@yaklabs-ai/plugin-protocol 0.27.0 → 0.28.0

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.27.0"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.28.0"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -2039,6 +2039,7 @@ declare const canonicalContributionSchemas: {
     }, z.core.$strict>;
     UriModuleContribution: z.ZodObject<{
         authService: z.ZodOptional<z.ZodString>;
+        authScheme: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -3901,8 +3902,23 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * `write`. `app.approvals`, its `prepare`, `finalize` and `resolveResource` are gone, and a write can
  * refuse in the person's words with `UriProviderError.refusalMessage`. No plugin outside this repo
  * declared a card, so 0.26.3 stays served. A plugin that declares a card declares ^0.27.0.
+ *
+ * 0.27.1 lets a manifest URI module name the exact sign-in scheme its calls use, as a tool can
+ * (#14928): `authScheme`, a scheme of the module's `authService`, local or another plugin's. A
+ * hosted module's code and manifest must agree on it, and the daemon reads it to find an
+ * external-CLI scheme without running the module. A module that runs in the daemon is unchanged,
+ * so this is additive; a plugin whose manifest sets `authScheme` declares ^0.27.1.
+ *
+ * 0.28.0 makes "whose credential is this?" one call (#15714). `api.auth.registerAccountLookup`
+ * replaces `registerValidator` and `registerAccountResolver`: it takes the credential, its fields and
+ * a cancel signal, and returns every account the credential reaches. A manifest says `account:
+ * "lookup"` on any `oauth2` or `api-key` scheme the plugin answers for, in place of `validates: true`
+ * and the `"resolveAccountId"` and `"resolveAccounts"` values, and a `pkce` scheme on a client the
+ * host holds may name one too. A plugin using a removed member or value stops loading until it is
+ * rebuilt; a code search found none outside this repo. A plugin with a sign-in declares ^0.28.0. 0.26.3 and 0.27.1
+ * stay served for a plugin that uses none of these.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.27.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.28.0";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -3954,6 +3970,7 @@ export declare const KayAgentTargetManifest: z.ZodObject<{
         }, z.core.$strict>>>;
         uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
             authService: z.ZodOptional<z.ZodString>;
+            authScheme: z.ZodOptional<z.ZodString>;
             knownResources: z.ZodOptional<z.ZodLiteral<true>>;
             describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
             claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -4709,6 +4726,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     }, z.core.$strict>>>;
                     uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         authService: z.ZodOptional<z.ZodString>;
+                        authScheme: z.ZodOptional<z.ZodString>;
                         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
                         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
                         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -5489,10 +5507,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                 exchange: z.ZodLiteral<"pkce">;
                 clientId: z.ZodOptional<z.ZodString>;
                 clientSecret: z.ZodOptional<z.ZodString>;
-                account: z.ZodOptional<z.ZodEnum<{
-                    resolveAccountId: "resolveAccountId";
-                    resolveAccounts: "resolveAccounts";
-                }>>;
+                account: z.ZodOptional<z.ZodLiteral<"lookup">>;
                 clientSuppliers: z.ZodArray<z.ZodEnum<{
                     user: "user";
                     kay: "kay";
@@ -5524,10 +5539,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                 exchange: z.ZodLiteral<"confidential">;
                 clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
                 scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                account: z.ZodUnion<readonly [z.ZodEnum<{
-                    resolveAccountId: "resolveAccountId";
-                    resolveAccounts: "resolveAccounts";
-                }>, z.ZodLiteral<"sign-in">]>;
+                account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
                 authorizationUrl: z.ZodURL;
                 tokenUrl: z.ZodURL;
                 extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -5561,7 +5573,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     instructions: z.ZodString;
                     url: z.ZodURL;
                 }, z.core.$strict>>;
-                validates: z.ZodOptional<z.ZodLiteral<true>>;
+                account: z.ZodOptional<z.ZodLiteral<"lookup">>;
                 displayName: z.ZodOptional<z.ZodString>;
                 agentHint: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
@@ -6599,6 +6611,9 @@ export declare function mintOperation(input: OperationCaptureInput, clock?: Capt
     readonly gaps: readonly ArtifactProvenanceGap[];
 };
 
+/** The namespace of a qualified auth ref (`google` in `google.oauth`); empty for a local ref. */
+export declare function namespaceOfQualifiedRef(ref: string): string;
+
 export declare const NonEmptyString: z.ZodString;
 
 /**
@@ -6730,10 +6745,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
             exchange: z.ZodLiteral<"pkce">;
             clientId: z.ZodOptional<z.ZodString>;
             clientSecret: z.ZodOptional<z.ZodString>;
