@yaklabs-ai/plugin-protocol 0.27.1 → 0.28.0

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.27.1"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.28.0"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -3908,8 +3908,17 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * hosted module's code and manifest must agree on it, and the daemon reads it to find an
  * external-CLI scheme without running the module. A module that runs in the daemon is unchanged,
  * so this is additive; a plugin whose manifest sets `authScheme` declares ^0.27.1.
+ *
+ * 0.28.0 makes "whose credential is this?" one call (#15714). `api.auth.registerAccountLookup`
+ * replaces `registerValidator` and `registerAccountResolver`: it takes the credential, its fields and
+ * a cancel signal, and returns every account the credential reaches. A manifest says `account:
+ * "lookup"` on any `oauth2` or `api-key` scheme the plugin answers for, in place of `validates: true`
+ * and the `"resolveAccountId"` and `"resolveAccounts"` values, and a `pkce` scheme on a client the
+ * host holds may name one too. A plugin using a removed member or value stops loading until it is
+ * rebuilt; a code search found none outside this repo. A plugin with a sign-in declares ^0.28.0. 0.26.3 and 0.27.1
+ * stay served for a plugin that uses none of these.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.27.1";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.28.0";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -5498,10 +5507,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                 exchange: z.ZodLiteral<"pkce">;
                 clientId: z.ZodOptional<z.ZodString>;
                 clientSecret: z.ZodOptional<z.ZodString>;
-                account: z.ZodOptional<z.ZodEnum<{
-                    resolveAccountId: "resolveAccountId";
-                    resolveAccounts: "resolveAccounts";
-                }>>;
+                account: z.ZodOptional<z.ZodLiteral<"lookup">>;
                 clientSuppliers: z.ZodArray<z.ZodEnum<{
                     user: "user";
                     kay: "kay";
@@ -5533,10 +5539,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                 exchange: z.ZodLiteral<"confidential">;
                 clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
                 scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                account: z.ZodUnion<readonly [z.ZodEnum<{
-                    resolveAccountId: "resolveAccountId";
-                    resolveAccounts: "resolveAccounts";
-                }>, z.ZodLiteral<"sign-in">]>;
+                account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
                 authorizationUrl: z.ZodURL;
                 tokenUrl: z.ZodURL;
                 extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -5570,7 +5573,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     instructions: z.ZodString;
                     url: z.ZodURL;
                 }, z.core.$strict>>;
-                validates: z.ZodOptional<z.ZodLiteral<true>>;
+                account: z.ZodOptional<z.ZodLiteral<"lookup">>;
                 displayName: z.ZodOptional<z.ZodString>;
                 agentHint: z.ZodOptional<z.ZodString>;
                 summary: z.ZodOptional<z.ZodString>;
@@ -6742,10 +6745,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
             exchange: z.ZodLiteral<"pkce">;
             clientId: z.ZodOptional<z.ZodString>;
             clientSecret: z.ZodOptional<z.ZodString>;
-            account: z.ZodOptional<z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
-            }>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             clientSuppliers: z.ZodArray<z.ZodEnum<{
                 user: "user";
                 kay: "kay";
@@ -6777,10 +6777,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
             exchange: z.ZodLiteral<"confidential">;
             clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
             scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            account: z.ZodUnion<readonly [z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
-            }>, z.ZodLiteral<"sign-in">]>;
+            account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
             authorizationUrl: z.ZodURL;
             tokenUrl: z.ZodURL;
             extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -6814,7 +6811,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
