@yaklabs-ai/plugin-protocol 0.13.6 → 0.13.8

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.13.6"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.13.8"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.13.6",
+  "version": "0.13.8",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -1705,6 +1705,26 @@ export declare interface DeclaredKayPluginCompatibility {
     readonly sdk?: string | undefined;
 }
 
+/**
+ * Where a plugin-declared skill source's bytes come from, as the daemon resolved it: the manifest
+ * declaration (`PluginSkillSourceDeclaration`) less its local id and display name, which grant
+ * nothing. The git channel carries the canonical locator plus the ref and subdir, because the same
+ * repository at another ref or folder is a different source the user never approved; the installer
+ * channel carries the command and its argv exactly, never joined into one string.
+ */
+export declare const DeclaredSkillSourceEnvelope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    channel: z.ZodLiteral<"git-clone">;
+    locator: z.ZodString;
+    ref: z.ZodOptional<z.ZodString>;
+    subdir: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    channel: z.ZodLiteral<"installer">;
+    command: z.ZodString;
+    args: z.ZodArray<z.ZodString>;
+}, z.core.$strict>], "channel">;
+
+export declare type DeclaredSkillSourceEnvelope = z.infer<typeof DeclaredSkillSourceEnvelope>;
+
 /** Drop repeats under {@link sameClaim}, preserving first-seen order (a sort settles the rest). */
 export declare function dedupeClaims(claims: readonly PluginCapabilityClaimV1[]): PluginCapabilityClaimV1[];
 
@@ -1948,6 +1968,12 @@ export declare type InteractionDriverContribution = z.infer<typeof InteractionDr
 /** Whether the report permits the plugin to load. */
 export declare function isCompatible(report: KayPluginCompatibilityReport): boolean;
 
+/**
+ * Whether a refusal `code` came from the compatibility check: the plugin was written for another
+ * SDK or protocol, as opposed to being malformed.
+ */
+export declare function isKayPluginCompatibilityRefusal(code: string): code is KayPluginCompatibilityRefusalCode;
+
 /**
  * Discriminates a grant's auth-scheme reference between a local id and an
  * already-qualified global id. Local contribution ids cannot contain dots.
@@ -2030,8 +2056,10 @@ export declare const KAY_APP_DATA_SNAPSHOT_MAX_BYTES: number;
  */
 export declare const KAY_EVENT_PUBLISHER_ID: "kay";
 
+declare const KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES: readonly ["unsupported-protocol", "sdk-range-unsatisfied", "sdk-range-unsupported", "host-sdk-version-invalid"];
+
 /** Released SDK contracts still implemented by the host, alongside its current SDK. */
-export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly ["0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.9.0", "0.9.1", "0.10.0", "0.11.0", "0.11.1", "0.12.0", "0.12.1", "0.12.2", "0.12.3", "0.12.4", "0.12.5", "0.13.0", "0.13.1", "0.13.2", "0.13.3", "0.13.4", "0.13.5"];
+export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly ["0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.9.0", "0.9.1", "0.10.0", "0.11.0", "0.11.1", "0.12.0", "0.12.1", "0.12.2", "0.12.3", "0.12.4", "0.12.5", "0.13.0", "0.13.1", "0.13.2", "0.13.3", "0.13.4", "0.13.5", "0.13.6", "0.13.7"];
 
