@yaklabs-ai/plugin-protocol 0.28.0 → 0.30.0

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.28.0"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.30.0"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -1564,6 +1564,7 @@ declare namespace authoringCommonSchemas {
         hostWithinDomain,
         urlHostWithinDomain,
         refineWebSessionScopeConfined,
+        KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES,
         KAY_PLUGIN_PROTOCOL_VERSION,
         KAY_PLUGIN_PROTOCOL_PACKAGE_NAME,
         KAY_PLUGIN_SDK_VERSION,
@@ -1634,6 +1635,7 @@ declare namespace authoringContributionSchemas {
         EntityResolverContribution,
         AgentRenderContribution,
         EndpointContribution,
+        WorkflowContribution,
         McpServerUrl,
         McpServerAuthMode,
         McpServerContribution,
@@ -2477,6 +2479,17 @@ declare const canonicalContributionSchemas: {
         requestSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>;
         responseSchema: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>;
     }, z.core.$strict>;
+    WorkflowContribution: z.ZodObject<{
+        localId: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodString;
+        everyMs: z.ZodNumber;
+        auth: z.ZodOptional<z.ZodObject<{
+            service: z.ZodString;
+            scheme: z.ZodString;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
     McpServerUrl: z.ZodString;
     McpServerAuthMode: z.ZodEnum<{
         oauth: "oauth";
@@ -2818,6 +2831,7 @@ declare const canonicalContributionSchemas: {
         appDataSource: "appDataSource";
         whiteboardType: "whiteboardType";
         approvalType: "approvalType";
+        workflow: "workflow";
         contextContributor: "contextContributor";
         transcriptionProvider: "transcriptionProvider";
         deviceDelegation: "deviceDelegation";
@@ -3344,7 +3358,7 @@ export declare const KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: readonly string[];
 /** The file whose presence makes a directory a plugin. A directory without one is not a plugin. */
 export declare const KAY_PLUGIN_MANIFEST_FILENAME = "kay-plugin.json";
 
-/** Manifest byte cap: a larger file is refused unread. */
+/** Manifest byte cap, including declared app-data schemas; larger files are refused unread. */
 export declare const KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES: number;
 
 export declare const KAY_PLUGIN_PROTOCOL_PACKAGE_NAME: "@bonsai/plugin-protocol";
@@ -3917,8 +3931,20 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * host holds may name one too. A plugin using a removed member or value stops loading until it is
  * rebuilt; a code search found none outside this repo. A plugin with a sign-in declares ^0.28.0. 0.26.3 and 0.27.1
  * stay served for a plugin that uses none of these.
+ *
+ * 0.29.0 replaces `servedSimulators` (`KayServedSimulators`, a lookup by adapter id) with
+ * `simulator` on both targets (#14929): what the plugin's own simulator built, handed over once by
+ * whichever process runs the plugin. A plugin's simulator file exports `createPluginSimulator`
+ * (`KayPluginSimulatorFactory`). A clean break: only this repo's plugins read the old member, and
+ * a plugin with no simulator is unaffected, so 0.28.0 stays served.
+ *
+ * 0.30.0 lets a scheduled workflow be described as data (#15722). `contributes.workflows` under
+ * `kay.app` declares its name, schedule and sign-in, and `app.implementWorkflow(localId, run)`
+ * supplies what a run does: each run is handed the workflow's accounts and tokens, so the code
+ * runs the same in the daemon and in the plugin host. Additive: `app.workflows.define` stays, and
+ * a plugin that declares a workflow declares ^0.30.0.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.28.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.30.0";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -4509,6 +4535,17 @@ export declare const KayAppTargetManifest: z.ZodObject<{
                 }, z.core.$strict>>>;
             }, z.core.$strict>>;
         }, z.core.$strict>>>;
+        workflows: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            localId: z.ZodString;
+            name: z.ZodString;
+            description: z.ZodString;
+            everyMs: z.ZodNumber;
+            auth: z.ZodOptional<z.ZodObject<{
+                service: z.ZodString;
+                scheme: z.ZodString;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
         eventDefinitions: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
             displayName: z.ZodOptional<z.ZodString>;
@@ -5262,6 +5299,17 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                             }, z.core.$strict>>>;
                         }, z.core.$strict>>;
                     }, z.core.$strict>>>;
+                    workflows: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        localId: z.ZodString;
+                        name: z.ZodString;
+                        description: z.ZodString;
+                        everyMs: z.ZodNumber;
+                        auth: z.ZodOptional<z.ZodObject<{
+                            service: z.ZodString;
+                            scheme: z.ZodString;
+                            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        }, z.core.$strict>>;
+                    }, z.core.$strict>>>;
                     eventDefinitions: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
                         displayName: z.ZodOptional<z.ZodString>;
@@ -8929,6 +8977,7 @@ export declare const PluginContributionKind: z.ZodEnum<{
     appDataSource: "appDataSource";
     whiteboardType: "whiteboardType";
     approvalType: "approvalType";
+    workflow: "workflow";
     contextContributor: "contextContributor";
     transcriptionProvider: "transcriptionProvider";
     deviceDelegation: "deviceDelegation";
@@ -10507,6 +10556,21 @@ export declare const ResolvedKayAppWhiteboardType: z.ZodObject<{
 
