@yaklabs-ai/plugin-protocol 0.26.3 → 0.27.1

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.26.3"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.27.1"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.26.3",
+  "version": "0.27.1",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -137,6 +137,41 @@ export declare const APPROVAL_KINDS: readonly ["message", "change", "action", "a
 
 export declare type ApprovalAnswer = (typeof APPROVAL_ANSWERS)[number];
 
+export declare const ApprovalCardForm: z.ZodObject<{
+    uri: z.ZodUnion<readonly [z.ZodObject<{
+        fixed: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        value: z.ZodString;
+    }, z.core.$strict>]>;
+    requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    payload: z.ZodRecord<z.ZodString, z.ZodString>;
+    fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+}, z.core.$strict>;
+
+export declare type ApprovalCardForm = z.infer<typeof ApprovalCardForm>;
+
+export declare const ApprovalCardStoredForm: z.ZodObject<{
+    uri: z.ZodUnion<readonly [z.ZodObject<{
+        fixed: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        value: z.ZodString;
+    }, z.core.$strict>]>;
+    requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    payload: z.ZodRecord<z.ZodString, z.ZodString>;
+    fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+    read: z.ZodObject<{
+        revision: z.ZodString;
+        body: z.ZodString;
+        subject: z.ZodOptional<z.ZodString>;
+        to: z.ZodOptional<z.ZodString>;
+        cc: z.ZodOptional<z.ZodString>;
+        bcc: z.ZodOptional<z.ZodString>;
+        attachments: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+
+export declare type ApprovalCardStoredForm = z.infer<typeof ApprovalCardStoredForm>;
+
 export declare type ApprovalKind = (typeof APPROVAL_KINDS)[number];
 
 export declare const approvalKindSchema: z.ZodEnum<{
@@ -158,12 +193,77 @@ export declare type ApprovalOrigin = z.infer<typeof ApprovalOrigin>;
 
 export declare const ApprovalTypeContribution: z.ZodObject<{
     localId: z.ZodString;
-    kind: z.ZodEnum<{
-        message: "message";
-        change: "change";
-        action: "action";
-        access: "access";
-    }>;
+    kind: z.ZodLiteral<"message">;
+    provider: z.ZodString;
+    uriModule: z.ZodString;
+    unknownMessage: z.ZodString;
+    fields: z.ZodObject<{
+        body: z.ZodObject<{
+            key: z.ZodString;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        subject: z.ZodOptional<z.ZodObject<{
+            key: z.ZodString;
+            max: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    presentation: z.ZodObject<{
+        showAccount: z.ZodBoolean;
+        recipient: z.ZodEnum<{
+            target: "target";
+            person: "person";
+        }>;
+    }, z.core.$strict>;
+    forms: z.ZodObject<{
+        inline: z.ZodOptional<z.ZodObject<{
+            uri: z.ZodUnion<readonly [z.ZodObject<{
+                fixed: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                value: z.ZodString;
+            }, z.core.$strict>]>;
+            requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            payload: z.ZodRecord<z.ZodString, z.ZodString>;
+            fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+        }, z.core.$strict>>;
+        saved: z.ZodOptional<z.ZodObject<{
+            uri: z.ZodUnion<readonly [z.ZodObject<{
+                fixed: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                value: z.ZodString;
+            }, z.core.$strict>]>;
+            requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            payload: z.ZodRecord<z.ZodString, z.ZodString>;
+            fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+        }, z.core.$strict>>;
+        stored: z.ZodOptional<z.ZodObject<{
+            uri: z.ZodUnion<readonly [z.ZodObject<{
+                fixed: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                value: z.ZodString;
+            }, z.core.$strict>]>;
+            requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            payload: z.ZodRecord<z.ZodString, z.ZodString>;
+            fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+            read: z.ZodObject<{
+                revision: z.ZodString;
+                body: z.ZodString;
+                subject: z.ZodOptional<z.ZodString>;
+                to: z.ZodOptional<z.ZodString>;
+                cc: z.ZodOptional<z.ZodString>;
+                bcc: z.ZodOptional<z.ZodString>;
+                attachments: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    display: z.ZodOptional<z.ZodObject<{
+        bodyFormat: z.ZodOptional<z.ZodLiteral<"mrkdwn">>;
+        replyField: z.ZodOptional<z.ZodString>;
+        replyLabel: z.ZodOptional<z.ZodString>;
+        facts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            field: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 
 export declare type ApprovalTypeContribution = z.infer<typeof ApprovalTypeContribution>;
@@ -1509,6 +1609,8 @@ declare namespace authoringContributionSchemas {
     export {
         MCP_SIGN_IN_SCHEME_KIND,
         PLUGIN_NOTIFICATION_RULE_HOST_KEYS,
+        ApprovalCardForm,
+        ApprovalCardStoredForm,
         ApprovalTypeContribution,
         UriModuleFacts,
         ToolContribution,
@@ -1629,14 +1731,108 @@ declare const canonicalCommonSchemas: {
 };
 
