring = z7.strictObject({
+  auth: z7.array(AuthGrantRequest).optional(),
+  storage: z7.array(StorageGrantRequest).optional(),
+  events: z7.array(EventGrantRequest).optional(),
+  endpoints: z7.array(EndpointGrantRequest).optional(),
+  webSession: z7.array(WebSessionGrantRequest).optional(),
+  knowledgeSearch: z7.array(KnowledgeSearchGrantRequest).optional(),
+  knownResources: z7.array(KnownResourcesGrantRequest).optional()
 }).superRefine((permissions, ctx) => {
   const rows = permissions.webSession ?? [];
   for (const [index, row] of rows.entries()) {
@@ -1409,9 +1416,9 @@ var TargetPermissionWiring = z6.strictObject({
     }
   }
 });
-var TargetPermissionSet = z6.preprocess(stripRetiredPermissionAsks, TargetPermissionWiring);
-var PluginPermissionManifest = z6.strictObject({
-  byTarget: z6.strictObject({
+var TargetPermissionSet = z7.preprocess(stripRetiredPermissionAsks, TargetPermissionWiring);
+var PluginPermissionManifest = z7.strictObject({
+  byTarget: z7.strictObject({
     "kay.agent": TargetPermissionSet.optional(),
     "kay.app": TargetPermissionSet.optional(),
     "kay.ui": TargetPermissionSet.optional()
@@ -1429,26 +1436,26 @@ var PluginPermissionManifest = z6.strictObject({
 });
 var ResolvedAuthGrantRequest = AuthGrantRequestBase.extend({
   service: GlobalContributionId,
-  schemes: z6.array(GlobalContributionId).min(1).optional(),
+  schemes: z7.array(GlobalContributionId).min(1).optional(),
   // Resolution fills an absent binding with the narrowest bound, so a resolved
   // grant ALWAYS carries an explicit, non-broadening account selector — the
   // runtime never has to invent a default and fail open.
-  accountSelectors: z6.array(AuthAccountSelector).min(1)
+  accountSelectors: z7.array(AuthAccountSelector).min(1)
 }).superRefine(validateAuthGrantRequest);
 var ResolvedEndpointGrantRequest = EndpointGrantRequest.extend({
   endpoint: GlobalContributionId
 });
-var ResolvedTargetGrantSet = z6.strictObject({
-  auth: z6.array(ResolvedAuthGrantRequest).optional(),
-  storage: z6.array(StorageGrantRequest).optional(),
-  events: z6.array(EventGrantRequest).optional(),
-  endpoints: z6.array(ResolvedEndpointGrantRequest).optional(),
-  webSession: z6.array(WebSessionGrantRequest).optional(),
-  knowledgeSearch: z6.array(KnowledgeSearchGrantRequest).optional(),
-  knownResources: z6.array(KnownResourcesGrantRequest).optional()
-});
-var ResolvedPluginGrants = z6.strictObject({
-  byTarget: z6.strictObject({
+var ResolvedTargetGrantSet = z7.strictObject({
+  auth: z7.array(ResolvedAuthGrantRequest).optional(),
+  storage: z7.array(StorageGrantRequest).optional(),
+  events: z7.array(EventGrantRequest).optional(),
+  endpoints: z7.array(ResolvedEndpointGrantRequest).optional(),
+  webSession: z7.array(WebSessionGrantRequest).optional(),
+  knowledgeSearch: z7.array(KnowledgeSearchGrantRequest).optional(),
+  knownResources: z7.array(KnownResourcesGrantRequest).optional()
+});
+var ResolvedPluginGrants = z7.strictObject({
+  byTarget: z7.strictObject({
     "kay.agent": ResolvedTargetGrantSet.optional(),
     "kay.app": ResolvedTargetGrantSet.optional(),
     "kay.ui": ResolvedTargetGrantSet.optional()
@@ -1456,24 +1463,24 @@ var ResolvedPluginGrants = z6.strictObject({
 });
 
 // packages/plugin-protocol/dist/authority.js
-var WhiteboardCapabilityScope = z7.enum(["own-types", "all-types"]);
-var WhiteboardCapabilityOperation = z7.enum([
+var WhiteboardCapabilityScope = z8.enum(["own-types", "all-types"]);
+var WhiteboardCapabilityOperation = z8.enum([
   "discover",
   "read",
   "create",
   "update",
   "remove"
 ]);
-var WhiteboardCapabilityClaimV1 = z7.strictObject({
-  target: z7.enum(["kay.agent", "kay.app"]),
-  slug: z7.enum([
+var WhiteboardCapabilityClaimV1 = z8.strictObject({
+  target: z8.enum(["kay.agent", "kay.app"]),
+  slug: z8.enum([
     "whiteboard.discover",
     "whiteboard.read",
     "whiteboard.create",
     "whiteboard.update",
     "whiteboard.remove"
   ]),
-  envelope: z7.strictObject({ scope: WhiteboardCapabilityScope })
+  envelope: z8.strictObject({ scope: WhiteboardCapabilityScope })
 }).superRefine((claim, ctx) => {
   if (claim.target === "kay.app" && claim.slug !== "whiteboard.discover" && claim.slug !== "whiteboard.read") {
     ctx.addIssue({
@@ -1483,91 +1490,104 @@ var WhiteboardCapabilityClaimV1 = z7.strictObject({
     });
   }
 });
-var PluginCapabilityClaimV1 = z7.discriminatedUnion("slug", [
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("sessions.run"),
-    envelope: z7.strictObject({})
+var DeclaredSkillSourceEnvelope = z8.discriminatedUnion("channel", [
+  z8.strictObject({
+    channel: z8.literal("git-clone"),
+    locator: NonEmptyString,
+    ref: NonEmptyString.optional(),
+    subdir: NonEmptyString.optional()
+  }),
+  z8.strictObject({
+    channel: z8.literal("installer"),
+    command: NonEmptyString,
+    args: z8.array(NonEmptyString)
+  })
+]);
+var PluginCapabilityClaimV1 = z8.discriminatedUnion("slug", [
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("sessions.run"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.agent"),
-    slug: z7.literal("network.connect"),
-    envelope: z7.strictObject({ connect: NonEmptyString })
+  z8.strictObject({
+    target: z8.literal("kay.agent"),
+    slug: z8.literal("network.connect"),
+    envelope: z8.strictObject({ connect: NonEmptyString })
   }),
-  z7.strictObject({
-    target: z7.literal("kay.agent"),
-    slug: z7.literal("web-session.request"),
-    envelope: z7.strictObject({
+  z8.strictObject({
+    target: z8.literal("kay.agent"),
+    slug: z8.literal("web-session.request"),
+    envelope: z8.strictObject({
       origin: NonEmptyString,
       pathPrefix: NonEmptyString
     })
   }),
-  z7.strictObject({
-    target: z7.literal("kay.agent"),
-    slug: z7.literal("web-session.download"),
-    envelope: z7.strictObject({
+  z8.strictObject({
+    target: z8.literal("kay.agent"),
+    slug: z8.literal("web-session.download"),
+    envelope: z8.strictObject({
       origin: NonEmptyString,
       pathPrefix: NonEmptyString
     })
   }),
-  z7.strictObject({
-    target: z7.literal("kay.agent"),
-    slug: z7.literal("process.spawn"),
-    envelope: z7.strictObject({
+  z8.strictObject({
+    target: z8.literal("kay.agent"),
+    slug: z8.literal("process.spawn"),
+    envelope: z8.strictObject({
       command: NonEmptyString,
       argvClass: NonEmptyString
     })
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("corpus.read"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("corpus.read"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
+  z8.strictObject({
     // Every plugin's recorded Jev signals, not only the caller's own: an empty envelope because
     // the grant itself is the visibility decision. Both first consumers (a session timeline, and
     // an agent loop turning signals into skills) read rows another plugin recorded.
-    target: z7.literal("kay.app"),
-    slug: z7.literal("signals.read"),
-    envelope: z7.strictObject({})
+    target: z8.literal("kay.app"),
+    slug: z8.literal("signals.read"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
+  z8.strictObject({
     // Read-only metadata about every managed skill: identity, versions, history, suggestions.
     // Never a skill's bytes (an agent reads those through `skill://`) and never a write. An
     // empty envelope because the grant itself is the visibility decision, as with `signals.read`.
-    target: z7.literal("kay.app"),
-    slug: z7.literal("skills.read"),
-    envelope: z7.strictObject({})
+    target: z8.literal("kay.app"),
+    slug: z8.literal("skills.read"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
+  z8.strictObject({
     // The text an agent sees for a tool or an address in a live session, where each comes from,
     // and whether it is one of Bonsai's own. Read-only and never a call. An empty envelope because
     // the grant itself is the visibility decision, as with `skills.read`.
-    target: z7.literal("kay.app"),
-    slug: z7.literal("tools.describe"),
-    envelope: z7.strictObject({})
+    target: z8.literal("kay.app"),
+    slug: z8.literal("tools.describe"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("workspace.command"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("workspace.command"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("sessions.create"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("sessions.create"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("sessions.update"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("sessions.update"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("models.complete"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("models.complete"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
+  z8.strictObject({
     // Held to `kay.app`, the daemon-lifetime tier, even though the same wrapper is exposed on
     // BOTH the `kay.app` and `kay.agent` plugin SDKs (and to host composition directly): a slug
     // pins exactly one target (see this file's module doc), so one shared claim is simpler and
@@ -1576,104 +1596,123 @@ var PluginCapabilityClaimV1 = z7.discriminatedUnion("slug", [
     // plugin's own pinned authority, which already spans both targets for every other capability
     // (`network.connect`/`tool-interception.register` are decided by the identical per-plugin
     // handle `kay.app`-target claims use).
-    target: z7.literal("kay.app"),
-    slug: z7.literal("jev.use"),
-    envelope: z7.strictObject({})
+    target: z8.literal("kay.app"),
+    slug: z8.literal("jev.use"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("automations.write"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("automations.write"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("automations.run"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("automations.run"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("workflows.define"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("workflows.define"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("session-events.subscribe"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("session-events.subscribe"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("agents.run"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("agents.run"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("dynamic-context.register"),
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("dynamic-context.register"),
     // The declared `contributes.contextContributors` localId, which doubles as the contributor's
     // section tag at the model boundary — so the row a human consents to names the section.