-            account: z.ZodOptional<z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
-            }>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             clientSuppliers: z.ZodArray<z.ZodEnum<{
                 user: "user";
                 kay: "kay";
@@ -6765,10 +6777,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
             exchange: z.ZodLiteral<"confidential">;
             clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
             scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            account: z.ZodUnion<readonly [z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
-            }>, z.ZodLiteral<"sign-in">]>;
+            account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
             authorizationUrl: z.ZodURL;
             tokenUrl: z.ZodURL;
             extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -6802,7 +6811,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
                 instructions: z.ZodString;
                 url: z.ZodURL;
             }, z.core.$strict>>;
-            validates: z.ZodOptional<z.ZodLiteral<true>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             displayName: z.ZodOptional<z.ZodString>;
             agentHint: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
@@ -6891,10 +6900,7 @@ export declare const PluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDiscriminat
     exchange: z.ZodLiteral<"pkce">;
     clientId: z.ZodOptional<z.ZodString>;
     clientSecret: z.ZodOptional<z.ZodString>;
-    account: z.ZodOptional<z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
-    }>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     clientSuppliers: z.ZodArray<z.ZodEnum<{
         user: "user";
         kay: "kay";
@@ -6926,10 +6932,7 @@ export declare const PluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDiscriminat
     exchange: z.ZodLiteral<"confidential">;
     clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
     scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    account: z.ZodUnion<readonly [z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
-    }>, z.ZodLiteral<"sign-in">]>;
+    account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
     authorizationUrl: z.ZodURL;
     tokenUrl: z.ZodURL;
     extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -6963,7 +6966,7 @@ export declare const PluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDiscriminat
         instructions: z.ZodString;
         url: z.ZodURL;
     }, z.core.$strict>>;
-    validates: z.ZodOptional<z.ZodLiteral<true>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     displayName: z.ZodOptional<z.ZodString>;
     agentHint: z.ZodOptional<z.ZodString>;
     summary: z.ZodOptional<z.ZodString>;
@@ -7033,10 +7036,7 @@ export declare const PluginAuthService: z.ZodObject<{
         exchange: z.ZodLiteral<"pkce">;
         clientId: z.ZodOptional<z.ZodString>;
         clientSecret: z.ZodOptional<z.ZodString>;
-        account: z.ZodOptional<z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
-        }>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         clientSuppliers: z.ZodArray<z.ZodEnum<{
             user: "user";
             kay: "kay";
@@ -7068,10 +7068,7 @@ export declare const PluginAuthService: z.ZodObject<{
         exchange: z.ZodLiteral<"confidential">;
         clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
         scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        account: z.ZodUnion<readonly [z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
-        }>, z.ZodLiteral<"sign-in">]>;
+        account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
         authorizationUrl: z.ZodURL;
         tokenUrl: z.ZodURL;
         extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -7105,7 +7102,7 @@ export declare const PluginAuthService: z.ZodObject<{
             instructions: z.ZodString;
             url: z.ZodURL;
         }, z.core.$strict>>;
-        validates: z.ZodOptional<z.ZodLiteral<true>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         displayName: z.ZodOptional<z.ZodString>;
         agentHint: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
@@ -10344,6 +10341,7 @@ export declare const ResolvedKayAgentUriModule: z.ZodObject<{
     schemes: z.ZodArray<z.ZodString>;
     displayName: z.ZodOptional<z.ZodString>;
     authServiceId: z.ZodOptional<z.ZodString>;
+    authSchemeId: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
@@ -10580,10 +10578,7 @@ export declare const ResolvedPluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDis
     }>>;
     clientId: z.ZodOptional<z.ZodString>;
     clientSecret: z.ZodOptional<z.ZodString>;
-    account: z.ZodOptional<z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
-    }>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     localId: z.ZodString;
     globalId: z.ZodString;
     kind: z.ZodLiteral<"oauth2">;
@@ -10612,8 +10607,7 @@ export declare const ResolvedPluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDis
     exchange: z.ZodLiteral<"confidential">;
     clientSuppliers: z.ZodTuple<[z.ZodLiteral<"kay">], null>;
     account: z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
+        lookup: "lookup";
         "sign-in": "sign-in";
     }>;
     localId: z.ZodString;
@@ -10654,7 +10648,7 @@ export declare const ResolvedPluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDis
         instructions: z.ZodString;
         url: z.ZodURL;
     }, z.core.$strict>>;
-    validates: z.ZodOptional<z.ZodLiteral<true>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     displayName: z.ZodOptional<z.ZodString>;
