@yaklabs-ai/plugin-protocol 0.14.1 → 0.15.1

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.14.1"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.15.1"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.14.1",
+  "version": "0.15.1",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -74,8 +74,8 @@ export declare const AppDataSourceContribution: z.ZodObject<{
     localId: z.ZodString;
     scope: z.ZodEnum<{
         session: "session";
-        account: "account";
         runtime: "runtime";
+        account: "account";
     }>;
     snapshot: z.ZodObject<{
         version: z.ZodNumber;
@@ -133,9 +133,9 @@ export declare type AppEventSubscription = z.infer<typeof AppEventSubscription>;
  * `kay.agent` registration seam only).
  */
 export declare const AppUriModuleContribution: z.ZodObject<{
+    localId: z.ZodString;
     displayName: z.ZodOptional<z.ZodString>;
     schemes: z.ZodArray<z.ZodString>;
-    localId: z.ZodString;
 }, z.core.$strict>;
 
 export declare type AppUriModuleContribution = z.infer<typeof AppUriModuleContribution>;
@@ -327,6 +327,7 @@ export declare const ArtifactProvenanceCaptureContextSchema: z.ZodObject<{
                     cron: "cron";
                     occurrence: "occurrence";
                     "uri-change": "uri-change";
+                    "plugin-event": "plugin-event";
                     manual: "manual";
                 }>;
             }, z.core.$strict>, z.ZodObject<{
@@ -715,6 +716,7 @@ export declare const ArtifactProvenanceEnvelopeV1: z.ZodPipe<z.ZodUnknown, z.Zod
                     cron: "cron";
                     occurrence: "occurrence";
                     "uri-change": "uri-change";
+                    "plugin-event": "plugin-event";
                     manual: "manual";
                 }>;
             }, z.core.$strict>, z.ZodObject<{
@@ -1127,6 +1129,7 @@ export declare const ArtifactProvenanceSession: z.ZodObject<{
                 cron: "cron";
                 occurrence: "occurrence";
                 "uri-change": "uri-change";
+                "plugin-event": "plugin-event";
                 manual: "manual";
             }>;
         }, z.core.$strict>, z.ZodObject<{
@@ -1767,7 +1770,9 @@ export declare function dedupeClaims(claims: readonly PluginCapabilityClaimV1[])
 /**
  * The one `toolName` a directory plugin may declare for the tool `localId`: every `.` in
  * `namespace` becomes `_`, then one more `_` joins `localId`. The directory verdict drops a tool
- * that declares anything else. Bundled plugins are not held to it.
+ * that declares anything else, except a name the host grandfathers for that plugin (Bonsai's own
+ * plugins keep the names they shipped with before moving to files). Compiled plugins never pass
+ * through the verdict.
  *
  * Injective over every schema-valid pair, so two directory plugins can only derive the same tool
  * name by sharing both namespace and localId. Neither input can contain `_` (`PLUGIN_ID_PATTERN`
@@ -2072,6 +2077,12 @@ export declare interface JudgeKayPluginDirectoryInput {
      * manifest is a refusal naming that commit rather than "not a plugin".
      */
     readonly revision?: string | undefined;
+    /**
+     * The tool names the plugin the manifest names may keep although they are not
+     * {@link deriveDirectoryPluginToolName}'s. The host decides: Bonsai lets its own plugins keep the
+     * names they shipped with before they moved to files (the wave 2 plan's P14). Absent keeps none.
+     */
+    readonly grandfatheredToolNames?: ((pluginId: string) => readonly string[]) | undefined;
 }
 
 /** Maximum UTF-8 JSON size of one plugin app-data live change. */
@@ -2097,7 +2108,7 @@ export declare const KAY_EVENT_PUBLISHER_ID: "kay";
 declare const KAY_PLUGIN_COMPATIBILITY_REFUSAL_CODES: readonly ["unsupported-protocol", "sdk-range-unsatisfied", "sdk-range-unsupported", "host-sdk-version-invalid"];
 