                 instructions: z.ZodString;
                 url: z.ZodURL;
             }, z.core.$strict>>;
-            validates: z.ZodOptional<z.ZodLiteral<true>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             displayName: z.ZodOptional<z.ZodString>;
             agentHint: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;
@@ -6903,10 +6900,7 @@ export declare const PluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDiscriminat
     exchange: z.ZodLiteral<"pkce">;
     clientId: z.ZodOptional<z.ZodString>;
     clientSecret: z.ZodOptional<z.ZodString>;
-    account: z.ZodOptional<z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
-    }>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     clientSuppliers: z.ZodArray<z.ZodEnum<{
         user: "user";
         kay: "kay";
@@ -6938,10 +6932,7 @@ export declare const PluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDiscriminat
     exchange: z.ZodLiteral<"confidential">;
     clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
     scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-    account: z.ZodUnion<readonly [z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
-    }>, z.ZodLiteral<"sign-in">]>;
+    account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
     authorizationUrl: z.ZodURL;
     tokenUrl: z.ZodURL;
     extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -6975,7 +6966,7 @@ export declare const PluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDiscriminat
         instructions: z.ZodString;
         url: z.ZodURL;
     }, z.core.$strict>>;
-    validates: z.ZodOptional<z.ZodLiteral<true>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     displayName: z.ZodOptional<z.ZodString>;
     agentHint: z.ZodOptional<z.ZodString>;
     summary: z.ZodOptional<z.ZodString>;
@@ -7045,10 +7036,7 @@ export declare const PluginAuthService: z.ZodObject<{
         exchange: z.ZodLiteral<"pkce">;
         clientId: z.ZodOptional<z.ZodString>;
         clientSecret: z.ZodOptional<z.ZodString>;
-        account: z.ZodOptional<z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
-        }>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         clientSuppliers: z.ZodArray<z.ZodEnum<{
             user: "user";
             kay: "kay";
@@ -7080,10 +7068,7 @@ export declare const PluginAuthService: z.ZodObject<{
         exchange: z.ZodLiteral<"confidential">;
         clientSuppliers: z.ZodOptional<z.ZodTuple<[z.ZodLiteral<"kay">], null>>;
         scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
-        account: z.ZodUnion<readonly [z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
-        }>, z.ZodLiteral<"sign-in">]>;
+        account: z.ZodUnion<readonly [z.ZodLiteral<"lookup">, z.ZodLiteral<"sign-in">]>;
         authorizationUrl: z.ZodURL;
         tokenUrl: z.ZodURL;
         extraAuthorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -7117,7 +7102,7 @@ export declare const PluginAuthService: z.ZodObject<{
             instructions: z.ZodString;
             url: z.ZodURL;
         }, z.core.$strict>>;
-        validates: z.ZodOptional<z.ZodLiteral<true>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         displayName: z.ZodOptional<z.ZodString>;
         agentHint: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
@@ -10593,10 +10578,7 @@ export declare const ResolvedPluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDis
     }>>;
     clientId: z.ZodOptional<z.ZodString>;
     clientSecret: z.ZodOptional<z.ZodString>;
-    account: z.ZodOptional<z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
-    }>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     localId: z.ZodString;
     globalId: z.ZodString;
     kind: z.ZodLiteral<"oauth2">;
@@ -10625,8 +10607,7 @@ export declare const ResolvedPluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDis
     exchange: z.ZodLiteral<"confidential">;
     clientSuppliers: z.ZodTuple<[z.ZodLiteral<"kay">], null>;
     account: z.ZodEnum<{
-        resolveAccountId: "resolveAccountId";
-        resolveAccounts: "resolveAccounts";
+        lookup: "lookup";
         "sign-in": "sign-in";
     }>;
     localId: z.ZodString;
@@ -10667,7 +10648,7 @@ export declare const ResolvedPluginAuthScheme: z.ZodDiscriminatedUnion<[z.ZodDis
         instructions: z.ZodString;
         url: z.ZodURL;