 export declare type ResolvedKayAppWhiteboardType = z.infer<typeof ResolvedKayAppWhiteboardType>;
 
+export declare const ResolvedKayAppWorkflow: z.ZodObject<{
+    localId: z.ZodString;
+    globalId: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    everyMs: z.ZodNumber;
+    auth: z.ZodOptional<z.ZodObject<{
+        serviceId: z.ZodString;
+        schemeId: z.ZodString;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+
+export declare type ResolvedKayAppWorkflow = z.infer<typeof ResolvedKayAppWorkflow>;
+
 export declare const ResolvedKayUiApp: z.ZodObject<{
     localId: z.ZodString;
     globalId: z.ZodString;
@@ -10910,6 +10974,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             appDataSource: "appDataSource";
             whiteboardType: "whiteboardType";
             approvalType: "approvalType";
+            workflow: "workflow";
             contextContributor: "contextContributor";
             transcriptionProvider: "transcriptionProvider";
             deviceDelegation: "deviceDelegation";
@@ -11681,6 +11746,18 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         moduleId: z.ZodString;
         authService: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>>;
+    kayAppWorkflows: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        localId: z.ZodString;
+        globalId: z.ZodString;
+        name: z.ZodString;
+        description: z.ZodString;
+        everyMs: z.ZodNumber;
+        auth: z.ZodOptional<z.ZodObject<{
+            serviceId: z.ZodString;
+            schemeId: z.ZodString;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     kayAppDataSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
         localId: z.ZodString;
         globalId: z.ZodString;
@@ -11877,6 +11954,7 @@ export declare const ResolvedPluginContributionId: z.ZodObject<{
         appDataSource: "appDataSource";
         whiteboardType: "whiteboardType";
         approvalType: "approvalType";
+        workflow: "workflow";
         contextContributor: "contextContributor";
         transcriptionProvider: "transcriptionProvider";
         deviceDelegation: "deviceDelegation";
@@ -14102,4 +14180,18 @@ export declare const WhiteboardValue: z.ZodType<JsonValue, unknown, z.core.$ZodT
 
 export declare type WhiteboardValue = z.infer<typeof WhiteboardValue>;
 
+export declare const WorkflowContribution: z.ZodObject<{
+    localId: z.ZodString;
+    name: z.ZodString;
+    description: z.ZodString;
+    everyMs: z.ZodNumber;
+    auth: z.ZodOptional<z.ZodObject<{
+        service: z.ZodString;
+        scheme: z.ZodString;
+        scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+
+export declare type WorkflowContribution = z.infer<typeof WorkflowContribution>;
+
 export { }

package/dist/index.js

@@ -173,6 +173,7 @@ __export(common_exports, {
   JsonValue: () => JsonValue,
   KAY_EVENT_PUBLISHER_ID: () => KAY_EVENT_PUBLISHER_ID,
   KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS: () => KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS,
+  KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES: () => KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES,
   KAY_PLUGIN_PROTOCOL_PACKAGE_NAME: () => KAY_PLUGIN_PROTOCOL_PACKAGE_NAME,
   KAY_PLUGIN_PROTOCOL_VERSION: () => KAY_PLUGIN_PROTOCOL_VERSION,
   KAY_PLUGIN_SDK_VERSION: () => KAY_PLUGIN_SDK_VERSION,
@@ -220,12 +221,15 @@ var JsonObject = z4.record(z4.string(), JsonValue);
 var JsonSchema = z4.record(z4.string(), JsonValue);
 