 declare const canonicalContributionSchemas: {
+    ApprovalCardForm: z.ZodObject<{
+        uri: z.ZodUnion<readonly [z.ZodObject<{
+            fixed: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            value: z.ZodString;
+        }, z.core.$strict>]>;
+        requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        payload: z.ZodRecord<z.ZodString, z.ZodString>;
+        fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+    }, z.core.$strict>;
+    ApprovalCardStoredForm: z.ZodObject<{
+        uri: z.ZodUnion<readonly [z.ZodObject<{
+            fixed: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            value: z.ZodString;
+        }, z.core.$strict>]>;
+        requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        payload: z.ZodRecord<z.ZodString, z.ZodString>;
+        fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+        read: z.ZodObject<{
+            revision: z.ZodString;
+            body: z.ZodString;
+            subject: z.ZodOptional<z.ZodString>;
+            to: z.ZodOptional<z.ZodString>;
+            cc: z.ZodOptional<z.ZodString>;
+            bcc: z.ZodOptional<z.ZodString>;
+            attachments: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>;
     ApprovalTypeContribution: z.ZodObject<{
         localId: z.ZodString;
-        kind: z.ZodEnum<{
-            message: "message";
-            change: "change";
-            action: "action";
-            access: "access";
-        }>;
+        kind: z.ZodLiteral<"message">;
+        provider: z.ZodString;
+        uriModule: z.ZodString;
+        unknownMessage: z.ZodString;
+        fields: z.ZodObject<{
+            body: z.ZodObject<{
+                key: z.ZodString;
+                max: z.ZodNumber;
+            }, z.core.$strict>;
+            subject: z.ZodOptional<z.ZodObject<{
+                key: z.ZodString;
+                max: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        presentation: z.ZodObject<{
+            showAccount: z.ZodBoolean;
+            recipient: z.ZodEnum<{
+                target: "target";
+                person: "person";
+            }>;
+        }, z.core.$strict>;
+        forms: z.ZodObject<{
+            inline: z.ZodOptional<z.ZodObject<{
+                uri: z.ZodUnion<readonly [z.ZodObject<{
+                    fixed: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    value: z.ZodString;
+                }, z.core.$strict>]>;
+                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+            }, z.core.$strict>>;
+            saved: z.ZodOptional<z.ZodObject<{
+                uri: z.ZodUnion<readonly [z.ZodObject<{
+                    fixed: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    value: z.ZodString;
+                }, z.core.$strict>]>;
+                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+            }, z.core.$strict>>;
+            stored: z.ZodOptional<z.ZodObject<{
+                uri: z.ZodUnion<readonly [z.ZodObject<{
+                    fixed: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    value: z.ZodString;
+                }, z.core.$strict>]>;
+                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                read: z.ZodObject<{
+                    revision: z.ZodString;
+                    body: z.ZodString;
+                    subject: z.ZodOptional<z.ZodString>;
+                    to: z.ZodOptional<z.ZodString>;
+                    cc: z.ZodOptional<z.ZodString>;
+                    bcc: z.ZodOptional<z.ZodString>;
+                    attachments: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        display: z.ZodOptional<z.ZodObject<{
+            bodyFormat: z.ZodOptional<z.ZodLiteral<"mrkdwn">>;
+            replyField: z.ZodOptional<z.ZodString>;
+            replyLabel: z.ZodOptional<z.ZodString>;
+            facts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                label: z.ZodString;
+                field: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     UriModuleFacts: z.ZodObject<{
         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -1843,6 +2039,7 @@ declare const canonicalContributionSchemas: {
     }, z.core.$strict>;
     UriModuleContribution: z.ZodObject<{
         authService: z.ZodOptional<z.ZodString>;
+        authScheme: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -2604,9 +2801,9 @@ declare const canonicalContributionSchemas: {
         endpoint: "endpoint";
         storage: "storage";
         command: "command";
+        uriModule: "uriModule";
         authService: "authService";
         app: "app";
-        uriModule: "uriModule";
         configSection: "configSection";
         skill: "skill";
         converter: "converter";
@@ -3699,8 +3896,20 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * registers the named function on any such scheme, its own client's included, and the SDK refuses a
  * plugin whose lookup and manifest disagree. An own-client (`pkce`) scheme may carry the
  * `clientSecret` that goes with its `clientId`. A plugin with an `oauth2` sign-in declares ^0.26.3.
+ *
+ * 0.27.0 makes a message approval card manifest data (#14574). `approvalTypes` declares the card's
+ * facts and forms, and Bonsai draws it with the module's `describeOperation` and sends it with its
+ * `write`. `app.approvals`, its `prepare`, `finalize` and `resolveResource` are gone, and a write can
+ * refuse in the person's words with `UriProviderError.refusalMessage`. No plugin outside this repo
+ * declared a card, so 0.26.3 stays served. A plugin that declares a card declares ^0.27.0.
+ *
+ * 0.27.1 lets a manifest URI module name the exact sign-in scheme its calls use, as a tool can
+ * (#14928): `authScheme`, a scheme of the module's `authService`, local or another plugin's. A
+ * hosted module's code and manifest must agree on it, and the daemon reads it to find an
+ * external-CLI scheme without running the module. A module that runs in the daemon is unchanged,
+ * so this is additive; a plugin whose manifest sets `authScheme` declares ^0.27.1.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.26.3";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.27.1";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -3752,6 +3961,7 @@ export declare const KayAgentTargetManifest: z.ZodObject<{
         }, z.core.$strict>>>;
         uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
             authService: z.ZodOptional<z.ZodString>;
+            authScheme: z.ZodOptional<z.ZodString>;
             knownResources: z.ZodOptional<z.ZodLiteral<true>>;
             describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
             claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -4218,12 +4428,77 @@ export declare const KayAppTargetManifest: z.ZodObject<{
         }, z.core.$strict>>>;
         approvalTypes: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
-            kind: z.ZodEnum<{
-                message: "message";
-                change: "change";
-                action: "action";
-                access: "access";
-            }>;
+            kind: z.ZodLiteral<"message">;
+            provider: z.ZodString;
+            uriModule: z.ZodString;
+            unknownMessage: z.ZodString;
+            fields: z.ZodObject<{
+                body: z.ZodObject<{
+                    key: z.ZodString;
+                    max: z.ZodNumber;
+                }, z.core.$strict>;
+                subject: z.ZodOptional<z.ZodObject<{
+                    key: z.ZodString;
+                    max: z.ZodNumber;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            presentation: z.ZodObject<{