     agentHint: z.ZodOptional<z.ZodString>;
     summary: z.ZodOptional<z.ZodString>;
@@ -10729,10 +10723,7 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
         }>>;
         clientId: z.ZodOptional<z.ZodString>;
         clientSecret: z.ZodOptional<z.ZodString>;
-        account: z.ZodOptional<z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
-        }>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         localId: z.ZodString;
         globalId: z.ZodString;
         kind: z.ZodLiteral<"oauth2">;
@@ -10761,8 +10752,7 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
         exchange: z.ZodLiteral<"confidential">;
         clientSuppliers: z.ZodTuple<[z.ZodLiteral<"kay">], null>;
         account: z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
+            lookup: "lookup";
             "sign-in": "sign-in";
         }>;
         localId: z.ZodString;
@@ -10803,7 +10793,7 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
             instructions: z.ZodString;
             url: z.ZodURL;
         }, z.core.$strict>>;
-        validates: z.ZodOptional<z.ZodLiteral<true>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         displayName: z.ZodOptional<z.ZodString>;
         agentHint: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
@@ -10951,10 +10941,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             }>>;
             clientId: z.ZodOptional<z.ZodString>;
             clientSecret: z.ZodOptional<z.ZodString>;
-            account: z.ZodOptional<z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
-            }>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             localId: z.ZodString;
             globalId: z.ZodString;
             kind: z.ZodLiteral<"oauth2">;
@@ -10983,8 +10970,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             exchange: z.ZodLiteral<"confidential">;
             clientSuppliers: z.ZodTuple<[z.ZodLiteral<"kay">], null>;
             account: z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
+                lookup: "lookup";
                 "sign-in": "sign-in";
             }>;
             localId: z.ZodString;
@@ -11025,7 +11011,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 instructions: z.ZodString;
                 url: z.ZodURL;
             }, z.core.$strict>>;
-            validates: z.ZodOptional<z.ZodLiteral<true>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             displayName: z.ZodOptional<z.ZodString>;
             agentHint: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
@@ -11560,6 +11546,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         schemes: z.ZodArray<z.ZodString>;
         displayName: z.ZodOptional<z.ZodString>;
         authServiceId: z.ZodOptional<z.ZodString>;
+        authSchemeId: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>>>;
@@ -13535,6 +13522,7 @@ export declare type UiSlotContribution = z.infer<typeof UiSlotContribution>;
 
 export declare const UriModuleContribution: z.ZodObject<{
     authService: z.ZodOptional<z.ZodString>;
+    authScheme: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
     claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{

package/dist/index.js

@@ -222,8 +222,11 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 // packages/plugin-protocol/dist/common.js
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.27.0";
-var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = ["0.26.3"];
+var KAY_PLUGIN_SDK_VERSION = "0.28.0";
+var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
+  "0.26.3",
+  "0.27.1"
+];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
   "kay.app",
@@ -1235,6 +1238,9 @@ function isQualifiedAuthServiceRef(ref) {
 function isQualifiedAuthSchemeRef(ref) {
   return ref.includes(".");
 }
+function namespaceOfQualifiedRef(ref) {
+  return ref.slice(0, Math.max(0, ref.lastIndexOf(".")));
+}
 function resolveAdapterId(globalId, declaredAdapterId) {
   return declaredAdapterId ?? globalId;
 }
@@ -2817,7 +2823,7 @@ var PLUGIN_NOTIFICATION_RULE_HOST_KEYS = [
 ];
 function createContributionsSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
-  const { AuthServiceReference: AuthServiceReference2, CliAuthEnvVarName: CliAuthEnvVarName2, CliBinaryName: CliBinaryName2, FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginToolName: PluginToolName2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
+  const { AuthSchemeReference: AuthSchemeReference2, AuthServiceReference: AuthServiceReference2, CliAuthEnvVarName: CliAuthEnvVarName2, CliBinaryName: CliBinaryName2, FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginToolName: PluginToolName2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { ScopeRequirement: ScopeRequirement2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const OptionalDisplayName = NonEmptyString3.optional();
   const ApprovalCardValueName = z12.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/u, "must be a plain field name");
@@ -3049,6 +3055,12 @@ function createContributionsSchemas(canonical) {
     // plugin's already-minted global id and is recorded, not resolved, here (see
     // `consumesAuthServices` on the resolved contract).
     authService: AuthServiceReference2.optional(),
+    // A scheme of the module's `authService`: every call to this module must use exactly this
+    // scheme. A local ref names a scheme of a service in this manifest; a dotted ref names a scheme
+    // of another plugin's service (`google.oauth`). The daemon reads it here because it may hold
+    // only the manifest (a plugin that runs in the plugin host), and the host refuses a module
+    // whose code names a different one.