 /** Released SDK contracts still implemented by the host, alongside its current SDK. */
-export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly ["0.8.0", "0.8.1", "0.8.2", "0.8.3", "0.8.4", "0.8.5", "0.9.0", "0.9.1", "0.10.0", "0.11.0", "0.11.1", "0.12.0", "0.12.1", "0.12.2", "0.12.3", "0.12.4", "0.12.5", "0.13.0", "0.13.1", "0.13.2", "0.13.3", "0.13.4", "0.13.5", "0.13.6", "0.13.7", "0.13.8", "0.13.9", "0.13.10", "0.14.0"];
+export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly string[];
 
 /** The file whose presence makes a directory a plugin. A directory without one is not a plugin. */
 export declare const KAY_PLUGIN_MANIFEST_FILENAME = "kay-plugin.json";
@@ -2425,8 +2436,14 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * 0.14.1 adds the owned-service `kay.app` auth list operation and `listAccounts`.
  * Existing resolve-only `has` callers retain account bounds and now probe metadata without
  * resolving credentials. Plugins using list declare `^0.14.1` so older hosts refuse at load.
+ *
+ * 0.15.0 replaces plugin-event publish arguments and requires resource URI declarations.
+ * Pre-0.15 SDK contracts are no longer retained: their publishers cannot satisfy this contract.
+ *
+ * 0.15.1 adds plugin-event automation conditions and public event-identity run matches.
+ * The host retains 0.15.0; plugins using the new condition declare ^0.15.1.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.14.1";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.15.1";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2589,16 +2606,16 @@ export declare const KayAppTargetManifest: z.ZodObject<{
             responseSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
         }, z.core.$strict>>>;
         uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            localId: z.ZodString;
             displayName: z.ZodOptional<z.ZodString>;
             schemes: z.ZodArray<z.ZodString>;
-            localId: z.ZodString;
         }, z.core.$strict>>>;
         dataSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
             scope: z.ZodEnum<{
                 session: "session";
-                account: "account";
                 runtime: "runtime";
+                account: "account";
             }>;
             snapshot: z.ZodObject<{
                 version: z.ZodNumber;
@@ -2648,7 +2665,9 @@ export declare const KayAppTargetManifest: z.ZodObject<{
             displayName: z.ZodOptional<z.ZodString>;
             description: z.ZodOptional<z.ZodString>;
             version: z.ZodDefault<z.ZodNumber>;
-            payloadSchema: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+            uriScheme: z.ZodString;
+            relatedKeys: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+            payloadSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
         }, z.core.$strict>>>;
         notificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
@@ -2687,6 +2706,7 @@ export declare const KayAppTargetManifest: z.ZodObject<{
             url: z.ZodString;
             auth: z.ZodOptional<z.ZodEnum<{
                 oauth: "oauth";
+                "api-key": "api-key";
                 none: "none";
             }>>;
             authService: z.ZodOptional<z.ZodString>;
@@ -2971,16 +2991,16 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         responseSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
                     }, z.core.$strict>>>;
                     uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        localId: z.ZodString;
                         displayName: z.ZodOptional<z.ZodString>;
                         schemes: z.ZodArray<z.ZodString>;
-                        localId: z.ZodString;
                     }, z.core.$strict>>>;
                     dataSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
                         scope: z.ZodEnum<{
                             session: "session";
-                            account: "account";
                             runtime: "runtime";
+                            account: "account";
                         }>;
                         snapshot: z.ZodObject<{
                             version: z.ZodNumber;
@@ -3030,7 +3050,9 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         displayName: z.ZodOptional<z.ZodString>;
                         description: z.ZodOptional<z.ZodString>;
                         version: z.ZodDefault<z.ZodNumber>;
-                        payloadSchema: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+                        uriScheme: z.ZodString;
+                        relatedKeys: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+                        payloadSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
                     }, z.core.$strict>>>;
                     notificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
@@ -3069,6 +3091,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         url: z.ZodString;
                         auth: z.ZodOptional<z.ZodEnum<{
                             oauth: "oauth";
+                            "api-key": "api-key";
                             none: "none";
                         }>>;
                         authService: z.ZodOptional<z.ZodString>;
@@ -3175,6 +3198,8 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                                 "skills.read": "skills.read";
                                 "automations.run": "automations.run";
                                 "navigation.open-session": "navigation.open-session";
+                                "artifacts.read": "artifacts.read";
+                                "artifacts.preview": "artifacts.preview";
                                 "cost.read": "cost.read";
                                 "billing.read": "billing.read";
                                 "context.read": "context.read";
@@ -3187,6 +3212,16 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                                 "workspace.arrange": "workspace.arrange";
                             }>>>;
                         }, z.core.$strict>>;
+                        activityRail: z.ZodOptional<z.ZodObject<{
+                            section: z.ZodOptional<z.ZodEnum<{
+                                primary: "primary";
+                                plugins: "plugins";
+                            }>>;
+                            order: z.ZodOptional<z.ZodNumber>;
+                            icon: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                                svg: z.ZodString;
+                            }, z.core.$strict>]>>;
+                        }, z.core.$strict>>;
                     }, z.core.$strict>>>;
                     themes: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
@@ -3696,6 +3731,8 @@ export declare const KayUiAppHostCapability: z.ZodEnum<{
     "skills.read": "skills.read";
     "automations.run": "automations.run";
     "navigation.open-session": "navigation.open-session";
+    "artifacts.read": "artifacts.read";
+    "artifacts.preview": "artifacts.preview";
     "cost.read": "cost.read";
     "billing.read": "billing.read";
     "context.read": "context.read";
@@ -3845,6 +3882,8 @@ export declare const KayUiTargetManifest: z.ZodObject<{
                     "skills.read": "skills.read";
                     "automations.run": "automations.run";
                     "navigation.open-session": "navigation.open-session";
+                    "artifacts.read": "artifacts.read";
+                    "artifacts.preview": "artifacts.preview";
                     "cost.read": "cost.read";
                     "billing.read": "billing.read";
                     "context.read": "context.read";
@@ -3857,6 +3896,16 @@ export declare const KayUiTargetManifest: z.ZodObject<{
                     "workspace.arrange": "workspace.arrange";
                 }>>>;
             }, z.core.$strict>>;
+            activityRail: z.ZodOptional<z.ZodObject<{
+                section: z.ZodOptional<z.ZodEnum<{
+                    primary: "primary";
+                    plugins: "plugins";
+                }>>;
+                order: z.ZodOptional<z.ZodNumber>;
+                icon: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    svg: z.ZodString;
+                }, z.core.$strict>]>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>>;
         themes: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
@@ -3924,9 +3973,30 @@ export declare const LocalContributionId: z.ZodString;
 