 /** The file whose presence makes a directory a plugin. A directory without one is not a plugin. */
 export declare const KAY_PLUGIN_MANIFEST_FILENAME = "kay-plugin.json";
@@ -2314,8 +2342,26 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * (`turnSegments`), the run records and the work-block and work-headline helpers. Additive: a
  * plugin compiled against 0.13.5 never imports them. A plugin that imports one declares `^0.13.6`,
  * so an older host refuses a directory or repository plugin at load instead of the import failing.
+ *
+ * 0.13.7 adds four subpaths. `@bonsai/plugin-sdk/vendored-mcp` re-exports
+ * `@bonsai/vendored-mcp-integration` (`createVendoredMcpUriModule` and its descriptor types; not
+ * the MCP read-port types). `transcript-review` and `agent-conversation` re-export the session
+ * folds Bonsai's own Sessions and Hindsight plugins share. `app-data` carries the app-data size
+ * caps on an entry with no other import, for code a `kay.ui` page also loads. The protocol it
+ * ships also carries three new capability-claim slugs (`mcp.host-server`, `prompt.resident`,
+ * `skills.declared-source`). Additive: a plugin compiled against 0.13.6 never imports the new
+ * subpaths, and its manifest parses unchanged. A plugin that imports one declares `^0.13.7`, so
+ * an older host refuses a directory or repository plugin at load instead of the import failing.
+ *
+ * 0.13.8 takes the PATCH slot under the addition rule, as `api.withJev` did in 0.8.1: one new
+ * member on the api a plugin RECEIVES, `api.systemOne` / `app.systemOne` (`@bonsai/plugin-sdk/
+ * system-one`), the System One client for `decide` and `extract` on Jev, Clef, Clef Flash and
+ * Clairic. It is non-optional for the same reason `withJev` is, and a host with no System One
+ * binds a client that throws `not-served`. `withJev` stays for every compatible plugin. A
+ * plugin that calls `systemOne` declares `^0.13.8`, so an older host refuses it at load instead
+ * of the member being absent.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.13.6";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.13.8";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2630,7 +2676,7 @@ export declare interface KayPluginCompatibilityNote<TCode extends string> {
     readonly message: string;
 }
 
-export declare type KayPluginCompatibilityRefusalCode = "unsupported-protocol" | "sdk-range-unsatisfied" | "sdk-range-unsupported" | "host-sdk-version-invalid";
+export declare type KayPluginCompatibilityRefusalCode = (typeof KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES)[number];
 
 /**
  * What the check found. `refusal` absent means the plugin may load; advisories
@@ -2656,6 +2702,11 @@ export declare type KayPluginDirectoryVerdict = {
 } | {
     readonly outcome: "refused";
     readonly refusal: PluginLoadDiagnostic;
+    /**
+     * The id the manifest declares, as written, when the refusal came after the manifest was
+     * read; it is not validated, so it may not be a well-formed plugin id.
+     */
+    readonly pluginId?: string;
     /** Notes raised before the refusal; the author still meets them once it is fixed. */
     readonly warnings: readonly PluginLoadDiagnostic[];
 } | {
@@ -3765,8 +3816,9 @@ export declare type McpServerAuthMode = z.infer<typeof McpServerAuthMode>;
  * or omitted `auth`) requires `authService`; `auth: "none"` may omit it. `authService` is a local
  * id that must resolve within this same manifest; unlike `uriModule.authService`, qualified foreign
  * service refs are not permitted because the MCP binding belongs to the plugin that ships it.
- * Declaring `mcpServers` at
- * all is bundled-plugin-only — enforced at composition, not by this schema (see `ARCHITECTURE.md`).
+ * A declared server is hosted
+ * only for a plugin holding `mcp.host-server` for its name and URL (the release's own plugins hold
+ * it) — decided at composition, not by this schema (see `ARCHITECTURE.md`).
  */
 export declare const McpServerContribution: z.ZodObject<{
     url: z.ZodString;
@@ -3908,7 +3960,7 @@ export declare function parseResolvedPluginContractV1(value: unknown): ResolvedP
 export declare function parseSemver(value: string): ParsedSemver | undefined;
 
 /** Every capability slug {@link PluginCapabilityClaimV1} can express, for exhaustive table checks. */
-export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "corpus.read", "signals.read", "skills.read", "tools.describe", "workspace.command", "sessions.create", "sessions.update", "models.complete", "jev.use", "automations.write", "automations.run", "workflows.define", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove"];
+export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "corpus.read", "signals.read", "skills.read", "tools.describe", "workspace.command", "sessions.create", "sessions.update", "models.complete", "jev.use", "automations.write", "automations.run", "workflows.define", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "mcp.host-server", "prompt.resident", "skills.declared-source", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove"];
 