-    envelope: z7.strictObject({ contributor: NonEmptyString })
+    envelope: z8.strictObject({ contributor: NonEmptyString })
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("app-data.register"),
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("app-data.register"),
     /** The declared `contributes.dataSources` localId. */
-    envelope: z7.strictObject({ source: NonEmptyString })
+    envelope: z8.strictObject({ source: NonEmptyString })
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("account.assert"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("account.assert"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("account.update"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("account.update"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.app"),
-    slug: z7.literal("agents.permissions"),
-    envelope: z7.strictObject({
+  z8.strictObject({
+    target: z8.literal("kay.app"),
+    slug: z8.literal("agents.permissions"),
+    envelope: z8.strictObject({
       /** The definition's local id — WHICH agent these rules are authored onto. */
       agent: NonEmptyString,
       /** `definition.permissions`, in declaration order (order is semantic; first match wins). */
-      rules: z7.array(PluginAgentDefinitionPermissionRule),
+      rules: z8.array(PluginAgentDefinitionPermissionRule),
       /** `definition.permissionsFallback`, in declaration order. */
-      fallback: z7.array(PluginAgentDefinitionPermissionRule)
+      fallback: z8.array(PluginAgentDefinitionPermissionRule)
     })
   }),
-  z7.strictObject({
-    target: z7.literal("kay.agent"),
-    slug: z7.literal("tool-interception.register"),
-    envelope: z7.strictObject({})
+  z8.strictObject({
+    target: z8.literal("kay.agent"),
+    slug: z8.literal("tool-interception.register"),
+    envelope: z8.strictObject({})
   }),
-  z7.strictObject({
-    target: z7.literal("kay.agent"),
-    slug: z7.literal("interaction.surface"),
+  z8.strictObject({
+    target: z8.literal("kay.agent"),
+    slug: z8.literal("interaction.surface"),
     /** The one Bonsai-shipped interaction surface this plugin may drive; one claim per surface. */
-    envelope: z7.strictObject({ surface: z7.enum(["browser-pane", "desktop"]) })
+    envelope: z8.strictObject({ surface: z8.enum(["browser-pane", "desktop"]) })
   }),
-  z7.strictObject({
-    target: z7.literal("plugin"),
-    slug: z7.literal("config.declare-section"),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("config.declare-section"),
     /** The settings-document section key, e.g. `models` or `plugins.com.acme.thing`. */
-    envelope: z7.strictObject({ section: NonEmptyString })
+    envelope: z8.strictObject({ section: NonEmptyString })
   }),
-  z7.strictObject({
-    target: z7.literal("plugin"),
-    slug: z7.literal("auth.own-service"),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("auth.own-service"),
     /** The minted global service id this plugin would own, e.g. `google.account`. */
-    envelope: z7.strictObject({ service: NonEmptyString })
+    envelope: z8.strictObject({ service: NonEmptyString })
   }),
-  z7.strictObject({
-    target: z7.literal("plugin"),
-    slug: z7.literal("auth.shared-identity"),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("auth.shared-identity"),
     /** The foreign global service id whose identity this plugin would resolve against. */
-    envelope: z7.strictObject({ service: NonEmptyString })
+    envelope: z8.strictObject({ service: NonEmptyString })
   }),
-  z7.strictObject({
-    target: z7.literal("plugin"),
-    slug: z7.literal("cli.bind"),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("cli.bind"),
     /** The binary basename a resolved credential would be injected into. */
-    envelope: z7.strictObject({ binary: NonEmptyString })
+    envelope: z8.strictObject({ binary: NonEmptyString })
+  }),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("mcp.host-server"),
+    // The daemon dials this endpoint, holds its sign-in, and serves it as `mcp://<name>`, so the
+    // endpoint becomes daemon execution authority. One claim per exact name and URL.
+    envelope: z8.strictObject({ name: NonEmptyString, url: NonEmptyString })
+  }),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("prompt.resident"),
+    // A section of the plugin's own text in every session's system prompt. An empty envelope
+    // because the grant itself is the decision; the host caps the section's length.
+    envelope: z8.strictObject({})
+  }),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("skills.declared-source"),
+    envelope: DeclaredSkillSourceEnvelope
   }),
   WhiteboardCapabilityClaimV1
 ]);
@@ -1712,34 +1751,37 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "auth.own-service",
   "auth.shared-identity",
   "cli.bind",
+  "mcp.host-server",
+  "prompt.resident",
+  "skills.declared-source",
   "whiteboard.discover",
   "whiteboard.read",
   "whiteboard.create",
   "whiteboard.update",
   "whiteboard.remove"
 ];
-var PluginCapabilityRefusalLayer = z7.enum(["grant", "binding"]);
-var PluginCapabilityRefusalCode = z7.enum([
+var PluginCapabilityRefusalLayer = z8.enum(["grant", "binding"]);
+var PluginCapabilityRefusalCode = z8.enum([
   "not-granted",
   "grant-read-failed",
   "binding-missing",
   "argv-outside-class"
 ]);
-var PluginCapabilityRefusalV1 = z7.strictObject({
+var PluginCapabilityRefusalV1 = z8.strictObject({
   claim: PluginCapabilityClaimV1,
   layer: PluginCapabilityRefusalLayer,
   code: PluginCapabilityRefusalCode,
   message: NonEmptyString,
   artifactGenerationId: ArtifactGenerationId.optional()
 });
-var PluginCapabilityDecisionV1 = z7.discriminatedUnion("kind", [
-  z7.strictObject({
-    kind: z7.literal("allowed"),
+var PluginCapabilityDecisionV1 = z8.discriminatedUnion("kind", [
+  z8.strictObject({
+    kind: z8.literal("allowed"),
     claim: PluginCapabilityClaimV1,
     artifactGenerationId: ArtifactGenerationId.optional()
   }),
-  z7.strictObject({
-    kind: z7.literal("refused"),
+  z8.strictObject({
+    kind: z8.literal("refused"),
     refusal: PluginCapabilityRefusalV1
   })
 ]);
@@ -1809,6 +1851,7 @@ function sameClaim(a, b) {
     case "account.assert":
     case "account.update":
     case "tool-interception.register":
+    case "prompt.resident":
       return true;
     case "network.connect":
       return b.slug === "network.connect" && a.envelope.connect === b.envelope.connect;
@@ -1832,6 +1875,10 @@ function sameClaim(a, b) {
       return (b.slug === "auth.own-service" || b.slug === "auth.shared-identity") && a.envelope.service === b.envelope.service;
     case "cli.bind":
       return b.slug === "cli.bind" && a.envelope.binary === b.envelope.binary;
+    case "mcp.host-server":
+      return b.slug === "mcp.host-server" && a.envelope.name === b.envelope.name && a.envelope.url === b.envelope.url;
+    case "skills.declared-source":
+      return b.slug === "skills.declared-source" && declaredSourcePairs(a.envelope, b.envelope).every(([left, right]) => left === right);
     case "whiteboard.discover":
     case "whiteboard.read":
     case "whiteboard.create":
@@ -1874,6 +1921,7 @@ function envelopePairs(a, b) {
     case "account.assert":
     case "account.update":
     case "tool-interception.register":
+    case "prompt.resident":
       return [];
     case "network.connect":
       return b.slug === "network.connect" ? [[a.envelope.connect, b.envelope.connect]] : [];
@@ -1913,6 +1961,13 @@ function envelopePairs(a, b) {
       return b.slug === "auth.own-service" || b.slug === "auth.shared-identity" ? [[a.envelope.service, b.envelope.service]] : [];
     case "cli.bind":
       return b.slug === "cli.bind" ? [[a.envelope.binary, b.envelope.binary]] : [];
+    case "mcp.host-server":
+      return b.slug === "mcp.host-server" ? [
+        [a.envelope.name, b.envelope.name],
+        [a.envelope.url, b.envelope.url]
+      ] : [];
+    case "skills.declared-source":
+      return b.slug === "skills.declared-source" ? declaredSourcePairs(a.envelope, b.envelope) : [];
     case "whiteboard.discover":
     case "whiteboard.read":
     case "whiteboard.create":
@@ -1921,6 +1976,24 @@ function envelopePairs(a, b) {
       return b.slug === a.slug && "scope" in b.envelope ? [[a.envelope.scope, b.envelope.scope]] : [];
   }
 }
+function declaredSourcePairs(a, b) {
+  if (a.channel === "git-clone" && b.channel === "git-clone") {
+    return [
+      [a.channel, b.channel],
+      [a.locator, b.locator],
+      [a.ref ?? "", b.ref ?? ""],
+      [a.subdir ?? "", b.subdir ?? ""]
+    ];
+  }
+  if (a.channel === "installer" && b.channel === "installer") {
+    return [
+      [a.channel, b.channel],
+      [a.command, b.command],
+      [JSON.stringify(a.args), JSON.stringify(b.args)]
+    ];
+  }
+  return [[a.channel, b.channel]];
+}
 function whiteboardCapabilityClaim(operation, scope, target = "kay.agent") {
   if (target === "kay.app" && operation !== "discover" && operation !== "read") {
     throw new TypeError("kay.app Whiteboard claims are read-only");
@@ -2121,6 +2194,15 @@ function kayPluginHostCompatibility(appVersion) {
     appVersion
   };
 }
+var KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES = [
+  "unsupported-protocol",
+  "sdk-range-unsatisfied",
+  "sdk-range-unsupported",
+  "host-sdk-version-invalid"
+];
+function isKayPluginCompatibilityRefusal(code) {
+  return KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES.includes(code);
+}
 function isCompatible(report) {
   return report.refusal === void 0;
 }
@@ -2207,30 +2289,30 @@ function checkKayPluginHostCompatibility(compatibility, host) {
 }
 
 // packages/plugin-protocol/dist/contributions.js
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 var OptionalDisplayName = NonEmptyString.optional();
-var UriFilesystemBacking = z8.strictObject({
-  root: z8.literal("dataDir")
+var UriFilesystemBacking = z9.strictObject({
+  root: z9.literal("dataDir")
 });
-var ToolContribution = z8.strictObject({
+var ToolContribution = z9.strictObject({
   localId: LocalContributionId,
   toolName: PluginToolName,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional()
 });
-var ConverterContribution = z8.strictObject({
+var ConverterContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional(),
   /** MIME types this converter claims — contract data for introspection and
    *  collision checks; runtime match behavior stays the converter's `matches()`. */
-  mimeTypes: z8.array(MimeTypeString).min(1),
+  mimeTypes: z9.array(MimeTypeString).min(1),
   /** Extension fallbacks (no dot) used when a probe has no usable MIME type. */
-  extensions: z8.array(FileExtensionToken).min(1).optional()
+  extensions: z9.array(FileExtensionToken).min(1).optional()
 });
-var UriModuleContribution = z8.strictObject({
+var UriModuleContribution = z9.strictObject({
   localId: LocalContributionId,
-  schemes: z8.array(UriScheme).min(1),
+  schemes: z9.array(UriScheme).min(1),
   displayName: OptionalDisplayName,
   // The plugin only requests a projection. The daemon binds the effective root
   // and retains access control at finalization.
@@ -2249,30 +2331,30 @@ var UriModuleContribution = z8.strictObject({
   // `knownResources` permission grant (`api.knownResources`). Present-means-on
   // (`true` or absent; `false` is not a state). Decision record:
   // `lab/user-plugins/decisions/014-known-resources-ledger.md`.
-  knownResources: z8.literal(true).optional()
+  knownResources: z9.literal(true).optional()
 });
 var AppUriModuleContribution = UriModuleContribution.omit({
   authService: true,
   filesystemBacking: true,
   knownResources: true
 });
-var AppDataSourceContribution = z8.strictObject({
+var AppDataSourceContribution = z9.strictObject({
   localId: LocalContributionId,
-  scope: z8.enum(["runtime", "account", "session"]),
-  snapshot: z8.strictObject({
-    version: z8.number().int().positive(),
+  scope: z9.enum(["runtime", "account", "session"]),
+  snapshot: z9.strictObject({
+    version: z9.number().int().positive(),
     schema: JsonSchema
   }),
-  change: z8.strictObject({
-    version: z8.number().int().positive(),
+  change: z9.strictObject({
+    version: z9.number().int().positive(),
     schema: JsonSchema,
     /** Review-only claim; source schemas and behavioral tests enforce it because the daemon treats changes as opaque. */
-    semantics: z8.discriminatedUnion("kind", [
-      z8.strictObject({ kind: z8.literal("incremental") }),
-      z8.strictObject({
-        kind: z8.literal("snapshot-replacement"),
-        maxEncodedBytes: z8.number().int().positive(),
-        rationale: z8.string().trim().min(1).max(1024)
+    semantics: z9.discriminatedUnion("kind", [
+      z9.strictObject({ kind: z9.literal("incremental") }),
+      z9.strictObject({
+        kind: z9.literal("snapshot-replacement"),
+        maxEncodedBytes: z9.number().int().positive(),
+        rationale: z9.string().trim().min(1).max(1024)
       })
     ]).optional()
   }),
@@ -2286,28 +2368,28 @@ var AppDataSourceContribution = z8.strictObject({
     });
   }
 });
-var WhiteboardTypeStorage = z8.discriminatedUnion("kind", [
-  z8.strictObject({ kind: z8.literal("json") }),
-  z8.strictObject({ kind: z8.literal("payload") }),
-  z8.strictObject({
-    kind: z8.literal("markdown"),
+var WhiteboardTypeStorage = z9.discriminatedUnion("kind", [
+  z9.strictObject({ kind: z9.literal("json") }),
+  z9.strictObject({ kind: z9.literal("payload") }),
+  z9.strictObject({
+    kind: z9.literal("markdown"),
     bodyField: NonEmptyString
   })
 ]);
-var WhiteboardTypeContribution = z8.strictObject({
+var WhiteboardTypeContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
-  schemaVersion: z8.number().int().positive(),
+  schemaVersion: z9.number().int().positive(),
   storage: WhiteboardTypeStorage,
   valueSchema: JsonSchema,
-  presentation: z8.strictObject({
+  presentation: z9.strictObject({
     app: LocalContributionId
   }).optional()
 });
-var AppDataMaterializerContribution = z8.strictObject({
+var AppDataMaterializerContribution = z9.strictObject({
   source: LocalContributionId
 });
-var ArtifactUriModuleContribution = z8.strictObject({
+var ArtifactUriModuleContribution = z9.strictObject({
   localId: LocalContributionId,
   /** The single `scheme://` this module owns; also the on-disk artifact kind. */
   scheme: UriScheme,
@@ -2321,17 +2403,17 @@ var ArtifactUriModuleContribution = z8.strictObject({
    * composes its description from the plugin's own display name + scheme — a per-scheme label
    * would have no path to matter, so it is intentionally omitted rather than accepted-and-ignored.