+                showAccount: z.ZodBoolean;
+                recipient: z.ZodEnum<{
+                    target: "target";
+                    person: "person";
+                }>;
+            }, z.core.$strict>;
+            forms: z.ZodObject<{
+                inline: z.ZodOptional<z.ZodObject<{
+                    uri: z.ZodUnion<readonly [z.ZodObject<{
+                        fixed: z.ZodString;
+                    }, z.core.$strict>, z.ZodObject<{
+                        value: z.ZodString;
+                    }, z.core.$strict>]>;
+                    requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                    fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                }, z.core.$strict>>;
+                saved: z.ZodOptional<z.ZodObject<{
+                    uri: z.ZodUnion<readonly [z.ZodObject<{
+                        fixed: z.ZodString;
+                    }, z.core.$strict>, z.ZodObject<{
+                        value: z.ZodString;
+                    }, z.core.$strict>]>;
+                    requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                    fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                }, z.core.$strict>>;
+                stored: z.ZodOptional<z.ZodObject<{
+                    uri: z.ZodUnion<readonly [z.ZodObject<{
+                        fixed: z.ZodString;
+                    }, z.core.$strict>, z.ZodObject<{
+                        value: z.ZodString;
+                    }, z.core.$strict>]>;
+                    requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                    fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                    read: z.ZodObject<{
+                        revision: z.ZodString;
+                        body: z.ZodString;
+                        subject: z.ZodOptional<z.ZodString>;
+                        to: z.ZodOptional<z.ZodString>;
+                        cc: z.ZodOptional<z.ZodString>;
+                        bcc: z.ZodOptional<z.ZodString>;
+                        attachments: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>;
+            display: z.ZodOptional<z.ZodObject<{
+                bodyFormat: z.ZodOptional<z.ZodLiteral<"mrkdwn">>;
+                replyField: z.ZodOptional<z.ZodString>;
+                replyLabel: z.ZodOptional<z.ZodString>;
+                facts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    label: z.ZodString;
+                    field: z.ZodString;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>>;
         eventDefinitions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
@@ -4442,6 +4717,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     }, z.core.$strict>>>;
                     uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         authService: z.ZodOptional<z.ZodString>;
+                        authScheme: z.ZodOptional<z.ZodString>;
                         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
                         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
                         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -4905,12 +5181,77 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     }, z.core.$strict>>>;
                     approvalTypes: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
-                        kind: z.ZodEnum<{
-                            message: "message";
-                            change: "change";
-                            action: "action";
-                            access: "access";
-                        }>;
+                        kind: z.ZodLiteral<"message">;
+                        provider: z.ZodString;
+                        uriModule: z.ZodString;
+                        unknownMessage: z.ZodString;
+                        fields: z.ZodObject<{
+                            body: z.ZodObject<{
+                                key: z.ZodString;
+                                max: z.ZodNumber;
+                            }, z.core.$strict>;
+                            subject: z.ZodOptional<z.ZodObject<{
+                                key: z.ZodString;
+                                max: z.ZodNumber;
+                            }, z.core.$strict>>;
+                        }, z.core.$strict>;
+                        presentation: z.ZodObject<{
+                            showAccount: z.ZodBoolean;
+                            recipient: z.ZodEnum<{
+                                target: "target";
+                                person: "person";
+                            }>;
+                        }, z.core.$strict>;
+                        forms: z.ZodObject<{
+                            inline: z.ZodOptional<z.ZodObject<{
+                                uri: z.ZodUnion<readonly [z.ZodObject<{
+                                    fixed: z.ZodString;
+                                }, z.core.$strict>, z.ZodObject<{
+                                    value: z.ZodString;
+                                }, z.core.$strict>]>;
+                                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                            }, z.core.$strict>>;
+                            saved: z.ZodOptional<z.ZodObject<{
+                                uri: z.ZodUnion<readonly [z.ZodObject<{
+                                    fixed: z.ZodString;
+                                }, z.core.$strict>, z.ZodObject<{
+                                    value: z.ZodString;
+                                }, z.core.$strict>]>;
+                                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                            }, z.core.$strict>>;
+                            stored: z.ZodOptional<z.ZodObject<{
+                                uri: z.ZodUnion<readonly [z.ZodObject<{
+                                    fixed: z.ZodString;
+                                }, z.core.$strict>, z.ZodObject<{
+                                    value: z.ZodString;
+                                }, z.core.$strict>]>;
+                                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                                read: z.ZodObject<{
+                                    revision: z.ZodString;
+                                    body: z.ZodString;
+                                    subject: z.ZodOptional<z.ZodString>;
+                                    to: z.ZodOptional<z.ZodString>;
+                                    cc: z.ZodOptional<z.ZodString>;
+                                    bcc: z.ZodOptional<z.ZodString>;
+                                    attachments: z.ZodOptional<z.ZodString>;
+                                }, z.core.$strict>;
+                            }, z.core.$strict>>;
+                        }, z.core.$strict>;
+                        display: z.ZodOptional<z.ZodObject<{
+                            bodyFormat: z.ZodOptional<z.ZodLiteral<"mrkdwn">>;
+                            replyField: z.ZodOptional<z.ZodString>;
+                            replyLabel: z.ZodOptional<z.ZodString>;
+                            facts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                label: z.ZodString;
+                                field: z.ZodString;
+                            }, z.core.$strict>>>;
+                        }, z.core.$strict>>;
                     }, z.core.$strict>>>;
                     eventDefinitions: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
@@ -6267,6 +6608,9 @@ export declare function mintOperation(input: OperationCaptureInput, clock?: Capt
     readonly gaps: readonly ArtifactProvenanceGap[];
 };
 