 /** Diagnostic messages carry plugin-controlled text (parse errors, module errors); bound it so a
  *  hostile or accidental multi-megabyte error can never blow up a log line or a render surface. */
@@ -4285,17 +4337,20 @@ export declare type PluginAuthService = z.infer<typeof PluginAuthService>;
  * `target` names that scope, and carries ONE value beyond the three plugin targets
  * (`PluginTargetName`): `"plugin"`, for a claim held by the plugin as a whole rather than by one
  * of its targets. Composition decides those — owning a shared auth service, consuming another
- * plugin's identity, binding a CLI credential, declaring a config section — before any target
- * code is loaded, so there is no target to charge them to. They are still exactly claims: one
+ * plugin's identity, binding a CLI credential, declaring a config section, hosting an MCP server,
+ * a resident prompt section, a plugin-declared skill source — before any target code is loaded, so
+ * there is no target to charge them to. They are still exactly claims: one
  * exact envelope, one grant row, one consent.
  *
  * `process.spawn` additionally carries `argvClass`: the declared CLASS of argument vector the
  * plugin will spawn with. It is an opaque exact string here — this module never interprets it —
  * and the broker packet that consumes it owns what a class permits.
  *
- * `agents.permissions` is the one variant whose envelope is not flat: it carries the permission
+ * Two variants carry an envelope that is not flat. `agents.permissions` carries the permission
  * rules themselves, in declaration order, because a human approving it must read the rules they
- * are approving. Its equality is still exact — see {@link sameClaim}.
+ * are approving. `skills.declared-source` carries one of two source shapes
+ * ({@link DeclaredSkillSourceEnvelope}), because a git source and an installer differ in what
+ * pins them. Equality for both is still exact — see {@link sameClaim}.
  */
 export declare const PluginCapabilityClaimV1: z.ZodDiscriminatedUnion<[z.ZodObject<{
     target: z.ZodLiteral<"kay.app">;
@@ -4481,6 +4536,30 @@ export declare const PluginCapabilityClaimV1: z.ZodDiscriminatedUnion<[z.ZodObje
     envelope: z.ZodObject<{
         binary: z.ZodString;
     }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    target: z.ZodLiteral<"plugin">;
+    slug: z.ZodLiteral<"mcp.host-server">;
+    envelope: z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    target: z.ZodLiteral<"plugin">;
+    slug: z.ZodLiteral<"prompt.resident">;
+    envelope: z.ZodObject<{}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    target: z.ZodLiteral<"plugin">;
+    slug: z.ZodLiteral<"skills.declared-source">;
+    envelope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        channel: z.ZodLiteral<"git-clone">;
+        locator: z.ZodString;
+        ref: z.ZodOptional<z.ZodString>;
+        subdir: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>, z.ZodObject<{
+        channel: z.ZodLiteral<"installer">;
+        command: z.ZodString;
+        args: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>], "channel">;
 }, z.core.$strict>, z.ZodObject<{
     target: z.ZodEnum<{
         "kay.agent": "kay.agent";
@@ -4693,6 +4772,30 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
         envelope: z.ZodObject<{
             binary: z.ZodString;
         }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"plugin">;
+        slug: z.ZodLiteral<"mcp.host-server">;
+        envelope: z.ZodObject<{
+            name: z.ZodString;
+            url: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"plugin">;
+        slug: z.ZodLiteral<"prompt.resident">;
+        envelope: z.ZodObject<{}, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"plugin">;
+        slug: z.ZodLiteral<"skills.declared-source">;
+        envelope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            channel: z.ZodLiteral<"git-clone">;
+            locator: z.ZodString;
+            ref: z.ZodOptional<z.ZodString>;
+            subdir: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            channel: z.ZodLiteral<"installer">;
+            command: z.ZodString;
+            args: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "channel">;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodEnum<{
             "kay.agent": "kay.agent";
@@ -4900,6 +5003,30 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
             envelope: z.ZodObject<{
                 binary: z.ZodString;
             }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            target: z.ZodLiteral<"plugin">;
+            slug: z.ZodLiteral<"mcp.host-server">;
+            envelope: z.ZodObject<{
+                name: z.ZodString;
+                url: z.ZodString;
+            }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            target: z.ZodLiteral<"plugin">;
+            slug: z.ZodLiteral<"prompt.resident">;
+            envelope: z.ZodObject<{}, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            target: z.ZodLiteral<"plugin">;
+            slug: z.ZodLiteral<"skills.declared-source">;
+            envelope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+                channel: z.ZodLiteral<"git-clone">;
+                locator: z.ZodString;
+                ref: z.ZodOptional<z.ZodString>;
+                subdir: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>, z.ZodObject<{
+                channel: z.ZodLiteral<"installer">;
+                command: z.ZodString;
+                args: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>], "channel">;
         }, z.core.$strict>, z.ZodObject<{
             target: z.ZodEnum<{
                 "kay.agent": "kay.agent";
@@ -5170,6 +5297,30 @@ export declare const PluginCapabilityRefusalV1: z.ZodObject<{
         envelope: z.ZodObject<{
             binary: z.ZodString;
         }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"plugin">;
+        slug: z.ZodLiteral<"mcp.host-server">;
+        envelope: z.ZodObject<{
+            name: z.ZodString;
+            url: z.ZodString;
+        }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"plugin">;
+        slug: z.ZodLiteral<"prompt.resident">;
+        envelope: z.ZodObject<{}, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodLiteral<"plugin">;
+        slug: z.ZodLiteral<"skills.declared-source">;
+        envelope: z.ZodDiscriminatedUnion<[z.ZodObject<{
+            channel: z.ZodLiteral<"git-clone">;
+            locator: z.ZodString;
+            ref: z.ZodOptional<z.ZodString>;
+            subdir: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>, z.ZodObject<{
+            channel: z.ZodLiteral<"installer">;
+            command: z.ZodString;
+            args: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>], "channel">;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodEnum<{
             "kay.agent": "kay.agent";

