@yaklabs-ai/plugin-protocol 0.27.0 → 0.27.1

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.27.0"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.27.1"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -2039,6 +2039,7 @@ declare const canonicalContributionSchemas: {
     }, z.core.$strict>;
     UriModuleContribution: z.ZodObject<{
         authService: z.ZodOptional<z.ZodString>;
+        authScheme: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -3901,8 +3902,14 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * `write`. `app.approvals`, its `prepare`, `finalize` and `resolveResource` are gone, and a write can
  * refuse in the person's words with `UriProviderError.refusalMessage`. No plugin outside this repo
  * declared a card, so 0.26.3 stays served. A plugin that declares a card declares ^0.27.0.
+ *
+ * 0.27.1 lets a manifest URI module name the exact sign-in scheme its calls use, as a tool can
+ * (#14928): `authScheme`, a scheme of the module's `authService`, local or another plugin's. A
+ * hosted module's code and manifest must agree on it, and the daemon reads it to find an
+ * external-CLI scheme without running the module. A module that runs in the daemon is unchanged,
+ * so this is additive; a plugin whose manifest sets `authScheme` declares ^0.27.1.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.27.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.27.1";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -3954,6 +3961,7 @@ export declare const KayAgentTargetManifest: z.ZodObject<{
         }, z.core.$strict>>>;
         uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
             authService: z.ZodOptional<z.ZodString>;
+            authScheme: z.ZodOptional<z.ZodString>;
             knownResources: z.ZodOptional<z.ZodLiteral<true>>;
             describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
             claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -4709,6 +4717,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     }, z.core.$strict>>>;
                     uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         authService: z.ZodOptional<z.ZodString>;
+                        authScheme: z.ZodOptional<z.ZodString>;
                         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
                         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
                         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -6599,6 +6608,9 @@ export declare function mintOperation(input: OperationCaptureInput, clock?: Capt
     readonly gaps: readonly ArtifactProvenanceGap[];
 };
 
+/** The namespace of a qualified auth ref (`google` in `google.oauth`); empty for a local ref. */
+export declare function namespaceOfQualifiedRef(ref: string): string;
+
 export declare const NonEmptyString: z.ZodString;
 
 /**
@@ -10344,6 +10356,7 @@ export declare const ResolvedKayAgentUriModule: z.ZodObject<{
     schemes: z.ZodArray<z.ZodString>;
     displayName: z.ZodOptional<z.ZodString>;
     authServiceId: z.ZodOptional<z.ZodString>;
+    authSchemeId: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
@@ -11560,6 +11573,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         schemes: z.ZodArray<z.ZodString>;
         displayName: z.ZodOptional<z.ZodString>;
         authServiceId: z.ZodOptional<z.ZodString>;
+        authSchemeId: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>>>;
@@ -13535,6 +13549,7 @@ export declare type UiSlotContribution = z.infer<typeof UiSlotContribution>;
 
 export declare const UriModuleContribution: z.ZodObject<{
     authService: z.ZodOptional<z.ZodString>;
+    authScheme: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
     claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{