 export declare type LocalContributionId = z.infer<typeof LocalContributionId>;
 
-/** Absent ⇒ `"oauth"` (resolution always carries the applied default). */
+/**
+ * The auth scheme kind each authenticated {@link McpServerAuthMode} signs in through. Composition
+ * keeps a server only when its auth service declares exactly one scheme of this kind, and the MCP
+ * credential port binds the server to that scheme, so the two read this one table.
+ */
+export declare const MCP_SIGN_IN_SCHEME_KIND: {
+    readonly oauth: "delegated";
+    readonly "api-key": "api-key";
+};
+
+/**
+ * How a vendored MCP server authenticates. Absent ⇒ `"oauth"` (resolution always carries the
+ * applied default).
+ *
+ * - `"oauth"`: the server runs its own OAuth. The owning auth service declares exactly one
+ *   `delegated` scheme, and the daemon's MCP host runs the sign-in.
+ * - `"api-key"`: the person pastes a key the vendor issued. The owning auth service declares exactly
+ *   one `api-key` scheme, and the host sends the stored key as `Authorization: Bearer <key>` on every
+ *   request. Only for a vendor whose hosted server takes a static bearer token.
+ * - `"none"`: the server needs no credential.
+ */
 export declare const McpServerAuthMode: z.ZodEnum<{
     oauth: "oauth";
+    "api-key": "api-key";
     none: "none";
 }>;
 