package/dist/index.js

@@ -136,7 +136,7 @@ var JsonSchema = z2.record(z2.string(), JsonValue);
 // packages/plugin-protocol/dist/common.js
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.13.6";
+var KAY_PLUGIN_SDK_VERSION = "0.13.8";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.8.0",
   "0.8.1",
@@ -160,7 +160,9 @@ var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.13.2",
   "0.13.3",
   "0.13.4",
-  "0.13.5"
+  "0.13.5",
+  "0.13.6",
+  "0.13.7"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -1489,6 +1491,19 @@ var WhiteboardCapabilityClaimV1 = z8.strictObject({
     });
   }
 });
+var DeclaredSkillSourceEnvelope = z8.discriminatedUnion("channel", [
+  z8.strictObject({
+    channel: z8.literal("git-clone"),
+    locator: NonEmptyString,
+    ref: NonEmptyString.optional(),
+    subdir: NonEmptyString.optional()
+  }),
+  z8.strictObject({
+    channel: z8.literal("installer"),
+    command: NonEmptyString,
+    args: z8.array(NonEmptyString)
+  })
+]);
 var PluginCapabilityClaimV1 = z8.discriminatedUnion("slug", [
   z8.strictObject({
     target: z8.literal("kay.app"),
@@ -1681,6 +1696,25 @@ var PluginCapabilityClaimV1 = z8.discriminatedUnion("slug", [
     /** The binary basename a resolved credential would be injected into. */
     envelope: z8.strictObject({ binary: NonEmptyString })
   }),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("mcp.host-server"),
+    // The daemon dials this endpoint, holds its sign-in, and serves it as `mcp://<name>`, so the
+    // endpoint becomes daemon execution authority. One claim per exact name and URL.
+    envelope: z8.strictObject({ name: NonEmptyString, url: NonEmptyString })
+  }),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("prompt.resident"),
+    // A section of the plugin's own text in every session's system prompt. An empty envelope
+    // because the grant itself is the decision; the host caps the section's length.
+    envelope: z8.strictObject({})
+  }),
+  z8.strictObject({
+    target: z8.literal("plugin"),
+    slug: z8.literal("skills.declared-source"),
+    envelope: DeclaredSkillSourceEnvelope
+  }),
   WhiteboardCapabilityClaimV1
 ]);
 var RETIRED_PLUGIN_CAPABILITY_SLUGS = [
@@ -1718,6 +1752,9 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "auth.own-service",
   "auth.shared-identity",
   "cli.bind",
+  "mcp.host-server",
+  "prompt.resident",
+  "skills.declared-source",
   "whiteboard.discover",
   "whiteboard.read",
   "whiteboard.create",
@@ -1815,6 +1852,7 @@ function sameClaim(a, b) {
     case "account.assert":
     case "account.update":
     case "tool-interception.register":
+    case "prompt.resident":
       return true;
     case "network.connect":
       return b.slug === "network.connect" && a.envelope.connect === b.envelope.connect;
@@ -1838,6 +1876,10 @@ function sameClaim(a, b) {
       return (b.slug === "auth.own-service" || b.slug === "auth.shared-identity") && a.envelope.service === b.envelope.service;
     case "cli.bind":
       return b.slug === "cli.bind" && a.envelope.binary === b.envelope.binary;
+    case "mcp.host-server":
+      return b.slug === "mcp.host-server" && a.envelope.name === b.envelope.name && a.envelope.url === b.envelope.url;