+/** The namespace of a qualified auth ref (`google` in `google.oauth`); empty for a local ref. */
+export declare function namespaceOfQualifiedRef(ref: string): string;
+
 export declare const NonEmptyString: z.ZodString;
 
 /**
@@ -8583,9 +8927,9 @@ export declare const PluginContributionKind: z.ZodEnum<{
     endpoint: "endpoint";
     storage: "storage";
     command: "command";
+    uriModule: "uriModule";
     authService: "authService";
     app: "app";
-    uriModule: "uriModule";
     configSection: "configSection";
     skill: "skill";
     converter: "converter";
@@ -9541,6 +9885,12 @@ declare type PrereleaseIdentifier = string | number;
  */
 export declare const PRIVATE_PLUGIN_CAPABILITY_SLUGS: readonly PluginCapabilitySlug[];
 
+/**
+ * What a manifest's JSON declares about compatibility, read the way a directory's verdict reads it:
+ * apart from the strict schema, because a manifest written for another SDK may not pass that schema.
+ */
+export declare function readKayPluginDeclaredCompatibility(manifest: unknown): DeclaredKayPluginCompatibility | undefined;
+
 export declare const ReferenceOpenBehavior: z.ZodDiscriminatedUnion<[z.ZodObject<{
     kind: z.ZodLiteral<"working-document">;
 }, z.core.$strict>, z.ZodObject<{
@@ -10006,6 +10356,7 @@ export declare const ResolvedKayAgentUriModule: z.ZodObject<{
     schemes: z.ZodArray<z.ZodString>;
     displayName: z.ZodOptional<z.ZodString>;
     authServiceId: z.ZodOptional<z.ZodString>;
+    authSchemeId: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
@@ -10013,14 +10364,80 @@ export declare const ResolvedKayAgentUriModule: z.ZodObject<{
 export declare type ResolvedKayAgentUriModule = z.infer<typeof ResolvedKayAgentUriModule>;
 
