@yaklabs-ai/plugin-protocol 0.37.1 → 0.39.0

package/dist/index.js

@@ -254,7 +254,7 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.37.1";
+var KAY_PLUGIN_SDK_VERSION = "0.39.0";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.26.3",
   "0.27.1",
@@ -266,7 +266,9 @@ var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.33.0",
   "0.34.0",
   "0.35.0",
-  "0.36.0"
+  "0.36.0",
+  "0.37.1",
+  "0.38.0"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -1755,6 +1757,7 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "automations.write",
   "automations.run",
   "workflows.define",
+  "workflows.signals",
   "session-events.subscribe",
   "agents.run",
   "dynamic-context.register",
@@ -1786,7 +1789,8 @@ var PRIVATE_PLUGIN_CAPABILITY_SLUGS = [
   "soul.write",
   "skills.share",
   "plugins.set-enabled",
-  "system-prompt.register"
+  "system-prompt.register",
+  "workflows.signals"
 ];
 function isPrivateCapabilityClaim(claim) {
   return PRIVATE_PLUGIN_CAPABILITY_SLUGS.includes(claim.slug);
@@ -2011,6 +2015,14 @@ function createAuthoritySchemas(canonical) {
       slug: z10.literal("workflows.define"),
       envelope: z10.strictObject({})
     }),
+    z10.strictObject({
+      // Start a declared workflow on every plugin's signal events (`signals: true`), which carry
+      // other plugins' data. Private (PRIVATE_PLUGIN_CAPABILITY_SLUGS): only a plugin the release
+      // carries may hold it, so a third-party plugin cannot read every source's signals.
+      target: z10.literal("kay.app"),
+      slug: z10.literal("workflows.signals"),
+      envelope: z10.strictObject({})
+    }),
     z10.strictObject({
       target: z10.literal("kay.app"),
       slug: z10.literal("session-events.subscribe"),
@@ -2242,6 +2254,7 @@ function sameClaim(a, b) {
     case "automations.write":
     case "automations.run":
     case "workflows.define":
+    case "workflows.signals":
     case "session-events.subscribe":
     case "agents.run":
     case "account.assert":
@@ -2326,6 +2339,7 @@ function envelopePairs(a, b) {
     case "automations.write":
     case "automations.run":
     case "workflows.define":
+    case "workflows.signals":
     case "session-events.subscribe":
     case "agents.run":
     case "account.assert":
@@ -2746,6 +2760,7 @@ __export(contributions_exports, {
   ReferencePresentationUrlClaim: () => ReferencePresentationUrlClaim,
   ReferencePresentationVariant: () => ReferencePresentationVariant,
   ReferencePresentationVariants: () => ReferencePresentationVariants,
+  ReferencePresentationWords: () => ReferencePresentationWords,
   ResourceContribution: () => ResourceContribution,
   ResultRendererContribution: () => ResultRendererContribution,
   RichViewContribution: () => RichViewContribution,
@@ -2777,6 +2792,13 @@ import { z as z12 } from "zod";
 var plugin_events_exports = {};
 __export(plugin_events_exports, {
   PLUGIN_EVENT_ID_MAX_BYTES: () => PLUGIN_EVENT_ID_MAX_BYTES,
+  PLUGIN_EVENT_REFUSED_ERROR_NAME: () => PLUGIN_EVENT_REFUSED_ERROR_NAME,
+  PLUGIN_SIGNAL_KINDS: () => PLUGIN_SIGNAL_KINDS,
+  PLUGIN_SIGNAL_LABELS_MAX: () => PLUGIN_SIGNAL_LABELS_MAX,
+  PLUGIN_SIGNAL_LABEL_MAX: () => PLUGIN_SIGNAL_LABEL_MAX,
+  PLUGIN_SIGNAL_RELATED_KEYS: () => PLUGIN_SIGNAL_RELATED_KEYS,
+  PLUGIN_SIGNAL_SNIPPET_MAX: () => PLUGIN_SIGNAL_SNIPPET_MAX,
+  PLUGIN_SIGNAL_TITLE_MAX: () => PLUGIN_SIGNAL_TITLE_MAX,
   PluginEventEnvelope: () => PluginEventEnvelope,
   PluginEventId: () => PluginEventId,
   PluginEventLocalId: () => PluginEventLocalId,
@@ -2786,9 +2808,34 @@ __export(plugin_events_exports, {
   PluginEventSource: () => PluginEventSource,
   PluginEventTimestamp: () => PluginEventTimestamp,
   PluginEventUri: () => PluginEventUri,
-  canonicalPluginEventSchemas: () => canonicalPluginEventSchemas
+  PluginSignal: () => PluginSignal,
+  PluginSignalPublish: () => PluginSignalPublish,
+  canonicalPluginEventSchemas: () => canonicalPluginEventSchemas,
+  pluginSignalPayloadJsonSchema: () => pluginSignalPayloadJsonSchema
 });
 import { z as z11 } from "zod";
+
+// packages/plugin-protocol/dist/plugin-signal-limits.js
+var PLUGIN_EVENT_REFUSED_ERROR_NAME = "PluginEventRefusedError";
+var PLUGIN_SIGNAL_KINDS = [
+  "message",
+  "request",
+  "mention",
+  "invite",
+  "status"
+];
+var PLUGIN_SIGNAL_TITLE_MAX = 300;
+var PLUGIN_SIGNAL_SNIPPET_MAX = 500;
+var PLUGIN_SIGNAL_LABELS_MAX = 20;
+var PLUGIN_SIGNAL_LABEL_MAX = 64;
+var PLUGIN_SIGNAL_RELATED_KEYS = [
+  "thread",
+  "from",
+  "to",
+  "cc"
+];
+
+// packages/plugin-protocol/dist/plugin-events.js
 var PLUGIN_EVENT_ID_MAX_BYTES = 1024;
 function createPluginEventsSchemas(canonical) {
   const { GlobalContributionId: GlobalContributionId2, NonEmptyString: NonEmptyString3 } = canonical ? canonicalCommonSchemas : common_exports;
@@ -2840,7 +2887,39 @@ function createPluginEventsSchemas(canonical) {
     source: PluginEventSource2,
     payload: JsonValue.optional()
   });
+  const PluginSignal2 = z11.strictObject({
+    kind: z11.enum(PLUGIN_SIGNAL_KINDS),
+    direction: z11.enum(["in", "out"]).optional(),
+    title: z11.string().max(PLUGIN_SIGNAL_TITLE_MAX).optional(),
+    snippet: z11.string().max(PLUGIN_SIGNAL_SNIPPET_MAX).optional(),
+    actor: z11.strictObject({
+      name: z11.string().max(PLUGIN_SIGNAL_TITLE_MAX).optional(),
+      uri: PluginEventUri2
+    }).optional(),
+    addressed: z11.enum(["direct", "cc", "mention", "group", "none"]).optional(),
+    labels: z11.array(z11.string().min(1).max(PLUGIN_SIGNAL_LABEL_MAX)).max(PLUGIN_SIGNAL_LABELS_MAX).optional(),
+    dueAt: PluginEventTimestamp2.optional(),
+    state: z11.enum(["open", "resolved"]).optional()
+  }).refine((signal) => signal.state === void 0 || signal.kind === "status", {
+    message: "state is only for a status signal",
+    path: ["state"]
+  });
+  const PluginSignalRelatedValue = z11.union([
+    PluginEventUri2,
+    z11.array(PluginEventUri2)
+  ]);
+  const PluginSignalPublish2 = z11.object({
+    payload: PluginSignal2,
+    related: z11.strictObject({
+      thread: PluginEventUri2,
+      from: PluginSignalRelatedValue.optional(),
+      to: PluginSignalRelatedValue.optional(),
+      cc: PluginSignalRelatedValue.optional()
+    })
+  });
   return {
+    PluginSignal: PluginSignal2,
+    PluginSignalPublish: PluginSignalPublish2,
     PluginEventLocalId: PluginEventLocalId2,
     PluginEventUri: PluginEventUri2,
     PluginEventTimestamp: PluginEventTimestamp2,
@@ -2852,8 +2931,14 @@ function createPluginEventsSchemas(canonical) {
     PluginEventEnvelope: PluginEventEnvelope2
   };
 }
-var { PluginEventLocalId, PluginEventUri, PluginEventTimestamp, PluginEventRelated, PluginEventPublishSource, PluginEventSource, PluginEventId, PluginEventPublishInput, PluginEventEnvelope } = createPluginEventsSchemas(false);
+var { PluginSignal, PluginSignalPublish, PluginEventLocalId, PluginEventUri, PluginEventTimestamp, PluginEventRelated, PluginEventPublishSource, PluginEventSource, PluginEventId, PluginEventPublishInput, PluginEventEnvelope } = createPluginEventsSchemas(false);
 var canonicalPluginEventSchemas = createPluginEventsSchemas(true);
+function pluginSignalPayloadJsonSchema() {
+  return z11.toJSONSchema(PluginSignal, {
+    io: "input",
+    unrepresentable: "any"
+  });
+}
 