     }, z.core.$strict>>;
-    validates: z.ZodOptional<z.ZodLiteral<true>>;
+    account: z.ZodOptional<z.ZodLiteral<"lookup">>;
     displayName: z.ZodOptional<z.ZodString>;
     agentHint: z.ZodOptional<z.ZodString>;
     summary: z.ZodOptional<z.ZodString>;
@@ -10742,10 +10723,7 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
         }>>;
         clientId: z.ZodOptional<z.ZodString>;
         clientSecret: z.ZodOptional<z.ZodString>;
-        account: z.ZodOptional<z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
-        }>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         localId: z.ZodString;
         globalId: z.ZodString;
         kind: z.ZodLiteral<"oauth2">;
@@ -10774,8 +10752,7 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
         exchange: z.ZodLiteral<"confidential">;
         clientSuppliers: z.ZodTuple<[z.ZodLiteral<"kay">], null>;
         account: z.ZodEnum<{
-            resolveAccountId: "resolveAccountId";
-            resolveAccounts: "resolveAccounts";
+            lookup: "lookup";
             "sign-in": "sign-in";
         }>;
         localId: z.ZodString;
@@ -10816,7 +10793,7 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
             instructions: z.ZodString;
             url: z.ZodURL;
         }, z.core.$strict>>;
-        validates: z.ZodOptional<z.ZodLiteral<true>>;
+        account: z.ZodOptional<z.ZodLiteral<"lookup">>;
         displayName: z.ZodOptional<z.ZodString>;
         agentHint: z.ZodOptional<z.ZodString>;
         summary: z.ZodOptional<z.ZodString>;
@@ -10964,10 +10941,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             }>>;
             clientId: z.ZodOptional<z.ZodString>;
             clientSecret: z.ZodOptional<z.ZodString>;
-            account: z.ZodOptional<z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
-            }>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             localId: z.ZodString;
             globalId: z.ZodString;
             kind: z.ZodLiteral<"oauth2">;
@@ -10996,8 +10970,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             exchange: z.ZodLiteral<"confidential">;
             clientSuppliers: z.ZodTuple<[z.ZodLiteral<"kay">], null>;
             account: z.ZodEnum<{
-                resolveAccountId: "resolveAccountId";
-                resolveAccounts: "resolveAccounts";
+                lookup: "lookup";
                 "sign-in": "sign-in";
             }>;
             localId: z.ZodString;
@@ -11038,7 +11011,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 instructions: z.ZodString;
                 url: z.ZodURL;
             }, z.core.$strict>>;
-            validates: z.ZodOptional<z.ZodLiteral<true>>;
+            account: z.ZodOptional<z.ZodLiteral<"lookup">>;
             displayName: z.ZodOptional<z.ZodString>;
             agentHint: z.ZodOptional<z.ZodString>;
             summary: z.ZodOptional<z.ZodString>;

package/dist/index.js

@@ -222,8 +222,11 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 // packages/plugin-protocol/dist/common.js
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.27.1";
-var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = ["0.26.3"];
+var KAY_PLUGIN_SDK_VERSION = "0.28.0";
+var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
+  "0.26.3",
+  "0.27.1"
+];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
   "kay.app",
@@ -3916,10 +3919,7 @@ function createManifestSchemas(canonical) {
     /** Provider-specific query parameters added to the authorize URL. */
     extraAuthorizeParams: z13.record(NonEmptyString3, z13.string()).optional()
   };
-  const PluginAuthSchemeAccountLookup = z13.enum([
-    "resolveAccountId",
-    "resolveAccounts"
-  ]);
+  const PluginAuthSchemeAccountLookup = z13.literal("lookup");
   const PluginAuthSchemeOAuthPkce = z13.strictObject({
     ...PluginProvisioningField,
     ...PluginAuthSchemeDescriptionFields,
@@ -3939,7 +3939,8 @@ function createManifestSchemas(canonical) {
     clientSecret: NonEmptyString3.optional(),
     /**
      * Where the account comes from (see {@link PluginAuthSchemeAccountLookup}); required with a
-     * `clientId`. A scheme without one is run by Bonsai's own client, which names the account.
+     * `clientId`. A scheme without one runs on a client the host holds and may name a lookup too
+     * (Google, Microsoft); naming none leaves the record under the placeholder account.