    */
-  editable: z8.boolean().optional(),
+  editable: z9.boolean().optional(),
   /** Opt in to `list` over the kind's stored names. Default false. Mirrors
    * `CreateArtifactUriModuleOptions.listable`. */
-  listable: z8.boolean().optional(),
+  listable: z9.boolean().optional(),
   /**
    * Opt in to `delete` for same-session entries. Default false. Deletion
    * unlinks the stored file — no trash tier; a kind that wants recoverable
    * deletion is not artifact-backed. Mirrors
    * `CreateArtifactUriModuleOptions.deletable`.
    */
-  deletable: z8.boolean().optional(),
+  deletable: z9.boolean().optional(),
   /**
    * Opt in to the `{ content, mode: "append" }` write envelope, which extends
    * stored text instead of replacing it (concurrent-appender-safe: the host
@@ -2339,7 +2421,7 @@ var ArtifactUriModuleContribution = z8.strictObject({
    * keep their verbatim round-trip. Mirrors
    * `CreateArtifactUriModuleOptions.appendable`.
    */
-  appendable: z8.boolean().optional(),
+  appendable: z9.boolean().optional(),
   /**
    * Which sessions share one storage namespace. Default `"session"` — the existing
    * per-session behavior (each session gets its own kind directory; other sessions'
@@ -2350,14 +2432,14 @@ var ArtifactUriModuleContribution = z8.strictObject({
    * the scope; the host derives the family root from provenance it already holds, so
    * family identity never crosses the SDK boundary.
    */
-  storageScope: z8.enum(["session", "family"]).optional()
+  storageScope: z9.enum(["session", "family"]).optional()
 });
-var CliBindingContribution = z8.strictObject({
+var CliBindingContribution = z9.strictObject({
   localId: LocalContributionId,
   binary: CliBinaryName,
-  aliases: z8.array(CliBinaryName).optional(),
+  aliases: z9.array(CliBinaryName).optional(),
   /** Where the binary comes from. Omitted ⇒ `"vendored"` (decision 007). */
-  provider: z8.enum(["vendored", "path"]).optional(),
+  provider: z9.enum(["vendored", "path"]).optional(),
   // A local ref (no dot) must name an auth service declared in this same
   // manifest; a qualified ref (dotted, e.g. `google.account`) names another
   // plugin's already-minted global id and is recorded, not resolved, here (see
@@ -2370,20 +2452,20 @@ var CliBindingContribution = z8.strictObject({
    * MUST be absent for a `path` binding, which can never receive a token.
    */
   authEnvVar: CliAuthEnvVarName.optional(),
-  readOnly: z8.array(NonEmptyString),
-  write: z8.array(NonEmptyString)
+  readOnly: z9.array(NonEmptyString),
+  write: z9.array(NonEmptyString)
 });
-var GitHostContribution = z8.strictObject({
+var GitHostContribution = z9.strictObject({
   host: GitHostName,
   authService: LocalContributionId,
   basicAuthUser: GitBasicAuthUser
 });
-var ResourceContribution = z8.strictObject({
+var ResourceContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional()
 });
-var SkillContribution = z8.strictObject({
+var SkillContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   /** Model-visible one-liner: when to reach for this skill. */
@@ -2391,18 +2473,18 @@ var SkillContribution = z8.strictObject({
   /** The SKILL.md-style file inside the package carrying the full instructions. */
   path: PackageAssetPath
 });
-var PluginSkillSourceDeclaration = z8.discriminatedUnion("channel", [
-  z8.strictObject({
-    channel: z8.literal("installer"),
+var PluginSkillSourceDeclaration = z9.discriminatedUnion("channel", [
+  z9.strictObject({
+    channel: z9.literal("installer"),
     localId: LocalContributionId,
     displayName: OptionalDisplayName,
     /** The package-runner executable, e.g. `npx` — checked against the daemon's allowlist. */
     command: NonEmptyString,
     /** Its argv, e.g. `["skills", "add", "clerk/skills"]`. */
-    args: z8.array(NonEmptyString)
+    args: z9.array(NonEmptyString)
   }),
-  z8.strictObject({
-    channel: z8.literal("git-clone"),
+  z9.strictObject({
+    channel: z9.literal("git-clone"),
     localId: LocalContributionId,
     displayName: OptionalDisplayName,
     /** The repository locator — canonicalized and hygiene-checked by the daemon. */
@@ -2413,17 +2495,17 @@ var PluginSkillSourceDeclaration = z8.discriminatedUnion("channel", [
     subdir: NonEmptyString.optional()
   })
 ]);
-var SearchProviderContribution = z8.strictObject({
+var SearchProviderContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
-  schemes: z8.array(UriScheme).optional()
+  schemes: z9.array(UriScheme).optional()
 });
-var InteractionDriverContribution = z8.strictObject({
+var InteractionDriverContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
-  kind: z8.enum(["browser", "computer-use"])
+  kind: z9.enum(["browser", "computer-use"])
 });
-var EntityResolverContribution = z8.strictObject({
+var EntityResolverContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   /** The `kay.agent` URI module (this manifest's own `contributes.uriModules[].localId`) whose
@@ -2431,24 +2513,24 @@ var EntityResolverContribution = z8.strictObject({
   uriModule: LocalContributionId,
   /** `person` | `channel` | `repo` | `pull-request` | ... -- drives avatar-first vs glyph-first row
    *  anatomy (N10-R2) and lets the renderer request a narrower `entityTypes` filter. */
-  entityTypes: z8.array(NonEmptyString).min(1),
+  entityTypes: z9.array(NonEmptyString).min(1),
   /** The URI namespace/route `search()` is called against, e.g. `slack://directory` or
    *  `github://search/repositories` -- the resolver's fixed search scope; the live user query is
    *  the `search()` call's `query` param, never concatenated into this string. */
   uriHint: NonEmptyString
 });
-var AgentRenderContribution = z8.strictObject({
+var AgentRenderContribution = z9.strictObject({
   localId: LocalContributionId,
-  resultKinds: z8.array(NonEmptyString).min(1)
+  resultKinds: z9.array(NonEmptyString).min(1)
 });
-var EndpointContribution = z8.strictObject({
+var EndpointContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   requestSchema: JsonSchema.optional(),
   responseSchema: JsonSchema.optional()
 });
 var MCP_SERVER_LOCAL_HTTP_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
-var McpServerUrl = z8.string().trim().min(1).refine((value) => {
+var McpServerUrl = z9.string().trim().min(1).refine((value) => {
   let parsed;
   try {
     parsed = new URL(value);
@@ -2461,8 +2543,8 @@ var McpServerUrl = z8.string().trim().min(1).refine((value) => {
 }, {
   message: "mcp server url must be https://, or http:// only for localhost/127.0.0.1 test servers"
 });
-var McpServerAuthMode = z8.enum(["oauth", "none"]);
-var McpServerContribution = z8.strictObject({
+var McpServerAuthMode = z9.enum(["oauth", "none"]);
+var McpServerContribution = z9.strictObject({
   url: McpServerUrl,
   auth: McpServerAuthMode.optional(),
   authService: LocalContributionId.optional()
@@ -2475,28 +2557,28 @@ var McpServerContribution = z8.strictObject({
     });
   }
 });
-var McpServerContributions = z8.record(LocalContributionId, McpServerContribution);
-var AppEventSubscription = z8.strictObject({
+var McpServerContributions = z9.record(LocalContributionId, McpServerContribution);
+var AppEventSubscription = z9.strictObject({
   localId: LocalContributionId,
   event: NonEmptyString
 });
-var ContextContributorContribution = z8.strictObject({
+var ContextContributorContribution = z9.strictObject({
   localId: LocalContributionId.max(64),
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional()
 });
-var PluginEventDefinitionContribution = z8.strictObject({
+var PluginEventDefinitionContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString.optional(),
-  version: z8.number().int().positive().default(1),
+  version: z9.number().int().positive().default(1),
   payloadSchema: JsonSchema
 });
-var PluginNotificationRuleContribution = z8.strictObject({
+var PluginNotificationRuleContribution = z9.strictObject({
   localId: LocalContributionId,
   /** The same-plugin `eventDefinitions` local id this rule matches. */
   event: LocalContributionId,
-  where: z8.array(JsonObject).optional(),
+  where: z9.array(JsonObject).optional(),
   rule: JsonObject
 });
 var PLUGIN_NOTIFICATION_RULE_HOST_KEYS = [
@@ -2504,67 +2586,67 @@ var PLUGIN_NOTIFICATION_RULE_HOST_KEYS = [
   "match",
   "sender"
 ];
-var UiEventSubscriptionContribution = z8.strictObject({
+var UiEventSubscriptionContribution = z9.strictObject({
   localId: LocalContributionId,
   event: NonEmptyString
 });
-var DeviceDelegationContribution = z8.strictObject({
+var DeviceDelegationContribution = z9.strictObject({
   localId: LocalContributionId,
-  device: z8.enum(["microphone"]),
-  delegateAs: z8.enum(["clip", "stream", "status"])
+  device: z9.enum(["microphone"]),
+  delegateAs: z9.enum(["clip", "stream", "status"])
 });
-var CorpusContribution = z8.strictObject({
+var CorpusContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
-  access: z8.enum(["read"]).default("read")
+  access: z9.enum(["read"]).default("read")
 });
-var UiCommandContribution = z8.strictObject({
+var UiCommandContribution = z9.strictObject({
   localId: LocalContributionId,
   title: NonEmptyString,
   icon: NonEmptyString.optional(),
   placement: NonEmptyString.optional()
 });
-var UiSlotContribution = z8.strictObject({
+var UiSlotContribution = z9.strictObject({
   localId: LocalContributionId,
   slot: NonEmptyString,
   title: NonEmptyString.optional()
 });
-var SettingsPanelContribution = z8.strictObject({
+var SettingsPanelContribution = z9.strictObject({
   localId: LocalContributionId,
   title: NonEmptyString,
   configSection: NonEmptyString.optional()
 });
-var ResultRendererContribution = z8.strictObject({
+var ResultRendererContribution = z9.strictObject({
   localId: LocalContributionId,
-  resultKinds: z8.array(NonEmptyString).min(1)
+  resultKinds: z9.array(NonEmptyString).min(1)
 });
-var ReferenceOpenBehavior = z8.discriminatedUnion("kind", [
-  z8.strictObject({ kind: z8.literal("working-document") }),
-  z8.strictObject({ kind: z8.literal("browser-pane") }),
+var ReferenceOpenBehavior = z9.discriminatedUnion("kind", [
+  z9.strictObject({ kind: z9.literal("working-document") }),
+  z9.strictObject({ kind: z9.literal("browser-pane") }),
   /**
    * Open one of the presenting plugin's OWN registered pages (`registerPage`'s
    * descriptor id) with the reference's canonical URI as the page's `objectId`.
    * Needs no web address, so a plugin-only resource (`user-todo://items/3`) can pill.