@@ -3936,9 +4006,10 @@ export declare type McpServerAuthMode = z.infer<typeof McpServerAuthMode>;
  * A vendored MCP server a plugin ships: a pointer to a VENDOR-HOSTED MCP endpoint, never a command
  * this host would spawn. v1 is hosted Streamable HTTP only — no stdio (`command`/`args`/`env`) and
  * no custom headers — enforced by this being a `strictObject`, so a stdio-shaped entry fails
- * schema outright rather than being silently ignored. Effective OAuth (explicit `auth: "oauth"`
- * or omitted `auth`) requires `authService`; `auth: "none"` may omit it. `authService` is a local
- * id that must resolve within this same manifest; unlike `uriModule.authService`, qualified foreign
+ * schema outright rather than being silently ignored. Every authenticated mode (`"oauth"`, which is
+ * also the default, and `"api-key"`) requires `authService`; `auth: "none"` may omit it.
+ * `authService` is a local id that must resolve within this same manifest; unlike
+ * `uriModule.authService`, qualified foreign
  * service refs are not permitted because the MCP binding belongs to the plugin that ships it.
  * A declared server is hosted
  * only for a plugin holding `mcp.host-server` for its name and URL (the release's own plugins hold
@@ -3948,6 +4019,7 @@ export declare const McpServerContribution: z.ZodObject<{
     url: z.ZodString;
     auth: z.ZodOptional<z.ZodEnum<{
         oauth: "oauth";
+        "api-key": "api-key";
         none: "none";
     }>>;
     authService: z.ZodOptional<z.ZodString>;
@@ -3964,6 +4036,7 @@ export declare const McpServerContributions: z.ZodRecord<z.ZodString, z.ZodObjec
     url: z.ZodString;
     auth: z.ZodOptional<z.ZodEnum<{
         oauth: "oauth";
+        "api-key": "api-key";
         none: "none";
     }>>;
     authService: z.ZodOptional<z.ZodString>;
@@ -4090,6 +4163,8 @@ export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network
  *  hostile or accidental multi-megabyte error can never blow up a log line or a render surface. */
 export declare const PLUGIN_DIAGNOSTIC_MESSAGE_CAP = 300;
 
+export declare const PLUGIN_EVENT_ID_MAX_BYTES = 1024;
+
 /** The root `<svg>` attribute a tile icon declares itself with. */
 export declare const PLUGIN_ICON_SHAPE_ATTRIBUTE = "data-icon-shape";
 
@@ -5627,11 +5702,86 @@ export declare const PluginEventDefinitionContribution: z.ZodObject<{
     displayName: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodString>;
     version: z.ZodDefault<z.ZodNumber>;
-    payloadSchema: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+    uriScheme: z.ZodString;
+    relatedKeys: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodString>>>;
+    payloadSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>>;
 }, z.core.$strict>;
 
 export declare type PluginEventDefinitionContribution = z.infer<typeof PluginEventDefinitionContribution>;
 