 export declare const ResolvedKayAppApprovalType: z.ZodObject<{
+    kind: z.ZodLiteral<"message">;
     localId: z.ZodString;
+    provider: z.ZodString;
+    unknownMessage: z.ZodString;
+    fields: z.ZodObject<{
+        body: z.ZodObject<{
+            key: z.ZodString;
+            max: z.ZodNumber;
+        }, z.core.$strict>;
+        subject: z.ZodOptional<z.ZodObject<{
+            key: z.ZodString;
+            max: z.ZodNumber;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    presentation: z.ZodObject<{
+        showAccount: z.ZodBoolean;
+        recipient: z.ZodEnum<{
+            target: "target";
+            person: "person";
+        }>;
+    }, z.core.$strict>;
+    forms: z.ZodObject<{
+        inline: z.ZodOptional<z.ZodObject<{
+            uri: z.ZodUnion<readonly [z.ZodObject<{
+                fixed: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                value: z.ZodString;
+            }, z.core.$strict>]>;
+            requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            payload: z.ZodRecord<z.ZodString, z.ZodString>;
+            fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+        }, z.core.$strict>>;
+        saved: z.ZodOptional<z.ZodObject<{
+            uri: z.ZodUnion<readonly [z.ZodObject<{
+                fixed: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                value: z.ZodString;
+            }, z.core.$strict>]>;
+            requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            payload: z.ZodRecord<z.ZodString, z.ZodString>;
+            fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+        }, z.core.$strict>>;
+        stored: z.ZodOptional<z.ZodObject<{
+            uri: z.ZodUnion<readonly [z.ZodObject<{
+                fixed: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                value: z.ZodString;
+            }, z.core.$strict>]>;
+            requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            payload: z.ZodRecord<z.ZodString, z.ZodString>;
+            fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+            read: z.ZodObject<{
+                revision: z.ZodString;
+                body: z.ZodString;
+                subject: z.ZodOptional<z.ZodString>;
+                to: z.ZodOptional<z.ZodString>;
+                cc: z.ZodOptional<z.ZodString>;
+                bcc: z.ZodOptional<z.ZodString>;
+                attachments: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+    display: z.ZodOptional<z.ZodObject<{
+        bodyFormat: z.ZodOptional<z.ZodLiteral<"mrkdwn">>;
+        replyField: z.ZodOptional<z.ZodString>;
+        replyLabel: z.ZodOptional<z.ZodString>;
+        facts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            label: z.ZodString;
+            field: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
     globalId: z.ZodString;
-    kind: z.ZodEnum<{
-        message: "message";
-        change: "change";
-        action: "action";
-        access: "access";
-    }>;
+    moduleId: z.ZodString;
+    authService: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 
 export declare type ResolvedKayAppApprovalType = z.infer<typeof ResolvedKayAppApprovalType>;
@@ -10499,9 +10916,9 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             endpoint: "endpoint";
             storage: "storage";
             command: "command";
+            uriModule: "uriModule";
             authService: "authService";
             app: "app";
-            uriModule: "uriModule";
             configSection: "configSection";
             skill: "skill";
             converter: "converter";
@@ -11156,6 +11573,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         schemes: z.ZodArray<z.ZodString>;
         displayName: z.ZodOptional<z.ZodString>;
         authServiceId: z.ZodOptional<z.ZodString>;
+        authSchemeId: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>>>;
@@ -11215,14 +11633,80 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         toolName: z.ZodString;
     }, z.core.$strict>>>;
     kayAppApprovalTypes: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        kind: z.ZodLiteral<"message">;
         localId: z.ZodString;
+        provider: z.ZodString;
+        unknownMessage: z.ZodString;
+        fields: z.ZodObject<{
+            body: z.ZodObject<{
+                key: z.ZodString;
+                max: z.ZodNumber;
+            }, z.core.$strict>;
+            subject: z.ZodOptional<z.ZodObject<{
+                key: z.ZodString;
+                max: z.ZodNumber;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        presentation: z.ZodObject<{
+            showAccount: z.ZodBoolean;
+            recipient: z.ZodEnum<{
+                target: "target";
+                person: "person";
+            }>;
+        }, z.core.$strict>;
+        forms: z.ZodObject<{
+            inline: z.ZodOptional<z.ZodObject<{
+                uri: z.ZodUnion<readonly [z.ZodObject<{
+                    fixed: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    value: z.ZodString;
+                }, z.core.$strict>]>;
+                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+            }, z.core.$strict>>;
+            saved: z.ZodOptional<z.ZodObject<{
+                uri: z.ZodUnion<readonly [z.ZodObject<{
+                    fixed: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    value: z.ZodString;
+                }, z.core.$strict>]>;
+                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+            }, z.core.$strict>>;
+            stored: z.ZodOptional<z.ZodObject<{
+                uri: z.ZodUnion<readonly [z.ZodObject<{
+                    fixed: z.ZodString;
+                }, z.core.$strict>, z.ZodObject<{
+                    value: z.ZodString;
+                }, z.core.$strict>]>;
+                requestFields: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                payload: z.ZodRecord<z.ZodString, z.ZodString>;
+                fixed: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodBoolean]>>>;
+                read: z.ZodObject<{
+                    revision: z.ZodString;
+                    body: z.ZodString;
+                    subject: z.ZodOptional<z.ZodString>;
+                    to: z.ZodOptional<z.ZodString>;
+                    cc: z.ZodOptional<z.ZodString>;
+                    bcc: z.ZodOptional<z.ZodString>;
+                    attachments: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>;
+        display: z.ZodOptional<z.ZodObject<{
+            bodyFormat: z.ZodOptional<z.ZodLiteral<"mrkdwn">>;
+            replyField: z.ZodOptional<z.ZodString>;
+            replyLabel: z.ZodOptional<z.ZodString>;
+            facts: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                label: z.ZodString;
+                field: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
         globalId: z.ZodString;
-        kind: z.ZodEnum<{
-            message: "message";
-            change: "change";
-            action: "action";
-            access: "access";
-        }>;
+        moduleId: z.ZodString;
+        authService: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
     kayAppDataSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
         localId: z.ZodString;
@@ -11403,9 +11887,9 @@ export declare const ResolvedPluginContributionId: z.ZodObject<{
         endpoint: "endpoint";
         storage: "storage";
         command: "command";
+        uriModule: "uriModule";
         authService: "authService";
         app: "app";
-        uriModule: "uriModule";
         configSection: "configSection";
         skill: "skill";
         converter: "converter";
@@ -13065,6 +13549,7 @@ export declare type UiSlotContribution = z.infer<typeof UiSlotContribution>;
 
 export declare const UriModuleContribution: z.ZodObject<{
     authService: z.ZodOptional<z.ZodString>;
+    authScheme: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
     claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{