    */
-  z8.strictObject({ kind: z8.literal("page"), pageId: NonEmptyString })
+  z9.strictObject({ kind: z9.literal("page"), pageId: NonEmptyString })
 ]);
-var ReferencePresentationVariant = z8.strictObject({
+var ReferencePresentationVariant = z9.strictObject({
   resourceKind: NonEmptyString,
   presentationPluginId: PluginId.optional()
 });
-var ReferencePresentationVariants = z8.record(MimeTypeString, ReferencePresentationVariant);
-var InlineSvg = z8.string().max(64 * 1024).refine((value) => /^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?<svg[\s>]/iu.test(value), { message: "brandIcon must be inline SVG markup." });
-var ReferencePresentationUrlClaim = z8.strictObject({
-  kind: z8.literal("urlPattern"),
-  pattern: z8.strictObject({
-    protocol: z8.enum(["http", "https"]),
+var ReferencePresentationVariants = z9.record(MimeTypeString, ReferencePresentationVariant);
+var InlineSvg = z9.string().max(64 * 1024).refine((value) => /^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?<svg[\s>]/iu.test(value), { message: "brandIcon must be inline SVG markup." });
+var ReferencePresentationUrlClaim = z9.strictObject({
+  kind: z9.literal("urlPattern"),
+  pattern: z9.strictObject({
+    protocol: z9.enum(["http", "https"]),
     hostname: NonEmptyString,
-    pathname: z8.string().optional(),
-    search: z8.string().optional()
+    pathname: z9.string().optional(),
+    search: z9.string().optional()
   }),
   brandIcon: InlineSvg.optional()
 });
-var ReferencePresentationContribution = z8.strictObject({
+var ReferencePresentationContribution = z9.strictObject({
   localId: LocalContributionId,
   uriModule: LocalContributionId,
   resourceKind: NonEmptyString,
@@ -2572,7 +2654,7 @@ var ReferencePresentationContribution = z8.strictObject({
   /** MIME-specific resource kinds; absent keys use the base presentation. */
   variants: ReferencePresentationVariants.optional(),
   /** Lexical public URL claims used only for host-rendered browser presentations. */
-  claims: z8.array(ReferencePresentationUrlClaim).optional()
+  claims: z9.array(ReferencePresentationUrlClaim).optional()
 }).superRefine((value, ctx) => {
   if (value.claims !== void 0 && value.claims.length > 0 && value.open.kind !== "browser-pane") {
     ctx.addIssue({
@@ -2582,12 +2664,12 @@ var ReferencePresentationContribution = z8.strictObject({
     });
   }
 });
-var RichViewContribution = z8.strictObject({
+var RichViewContribution = z9.strictObject({
   localId: LocalContributionId,
   title: NonEmptyString,
   route: NonEmptyString.optional()
 });
-var KayUiAppHostCapability = z8.enum([
+var KayUiAppHostCapability = z9.enum([
   "navigation.open-session",
   "cost.read",
   // Server-rated organization billing, distinct from local/provider cost.
@@ -2618,9 +2700,9 @@ var KayUiAppHostCapability = z8.enum([
   // rearrange the workspace but never remove something the user would have to notice going missing.
   "workspace.arrange"
 ]);
-var UiAppCapabilities = z8.strictObject({
-  endpoints: z8.array(LocalContributionId).optional(),
-  host: z8.array(KayUiAppHostCapability).optional()
+var UiAppCapabilities = z9.strictObject({
+  endpoints: z9.array(LocalContributionId).optional(),
+  host: z9.array(KayUiAppHostCapability).optional()
 }).superRefine((capabilities, ctx) => {
   for (const field of ["endpoints", "host"]) {
     const seen = /* @__PURE__ */ new Set();
@@ -2636,47 +2718,47 @@ var UiAppCapabilities = z8.strictObject({
     }
   }
 });
-var UiAppContribution = z8.strictObject({
+var UiAppContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
   description: NonEmptyString.optional(),
   icon: PackageAssetPath.optional(),
-  runtime: z8.literal("kay.react-app.v1"),
-  sdk: z8.strictObject({ range: NonEmptyString }),
+  runtime: z9.literal("kay.react-app.v1"),
+  sdk: z9.strictObject({ range: NonEmptyString }),
   entrypoint: TargetEntrypoint,
-  styles: z8.array(PackageAssetPath).optional(),
-  assets: z8.array(PackageAssetPath).optional(),
+  styles: z9.array(PackageAssetPath).optional(),
+  assets: z9.array(PackageAssetPath).optional(),
   capabilities: UiAppCapabilities.optional()
 });
-var ThemeContribution = z8.strictObject({
+var ThemeContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
-  appearance: z8.enum(["light", "dark"]),
+  appearance: z9.enum(["light", "dark"]),
   tokens: PackageAssetPath
 });
-var CommandHandler = z8.discriminatedUnion("kind", [
-  z8.strictObject({ kind: z8.literal("skill"), skill: LocalContributionId }),
-  z8.strictObject({
-    kind: z8.literal("tool"),
+var CommandHandler = z9.discriminatedUnion("kind", [
+  z9.strictObject({ kind: z9.literal("skill"), skill: LocalContributionId }),
+  z9.strictObject({
+    kind: z9.literal("tool"),
     tool: PluginToolName,
     /** Positional mapping from tokenized `argsText` onto the tool's own input fields — see this
      *  union's doc for the exact tokenize/map/last-field-absorbs rule. */
-    argumentFields: z8.array(NonEmptyString)
+    argumentFields: z9.array(NonEmptyString)
   }),
-  z8.strictObject({
-    kind: z8.literal("endpoint"),
+  z9.strictObject({
+    kind: z9.literal("endpoint"),
     endpoint: LocalContributionId
   })
 ]);
-var CommandContribution = z8.strictObject({
+var CommandContribution = z9.strictObject({
   localId: LocalContributionId,
   displayName: OptionalDisplayName,
   description: NonEmptyString,
-  aliases: z8.array(LocalContributionId).optional(),
+  aliases: z9.array(LocalContributionId).optional(),
   argumentHint: NonEmptyString.optional(),
   handler: CommandHandler
 });
-var PluginContributionKind = z8.enum([
+var PluginContributionKind = z9.enum([
   "tool",
   "converter",
   "uriModule",
@@ -2737,6 +2819,9 @@ function resolvePluginNamespace(pluginId, namespace) {
 function resolveGlobalContributionId(namespace, localId) {
   return `${namespace}.${localId}`;
 }
+function deriveDirectoryPluginToolName(namespace, localId) {
+  return `${namespace.replaceAll(".", "_")}_${localId}`;
+}
 function resolvePluginEventType(namespace, localId) {
   return resolveGlobalContributionId(namespace, localId);
 }
@@ -2751,7 +2836,7 @@ function resolveAdapterId(globalId, declaredAdapterId) {
 }
 
 // packages/plugin-protocol/dist/manifest.js
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // packages/plugin-protocol/dist/synthetic-contributions.js
 function resolveConfigSectionContributionLocalId(section) {
@@ -2771,34 +2856,34 @@ var KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS = [
   "native:renderer.contributions.changed"
 ];
 var KAY_UI_NATIVE_EVENT_ALLOWLIST = new Set(KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS);
-var KayAgentTargetManifest = z9.strictObject({
+var KayAgentTargetManifest = z10.strictObject({
   entrypoint: TargetEntrypoint,
-  contributes: z9.strictObject({
-    tools: z9.array(ToolContribution).optional(),
-    converters: z9.array(ConverterContribution).optional(),
-    uriModules: z9.array(UriModuleContribution).optional(),
+  contributes: z10.strictObject({
+    tools: z10.array(ToolContribution).optional(),
+    converters: z10.array(ConverterContribution).optional(),
+    uriModules: z10.array(UriModuleContribution).optional(),
     // Host-composed artifact-backed schemes (see `ArtifactUriModuleContribution`): the plugin
     // declares scheme + editability; the daemon binds each to the kernel's artifact lifecycle
     // per session. Separate from `uriModules` (plugin-implemented backends) precisely because
     // the plugin registers NOTHING for these at activation.
-    artifactUriModules: z9.array(ArtifactUriModuleContribution).optional(),
-    cliBindings: z9.array(CliBindingContribution).optional(),
+    artifactUriModules: z10.array(ArtifactUriModuleContribution).optional(),
+    cliBindings: z10.array(CliBindingContribution).optional(),
     // Which git hosts this plugin's credential serves (see `GitHostContribution`): a
     // declaration, so a plugin for any git backend gets credentialed clones without
     // the daemon learning its name. Sibling of `cliBindings` because both answer the
     // same question — which of this plugin's auth services a host-side consumer
     // resolves — for two different transports.
-    gitHosts: z9.array(GitHostContribution).optional(),
-    resources: z9.array(ResourceContribution).optional(),
-    skills: z9.array(SkillContribution).optional(),
-    searchProviders: z9.array(SearchProviderContribution).optional(),
-    interactionDrivers: z9.array(InteractionDriverContribution).optional(),
-    entityResolvers: z9.array(EntityResolverContribution).optional(),
-    renderers: z9.array(AgentRenderContribution).optional(),
+    gitHosts: z10.array(GitHostContribution).optional(),
+    resources: z10.array(ResourceContribution).optional(),
+    skills: z10.array(SkillContribution).optional(),
+    searchProviders: z10.array(SearchProviderContribution).optional(),
+    interactionDrivers: z10.array(InteractionDriverContribution).optional(),
+    entityResolvers: z10.array(EntityResolverContribution).optional(),
+    renderers: z10.array(AgentRenderContribution).optional(),
     // Handler restricted to skill | tool by the manifest-level refinement below (see
     // `CommandContribution`'s doc for why the restriction is not expressed in the type, and
     // `CommandHandler`'s doc for why there is no promptTemplate variant to declare here).
-    commands: z9.array(CommandContribution).optional()
+    commands: z10.array(CommandContribution).optional()
   }).optional(),
   /**
    * The plugin's primer skill — the `localId` of one of its own declared
@@ -2825,7 +2910,7 @@ var KayAgentTargetManifest = z9.strictObject({
    * `# Your workbench`, for every session the plugin is enabled in. Declaring it is the opt-in:
    * most plugins should NOT be resident (their `<installed_plugins>` line plus primer is the
    * default advertisement); a plugin that is part of how the agent works every turn (memory,
-   * scratchpad, variables) earns a section here. The body is prose the agent reads before any
+   * whiteboard) earns a section here. The body is prose the agent reads before any
    * routing, so it should say what the capability is and when to reach for it, not how to
    * operate it — that is the primer's job, and the host appends the primer route after the body.
    *
@@ -2844,55 +2929,55 @@ var KayAgentTargetManifest = z9.strictObject({
    * acquisition, not declared here, so there is nothing for the resolved contract to mint a
    * `globalId` for at parse time.
    */
-  skillSources: z9.array(PluginSkillSourceDeclaration).optional()
+  skillSources: z10.array(PluginSkillSourceDeclaration).optional()
 });
-var KayAppTargetManifest = z9.strictObject({
+var KayAppTargetManifest = z10.strictObject({
   // Optional, like `kay.ui`'s: a target may carry only declarative `contributes` (e.g. a plugin
   // that ships nothing but `mcpServers`) with no app-lifetime module for the host to load.
   entrypoint: TargetEntrypoint.optional(),
-  contributes: z9.strictObject({
+  contributes: z10.strictObject({
     // Session tools implemented by the app-lifetime activation (registered once, injected into
     // every session with a host-stamped session context) — the tool counterpart of `uriModules`
     // below. Same descriptor shape as kay.agent tools; `toolName` shares ONE flat session
     // namespace with them (enforced by the manifest-level refinement below).
-    tools: z9.array(ToolContribution).optional(),
-    endpoints: z9.array(EndpointContribution).optional(),
-    uriModules: z9.array(AppUriModuleContribution).optional(),
-    dataSources: z9.array(AppDataSourceContribution).optional(),
-    whiteboardTypes: z9.array(WhiteboardTypeContribution).optional(),
-    eventDefinitions: z9.array(PluginEventDefinitionContribution).optional(),
+    tools: z10.array(ToolContribution).optional(),
+    endpoints: z10.array(EndpointContribution).optional(),
+    uriModules: z10.array(AppUriModuleContribution).optional(),
+    dataSources: z10.array(AppDataSourceContribution).optional(),
+    whiteboardTypes: z10.array(WhiteboardTypeContribution).optional(),
+    eventDefinitions: z10.array(PluginEventDefinitionContribution).optional(),
     // Default notification rules over this plugin's own `eventDefinitions`; seeded by the host
     // (see `PluginNotificationRuleContribution`).