+    case "skills.declared-source":
+      return b.slug === "skills.declared-source" && declaredSourcePairs(a.envelope, b.envelope).every(([left, right]) => left === right);
     case "whiteboard.discover":
     case "whiteboard.read":
     case "whiteboard.create":
@@ -1880,6 +1922,7 @@ function envelopePairs(a, b) {
     case "account.assert":
     case "account.update":
     case "tool-interception.register":
+    case "prompt.resident":
       return [];
     case "network.connect":
       return b.slug === "network.connect" ? [[a.envelope.connect, b.envelope.connect]] : [];
@@ -1919,6 +1962,13 @@ function envelopePairs(a, b) {
       return b.slug === "auth.own-service" || b.slug === "auth.shared-identity" ? [[a.envelope.service, b.envelope.service]] : [];
     case "cli.bind":
       return b.slug === "cli.bind" ? [[a.envelope.binary, b.envelope.binary]] : [];
+    case "mcp.host-server":
+      return b.slug === "mcp.host-server" ? [
+        [a.envelope.name, b.envelope.name],
+        [a.envelope.url, b.envelope.url]
+      ] : [];
+    case "skills.declared-source":
+      return b.slug === "skills.declared-source" ? declaredSourcePairs(a.envelope, b.envelope) : [];
     case "whiteboard.discover":
     case "whiteboard.read":
     case "whiteboard.create":
@@ -1927,6 +1977,24 @@ function envelopePairs(a, b) {
       return b.slug === a.slug && "scope" in b.envelope ? [[a.envelope.scope, b.envelope.scope]] : [];
   }
 }
+function declaredSourcePairs(a, b) {
+  if (a.channel === "git-clone" && b.channel === "git-clone") {
+    return [
+      [a.channel, b.channel],
+      [a.locator, b.locator],
+      [a.ref ?? "", b.ref ?? ""],
+      [a.subdir ?? "", b.subdir ?? ""]
+    ];
+  }
+  if (a.channel === "installer" && b.channel === "installer") {
+    return [
+      [a.channel, b.channel],
+      [a.command, b.command],
+      [JSON.stringify(a.args), JSON.stringify(b.args)]
+    ];
+  }
+  return [[a.channel, b.channel]];
+}
 function whiteboardCapabilityClaim(operation, scope, target = "kay.agent") {
   if (target === "kay.app" && operation !== "discover" && operation !== "read") {
     throw new TypeError("kay.app Whiteboard claims are read-only");
@@ -2127,6 +2195,15 @@ function kayPluginHostCompatibility(appVersion) {
     appVersion
   };
 }
+var KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES = [
+  "unsupported-protocol",
+  "sdk-range-unsatisfied",
+  "sdk-range-unsupported",
+  "host-sdk-version-invalid"
+];
+function isKayPluginCompatibilityRefusal(code) {
+  return KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES.includes(code);
+}
 function isCompatible(report) {
   return report.refusal === void 0;
 }
@@ -2838,9 +2915,9 @@ var KayAgentTargetManifest = z10.strictObject({
    * routing, so it should say what the capability is and when to reach for it, not how to
    * operate it — that is the primer's job, and the host appends the primer route after the body.
    *
-   * Policy the HOST applies (never trust this field alone): a body over 500 words is dropped,
-   * and a directory/repository-origin plugin's declaration is ignored — a third-party manifest