package/dist/index.js

@@ -222,8 +222,8 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 // packages/plugin-protocol/dist/common.js
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.26.3";
-var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [];
+var KAY_PLUGIN_SDK_VERSION = "0.27.1";
+var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = ["0.26.3"];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
   "kay.app",
@@ -1235,6 +1235,9 @@ function isQualifiedAuthServiceRef(ref) {
 function isQualifiedAuthSchemeRef(ref) {
   return ref.includes(".");
 }
+function namespaceOfQualifiedRef(ref) {
+  return ref.slice(0, Math.max(0, ref.lastIndexOf(".")));
+}
 function resolveAdapterId(globalId, declaredAdapterId) {
   return declaredAdapterId ?? globalId;
 }
@@ -2666,6 +2669,8 @@ __export(contributions_exports, {
   AppDataSourceContribution: () => AppDataSourceContribution,
   AppEventSubscription: () => AppEventSubscription,
   AppUriModuleContribution: () => AppUriModuleContribution,
+  ApprovalCardForm: () => ApprovalCardForm,
+  ApprovalCardStoredForm: () => ApprovalCardStoredForm,
   ApprovalTypeContribution: () => ApprovalTypeContribution,
   ArtifactUriModuleContribution: () => ArtifactUriModuleContribution,
   CliBindingContribution: () => CliBindingContribution,
@@ -2815,12 +2820,77 @@ var PLUGIN_NOTIFICATION_RULE_HOST_KEYS = [
 ];
 function createContributionsSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
-  const { AuthServiceReference: AuthServiceReference2, CliAuthEnvVarName: CliAuthEnvVarName2, CliBinaryName: CliBinaryName2, FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginToolName: PluginToolName2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
+  const { AuthSchemeReference: AuthSchemeReference2, AuthServiceReference: AuthServiceReference2, CliAuthEnvVarName: CliAuthEnvVarName2, CliBinaryName: CliBinaryName2, FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginToolName: PluginToolName2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { ScopeRequirement: ScopeRequirement2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const OptionalDisplayName = NonEmptyString3.optional();
+  const ApprovalCardValueName = z12.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/u, "must be a plain field name");
+  const ApprovalCardForm2 = z12.strictObject({
+    /** Where the write goes: a fixed address, or the card value that names one. */
+    uri: z12.union([
+      z12.strictObject({ fixed: NonEmptyString3 }),
+      z12.strictObject({ value: ApprovalCardValueName })
+    ]),
+    /** The delivery request fields this kind of card accepts, beyond provider and account. */
+    requestFields: z12.array(ApprovalCardValueName).optional(),
+    /** Payload field to the card value it is filled from. An absent value or empty list is left out. */
+    payload: z12.record(ApprovalCardValueName, ApprovalCardValueName),
+    /** Payload fields with a constant value. */
+    fixed: z12.record(ApprovalCardValueName, z12.union([z12.string(), z12.boolean()])).optional()
+  });
+  const ApprovalCardStoredForm2 = ApprovalCardForm2.extend({
+    read: z12.strictObject({
+      revision: ApprovalCardValueName,
+      body: ApprovalCardValueName,
+      subject: ApprovalCardValueName.optional(),
+      to: ApprovalCardValueName.optional(),
+      cc: ApprovalCardValueName.optional(),
+      bcc: ApprovalCardValueName.optional(),
+      /** A list of `{ filename? }` objects: a card that has any cannot be sent by the app. */
+      attachments: ApprovalCardValueName.optional()
+    })
+  });
+  const ApprovalCardField = z12.strictObject({
+    key: ApprovalCardValueName,
+    max: z12.number().int().positive()
+  });
   const ApprovalTypeContribution2 = z12.strictObject({
     localId: LocalContributionId2,
-    kind: approvalKindSchema
+    kind: z12.literal("message"),
+    /** The URI scheme of `uriModule` that cards of this type write to. */
+    provider: UriScheme2,
+    /** The local id of this plugin's URI module that handles the write. */
+    uriModule: LocalContributionId2,
+    /** Shown when a send's outcome cannot be confirmed: where the person checks. */
+    unknownMessage: NonEmptyString3,
+    /** The payload fields holding the text a person may edit. A `subject` makes this a mail type. */
+    fields: z12.strictObject({
+      body: ApprovalCardField,
+      subject: ApprovalCardField.optional()
+    }),
+    presentation: z12.strictObject({
+      showAccount: z12.boolean(),
+      recipient: z12.enum(["person", "target"])
+    }),
+    /** One form per kind of card this provider supports. A kind left out is never bound. */
+    forms: z12.strictObject({
+      inline: ApprovalCardForm2.optional(),
+      saved: ApprovalCardForm2.optional(),
+      stored: ApprovalCardStoredForm2.optional()
+    }),
+    /** What the card shows beyond its text, read from the delivery request. */
+    display: z12.strictObject({
+      /** How the renderer reads the body. Absent is Markdown, or plain for a stored draft. */
+      bodyFormat: z12.literal("mrkdwn").optional(),
+      /** The request field naming what this card replies to. */
+      replyField: ApprovalCardValueName.optional(),
+      /** Shown instead of the reply's id when that id means nothing to a person. */
+      replyLabel: NonEmptyString3.optional(),
+      /** Further request fields shown as labelled lines. */
+      facts: z12.array(z12.strictObject({
+        label: NonEmptyString3,
+        field: ApprovalCardValueName
+      })).optional()
+    }).optional()
   });
   const ToolContribution2 = z12.strictObject({
     localId: LocalContributionId2,
@@ -2982,6 +3052,12 @@ function createContributionsSchemas(canonical) {
     // plugin's already-minted global id and is recorded, not resolved, here (see
     // `consumesAuthServices` on the resolved contract).
     authService: AuthServiceReference2.optional(),
+    // A scheme of the module's `authService`: every call to this module must use exactly this
+    // scheme. A local ref names a scheme of a service in this manifest; a dotted ref names a scheme
+    // of another plugin's service (`google.oauth`). The daemon reads it here because it may hold
+    // only the manifest (a plugin that runs in the plugin host), and the host refuses a module
+    // whose code names a different one.
+    authScheme: AuthSchemeReference2.optional(),
     // Opt this module's traffic into the daemon's known-resources ledger: the
     // HOST records the canonical URIs (plus title/summary/mime facts) that flow
     // through the module's successful read/list/search resolutions (a read only
@@ -3000,6 +3076,7 @@ function createContributionsSchemas(canonical) {
   const AppUriModuleContribution2 = UriModuleContribution2.omit({
     authActions: true,
     authService: true,
+    authScheme: true,
     knownResources: true,
     describesOperations: true
   });
@@ -3488,6 +3565,8 @@ function createContributionsSchemas(canonical) {
     "configSection"
   ]);
   return {
+    ApprovalCardForm: ApprovalCardForm2,
+    ApprovalCardStoredForm: ApprovalCardStoredForm2,
     ApprovalTypeContribution: ApprovalTypeContribution2,
     UriModuleFacts: UriModuleFacts2,
     ToolContribution: ToolContribution2,
@@ -3544,7 +3623,7 @@ function createContributionsSchemas(canonical) {
     PluginContributionKind: PluginContributionKind2
   };
 }
-var { ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiAppActivityRail, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
+var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiAppActivityRail, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
 var canonicalContributionSchemas = createContributionsSchemas(true);
 