-    notificationRules: z9.array(PluginNotificationRuleContribution).optional(),
-    eventSubscriptions: z9.array(AppEventSubscription).optional(),
-    deviceDelegations: z9.array(DeviceDelegationContribution).optional(),
-    corpusConsumers: z9.array(CorpusContribution).optional(),
-    contextContributors: z9.array(ContextContributorContribution).optional(),
+    notificationRules: z10.array(PluginNotificationRuleContribution).optional(),
+    eventSubscriptions: z10.array(AppEventSubscription).optional(),
+    deviceDelegations: z10.array(DeviceDelegationContribution).optional(),
+    corpusConsumers: z10.array(CorpusContribution).optional(),
+    contextContributors: z10.array(ContextContributorContribution).optional(),
     // Vendored MCP servers this plugin ships (see `McpServerContributions`). Bundled-plugin-only
     // in practice; this package cannot see plugin origin, so that ceiling is enforced at
     // composition, not here (see ARCHITECTURE.md "Validation Law").
     mcpServers: McpServerContributions.optional(),
     // Handler restricted to endpoint-only by the manifest-level refinement below.
-    commands: z9.array(CommandContribution).optional()
+    commands: z10.array(CommandContribution).optional()
   }).optional()
 });
-var KayUiTargetManifest = z9.strictObject({
+var KayUiTargetManifest = z10.strictObject({
   entrypoint: TargetEntrypoint.optional(),
-  contributes: z9.strictObject({
-    commands: z9.array(UiCommandContribution).optional(),
-    slots: z9.array(UiSlotContribution).optional(),
-    settingsPanels: z9.array(SettingsPanelContribution).optional(),
-    resultRenderers: z9.array(ResultRendererContribution).optional(),
-    referencePresentations: z9.array(ReferencePresentationContribution).optional(),
-    views: z9.array(RichViewContribution).optional(),
-    apps: z9.array(UiAppContribution).optional(),
-    themes: z9.array(ThemeContribution).optional(),
-    eventSubscriptions: z9.array(UiEventSubscriptionContribution).optional(),
-    dataMaterializers: z9.array(AppDataMaterializerContribution).optional()
+  contributes: z10.strictObject({
+    commands: z10.array(UiCommandContribution).optional(),
+    slots: z10.array(UiSlotContribution).optional(),
+    settingsPanels: z10.array(SettingsPanelContribution).optional(),
+    resultRenderers: z10.array(ResultRendererContribution).optional(),
+    referencePresentations: z10.array(ReferencePresentationContribution).optional(),
+    views: z10.array(RichViewContribution).optional(),
+    apps: z10.array(UiAppContribution).optional(),
+    themes: z10.array(ThemeContribution).optional(),
+    eventSubscriptions: z10.array(UiEventSubscriptionContribution).optional(),
+    dataMaterializers: z10.array(AppDataMaterializerContribution).optional()
   }).optional()
 });
-var PluginConfigScope = z9.enum(["global", "project", "agent"]);
-var PluginConfigSectionManifest = z9.strictObject({
+var PluginConfigScope = z10.enum(["global", "project", "agent"]);
+var PluginConfigSectionManifest = z10.strictObject({
   section: NonEmptyString.optional(),
   schema: JsonSchema,
   /**
@@ -2910,25 +2995,25 @@ var PluginConfigSectionManifest = z9.strictObject({
    * is the baseline every section has; `agent` has no runtime mapping (the
    * agent/entity fold is downstream of the document protocol).
    */
-  scopes: z9.array(PluginConfigScope).optional()
+  scopes: z10.array(PluginConfigScope).optional()
 });
-var PluginConfigManifest = z9.array(PluginConfigSectionManifest).min(1);
+var PluginConfigManifest = z10.array(PluginConfigSectionManifest).min(1);
 function configSectionKeysForManifest(manifest) {
   return manifest.config?.map((config) => config.section ?? `plugins.${manifest.id}`) ?? [];
 }
-var PluginStorageManifest = z9.strictObject({
-  sqlite: z9.strictObject({
-    enabled: z9.boolean(),
-    ownerTarget: z9.literal("kay.app").optional(),
+var PluginStorageManifest = z10.strictObject({
+  sqlite: z10.strictObject({
+    enabled: z10.boolean(),
+    ownerTarget: z10.literal("kay.app").optional(),
     migrations: NonEmptyString.optional()
   }).optional(),
-  dataDir: z9.strictObject({
-    enabled: z9.boolean(),
-    ownerTarget: z9.literal("kay.app").optional()
+  dataDir: z10.strictObject({
+    enabled: z10.boolean(),
+    ownerTarget: z10.literal("kay.app").optional()
   }).optional()
 });
-var PluginOAuthClientSupplier = z9.enum(["kay", "user"]);
-var PluginProvisioningProbe = z9.strictObject({
+var PluginOAuthClientSupplier = z10.enum(["kay", "user"]);
+var PluginProvisioningProbe = z10.strictObject({
   /**
    * The API endpoint that answers the question. The host sends the service's OWN credential here,
    * so this must belong to the provider that minted it — enforced by the daemon against the
@@ -2936,13 +3021,13 @@ var PluginProvisioningProbe = z9.strictObject({
    */
   url: HttpsUrl,
   /** Absent ⇒ `GET`. */
-  method: z9.enum(["GET"]).optional(),
+  method: z10.enum(["GET"]).optional(),
   /**
    * The statuses that make the response a VERDICT at all. Anything else (a 401 from a stale
    * token, a 5xx, a rate limit) means the probe learned nothing and reports `unknown` — never
    * `unsatisfied`, which would tell a user to go fix setup that is fine.
    */
-  verdictStatuses: z9.array(SignedInStatusCode).min(1),
+  verdictStatuses: z10.array(SignedInStatusCode).min(1),
   /**
    * Dot-path to a JSON array in the response body that must be NON-EMPTY for the requirement to
    * count as satisfied (e.g. `installations`). Absent means a verdict status alone is enough.
@@ -2951,7 +3036,7 @@ var PluginProvisioningProbe = z9.strictObject({
    */
   nonEmptyArrayAt: NonEmptyString.optional()
 });
-var PluginProvisioningRequirement = z9.strictObject({
+var PluginProvisioningRequirement = z10.strictObject({
   /** Stable id, unique within the scheme. */
   id: LocalContributionId,
   /** Human-facing requirement name, e.g. "GitHub App installation". */
@@ -2968,7 +3053,7 @@ var PluginProvisioningRequirement = z9.strictObject({
   probe: PluginProvisioningProbe
 });
 var PluginProvisioningField = {
-  provisioning: z9.array(PluginProvisioningRequirement).optional()
+  provisioning: z10.array(PluginProvisioningRequirement).optional()
 };
 var PluginAuthSchemeDescriptionFields = {
   /** Human-facing flow name; the runtime scheme name is the fallback. */
@@ -2981,19 +3066,19 @@ var PluginAuthSchemeDescriptionFields = {
    */
   summary: NonEmptyString.optional()
 };
-var PluginAuthSchemeOAuthPkce = z9.strictObject({
+var PluginAuthSchemeOAuthPkce = z10.strictObject({
   ...PluginProvisioningField,
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z9.literal("oauth2"),
-  exchange: z9.literal("pkce"),
+  kind: z10.literal("oauth2"),
+  exchange: z10.literal("pkce"),
   /**
    * Unordered SET of who may supply the client — non-empty, and every entry must be distinct
    * (fail-closed re-assertion of the kernel's construction-time dedupe: TS exhaustiveness never
    * runs on an untrusted manifest, so a hand-built `["kay","kay"]` must be refused here, not
    * silently normalized).
    */
-  clientSuppliers: z9.array(PluginOAuthClientSupplier).nonempty().superRefine((suppliers, ctx) => {
+  clientSuppliers: z10.array(PluginOAuthClientSupplier).nonempty().superRefine((suppliers, ctx) => {
     if (new Set(suppliers).size !== suppliers.length) {
       ctx.addIssue({
         code: "custom",
@@ -3001,70 +3086,70 @@ var PluginAuthSchemeOAuthPkce = z9.strictObject({
       });
     }
   }),
-  scopes: z9.array(NonEmptyString).optional()
+  scopes: z10.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeOAuthConfidential = z9.strictObject({
+var PluginAuthSchemeOAuthConfidential = z10.strictObject({
   ...PluginProvisioningField,
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z9.literal("oauth2"),
-  exchange: z9.literal("confidential"),
+  kind: z10.literal("oauth2"),
+  exchange: z10.literal("confidential"),
   /** Absent means `["kay"]` — a confidential exchange's secret may only ever be Bonsai's. */
-  clientSuppliers: z9.tuple([z9.literal("kay")]).optional(),
-  scopes: z9.array(NonEmptyString).optional()
+  clientSuppliers: z10.tuple([z10.literal("kay")]).optional(),
+  scopes: z10.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeOAuth2 = z9.discriminatedUnion("exchange", [
+var PluginAuthSchemeOAuth2 = z10.discriminatedUnion("exchange", [
   PluginAuthSchemeOAuthPkce,
   PluginAuthSchemeOAuthConfidential
 ]);
-var PluginAuthSchemeApiKey = z9.strictObject({
+var PluginAuthSchemeApiKey = z10.strictObject({
   ...PluginProvisioningField,
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z9.literal("api-key"),
-  scopes: z9.array(NonEmptyString).optional()
+  kind: z10.literal("api-key"),
+  scopes: z10.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeDelegated = z9.strictObject({
+var PluginAuthSchemeDelegated = z10.strictObject({
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z9.literal("delegated"),
-  scopes: z9.array(NonEmptyString).optional()
+  kind: z10.literal("delegated"),
+  scopes: z10.array(NonEmptyString).optional()
 });
-var PluginAuthSchemeExternalCli = z9.strictObject({
+var PluginAuthSchemeExternalCli = z10.strictObject({
   ...PluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
-  kind: z9.literal("external-cli"),
-  scopes: z9.array(NonEmptyString).optional()
+  kind: z10.literal("external-cli"),
+  scopes: z10.array(NonEmptyString).optional()
 });
-var PluginAuthScheme = z9.discriminatedUnion("kind", [
+var PluginAuthScheme = z10.discriminatedUnion("kind", [
   PluginAuthSchemeOAuth2,
   PluginAuthSchemeApiKey,
   PluginAuthSchemeDelegated,
   PluginAuthSchemeExternalCli
 ]);
-var PluginWebSessionProbe = z9.strictObject({
+var PluginWebSessionProbe = z10.strictObject({
   url: HttpsUrl,
   /** Absent ⇒ `GET`. `POST` sends an empty JSON object body. */
-  method: z9.enum(["GET", "POST"]).optional(),
-  signedInStatuses: z9.array(SignedInStatusCode).min(1)
+  method: z10.enum(["GET", "POST"]).optional(),
+  signedInStatuses: z10.array(SignedInStatusCode).min(1)
 });
-var PluginWebSessionDeclaration = z9.strictObject({
+var PluginWebSessionDeclaration = z10.strictObject({
   /** `required`: capabilities degrade without the site login; `recommended`: it only smooths UX. */
-  importance: z9.enum(["required", "recommended"]),
+  importance: z10.enum(["required", "recommended"]),
   loginUrl: HttpsUrl,
-  cookieDomains: z9.array(RegistrableDomain).min(1),
+  cookieDomains: z10.array(RegistrableDomain).min(1),
   probe: PluginWebSessionProbe,
-  oauthVenue: z9.enum(["embedded", "external"])
+  oauthVenue: z10.enum(["embedded", "external"])
 }).superRefine(refineWebSessionScopeConfined);
-var PluginAuthService = z9.strictObject({
+var PluginAuthService = z10.strictObject({
   localId: LocalContributionId,
   displayName: NonEmptyString,
-  schemes: z9.array(PluginAuthScheme).min(1),
-  purposes: z9.array(NonEmptyString).min(1),
+  schemes: z10.array(PluginAuthScheme).min(1),
+  purposes: z10.array(NonEmptyString).min(1),
   webSession: PluginWebSessionDeclaration.optional()
 });
-var PluginAuthManifest = z9.strictObject({
-  services: z9.array(PluginAuthService).optional()
+var PluginAuthManifest = z10.strictObject({
+  services: z10.array(PluginAuthService).optional()
 });
 var RETIRED_COMPATIBILITY_KEYS = ["policy"];
 function stripRetiredCompatibilityKeys(value) {
@@ -3076,8 +3161,8 @@ function stripRetiredCompatibilityKeys(value) {
     delete remaining[key];
   return remaining;
 }
-var PluginCompatibilityManifest = z9.preprocess(stripRetiredCompatibilityKeys, z9.strictObject({
-  supportedProtocols: z9.array(KayPluginProtocolVersion).optional(),
+var PluginCompatibilityManifest = z10.preprocess(stripRetiredCompatibilityKeys, z10.strictObject({
+  supportedProtocols: z10.array(KayPluginProtocolVersion).optional(),
   minKayVersion: NonEmptyString.optional(),
   sdk: NonEmptyString.optional()
 }));
@@ -3093,8 +3178,8 @@ function retiredCompatibilityKeysIn(rawManifest) {
 var KayVersionString = NonEmptyString.regex(SEMVER_PATTERN, {
   message: "version must be semver, for example 1.2.3"
 });
-var KayPluginManifestV1 = z9.strictObject({
-  protocol: z9.literal(KAY_PLUGIN_PROTOCOL_VERSION),
+var KayPluginManifestV1 = z10.strictObject({
+  protocol: z10.literal(KAY_PLUGIN_PROTOCOL_VERSION),
   id: PluginId,
   displayName: NonEmptyString,
   version: KayVersionString,
@@ -3124,8 +3209,8 @@ var KayPluginManifestV1 = z9.strictObject({
   icon: PackageAssetPath.optional(),
   iconDark: PackageAssetPath.optional(),
   namespace: PluginNamespace.optional(),
-  targets: z9.strictObject({
-    kay: z9.strictObject({
+  targets: z10.strictObject({
+    kay: z10.strictObject({
       agent: KayAgentTargetManifest.optional(),
       app: KayAppTargetManifest.optional(),
       ui: KayUiTargetManifest.optional()
@@ -3142,15 +3227,15 @@ var KayPluginManifestV1 = z9.strictObject({
    * schemes then report `ownedByBonsai`. Honoured only for a plugin that ships with Bonsai: the
    * host reads any other plugin's flag as false. Absent ⇒ false.