 // packages/plugin-protocol/dist/common.js
+var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.28.0";
+var KAY_PLUGIN_SDK_VERSION = "0.30.0";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.26.3",
-  "0.27.1"
+  "0.27.1",
+  "0.28.0",
+  "0.29.0"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -2724,6 +2728,7 @@ __export(contributions_exports, {
   UriModuleFacts: () => UriModuleFacts,
   WhiteboardTypeContribution: () => WhiteboardTypeContribution,
   WhiteboardTypeStorage: () => WhiteboardTypeStorage,
+  WorkflowContribution: () => WorkflowContribution,
   canonicalContributionSchemas: () => canonicalContributionSchemas
 });
 import { z as z12 } from "zod";
@@ -3274,6 +3279,24 @@ function createContributionsSchemas(canonical) {
     requestSchema: JsonSchema.optional(),
     responseSchema: JsonSchema.optional()
   });
+  const WorkflowContribution2 = z12.strictObject({
+    localId: LocalContributionId2,
+    name: NonEmptyString3,
+    /** Plain-text purpose, at most 280 characters. */
+    description: NonEmptyString3,
+    /** How often it runs. The automations engine enforces its scheduling floor. */
+    everyMs: z12.number().int().positive(),
+    auth: z12.strictObject({
+      /** A local ref names a service in this manifest; a dotted ref names another plugin's. */
+      service: AuthServiceReference2,
+      scheme: AuthSchemeReference2,
+      /**
+       * Scopes each account's token must hold. Omitted, the host asks for the first scope of the
+       * `background-job` grant's `allowedScopes` that the account holds.
+       */
+      scopes: z12.array(NonEmptyString3).min(1).optional()
+    }).optional()
+  });
   const McpServerUrl2 = pluginString(canonical).min(1).refine((value) => {
     let parsed;
     try {
@@ -3550,6 +3573,7 @@ function createContributionsSchemas(canonical) {
     "appDataSource",
     "whiteboardType",
     "approvalType",
+    "workflow",
     "contextContributor",
     "transcriptionProvider",
     "deviceDelegation",
@@ -3593,6 +3617,7 @@ function createContributionsSchemas(canonical) {
     EntityResolverContribution: EntityResolverContribution2,
     AgentRenderContribution: AgentRenderContribution2,
     EndpointContribution: EndpointContribution2,
+    WorkflowContribution: WorkflowContribution2,
     McpServerUrl: McpServerUrl2,
     McpServerAuthMode: McpServerAuthMode2,
     McpServerContribution: McpServerContribution2,
@@ -3626,7 +3651,7 @@ function createContributionsSchemas(canonical) {
     PluginContributionKind: PluginContributionKind2
   };
 }
-var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiAppActivityRail, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
+var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiAppActivityRail, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
 var canonicalContributionSchemas = createContributionsSchemas(true);
 