-   * does not buy prompt residency (mirrors the skill-exposure clamp).
+   * Policy the HOST applies (never trust this field alone): the doc renders only for a plugin
+   * holding the `prompt.resident` claim (Bonsai's own plugins hold it; any other plugin needs a
+   * grant a person approved), and a body over 500 words is dropped.
    */
   prompt: PackageAssetPath.optional(),
   /**
@@ -2877,8 +2954,8 @@ var KayAppTargetManifest = z10.strictObject({
     deviceDelegations: z10.array(DeviceDelegationContribution).optional(),
     corpusConsumers: z10.array(CorpusContribution).optional(),
     contextContributors: z10.array(ContextContributorContribution).optional(),
-    // Vendored MCP servers this plugin ships (see `McpServerContributions`). Bundled-plugin-only
-    // in practice; this package cannot see plugin origin, so that ceiling is enforced at
+    // Vendored MCP servers this plugin ships (see `McpServerContributions`). Each is hosted only
+    // for a plugin holding `mcp.host-server` for its name and URL; that is decided at
     // composition, not here (see ARCHITECTURE.md "Validation Law").
     mcpServers: McpServerContributions.optional(),
     // Handler restricted to endpoint-only by the manifest-level refinement below.
@@ -4527,10 +4604,12 @@ async function judgeKayPluginDirectory(input) {
   const file = KAY_PLUGIN_MANIFEST_FILENAME;
   const hostSdkVersion = host?.sdkVersion;
   const warnings = [];
+  let pluginId;
   const refuse = (stage, code, message) => ({
     outcome: "refused",
     hostSdkVersion,
     refusal: { stage, root, dir, code, message: boundPluginDiagnosticMessage(message) },
+    ...pluginId === void 0 ? {} : { pluginId },
     warnings
   });
   let manifestEntry;
@@ -4564,6 +4643,8 @@ async function judgeKayPluginDirectory(input) {
     return refuse("manifest-parse", "invalid-json", `${file} is not valid JSON: ${errorText(error)}`);
   }
   const head = ReadableManifestHead.safeParse(json);
+  if (head.success)
+    pluginId = head.data.id;
   if (host !== void 0 && head.success && head.data.compatibility) {
     const { refusal } = checkKayPluginHostCompatibility(head.data.compatibility, host);
     if (refusal !== void 0) {
@@ -4714,6 +4795,9 @@ function referencedPaths(manifest) {
   if (manifest.iconDark !== void 0) {
     refs.push({ label: "iconDark", path: manifest.iconDark });
   }
+  if (kayAgent?.prompt !== void 0) {
+    refs.push({ label: "kay.agent prompt", path: kayAgent.prompt });
+  }
   for (const skill of kayAgent?.contributes?.skills ?? []) {
     refs.push({ label: `skill '${skill.localId}'`, path: skill.path });
   }
@@ -4972,6 +5056,7 @@ export {
   CorpusResourceInvocationCursor,
   CorpusResourceInvocationQuery,
   CorpusResourceKind,
+  DeclaredSkillSourceEnvelope,
   DeviceDelegationContribution,
   EndpointContribution,
   EndpointGrantRequest,
@@ -5158,6 +5243,7 @@ export {
   hasClaim,
   hostWithinDomain,
   isCompatible,
+  isKayPluginCompatibilityRefusal,
   isQualifiedAuthSchemeRef,
   isQualifiedAuthServiceRef,
   isSupportedSemverRange,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.13.6",
+  "version": "0.13.8",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",