+export declare const PluginEventEnvelope: z.ZodObject<{
+    id: z.ZodString;
+    localId: z.ZodString;
+    type: z.ZodString;
+    version: z.ZodNumber;
+    uri: z.ZodString;
+    related: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    key: z.ZodOptional<z.ZodString>;
+    occurredAt: z.ZodISODateTime;
+    publishedAt: z.ZodISODateTime;
+    source: z.ZodObject<{
+        poller: z.ZodOptional<z.ZodString>;
+        runId: z.ZodOptional<z.ZodString>;
+        layer: z.ZodLiteral<"runtime">;
+        pluginId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    payload: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+}, z.core.$strict>;
+
+export declare type PluginEventEnvelope = z.infer<typeof PluginEventEnvelope>;
+
+export declare const PluginEventId: z.ZodString;
+
+export declare type PluginEventId = z.infer<typeof PluginEventId>;
+
+export declare const PluginEventLocalId: z.ZodString;
+
+export declare type PluginEventLocalId = z.infer<typeof PluginEventLocalId>;
+
+export declare const PluginEventPublishInput: z.ZodObject<{
+    uri: z.ZodString;
+    related: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    key: z.ZodOptional<z.ZodString>;
+    occurredAt: z.ZodOptional<z.ZodISODateTime>;
+    source: z.ZodOptional<z.ZodObject<{
+        poller: z.ZodOptional<z.ZodString>;
+        runId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    payload: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+}, z.core.$strict>;
+
+export declare type PluginEventPublishInput = z.infer<typeof PluginEventPublishInput>;
+
+export declare const PluginEventPublishSource: z.ZodObject<{
+    poller: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+
+export declare type PluginEventPublishSource = z.infer<typeof PluginEventPublishSource>;
+
+export declare const PluginEventRelated: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>;
+
+export declare type PluginEventRelated = z.infer<typeof PluginEventRelated>;
+
+export declare const PluginEventSource: z.ZodObject<{
+    poller: z.ZodOptional<z.ZodString>;
+    runId: z.ZodOptional<z.ZodString>;
+    layer: z.ZodLiteral<"runtime">;
+    pluginId: z.ZodString;
+    sessionId: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+
+export declare type PluginEventSource = z.infer<typeof PluginEventSource>;
+
+export declare const PluginEventTimestamp: z.ZodISODateTime;
+
+export declare type PluginEventTimestamp = z.infer<typeof PluginEventTimestamp>;
+
+export declare const PluginEventUri: z.ZodString;
+
+export declare type PluginEventUri = z.infer<typeof PluginEventUri>;
+
 /**
  * How the host connects an `external-cli` scheme (SDK 0.13.10). Bonsai reads it for its own plugins
  * only; any other plugin's is ignored, with a load diagnostic.
@@ -6617,8 +6767,8 @@ export declare const ResolvedKayAppDataSource: z.ZodObject<{
     globalId: z.ZodString;
     scope: z.ZodEnum<{
         session: "session";
-        account: "account";
         runtime: "runtime";
+        account: "account";
     }>;
     snapshot: z.ZodObject<{
         version: z.ZodNumber;
@@ -6670,6 +6820,7 @@ export declare const ResolvedKayAppMcpServer: z.ZodObject<{
     url: z.ZodString;
     auth: z.ZodEnum<{
         oauth: "oauth";
+        "api-key": "api-key";
         none: "none";
     }>;
     authServiceId: z.ZodOptional<z.ZodString>;
@@ -6715,6 +6866,16 @@ export declare const ResolvedKayUiApp: z.ZodObject<{
     localId: z.ZodString;
     globalId: z.ZodString;
     displayName: z.ZodString;
+    activityRail: z.ZodOptional<z.ZodObject<{
+        section: z.ZodOptional<z.ZodEnum<{
+            primary: "primary";
+            plugins: "plugins";
+        }>>;
+        order: z.ZodOptional<z.ZodNumber>;
+        icon: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            svg: z.ZodString;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>>;
     description: z.ZodOptional<z.ZodString>;
     icon: z.ZodOptional<z.ZodString>;
     runtime: z.ZodLiteral<"kay.react-app.v1">;
@@ -6736,6 +6897,8 @@ export declare const ResolvedKayUiApp: z.ZodObject<{
             "skills.read": "skills.read";
             "automations.run": "automations.run";
             "navigation.open-session": "navigation.open-session";
+            "artifacts.read": "artifacts.read";
+            "artifacts.preview": "artifacts.preview";
             "cost.read": "cost.read";
             "billing.read": "billing.read";
             "context.read": "context.read";
@@ -7561,8 +7724,8 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         globalId: z.ZodString;
         scope: z.ZodEnum<{
             session: "session";
-            account: "account";
             runtime: "runtime";
+            account: "account";
         }>;
         snapshot: z.ZodObject<{
             version: z.ZodNumber;
@@ -7614,6 +7777,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         url: z.ZodString;
         auth: z.ZodEnum<{
             oauth: "oauth";
+            "api-key": "api-key";
             none: "none";
         }>;
         authServiceId: z.ZodOptional<z.ZodString>;
@@ -7659,6 +7823,16 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         localId: z.ZodString;
         globalId: z.ZodString;
         displayName: z.ZodString;
+        activityRail: z.ZodOptional<z.ZodObject<{
+            section: z.ZodOptional<z.ZodEnum<{
+                primary: "primary";
+                plugins: "plugins";
+            }>>;
+            order: z.ZodOptional<z.ZodNumber>;
+            icon: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                svg: z.ZodString;
+            }, z.core.$strict>]>>;
+        }, z.core.$strict>>;
         description: z.ZodOptional<z.ZodString>;
         icon: z.ZodOptional<z.ZodString>;
         runtime: z.ZodLiteral<"kay.react-app.v1">;
@@ -7680,6 +7854,8 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 "skills.read": "skills.read";
                 "automations.run": "automations.run";
                 "navigation.open-session": "navigation.open-session";
+                "artifacts.read": "artifacts.read";
+                "artifacts.preview": "artifacts.preview";
                 "cost.read": "cost.read";
                 "billing.read": "billing.read";
                 "context.read": "context.read";
@@ -8240,7 +8416,7 @@ export declare function resolveGlobalContributionId(namespace: PluginNamespace,
 