 // packages/plugin-protocol/dist/icon-shape.js
@@ -3700,7 +3725,7 @@ var KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS = [
 var KAY_UI_NATIVE_EVENT_ALLOWLIST = new Set(KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS);
 var RETIRED_COMPATIBILITY_KEYS = ["policy"];
 function createManifestSchemas(canonical) {
-  const { AgentRenderContribution: AgentRenderContribution2, ApprovalTypeContribution: ApprovalTypeContribution2, AppDataMaterializerContribution: AppDataMaterializerContribution2, AppDataSourceContribution: AppDataSourceContribution2, AppUriModuleContribution: AppUriModuleContribution2, AppEventSubscription: AppEventSubscription2, ArtifactUriModuleContribution: ArtifactUriModuleContribution2, CliBindingContribution: CliBindingContribution2, CommandContribution: CommandContribution2, ContextContributorContribution: ContextContributorContribution2, ConverterContribution: ConverterContribution2, SessionReaderContribution: SessionReaderContribution2, DeviceDelegationContribution: DeviceDelegationContribution2, EndpointContribution: EndpointContribution2, EntityResolverContribution: EntityResolverContribution2, GitHostContribution: GitHostContribution2, McpServerContributions: McpServerContributions2, PluginEventDefinitionContribution: PluginEventDefinitionContribution2, PluginNotificationRuleContribution: PluginNotificationRuleContribution2, ResourceContribution: ResourceContribution2, ReferencePresentationContribution: ReferencePresentationContribution2, ResultRendererContribution: ResultRendererContribution2, RichViewContribution: RichViewContribution2, PluginSkillSourceDeclaration: PluginSkillSourceDeclaration2, InteractionDriverContribution: InteractionDriverContribution2, SearchProviderContribution: SearchProviderContribution2, SkillContribution: SkillContribution2, SettingsPanelContribution: SettingsPanelContribution2, ThemeContribution: ThemeContribution2, AgentToolContribution: AgentToolContribution2, ToolContribution: ToolContribution2, UiCommandContribution: UiCommandContribution2, UiAppContribution: UiAppContribution2, UiEventSubscriptionContribution: UiEventSubscriptionContribution2, UiSlotContribution: UiSlotContribution2, UriModuleContribution: UriModuleContribution2, WhiteboardTypeContribution: WhiteboardTypeContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
+  const { AgentRenderContribution: AgentRenderContribution2, ApprovalTypeContribution: ApprovalTypeContribution2, WorkflowContribution: WorkflowContribution2, AppDataMaterializerContribution: AppDataMaterializerContribution2, AppDataSourceContribution: AppDataSourceContribution2, AppUriModuleContribution: AppUriModuleContribution2, AppEventSubscription: AppEventSubscription2, ArtifactUriModuleContribution: ArtifactUriModuleContribution2, CliBindingContribution: CliBindingContribution2, CommandContribution: CommandContribution2, ContextContributorContribution: ContextContributorContribution2, ConverterContribution: ConverterContribution2, SessionReaderContribution: SessionReaderContribution2, DeviceDelegationContribution: DeviceDelegationContribution2, EndpointContribution: EndpointContribution2, EntityResolverContribution: EntityResolverContribution2, GitHostContribution: GitHostContribution2, McpServerContributions: McpServerContributions2, PluginEventDefinitionContribution: PluginEventDefinitionContribution2, PluginNotificationRuleContribution: PluginNotificationRuleContribution2, ResourceContribution: ResourceContribution2, ReferencePresentationContribution: ReferencePresentationContribution2, ResultRendererContribution: ResultRendererContribution2, RichViewContribution: RichViewContribution2, PluginSkillSourceDeclaration: PluginSkillSourceDeclaration2, InteractionDriverContribution: InteractionDriverContribution2, SearchProviderContribution: SearchProviderContribution2, SkillContribution: SkillContribution2, SettingsPanelContribution: SettingsPanelContribution2, ThemeContribution: ThemeContribution2, AgentToolContribution: AgentToolContribution2, ToolContribution: ToolContribution2, UiCommandContribution: UiCommandContribution2, UiAppContribution: UiAppContribution2, UiEventSubscriptionContribution: UiEventSubscriptionContribution2, UiSlotContribution: UiSlotContribution2, UriModuleContribution: UriModuleContribution2, WhiteboardTypeContribution: WhiteboardTypeContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginPermissionManifest: PluginPermissionManifest2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const KayAgentTargetManifest2 = z13.strictObject({
@@ -3793,6 +3818,7 @@ function createManifestSchemas(canonical) {