    */
-  ownedByBonsai: z9.boolean().optional(),
+  ownedByBonsai: z10.boolean().optional(),
   /**
    * Explicit plugin-level dependencies — other plugins this plugin requires to be present in the
    * composed roster. At composition time the runtime checks each id against the accepted
    * registration list and derives a provenance-complete dependency graph (together with implicit
    * auth-service edges from `consumesAuthServices`). Absent ⇒ no explicit dependencies.
    */
-  dependencies: z9.strictObject({
-    plugins: z9.array(PluginId).optional()
+  dependencies: z10.strictObject({
+    plugins: z10.array(PluginId).optional()
   }).optional()
 }).superRefine((manifest, ctx) => {
   const authServices = new Set(manifest.auth?.services?.map((service) => service.localId) ?? []);
@@ -3820,7 +3905,7 @@ function pushContributionIds(output, path, items) {
 }
 
 // packages/plugin-protocol/dist/plugin-directory-verdict.js
-import { z as z11 } from "zod";
+import { z as z12 } from "zod";
 
 // packages/plugin-protocol/dist/plugin-load-diagnostic.js
 var PLUGIN_DIAGNOSTIC_MESSAGE_CAP = 300;
@@ -3829,36 +3914,36 @@ function boundPluginDiagnosticMessage(message) {
 }
 
 // packages/plugin-protocol/dist/resolved-contract.js
-import { z as z10 } from "zod";
-var ResolvedPluginContributionId = z10.strictObject({
+import { z as z11 } from "zod";
+var ResolvedPluginContributionId = z11.strictObject({
   target: PluginTargetName,
   kind: PluginContributionKind,
   localId: LocalContributionId,
   globalId: GlobalContributionId
 });
-var ResolvedKayAgentTool = z10.strictObject({
+var ResolvedKayAgentTool = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   toolName: PluginToolName
 });
 var ResolvedKayAppTool = ResolvedKayAgentTool;
-var ResolvedKayAppDataSource = z10.strictObject({
+var ResolvedKayAppDataSource = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  scope: z10.enum(["runtime", "account", "session"]),
-  snapshot: z10.strictObject({
-    version: z10.number().int().positive(),
-    schema: z10.record(z10.string(), z10.unknown())
+  scope: z11.enum(["runtime", "account", "session"]),
+  snapshot: z11.strictObject({
+    version: z11.number().int().positive(),
+    schema: z11.record(z11.string(), z11.unknown())
   }),
-  change: z10.strictObject({
-    version: z10.number().int().positive(),
-    schema: z10.record(z10.string(), z10.unknown()),
-    semantics: z10.discriminatedUnion("kind", [
-      z10.strictObject({ kind: z10.literal("incremental") }),
-      z10.strictObject({
-        kind: z10.literal("snapshot-replacement"),
-        maxEncodedBytes: z10.number().int().positive(),
-        rationale: z10.string().trim().min(1).max(1024)
+  change: z11.strictObject({
+    version: z11.number().int().positive(),
+    schema: z11.record(z11.string(), z11.unknown()),
+    semantics: z11.discriminatedUnion("kind", [
+      z11.strictObject({ kind: z11.literal("incremental") }),
+      z11.strictObject({
+        kind: z11.literal("snapshot-replacement"),
+        maxEncodedBytes: z11.number().int().positive(),
+        rationale: z11.string().trim().min(1).max(1024)
       })
     ]).optional()
   }),
@@ -3872,66 +3957,66 @@ var ResolvedKayAppDataSource = z10.strictObject({
     });
   }
 });
-var ResolvedKayAppWhiteboardType = z10.strictObject({
+var ResolvedKayAppWhiteboardType = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   displayName: NonEmptyString,
-  schemaVersion: z10.number().int().positive(),
+  schemaVersion: z11.number().int().positive(),
   storage: WhiteboardTypeStorage,
   valueSchema: JsonSchema,
-  presentation: z10.strictObject({
+  presentation: z11.strictObject({
     app: GlobalContributionId
   }).optional()
 });
-var ResolvedKayAppMcpServer = z10.strictObject({
+var ResolvedKayAppMcpServer = z11.strictObject({
   name: LocalContributionId,
   pluginId: PluginId,
   url: McpServerUrl,
   auth: McpServerAuthMode,
   authServiceId: GlobalContributionId.optional()
 });
-var ResolvedKayAgentUriModule = z10.strictObject({
+var ResolvedKayAgentUriModule = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  schemes: z10.array(UriScheme).min(1),
+  schemes: z11.array(UriScheme).min(1),
   filesystemBacking: UriFilesystemBacking.optional(),
   /** Mirrors `UriModuleContribution.knownResources` (host-side recording opt-in). */
-  knownResources: z10.literal(true).optional()
+  knownResources: z11.literal(true).optional()
 });
-var ResolvedKayAgentArtifactUriModule = z10.strictObject({
+var ResolvedKayAgentArtifactUriModule = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   scheme: UriScheme,
-  editable: z10.boolean(),
-  listable: z10.boolean(),
-  deletable: z10.boolean(),
-  appendable: z10.boolean(),
-  storageScope: z10.enum(["session", "family"])
+  editable: z11.boolean(),
+  listable: z11.boolean(),
+  deletable: z11.boolean(),
+  appendable: z11.boolean(),
+  storageScope: z11.enum(["session", "family"])
 });
-var ResolvedKayAgentEntityResolver = z10.strictObject({
+var ResolvedKayAgentEntityResolver = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   displayName: NonEmptyString.optional(),
   uriModule: GlobalContributionId,
-  entityTypes: z10.array(NonEmptyString).min(1),
+  entityTypes: z11.array(NonEmptyString).min(1),
   uriHint: NonEmptyString
 });
-var ResolvedKayAgentGitHostClaim = z10.strictObject({
+var ResolvedKayAgentGitHostClaim = z11.strictObject({
   host: GitHostName,
   authServiceId: GlobalContributionId,
   /** Manifest-declared order; the clone ladder tries them in sequence. */
-  authSchemeIds: z10.array(GlobalContributionId).min(1),
+  authSchemeIds: z11.array(GlobalContributionId).min(1),
   /** Non-secret display copy for the claiming service, for clone failure text. */
-  authServiceDisplayName: z10.string(),
+  authServiceDisplayName: z11.string(),
   basicAuthUser: GitBasicAuthUser
 });
-var ResolvedKayAgentConverter = z10.strictObject({
+var ResolvedKayAgentConverter = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  mimeTypes: z10.array(MimeTypeString).min(1),
-  extensions: z10.array(FileExtensionToken).min(1).optional()
+  mimeTypes: z11.array(MimeTypeString).min(1),
+  extensions: z11.array(FileExtensionToken).min(1).optional()
 });
-var ResolvedReferencePresentation = z10.strictObject({
+var ResolvedReferencePresentation = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   uriModule: GlobalContributionId,
@@ -3939,9 +4024,9 @@ var ResolvedReferencePresentation = z10.strictObject({
   open: ReferenceOpenBehavior,
   /** MIME-specific resource kinds; absent keys use the base presentation. */
   variants: ReferencePresentationVariants.optional(),
-  claims: z10.array(ReferencePresentationUrlClaim).optional()
+  claims: z11.array(ReferencePresentationUrlClaim).optional()
 });
-var ResolvedPluginProvisioningRequirement = z10.strictObject({
+var ResolvedPluginProvisioningRequirement = z11.strictObject({
   id: LocalContributionId,
   displayName: NonEmptyString,
   description: NonEmptyString,
@@ -3951,15 +4036,15 @@ var ResolvedPluginProvisioningRequirement = z10.strictObject({
    * URL degrades to "Reconnect" in the UI instead of a broken link.