package/dist/index.js

@@ -222,7 +222,7 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 // packages/plugin-protocol/dist/common.js
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.27.0";
+var KAY_PLUGIN_SDK_VERSION = "0.27.1";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = ["0.26.3"];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -1235,6 +1235,9 @@ function isQualifiedAuthServiceRef(ref) {
 function isQualifiedAuthSchemeRef(ref) {
   return ref.includes(".");
 }
+function namespaceOfQualifiedRef(ref) {
+  return ref.slice(0, Math.max(0, ref.lastIndexOf(".")));
+}
 function resolveAdapterId(globalId, declaredAdapterId) {
   return declaredAdapterId ?? globalId;
 }
@@ -2817,7 +2820,7 @@ var PLUGIN_NOTIFICATION_RULE_HOST_KEYS = [
 ];
 function createContributionsSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
-  const { AuthServiceReference: AuthServiceReference2, CliAuthEnvVarName: CliAuthEnvVarName2, CliBinaryName: CliBinaryName2, FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginToolName: PluginToolName2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
+  const { AuthSchemeReference: AuthSchemeReference2, AuthServiceReference: AuthServiceReference2, CliAuthEnvVarName: CliAuthEnvVarName2, CliBinaryName: CliBinaryName2, FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginToolName: PluginToolName2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { ScopeRequirement: ScopeRequirement2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const OptionalDisplayName = NonEmptyString3.optional();
   const ApprovalCardValueName = z12.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/u, "must be a plain field name");
@@ -3049,6 +3052,12 @@ function createContributionsSchemas(canonical) {
     // plugin's already-minted global id and is recorded, not resolved, here (see
     // `consumesAuthServices` on the resolved contract).
     authService: AuthServiceReference2.optional(),
+    // A scheme of the module's `authService`: every call to this module must use exactly this
+    // scheme. A local ref names a scheme of a service in this manifest; a dotted ref names a scheme
+    // of another plugin's service (`google.oauth`). The daemon reads it here because it may hold
+    // only the manifest (a plugin that runs in the plugin host), and the host refuses a module
+    // whose code names a different one.
+    authScheme: AuthSchemeReference2.optional(),
     // Opt this module's traffic into the daemon's known-resources ledger: the
     // HOST records the canonical URIs (plus title/summary/mime facts) that flow
     // through the module's successful read/list/search resolutions (a read only
@@ -3067,6 +3076,7 @@ function createContributionsSchemas(canonical) {
   const AppUriModuleContribution2 = UriModuleContribution2.omit({
     authActions: true,
     authService: true,
+    authScheme: true,
     knownResources: true,
     describesOperations: true
   });
@@ -4434,6 +4444,13 @@ function createManifestSchemas(canonical) {
           message: `uri module ${module.localId} references unknown auth service ${module.authService}`
         });
       }
+      if (module.authScheme !== void 0 && (module.authService === void 0 || (isQualifiedAuthServiceRef(module.authService) ? namespaceOfQualifiedRef(module.authScheme) !== namespaceOfQualifiedRef(module.authService) : authSchemeIdsByService.get(module.authService)?.has(module.authScheme) !== true))) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["targets", "kay", "agent", "contributes", "uriModules"],
+          message: `uri module ${module.localId} names auth scheme ${module.authScheme}, which is not a scheme of its authService`
+        });
+      }
     }
     for (const [index, tool] of (manifest.targets?.kay?.agent?.contributes?.tools ?? []).entries()) {
       const path = ["targets", "kay", "agent", "contributes", "tools", index];
@@ -5075,6 +5092,8 @@ function createResolvedContractSchemas(canonical) {
     schemes: z14.array(UriScheme2).min(1),
     displayName: NonEmptyString3.optional(),
     authServiceId: GlobalContributionId2.optional(),
+    /** Mirrors `UriModuleContribution.authScheme`; a local ref takes the plugin's namespace. */
+    authSchemeId: GlobalContributionId2.optional(),
     /** Mirrors `UriModuleContribution.knownResources` (host-side recording opt-in). */
     knownResources: z14.literal(true).optional(),
     /** Mirrors `UriModuleContribution.describesOperations`. */
@@ -5689,6 +5708,9 @@ function resolveKayPluginContractV1(manifest) {
     ...module.authService === void 0 ? {} : {
       authServiceId: isQualifiedAuthServiceRef(module.authService) ? module.authService : resolveGlobalContributionId(namespace, module.authService)
     },
+    ...module.authScheme === void 0 ? {} : {
+      authSchemeId: isQualifiedAuthSchemeRef(module.authScheme) ? module.authScheme : resolveGlobalContributionId(namespace, module.authScheme)
+    },
     ...module.knownResources === void 0 ? {} : { knownResources: module.knownResources },
     ...module.describesOperations === void 0 ? {} : { describesOperations: module.describesOperations },
     ...uriModuleFacts(module)
@@ -5808,7 +5830,7 @@ function safeResolveKayPluginContractV1(manifest) {
     throw error;
   }
 }
-function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
+function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
   return facts;
 }
 
@@ -6765,6 +6787,7 @@ export {
   kayPluginHostCompatibility,
   kayUiEventSubscriptionsFromManifest,
   mintOperation,
+  namespaceOfQualifiedRef,
   normalizeNetworkConnectHost,
   parseArtifactOutputUri,
   parseArtifactProvenanceCaptureContext,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.27.0",
+  "version": "0.27.1",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",