 // packages/plugin-protocol/dist/icon-shape.js
@@ -4271,6 +4350,27 @@ function createManifestSchemas(canonical) {
     reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "eventDefinitions"], manifest.targets?.kay?.app?.contributes?.eventDefinitions, "plugin event definition");
     reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "contextContributors"], manifest.targets?.kay?.app?.contributes?.contextContributors, "context contributor");
     reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "approvalTypes"], manifest.targets?.kay?.app?.contributes?.approvalTypes, "approval type");
+    for (const [index, type] of (manifest.targets?.kay?.app?.contributes?.approvalTypes ?? []).entries()) {
+      const module = [
+        ...manifest.targets?.kay?.agent?.contributes?.uriModules ?? [],
+        ...manifest.targets?.kay?.app?.contributes?.uriModules ?? []
+      ].find((candidate) => candidate.localId === type.uriModule);
+      if (module === void 0 || !module.schemes.includes(type.provider)) {
+        ctx.addIssue({
+          code: "custom",
+          path: [
+            "targets",
+            "kay",
+            "app",
+            "contributes",
+            "approvalTypes",
+            index,
+            "uriModule"
+          ],
+          message: `approval type ${type.localId} must name one of this plugin's URI modules, with provider ${type.provider} among its schemes`
+        });
+      }
+    }
     const syntheticContributionIds = collectSyntheticContributionIds(manifest);
     for (const contribution of collectDeclaredContributionIds(manifest)) {
       if (syntheticContributionIds.has(contribution.localId)) {
@@ -4344,6 +4444,13 @@ function createManifestSchemas(canonical) {
           message: `uri module ${module.localId} references unknown auth service ${module.authService}`
         });
       }
+      if (module.authScheme !== void 0 && (module.authService === void 0 || (isQualifiedAuthServiceRef(module.authService) ? namespaceOfQualifiedRef(module.authScheme) !== namespaceOfQualifiedRef(module.authService) : authSchemeIdsByService.get(module.authService)?.has(module.authScheme) !== true))) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["targets", "kay", "agent", "contributes", "uriModules"],
+          message: `uri module ${module.localId} names auth scheme ${module.authScheme}, which is not a scheme of its authService`
+        });
+      }
     }
     for (const [index, tool] of (manifest.targets?.kay?.agent?.contributes?.tools ?? []).entries()) {
       const path = ["targets", "kay", "agent", "contributes", "tools", index];
@@ -4887,7 +4994,7 @@ function boundPluginDiagnosticMessage(message) {
 import { z as z14 } from "zod";
 function createResolvedContractSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
-  const { KayUiAppHostCapability: KayUiAppHostCapability2, UiAppActivityRail: UiAppActivityRail2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
+  const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, UiAppActivityRail: UiAppActivityRail2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, GlobalContributionId: GlobalContributionId2, HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, PluginToolName: PluginToolName2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginExternalCliConnect: PluginExternalCliConnect2, PluginOAuthClientSupplier: PluginOAuthClientSupplier2 } = canonical ? canonicalManifestSchemas : manifest_exports;
   const { ResolvedPluginGrants: ResolvedPluginGrants2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
@@ -4952,10 +5059,14 @@ function createResolvedContractSchemas(canonical) {
       });
     }
   });
-  const ResolvedKayAppApprovalType2 = z14.strictObject({
-    localId: LocalContributionId2,
+  const ResolvedKayAppApprovalType2 = ApprovalTypeContribution2.omit({
+    uriModule: true
+  }).extend({
     globalId: GlobalContributionId2,
-    kind: approvalKindSchema
+    /** The global id of the URI module that handles the write. */
+    moduleId: GlobalContributionId2,
+    /** The auth service that module signs in through, whose accounts a card may send from. */
+    authService: GlobalContributionId2.optional()
   });
   const ResolvedKayAppWhiteboardType2 = z14.strictObject({
     localId: LocalContributionId2,
@@ -4981,6 +5092,8 @@ function createResolvedContractSchemas(canonical) {
     schemes: z14.array(UriScheme2).min(1),
     displayName: NonEmptyString3.optional(),
     authServiceId: GlobalContributionId2.optional(),
+    /** Mirrors `UriModuleContribution.authScheme`; a local ref takes the plugin's namespace. */
+    authSchemeId: GlobalContributionId2.optional(),
     /** Mirrors `UriModuleContribution.knownResources` (host-side recording opt-in). */
     knownResources: z14.literal(true).optional(),
     /** Mirrors `UriModuleContribution.describesOperations`. */
@@ -5554,11 +5667,17 @@ function resolveKayPluginContractV1(manifest) {
     change: source.change,
     ...source.read === void 0 ? {} : { read: source.read }
   }));
-  const kayAppApprovalTypes = manifest.targets?.kay?.app?.contributes?.approvalTypes?.map((type) => ({
-    localId: type.localId,
-    globalId: resolveGlobalContributionId(namespace, type.localId),
-    kind: type.kind
-  }));
+  const kayAppApprovalTypes = manifest.targets?.kay?.app?.contributes?.approvalTypes?.map(({ uriModule, ...type }) => {
+    const authService = manifest.targets?.kay?.agent?.contributes?.uriModules?.find((candidate) => candidate.localId === uriModule)?.authService;
+    return {
+      ...type,
+      globalId: resolveGlobalContributionId(namespace, type.localId),
+      moduleId: resolveGlobalContributionId(namespace, uriModule),
+      ...authService === void 0 ? {} : {
+        authService: authService.includes(".") ? authService : resolveGlobalContributionId(namespace, authService)
+      }
+    };
+  });
   const kayAppWhiteboardTypes = manifest.targets?.kay?.app?.contributes?.whiteboardTypes?.map((type) => ({
     localId: type.localId,
     globalId: resolveGlobalContributionId(namespace, type.localId),
@@ -5589,6 +5708,9 @@ function resolveKayPluginContractV1(manifest) {
     ...module.authService === void 0 ? {} : {
       authServiceId: isQualifiedAuthServiceRef(module.authService) ? module.authService : resolveGlobalContributionId(namespace, module.authService)
     },
+    ...module.authScheme === void 0 ? {} : {
+      authSchemeId: isQualifiedAuthSchemeRef(module.authScheme) ? module.authScheme : resolveGlobalContributionId(namespace, module.authScheme)
+    },
     ...module.knownResources === void 0 ? {} : { knownResources: module.knownResources },
     ...module.describesOperations === void 0 ? {} : { describesOperations: module.describesOperations },
     ...uriModuleFacts(module)
@@ -5708,7 +5830,7 @@ function safeResolveKayPluginContractV1(manifest) {
     throw error;
   }
 }
-function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
+function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
   return facts;
 }
 