 export declare function resolveKayPluginContractV1(manifest: KayPluginManifestV1): ResolvedPluginContractV1;
 
-export declare function resolvePluginEventType(namespace: PluginNamespace, localId: LocalContributionId): GlobalContributionId;
+export declare function resolvePluginEventType(namespace: PluginNamespace, localId: PluginEventLocalId): GlobalContributionId;
 
 export declare function resolvePluginNamespace(pluginId: PluginNamespace, namespace?: PluginNamespace): PluginNamespace;
 
@@ -8563,6 +8739,7 @@ export declare const SessionCreator: z.ZodDiscriminatedUnion<[z.ZodObject<{
         cron: "cron";
         occurrence: "occurrence";
         "uri-change": "uri-change";
+        "plugin-event": "plugin-event";
         manual: "manual";
     }>;
 }, z.core.$strict>, z.ZodObject<{
@@ -8707,6 +8884,7 @@ export declare const SessionProvenanceRecord: z.ZodObject<{
             cron: "cron";
             occurrence: "occurrence";
             "uri-change": "uri-change";
+            "plugin-event": "plugin-event";
             manual: "manual";
         }>;
     }, z.core.$strict>, z.ZodObject<{
@@ -9209,12 +9387,28 @@ export declare interface TurnPacketMessage {
     readonly origin: TurnMessageOrigin;
 }
 
+/** An optional direct destination on the host activity rail; no secondary panel. */
+export declare const UiAppActivityRail: z.ZodObject<{
+    section: z.ZodOptional<z.ZodEnum<{
+        primary: "primary";
+        plugins: "plugins";
+    }>>;
+    order: z.ZodOptional<z.ZodNumber>;
+    icon: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        svg: z.ZodString;
+    }, z.core.$strict>]>>;
+}, z.core.$strict>;
+
+export declare type UiAppActivityRail = z.infer<typeof UiAppActivityRail>;
+
 export declare const UiAppCapabilities: z.ZodObject<{
     endpoints: z.ZodOptional<z.ZodArray<z.ZodString>>;
     host: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         "skills.read": "skills.read";
         "automations.run": "automations.run";
         "navigation.open-session": "navigation.open-session";
+        "artifacts.read": "artifacts.read";
+        "artifacts.preview": "artifacts.preview";
         "cost.read": "cost.read";
         "billing.read": "billing.read";
         "context.read": "context.read";
@@ -9251,6 +9445,8 @@ export declare const UiAppContribution: z.ZodObject<{
             "skills.read": "skills.read";
             "automations.run": "automations.run";
             "navigation.open-session": "navigation.open-session";
+            "artifacts.read": "artifacts.read";
+            "artifacts.preview": "artifacts.preview";
             "cost.read": "cost.read";
             "billing.read": "billing.read";
             "context.read": "context.read";
@@ -9263,6 +9459,16 @@ export declare const UiAppContribution: z.ZodObject<{
             "workspace.arrange": "workspace.arrange";
         }>>>;
     }, z.core.$strict>>;
+    activityRail: z.ZodOptional<z.ZodObject<{
+        section: z.ZodOptional<z.ZodEnum<{
+            primary: "primary";
+            plugins: "plugins";
+        }>>;
+        order: z.ZodOptional<z.ZodNumber>;
+        icon: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            svg: z.ZodString;
+        }, z.core.$strict>]>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 
 export declare type UiAppContribution = z.infer<typeof UiAppContribution>;