+    authScheme: AuthSchemeReference2.optional(),
     // Opt this module's traffic into the daemon's known-resources ledger: the
     // HOST records the canonical URIs (plus title/summary/mime facts) that flow
     // through the module's successful read/list/search resolutions (a read only
@@ -3067,6 +3079,7 @@ function createContributionsSchemas(canonical) {
   const AppUriModuleContribution2 = UriModuleContribution2.omit({
     authActions: true,
     authService: true,
+    authScheme: true,
     knownResources: true,
     describesOperations: true
   });
@@ -3906,10 +3919,7 @@ function createManifestSchemas(canonical) {
     /** Provider-specific query parameters added to the authorize URL. */
     extraAuthorizeParams: z13.record(NonEmptyString3, z13.string()).optional()
   };
-  const PluginAuthSchemeAccountLookup = z13.enum([
-    "resolveAccountId",
-    "resolveAccounts"
-  ]);
+  const PluginAuthSchemeAccountLookup = z13.literal("lookup");
   const PluginAuthSchemeOAuthPkce = z13.strictObject({
     ...PluginProvisioningField,
     ...PluginAuthSchemeDescriptionFields,
@@ -3929,7 +3939,8 @@ function createManifestSchemas(canonical) {
     clientSecret: NonEmptyString3.optional(),
     /**
      * Where the account comes from (see {@link PluginAuthSchemeAccountLookup}); required with a
-     * `clientId`. A scheme without one is run by Bonsai's own client, which names the account.
+     * `clientId`. A scheme without one runs on a client the host holds and may name a lookup too
+     * (Google, Microsoft); naming none leaves the record under the placeholder account.
      */
     account: PluginAuthSchemeAccountLookup.optional(),
     /**
@@ -3950,8 +3961,8 @@ function createManifestSchemas(canonical) {
   }).refine((scheme) => scheme.clientSecret === void 0 || scheme.clientId !== void 0, {
     message: "clientSecret needs the clientId it belongs to",
     path: ["clientSecret"]
-  }).refine((scheme) => scheme.account === void 0 === (scheme.clientId === void 0), {
-    message: "a scheme with its own clientId names where its account comes from (`account`), and one without declares none",
+  }).refine((scheme) => scheme.clientId === void 0 || scheme.account !== void 0, {
+    message: "a scheme with its own clientId names where its account comes from (`account`)",
     path: ["account"]
   });
   const PluginAuthSchemeOAuthConfidential = z13.strictObject({
@@ -3991,10 +4002,11 @@ function createManifestSchemas(canonical) {
     /** Where and how the person creates the key outside Bonsai. */
     setup: z13.strictObject({ instructions: NonEmptyString3, url: HttpsUrl2 }).optional(),
     /**
-     * The plugin checks a key before it is saved, with the validator it registers for this scheme
-     * (`api.auth.registerValidator`).
+     * `"lookup"`: the plugin checks a key before it is saved and names its account, with the function
+     * it registers (`api.auth.registerAccountLookup`). Absent: the key is saved unchecked, under the
+     * caller's account or the placeholder.