       dataSources: z13.array(AppDataSourceContribution2).optional(),
       whiteboardTypes: z13.array(WhiteboardTypeContribution2).optional(),
       approvalTypes: z13.array(ApprovalTypeContribution2).optional(),
+      workflows: z13.array(WorkflowContribution2).optional(),
       eventDefinitions: z13.array(PluginEventDefinitionContribution2).optional(),
       // Default notification rules over this plugin's own `eventDefinitions`; seeded by the host
       // (see `PluginNotificationRuleContribution`).
@@ -4373,6 +4399,35 @@ function createManifestSchemas(canonical) {
         });
       }
     }
+    reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "workflows"], manifest.targets?.kay?.app?.contributes?.workflows, "workflow");
+    for (const [index, workflow] of (manifest.targets?.kay?.app?.contributes?.workflows ?? []).entries()) {
+      const path = [
+        "targets",
+        "kay",
+        "app",
+        "contributes",
+        "workflows",
+        index
+      ];
+      if (manifest.targets?.kay?.app?.entrypoint === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path,
+          message: `workflow ${workflow.localId} needs a kay.app entrypoint to implement it`
+        });
+      }
+      const { auth } = workflow;
+      if (auth === void 0)
+        continue;
+      const granted = manifest.permissions?.byTarget["kay.app"]?.auth?.some((grant) => grant.service === auth.service && grant.operations.includes("list") && grant.operations.includes("resolve") && (grant.purposes === void 0 || grant.purposes.includes("background-job")));
+      if (granted !== true) {
+        ctx.addIssue({
+          code: "custom",
+          path: [...path, "auth", "service"],
+          message: `workflow ${workflow.localId} needs a kay.app auth grant on ${auth.service} with the list and resolve operations and the background-job purpose`
+        });
+      }
+    }
     const syntheticContributionIds = collectSyntheticContributionIds(manifest);
     for (const contribution of collectDeclaredContributionIds(manifest)) {
       if (syntheticContributionIds.has(contribution.localId)) {
@@ -4921,6 +4976,7 @@ function collectKayAppContributionIds(manifest) {
   const contributes = manifest.targets?.kay?.app?.contributes;
   const output = [];
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "approvalTypes"], contributes?.approvalTypes);
+  pushContributionIds(output, ["targets", "kay", "app", "contributes", "workflows"], contributes?.workflows);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "tools"], contributes?.tools);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "endpoints"], contributes?.endpoints);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "uriModules"], contributes?.uriModules);
@@ -5070,6 +5126,18 @@ function createResolvedContractSchemas(canonical) {
     /** The auth service that module signs in through, whose accounts a card may send from. */
     authService: GlobalContributionId2.optional()
   });
+  const ResolvedKayAppWorkflow2 = z14.strictObject({
+    localId: LocalContributionId2,
+    globalId: GlobalContributionId2,
+    name: NonEmptyString3,
+    description: NonEmptyString3,
+    everyMs: z14.number().int().positive(),
+    auth: z14.strictObject({
+      serviceId: GlobalContributionId2,
+      schemeId: GlobalContributionId2,
+      scopes: z14.array(NonEmptyString3).min(1).optional()
+    }).optional()
+  });
   const ResolvedKayAppWhiteboardType2 = z14.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
@@ -5313,6 +5381,7 @@ function createResolvedContractSchemas(canonical) {
     kayAgentTools: z14.array(ResolvedKayAgentTool2).optional(),
     kayAppTools: z14.array(ResolvedKayAppTool2).optional(),
     kayAppApprovalTypes: z14.array(ResolvedKayAppApprovalType2).optional(),
+    kayAppWorkflows: z14.array(ResolvedKayAppWorkflow2).optional(),
     kayAppDataSources: z14.array(ResolvedKayAppDataSource2).optional(),
     kayAppWhiteboardTypes: z14.array(ResolvedKayAppWhiteboardType2).optional(),
     kayAppMcpServers: z14.array(ResolvedKayAppMcpServer2).optional(),
@@ -5325,6 +5394,7 @@ function createResolvedContractSchemas(canonical) {
     ResolvedKayAgentTool: ResolvedKayAgentTool2,
     ResolvedKayAppTool: ResolvedKayAppTool2,
     ResolvedKayAppApprovalType: ResolvedKayAppApprovalType2,
+    ResolvedKayAppWorkflow: ResolvedKayAppWorkflow2,
     ResolvedKayAppDataSource: ResolvedKayAppDataSource2,
     ResolvedKayAppWhiteboardType: ResolvedKayAppWhiteboardType2,
     ResolvedKayAppMcpServer: ResolvedKayAppMcpServer2,
@@ -5343,7 +5413,7 @@ function createResolvedContractSchemas(canonical) {