    */
   remediationUrl: HttpsUrl.optional(),
-  probe: z10.strictObject({
+  probe: z11.strictObject({
     url: HttpsUrl,
-    method: z10.enum(["GET"]),
-    verdictStatuses: z10.array(SignedInStatusCode).min(1),
+    method: z11.enum(["GET"]),
+    verdictStatuses: z11.array(SignedInStatusCode).min(1),
     nonEmptyArrayAt: NonEmptyString.optional()
   })
 });
 var ResolvedProvisioningField = {
-  provisioning: z10.array(ResolvedPluginProvisioningRequirement).optional()
+  provisioning: z11.array(ResolvedPluginProvisioningRequirement).optional()
 };
 var ResolvedPluginAuthSchemeDescriptionFields = {
   displayName: NonEmptyString.optional(),
@@ -3971,96 +4056,96 @@ var ResolvedPluginAuthSchemeOAuthBase = {
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z10.literal("oauth2"),
-  scopes: z10.array(z10.string()).optional()
+  kind: z11.literal("oauth2"),
+  scopes: z11.array(z11.string()).optional()
 };
-var ResolvedPluginAuthSchemeOAuthPkce = z10.strictObject({
+var ResolvedPluginAuthSchemeOAuthPkce = z11.strictObject({
   ...ResolvedPluginAuthSchemeOAuthBase,
-  exchange: z10.literal("pkce"),
-  clientSuppliers: z10.array(PluginOAuthClientSupplier).nonempty()
+  exchange: z11.literal("pkce"),
+  clientSuppliers: z11.array(PluginOAuthClientSupplier).nonempty()
 });
-var ResolvedPluginAuthSchemeOAuthConfidential = z10.strictObject({
+var ResolvedPluginAuthSchemeOAuthConfidential = z11.strictObject({
   ...ResolvedPluginAuthSchemeOAuthBase,
-  exchange: z10.literal("confidential"),
-  clientSuppliers: z10.tuple([z10.literal("kay")])
+  exchange: z11.literal("confidential"),
+  clientSuppliers: z11.tuple([z11.literal("kay")])
 });
-var ResolvedPluginAuthSchemeOAuth2 = z10.discriminatedUnion("exchange", [
+var ResolvedPluginAuthSchemeOAuth2 = z11.discriminatedUnion("exchange", [
   ResolvedPluginAuthSchemeOAuthPkce,
   ResolvedPluginAuthSchemeOAuthConfidential
 ]);
-var ResolvedPluginAuthSchemeApiKey = z10.strictObject({
+var ResolvedPluginAuthSchemeApiKey = z11.strictObject({
   ...ResolvedProvisioningField,
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z10.literal("api-key"),
-  scopes: z10.array(z10.string()).optional()
+  kind: z11.literal("api-key"),
+  scopes: z11.array(z11.string()).optional()
 });
-var ResolvedPluginAuthSchemeDelegated = z10.strictObject({
+var ResolvedPluginAuthSchemeDelegated = z11.strictObject({
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z10.literal("delegated"),
-  scopes: z10.array(z10.string()).optional()
+  kind: z11.literal("delegated"),
+  scopes: z11.array(z11.string()).optional()
 });
-var ResolvedPluginAuthSchemeExternalCli = z10.strictObject({
+var ResolvedPluginAuthSchemeExternalCli = z11.strictObject({
   ...ResolvedPluginAuthSchemeDescriptionFields,
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  kind: z10.literal("external-cli"),
-  scopes: z10.array(z10.string()).optional()
+  kind: z11.literal("external-cli"),
+  scopes: z11.array(z11.string()).optional()
 });
-var ResolvedPluginAuthScheme = z10.discriminatedUnion("kind", [
+var ResolvedPluginAuthScheme = z11.discriminatedUnion("kind", [
   ResolvedPluginAuthSchemeOAuth2,
   ResolvedPluginAuthSchemeApiKey,
   ResolvedPluginAuthSchemeDelegated,
   ResolvedPluginAuthSchemeExternalCli
 ]);
-var ResolvedPluginWebSession = z10.strictObject({
-  importance: z10.enum(["required", "recommended"]),
+var ResolvedPluginWebSession = z11.strictObject({
+  importance: z11.enum(["required", "recommended"]),
   loginUrl: HttpsUrl,
-  cookieDomains: z10.array(RegistrableDomain).min(1),
-  probe: z10.strictObject({
+  cookieDomains: z11.array(RegistrableDomain).min(1),
+  probe: z11.strictObject({
     url: HttpsUrl,
-    method: z10.enum(["GET", "POST"]),
-    signedInStatuses: z10.array(SignedInStatusCode).min(1)
+    method: z11.enum(["GET", "POST"]),
+    signedInStatuses: z11.array(SignedInStatusCode).min(1)
   }),
-  oauthVenue: z10.enum(["embedded", "external"])
+  oauthVenue: z11.enum(["embedded", "external"])
 }).superRefine(refineWebSessionScopeConfined);
-var ResolvedPluginAuthService = z10.strictObject({
+var ResolvedPluginAuthService = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
-  displayName: z10.string(),
-  schemes: z10.array(ResolvedPluginAuthScheme).min(1),
-  purposes: z10.array(z10.string()).min(1),
+  displayName: z11.string(),
+  schemes: z11.array(ResolvedPluginAuthScheme).min(1),
+  purposes: z11.array(z11.string()).min(1),
   /** The service's browser half, when the manifest declares one. */
   webSession: ResolvedPluginWebSession.optional()
 });
-var ResolvedKayUiAppEndpointCapability = z10.strictObject({
+var ResolvedKayUiAppEndpointCapability = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId
 });
-var ResolvedKayUiApp = z10.strictObject({
+var ResolvedKayUiApp = z11.strictObject({
   localId: LocalContributionId,
   globalId: GlobalContributionId,
   displayName: NonEmptyString,
   description: NonEmptyString.optional(),
   icon: PackageAssetPath.optional(),
-  runtime: z10.literal("kay.react-app.v1"),
-  sdk: z10.strictObject({ range: NonEmptyString }),
+  runtime: z11.literal("kay.react-app.v1"),
+  sdk: z11.strictObject({ range: NonEmptyString }),
   entrypoint: TargetEntrypoint,
-  styles: z10.array(PackageAssetPath).optional(),
-  assets: z10.array(PackageAssetPath).optional(),
-  capabilities: z10.strictObject({
-    endpoints: z10.array(ResolvedKayUiAppEndpointCapability).optional(),
-    host: z10.array(KayUiAppHostCapability).optional()
+  styles: z11.array(PackageAssetPath).optional(),
+  assets: z11.array(PackageAssetPath).optional(),
+  capabilities: z11.strictObject({
+    endpoints: z11.array(ResolvedKayUiAppEndpointCapability).optional(),
+    host: z11.array(KayUiAppHostCapability).optional()
   }).optional()
 });
-var ResolvedPluginContractV1 = z10.strictObject({
-  protocol: z10.literal("kay.plugin.v1"),
+var ResolvedPluginContractV1 = z11.strictObject({
+  protocol: z11.literal("kay.plugin.v1"),
   pluginId: PluginId,
   namespace: PluginNamespace,
-  contributions: z10.array(ResolvedPluginContributionId),
+  contributions: z11.array(ResolvedPluginContributionId),
   // The deduplicated set of qualified (dotted) external auth-service ids this
   // plugin references, from agent uriModule `authService` refs, cliBinding
   // `authService` refs, and auth-grant `service` refs. Always present — a plugin
@@ -4068,30 +4153,30 @@ var ResolvedPluginContractV1 = z10.strictObject({
   // is a recorded dependency, not a resolution: there is no runtime plugin
   // loader in v1, so nothing here verifies the reference resolves within a
   // composed roster (a composition-time concern owned elsewhere).
-  consumesAuthServices: z10.array(GlobalContributionId),
+  consumesAuthServices: z11.array(GlobalContributionId),
   // The explicit plugin-level dependency ids declared in `dependencies.plugins` on the manifest,
   // deduped and validated at parse time. Always present; a plugin with no explicit dependencies
   // carries an empty array. Composition checks each id against the accepted roster and derives the
   // full dependency graph together with auth-inferred edges from `consumesAuthServices`.
-  explicitDependencies: z10.array(PluginId),
+  explicitDependencies: z11.array(PluginId),
   // The auth services this plugin OWNS, carrying the global ids its harness
   // target must register and the credential authority keys on. Always present;
   // a plugin that declares no `auth.services` carries an empty array. The dual
   // of `consumesAuthServices` (services it merely references).
-  authServices: z10.array(ResolvedPluginAuthService),
+  authServices: z11.array(ResolvedPluginAuthService),
   grants: ResolvedPluginGrants.optional(),
-  kayAgentUriModules: z10.array(ResolvedKayAgentUriModule).optional(),
-  kayAgentArtifactUriModules: z10.array(ResolvedKayAgentArtifactUriModule).optional(),
-  kayAgentEntityResolvers: z10.array(ResolvedKayAgentEntityResolver).optional(),
-  kayAgentGitHostClaims: z10.array(ResolvedKayAgentGitHostClaim).optional(),
-  kayAgentTools: z10.array(ResolvedKayAgentTool).optional(),
-  kayAppTools: z10.array(ResolvedKayAppTool).optional(),
-  kayAppDataSources: z10.array(ResolvedKayAppDataSource).optional(),
-  kayAppWhiteboardTypes: z10.array(ResolvedKayAppWhiteboardType).optional(),
-  kayAppMcpServers: z10.array(ResolvedKayAppMcpServer).optional(),
-  kayAgentConverters: z10.array(ResolvedKayAgentConverter).optional(),
-  referencePresentations: z10.array(ResolvedReferencePresentation).optional(),
-  kayUiApps: z10.array(ResolvedKayUiApp).optional()
+  kayAgentUriModules: z11.array(ResolvedKayAgentUriModule).optional(),
+  kayAgentArtifactUriModules: z11.array(ResolvedKayAgentArtifactUriModule).optional(),
+  kayAgentEntityResolvers: z11.array(ResolvedKayAgentEntityResolver).optional(),
+  kayAgentGitHostClaims: z11.array(ResolvedKayAgentGitHostClaim).optional(),
+  kayAgentTools: z11.array(ResolvedKayAgentTool).optional(),
+  kayAppTools: z11.array(ResolvedKayAppTool).optional(),
+  kayAppDataSources: z11.array(ResolvedKayAppDataSource).optional(),
+  kayAppWhiteboardTypes: z11.array(ResolvedKayAppWhiteboardType).optional(),
+  kayAppMcpServers: z11.array(ResolvedKayAppMcpServer).optional(),
+  kayAgentConverters: z11.array(ResolvedKayAgentConverter).optional(),
+  referencePresentations: z11.array(ResolvedReferencePresentation).optional(),
+  kayUiApps: z11.array(ResolvedKayUiApp).optional()
 });
 function narrowestAccountSelectors() {
   return [{ kind: "active" }];
@@ -4518,10 +4603,12 @@ async function judgeKayPluginDirectory(input) {
   const file = KAY_PLUGIN_MANIFEST_FILENAME;
   const hostSdkVersion = host?.sdkVersion;
   const warnings = [];
+  let pluginId;
   const refuse = (stage, code, message) => ({
     outcome: "refused",
     hostSdkVersion,
     refusal: { stage, root, dir, code, message: boundPluginDiagnosticMessage(message) },
+    ...pluginId === void 0 ? {} : { pluginId },
     warnings
   });
   let manifestEntry;
@@ -4555,6 +4642,8 @@ async function judgeKayPluginDirectory(input) {
     return refuse("manifest-parse", "invalid-json", `${file} is not valid JSON: ${errorText(error)}`);
   }
   const head = ReadableManifestHead.safeParse(json);
+  if (head.success)
+    pluginId = head.data.id;
   if (host !== void 0 && head.success && head.data.compatibility) {
     const { refusal } = checkKayPluginHostCompatibility(head.data.compatibility, host);
     if (refusal !== void 0) {
@@ -4597,6 +4686,16 @@ async function judgeKayPluginDirectory(input) {
   if (!resolved.success) {
     return refuse("contract-resolve", "contract-unresolvable", `contract could not be resolved: ${resolved.error.message}`);
   }
+  const { contract, misnamedTools } = keepNamespaceDerivedTools(resolved.data);
+  for (const tool of misnamedTools) {
+    warnings.push({
+      stage: "contract-resolve",
+      root,
+      dir,
+      code: "directory-tool-name-not-namespace-derived",
+      message: boundPluginDiagnosticMessage(`plugin '${manifest.id}' tool '${tool.localId}' declares toolName '${tool.toolName}'; a directory plugin's tool must be named '${tool.expected}', so that tool is left out and the plugin otherwise loads`)
+    });
+  }
   const realDirectory = await tree.realDirectory();
   if (realDirectory === void 0) {
     return refuse("source-scan", "unreadable-dir", "could not resolve the real path of the plugin directory");
@@ -4610,7 +4709,7 @@ async function judgeKayPluginDirectory(input) {
     outcome: "loads",
     hostSdkVersion,
     manifest,
-    contract: resolved.data,
+    contract,
     warnings,
     advisories: host === void 0 ? [] : kayPluginCompatibilityAdvisories({ manifest, host, root })
   };
@@ -4628,16 +4727,49 @@ function kayPluginCompatibilityAdvisories(input) {
     message: boundPluginDiagnosticMessage(`${manifest.displayName} (${manifest.id}) ${advisory.message}`)
   }));
 }
-var ReadableCompatibility = z11.object({
-  supportedProtocols: z11.array(z11.string()).optional().catch(void 0),
+var ReadableCompatibility = z12.object({
+  supportedProtocols: z12.array(z12.string()).optional().catch(void 0),
   minKayVersion: NonEmptyString.optional().catch(void 0),
   sdk: NonEmptyString.optional().catch(void 0)
 });
-var ReadableManifestHead = z11.object({
-  id: z11.string().optional().catch(void 0),
-  displayName: z11.string().optional().catch(void 0),
+var ReadableManifestHead = z12.object({
+  id: z12.string().optional().catch(void 0),
+  displayName: z12.string().optional().catch(void 0),
   compatibility: ReadableCompatibility.optional().catch(void 0)
 });
+function keepNamespaceDerivedTools(contract) {
+  const misnamedTools = [];
+  const droppedGlobalIds = /* @__PURE__ */ new Set();
+  const keep = (tools) => {
+    const kept = tools?.filter((tool) => {
+      const expected = deriveDirectoryPluginToolName(contract.namespace, tool.localId);
+      if (tool.toolName === expected)
+        return true;
+      misnamedTools.push({
+        localId: tool.localId,
+        toolName: tool.toolName,
+        expected
+      });
+      droppedGlobalIds.add(tool.globalId);
+      return false;
+    });
+    return kept === void 0 || kept.length === 0 ? void 0 : kept;
+  };
+  const kayAgentTools = keep(contract.kayAgentTools);
+  const kayAppTools = keep(contract.kayAppTools);
+  if (misnamedTools.length === 0)
+    return { contract, misnamedTools };
+  const { kayAgentTools: _agent, kayAppTools: _app, ...rest } = contract;
+  return {
+    contract: {
+      ...rest,
+      contributions: contract.contributions.filter((contribution) => contribution.kind !== "tool" || !droppedGlobalIds.has(contribution.globalId)),
+      ...kayAgentTools === void 0 ? {} : { kayAgentTools },
+      ...kayAppTools === void 0 ? {} : { kayAppTools }
+    },
+    misnamedTools
+  };
+}
 function namedIn(head) {
   if (head.id === void 0)
     return KAY_PLUGIN_MANIFEST_FILENAME;
@@ -4698,28 +4830,28 @@ function errorText(error) {
 }
 
 // packages/plugin-protocol/dist/session-health.js
-import { z as z12 } from "zod";
+import { z as z13 } from "zod";
 var SESSION_HEALTH_EXTENSION_ID = "kay.session-health";
 var SESSION_HEALTH_ENTRY_NAME = "session_health";
 var SESSION_HEALTH_CUSTOM_TYPE = `ext:${SESSION_HEALTH_EXTENSION_ID}:${SESSION_HEALTH_ENTRY_NAME}`;
 var SESSION_HEALTH_CLASSIFIER_IDS = ["jev"];
-var sessionHealthEntrySchema = z12.object({
-  v: z12.literal(1),
-  verdict: z12.enum(["well", "bad", "unknown"]),
+var sessionHealthEntrySchema = z13.object({
+  v: z13.literal(1),
+  verdict: z13.enum(["well", "bad", "unknown"]),
   /**
    * The model's calibrated confidence in `well`, 0..1, or null when the
    * classifier declined to produce one. Never exported raw: the telemetry
    * event carries only the decile bucket.