      */
     account: PluginAuthSchemeAccountLookup.optional(),
     /**
@@ -3960,8 +3961,8 @@ function createManifestSchemas(canonical) {
   }).refine((scheme) => scheme.clientSecret === void 0 || scheme.clientId !== void 0, {
     message: "clientSecret needs the clientId it belongs to",
     path: ["clientSecret"]
-  }).refine((scheme) => scheme.account === void 0 === (scheme.clientId === void 0), {
-    message: "a scheme with its own clientId names where its account comes from (`account`), and one without declares none",
+  }).refine((scheme) => scheme.clientId === void 0 || scheme.account !== void 0, {
+    message: "a scheme with its own clientId names where its account comes from (`account`)",
     path: ["account"]
   });
   const PluginAuthSchemeOAuthConfidential = z13.strictObject({
@@ -4001,10 +4002,11 @@ function createManifestSchemas(canonical) {
     /** Where and how the person creates the key outside Bonsai. */
     setup: z13.strictObject({ instructions: NonEmptyString3, url: HttpsUrl2 }).optional(),
     /**
-     * The plugin checks a key before it is saved, with the validator it registers for this scheme
-     * (`api.auth.registerValidator`).
+     * `"lookup"`: the plugin checks a key before it is saved and names its account, with the function
+     * it registers (`api.auth.registerAccountLookup`). Absent: the key is saved unchecked, under the
+     * caller's account or the placeholder.
      */
-    validates: z13.literal(true).optional()
+    account: PluginAuthSchemeAccountLookup.optional()
   });
   const PluginAuthSchemeDelegated = z13.strictObject({
     ...PluginAuthSchemeDescriptionFields,
@@ -5190,13 +5192,13 @@ function createResolvedContractSchemas(canonical) {
     clientSuppliers: z14.array(PluginOAuthClientSupplier2).nonempty(),
     clientId: NonEmptyString3.optional(),
     clientSecret: NonEmptyString3.optional(),
-    account: z14.enum(["resolveAccountId", "resolveAccounts"]).optional()
+    account: z14.literal("lookup").optional()
   });
   const ResolvedPluginAuthSchemeOAuthConfidential = z14.strictObject({
     ...ResolvedPluginAuthSchemeOAuthBase,
     exchange: z14.literal("confidential"),
     clientSuppliers: z14.tuple([z14.literal("kay")]),
-    account: z14.enum(["resolveAccountId", "resolveAccounts", "sign-in"])
+    account: z14.enum(["lookup", "sign-in"])
   });
   const ResolvedPluginAuthSchemeOAuth2 = z14.discriminatedUnion("exchange", [
     ResolvedPluginAuthSchemeOAuthPkce,
@@ -5213,7 +5215,7 @@ function createResolvedContractSchemas(canonical) {
     inputLabel: NonEmptyString3,
     fields: z14.array(z14.strictObject({ id: z14.string(), label: z14.string() })).optional(),
     setup: z14.strictObject({ instructions: z14.string(), url: HttpsUrl2 }).optional(),
-    validates: z14.literal(true).optional()
+    account: z14.literal("lookup").optional()
   });
   const ResolvedPluginAuthSchemeDelegated = z14.strictObject({
     ...ResolvedPluginAuthSchemeDescriptionFields,
@@ -5577,7 +5579,7 @@ function resolveAuthServices(namespace, manifest) {
           inputLabel: scheme.inputLabel ?? `${service.displayName} API key`,
           ...scheme.fields === void 0 ? {} : { fields: scheme.fields.map((field) => ({ ...field })) },
           ...scheme.setup === void 0 ? {} : { setup: { ...scheme.setup } },
-          ...scheme.validates === void 0 ? {} : { validates: scheme.validates },
+          ...scheme.account === void 0 ? {} : { account: scheme.account },
           ...scopesField,
           ...descriptionFields,
           ...provisioningField

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.27.1",
+  "version": "0.28.0",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",