@@ -5888,6 +6010,10 @@ function keepNamespaceDerivedTools(contract, grandfathered) {
     misnamedTools
   };
 }
+function readKayPluginDeclaredCompatibility(manifest) {
+  const head = ReadableManifestHead.safeParse(manifest);
+  return head.success ? head.data.compatibility : void 0;
+}
 function namedIn(head) {
   if (head.id === void 0)
     return KAY_PLUGIN_MANIFEST_FILENAME;
@@ -6399,6 +6525,8 @@ export {
   AppDataSourceRead,
   AppEventSubscription,
   AppUriModuleContribution,
+  ApprovalCardForm,
+  ApprovalCardStoredForm,
   ApprovalOrigin,
   ApprovalTypeContribution,
   ArtifactGenerationId,
@@ -6659,6 +6787,7 @@ export {
   kayPluginHostCompatibility,
   kayUiEventSubscriptionsFromManifest,
   mintOperation,
+  namespaceOfQualifiedRef,
   normalizeNetworkConnectHost,
   parseArtifactOutputUri,
   parseArtifactProvenanceCaptureContext,
@@ -6670,6 +6799,7 @@ export {
   parseSemver,
   pluginIconShape,
   precedingPersonMessages,
+  readKayPluginDeclaredCompatibility,
   refineWebSessionScopeConfined,
   resolveAdapterId,
   resolveGlobalContributionId,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.26.3",
+  "version": "0.27.1",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",