     ResolvedPluginContractV1: ResolvedPluginContractV12
   };
 }
-var { ResolvedKayAppApprovalType, ResolvedPluginContributionId, ResolvedKayAgentTool, ResolvedKayAppTool, ResolvedKayAppDataSource, ResolvedKayAppWhiteboardType, ResolvedKayAppMcpServer, ResolvedKayAgentUriModule, ResolvedKayAgentArtifactUriModule, ResolvedKayAgentEntityResolver, ResolvedKayAgentGitHostClaim, ResolvedKayAgentConverter, ResolvedReferencePresentation, ResolvedPluginProvisioningRequirement, ResolvedPluginAuthScheme, ResolvedPluginWebSession, ResolvedPluginAuthService, ResolvedKayUiAppEndpointCapability, ResolvedKayUiApp, ResolvedPluginContractV1 } = createResolvedContractSchemas(false);
+var { ResolvedKayAppApprovalType, ResolvedKayAppWorkflow, ResolvedPluginContributionId, ResolvedKayAgentTool, ResolvedKayAppTool, ResolvedKayAppDataSource, ResolvedKayAppWhiteboardType, ResolvedKayAppMcpServer, ResolvedKayAgentUriModule, ResolvedKayAgentArtifactUriModule, ResolvedKayAgentEntityResolver, ResolvedKayAgentGitHostClaim, ResolvedKayAgentConverter, ResolvedReferencePresentation, ResolvedPluginProvisioningRequirement, ResolvedPluginAuthScheme, ResolvedPluginWebSession, ResolvedPluginAuthService, ResolvedKayUiAppEndpointCapability, ResolvedKayUiApp, ResolvedPluginContractV1 } = createResolvedContractSchemas(false);
 var canonicalResolvedContractSchemas = createResolvedContractSchemas(true);
 function narrowestAccountSelectors() {
   return [{ kind: "active" }];
@@ -5383,6 +5453,7 @@ function collectContributionSources(manifest) {
   pushAll(output, "kay.app", "appDataSource", app?.dataSources);
   pushAll(output, "kay.app", "whiteboardType", app?.whiteboardTypes);
   pushAll(output, "kay.app", "approvalType", app?.approvalTypes);
+  pushAll(output, "kay.app", "workflow", app?.workflows);
   pushAll(output, "kay.app", "command", app?.commands);
   pushAll(output, "kay.app", "eventDefinition", app?.eventDefinitions);
   pushAll(output, "kay.app", "eventSubscription", app?.eventSubscriptions);
@@ -5661,6 +5732,17 @@ function resolveKayPluginContractV1(manifest) {
     globalId: resolveGlobalContributionId(namespace, tool.localId),
     toolName: tool.toolName
   }));
+  const kayAppWorkflows = manifest.targets?.kay?.app?.contributes?.workflows?.map(({ auth, ...workflow }) => ({
+    ...workflow,
+    globalId: resolveGlobalContributionId(namespace, workflow.localId),
+    ...auth === void 0 ? {} : {
+      auth: {
+        serviceId: isQualifiedAuthServiceRef(auth.service) ? auth.service : resolveGlobalContributionId(namespace, auth.service),
+        schemeId: isQualifiedAuthSchemeRef(auth.scheme) ? auth.scheme : resolveGlobalContributionId(namespace, auth.scheme),
+        ...auth.scopes === void 0 ? {} : { scopes: auth.scopes }
+      }
+    }
+  }));
   const kayAppDataSources = manifest.targets?.kay?.app?.contributes?.dataSources?.map((source) => ({
     localId: source.localId,
     globalId: resolveGlobalContributionId(namespace, source.localId),
@@ -5811,6 +5893,7 @@ function resolveKayPluginContractV1(manifest) {
     ...kayAgentTools && kayAgentTools.length > 0 ? { kayAgentTools } : {},
     ...kayAppTools && kayAppTools.length > 0 ? { kayAppTools } : {},
     ...kayAppApprovalTypes && kayAppApprovalTypes.length > 0 ? { kayAppApprovalTypes } : {},
+    ...kayAppWorkflows && kayAppWorkflows.length > 0 ? { kayAppWorkflows } : {},
     ...kayAppDataSources && kayAppDataSources.length > 0 ? { kayAppDataSources } : {},
     ...kayAppWhiteboardTypes && kayAppWhiteboardTypes.length > 0 ? { kayAppWhiteboardTypes } : {},
     ...kayAppMcpServers.length > 0 ? { kayAppMcpServers } : {},
@@ -5838,7 +5921,6 @@ function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _di
 
 // packages/plugin-protocol/dist/plugin-directory-verdict.js
 var KAY_PLUGIN_MANIFEST_FILENAME = "kay-plugin.json";
-var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 64 * 1024;
 var RESERVED_DIRECTORY_PLUGIN_ID_PREFIXES = ["herd.", "kay."];
 async function judgeKayPluginDirectory(input) {
   const { tree, root, dir, host } = input;
@@ -6697,6 +6779,7 @@ export {
   ResolvedKayAppMcpServer,
   ResolvedKayAppTool,
   ResolvedKayAppWhiteboardType,
+  ResolvedKayAppWorkflow,
   ResolvedKayUiApp,
   ResolvedKayUiAppEndpointCapability,
   ResolvedPluginAuthScheme,
@@ -6763,6 +6846,7 @@ export {
   WhiteboardTypeInfo,
   WhiteboardTypeStorage,
   WhiteboardValue,
+  WorkflowContribution,
   approvalKindSchema,
   boundPluginDiagnosticMessage,
   captureArtifactProvenance,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.28.0",
+  "version": "0.30.0",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",