    */
-  p_well: z12.number().min(0).max(1).nullable(),
-  classifier: z12.enum(SESSION_HEALTH_CLASSIFIER_IDS),
-  classifier_version: z12.string().min(1).max(64),
-  judged_at: z12.number().int().nonnegative(),
-  user_entry_id: z12.string().min(1).max(256),
-  through_entry_id: z12.string().min(1).max(256),
-  usage: z12.strictObject({
-    input_tokens: z12.number().int().nonnegative(),
-    output_tokens: z12.number().int().nonnegative()
+  p_well: z13.number().min(0).max(1).nullable(),
+  classifier: z13.enum(SESSION_HEALTH_CLASSIFIER_IDS),
+  classifier_version: z13.string().min(1).max(64),
+  judged_at: z13.number().int().nonnegative(),
+  user_entry_id: z13.string().min(1).max(256),
+  through_entry_id: z13.string().min(1).max(256),
+  usage: z13.strictObject({
+    input_tokens: z13.number().int().nonnegative(),
+    output_tokens: z13.number().int().nonnegative()
   }).optional()
 });
 function sessionHealthPWellDecile(pWell) {
@@ -4729,36 +4861,36 @@ function sessionHealthPWellDecile(pWell) {
 }
 
 // packages/plugin-protocol/dist/resource-invocations.js
-import { z as z13 } from "zod";
-var CorpusResourceKind = z13.enum([
+import { z as z14 } from "zod";
+var CorpusResourceKind = z14.enum([
   "skill",
   "context-file",
   "prompt-command"
 ]);
-var CorpusResourceInvocationCursor = z13.strictObject({
-  at: z13.iso.datetime({ offset: true }),
-  eventId: z13.string().min(1)
+var CorpusResourceInvocationCursor = z14.strictObject({
+  at: z14.iso.datetime({ offset: true }),
+  eventId: z14.string().min(1)
 });
-var CorpusResourceInvocationQuery = z13.strictObject({
+var CorpusResourceInvocationQuery = z14.strictObject({
   kind: CorpusResourceKind,
-  since: z13.iso.datetime({ offset: true }),
-  until: z13.iso.datetime({ offset: true }),
+  since: z14.iso.datetime({ offset: true }),
+  until: z14.iso.datetime({ offset: true }),
   after: CorpusResourceInvocationCursor.optional(),
-  limit: z13.number().int().min(1).max(1e3).optional(),
-  rootCreatedByKind: z13.enum(AGENT_RUNTIME_SESSION_CREATOR_KINDS).optional()
+  limit: z14.number().int().min(1).max(1e3).optional(),
+  rootCreatedByKind: z14.enum(AGENT_RUNTIME_SESSION_CREATOR_KINDS).optional()
 }).refine((value) => Date.parse(value.since) < Date.parse(value.until), {
   message: "since must precede until"
 });
 
 // packages/plugin-protocol/dist/ui-app-package.js
-import { z as z14 } from "zod";
+import { z as z15 } from "zod";
 var KAY_UI_APP_PACKAGE_PROTOCOL = "kay.ui.app-package.v1";
 var KAY_UI_BUNDLE_INDEX_PROTOCOL = "kay.ui.bundle-index.v1";
-var KayUiBundleOutputPath = z14.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.startsWith("./") && !value.includes("\\") && !value.split("/").includes(".."), { message: "bundle output path must stay relative to the bundle root" });
-var KayUiBundleIndexV1 = z14.strictObject({
-  protocol: z14.literal(KAY_UI_BUNDLE_INDEX_PROTOCOL),
+var KayUiBundleOutputPath = z15.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.startsWith("./") && !value.includes("\\") && !value.split("/").includes(".."), { message: "bundle output path must stay relative to the bundle root" });
+var KayUiBundleIndexV1 = z15.strictObject({
+  protocol: z15.literal(KAY_UI_BUNDLE_INDEX_PROTOCOL),
   entryPath: KayUiBundleOutputPath,
-  files: z14.array(z14.strictObject({
+  files: z15.array(z15.strictObject({
     path: KayUiBundleOutputPath,
     mediaType: NonEmptyString
   })).min(1)
@@ -4785,19 +4917,19 @@ var KayUiBundleIndexV1 = z14.strictObject({
 function parseKayUiBundleIndexV1(input) {
   return KayUiBundleIndexV1.parse(input);
 }
-var KayUiAppPackageFile = z14.strictObject({
+var KayUiAppPackageFile = z15.strictObject({
   path: PackageAssetPath,
   mediaType: NonEmptyString,
-  bytes: z14.instanceof(Uint8Array).refine((bytes) => bytes.byteLength > 0, {
+  bytes: z15.instanceof(Uint8Array).refine((bytes) => bytes.byteLength > 0, {
     message: "app package file bytes must not be empty"
   })
 });
-var KayUiAppPackageV1 = z14.strictObject({
-  protocol: z14.literal(KAY_UI_APP_PACKAGE_PROTOCOL),
+var KayUiAppPackageV1 = z15.strictObject({
+  protocol: z15.literal(KAY_UI_APP_PACKAGE_PROTOCOL),
   appLocalId: LocalContributionId,
   entry: KayUiAppPackageFile,
-  styles: z14.array(KayUiAppPackageFile).optional(),
-  assets: z14.array(KayUiAppPackageFile).optional()
+  styles: z15.array(KayUiAppPackageFile).optional(),
+  assets: z15.array(KayUiAppPackageFile).optional()
 }).superRefine((appPackage, ctx) => {
   if (appPackage.entry.mediaType !== "application/javascript") {
     ctx.addIssue({
@@ -4834,16 +4966,16 @@ function parseKayUiAppPackageV1(input) {
 }
 
 // packages/plugin-protocol/dist/whiteboard.js
-import { z as z15 } from "zod";
+import { z as z16 } from "zod";
 var WhiteboardValue = JsonValue;
-var WhiteboardEntryEnvelope = z15.strictObject({
+var WhiteboardEntryEnvelope = z16.strictObject({
   id: NonEmptyString,
   typeId: GlobalContributionId,
-  schemaVersion: z15.number().int().positive(),
-  title: z15.string(),
+  schemaVersion: z16.number().int().positive(),
+  title: z16.string(),
   authorSessionId: NonEmptyString.nullable()
 });
-var WhiteboardEntrySummary = z15.strictObject({
+var WhiteboardEntrySummary = z16.strictObject({
   name: NonEmptyString,
   entry: WhiteboardEntryEnvelope,
   revision: NonEmptyString
@@ -4851,31 +4983,31 @@ var WhiteboardEntrySummary = z15.strictObject({
 var WhiteboardEntrySnapshot = WhiteboardEntrySummary.extend({
   value: WhiteboardValue
 });
-var WhiteboardDiagnostic = z15.strictObject({
+var WhiteboardDiagnostic = z16.strictObject({
   ruleId: NonEmptyString,
-  severity: z15.enum(["error", "warning"]),
+  severity: z16.enum(["error", "warning"]),
   message: NonEmptyString
 });
-var WhiteboardEntryInfo = z15.strictObject({
+var WhiteboardEntryInfo = z16.strictObject({
   name: NonEmptyString,
   revision: NonEmptyString,
   entry: WhiteboardEntryEnvelope.optional(),
-  state: z15.enum(["available", "unavailable", "unsupported-version", "invalid"]),
-  mutable: z15.boolean(),
-  diagnostics: z15.array(z15.string())
+  state: z16.enum(["available", "unavailable", "unsupported-version", "invalid"]),
+  mutable: z16.boolean(),
+  diagnostics: z16.array(z16.string())
 });
 var WhiteboardEntryInspection = WhiteboardEntryInfo.extend({
   value: WhiteboardValue.optional(),
-  text: z15.string(),
-  truncated: z15.boolean()
+  text: z16.string(),
+  truncated: z16.boolean()
 });
-var WhiteboardTypeInfo = z15.strictObject({
+var WhiteboardTypeInfo = z16.strictObject({
   typeId: GlobalContributionId,
   displayName: NonEmptyString,
-  schemaVersion: z15.number().int().positive(),
-  available: z15.boolean(),
+  schemaVersion: z16.number().int().positive(),
+  available: z16.boolean(),
   /** A plugin-owned readonly presentation; absent types use the host fallback. */
-  presentation: z15.strictObject({
+  presentation: z16.strictObject({
     app: GlobalContributionId
   }).optional()
 });
@@ -4920,6 +5052,7 @@ export {
   CorpusResourceInvocationCursor,
   CorpusResourceInvocationQuery,
   CorpusResourceKind,
+  DeclaredSkillSourceEnvelope,
   DeviceDelegationContribution,
   EndpointContribution,
   EndpointGrantRequest,
@@ -5101,10 +5234,12 @@ export {
   compareSemver,
   configSectionKeysForManifest,
   dedupeClaims,
+  deriveDirectoryPluginToolName,
   finalizeArtifactProvenanceEnvelope,
   hasClaim,
   hostWithinDomain,
   isCompatible,
+  isKayPluginCompatibilityRefusal,
   isQualifiedAuthSchemeRef,
   isQualifiedAuthServiceRef,
   isSupportedSemverRange,