      */
-    validates: z13.literal(true).optional()
+    account: PluginAuthSchemeAccountLookup.optional()
   });
   const PluginAuthSchemeDelegated = z13.strictObject({
     ...PluginAuthSchemeDescriptionFields,
@@ -4434,6 +4446,13 @@ function createManifestSchemas(canonical) {
           message: `uri module ${module.localId} references unknown auth service ${module.authService}`
         });
       }
+      if (module.authScheme !== void 0 && (module.authService === void 0 || (isQualifiedAuthServiceRef(module.authService) ? namespaceOfQualifiedRef(module.authScheme) !== namespaceOfQualifiedRef(module.authService) : authSchemeIdsByService.get(module.authService)?.has(module.authScheme) !== true))) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["targets", "kay", "agent", "contributes", "uriModules"],
+          message: `uri module ${module.localId} names auth scheme ${module.authScheme}, which is not a scheme of its authService`
+        });
+      }
     }
     for (const [index, tool] of (manifest.targets?.kay?.agent?.contributes?.tools ?? []).entries()) {
       const path = ["targets", "kay", "agent", "contributes", "tools", index];
@@ -5075,6 +5094,8 @@ function createResolvedContractSchemas(canonical) {
     schemes: z14.array(UriScheme2).min(1),
     displayName: NonEmptyString3.optional(),
     authServiceId: GlobalContributionId2.optional(),
+    /** Mirrors `UriModuleContribution.authScheme`; a local ref takes the plugin's namespace. */
+    authSchemeId: GlobalContributionId2.optional(),
     /** Mirrors `UriModuleContribution.knownResources` (host-side recording opt-in). */
     knownResources: z14.literal(true).optional(),
     /** Mirrors `UriModuleContribution.describesOperations`. */
@@ -5171,13 +5192,13 @@ function createResolvedContractSchemas(canonical) {
     clientSuppliers: z14.array(PluginOAuthClientSupplier2).nonempty(),
     clientId: NonEmptyString3.optional(),
     clientSecret: NonEmptyString3.optional(),
-    account: z14.enum(["resolveAccountId", "resolveAccounts"]).optional()
+    account: z14.literal("lookup").optional()
   });
   const ResolvedPluginAuthSchemeOAuthConfidential = z14.strictObject({
     ...ResolvedPluginAuthSchemeOAuthBase,
     exchange: z14.literal("confidential"),
     clientSuppliers: z14.tuple([z14.literal("kay")]),
-    account: z14.enum(["resolveAccountId", "resolveAccounts", "sign-in"])
+    account: z14.enum(["lookup", "sign-in"])
   });
   const ResolvedPluginAuthSchemeOAuth2 = z14.discriminatedUnion("exchange", [
     ResolvedPluginAuthSchemeOAuthPkce,
@@ -5194,7 +5215,7 @@ function createResolvedContractSchemas(canonical) {
     inputLabel: NonEmptyString3,
     fields: z14.array(z14.strictObject({ id: z14.string(), label: z14.string() })).optional(),
     setup: z14.strictObject({ instructions: z14.string(), url: HttpsUrl2 }).optional(),
-    validates: z14.literal(true).optional()
+    account: z14.literal("lookup").optional()
   });
   const ResolvedPluginAuthSchemeDelegated = z14.strictObject({
     ...ResolvedPluginAuthSchemeDescriptionFields,
@@ -5558,7 +5579,7 @@ function resolveAuthServices(namespace, manifest) {
           inputLabel: scheme.inputLabel ?? `${service.displayName} API key`,
           ...scheme.fields === void 0 ? {} : { fields: scheme.fields.map((field) => ({ ...field })) },
           ...scheme.setup === void 0 ? {} : { setup: { ...scheme.setup } },
-          ...scheme.validates === void 0 ? {} : { validates: scheme.validates },
+          ...scheme.account === void 0 ? {} : { account: scheme.account },
           ...scopesField,
           ...descriptionFields,
           ...provisioningField
@@ -5689,6 +5710,9 @@ function resolveKayPluginContractV1(manifest) {
     ...module.authService === void 0 ? {} : {
       authServiceId: isQualifiedAuthServiceRef(module.authService) ? module.authService : resolveGlobalContributionId(namespace, module.authService)
     },
+    ...module.authScheme === void 0 ? {} : {
+      authSchemeId: isQualifiedAuthSchemeRef(module.authScheme) ? module.authScheme : resolveGlobalContributionId(namespace, module.authScheme)
+    },
     ...module.knownResources === void 0 ? {} : { knownResources: module.knownResources },
     ...module.describesOperations === void 0 ? {} : { describesOperations: module.describesOperations },
     ...uriModuleFacts(module)
@@ -5808,7 +5832,7 @@ function safeResolveKayPluginContractV1(manifest) {
     throw error;
   }
 }
-function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
+function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
   return facts;
 }
 
@@ -6765,6 +6789,7 @@ export {
   kayPluginHostCompatibility,
   kayUiEventSubscriptionsFromManifest,
   mintOperation,
+  namespaceOfQualifiedRef,
   normalizeNetworkConnectHost,
   parseArtifactOutputUri,
   parseArtifactProvenanceCaptureContext,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",