 // packages/plugin-protocol/dist/where-expression.js
 var TOKEN = /\s*(?:(\|\||&&|==|!=|!|\(|\))|'([^']*)'|"([^"]*)"|([A-Za-z][A-Za-z0-9]*(?:\.[A-Za-z][A-Za-z0-9]*)*))/y;
@@ -3035,6 +3120,33 @@ function evaluateCommandWhere(where, values) {
   return evaluateWhere(where, (key) => values[key]);
 }
 
+// packages/plugin-protocol/dist/tool-glyph.js
+var TOOL_GLYPHS = [
+  "terminal",
+  "file",
+  "search",
+  "folder",
+  "person",
+  "repo",
+  "clock",
+  "robot",
+  "globe",
+  "browser",
+  "skill",
+  "memory",
+  "session",
+  "plan",
+  "download",
+  "attachment",
+  "settings",
+  "catalog",
+  "model",
+  "doc",
+  "feedback",
+  "plugin",
+  "note"
+];
+
 // packages/plugin-protocol/dist/contributions.js
 var MCP_SERVER_LOCAL_HTTP_HOSTNAMES = /* @__PURE__ */ new Set(["localhost", "127.0.0.1"]);
 var MCP_SIGN_IN_SCHEME_KIND = {
@@ -3588,7 +3700,34 @@ function createContributionsSchemas(canonical) {
     version: canonical ? EventDefinitionVersion : EventDefinitionVersion.default(1),
     uriScheme: UriScheme2,
     relatedKeys: z12.array(NonEmptyString3).readonly().optional(),
-    payloadSchema: JsonSchema.optional()
+    payloadSchema: JsonSchema.optional(),
+    /**
+     * This event is a signal: its payload is the shared `PluginSignal` v1 and every publish
+     * names `related.thread`. Bundled workflows that subscribe with `signals: true` receive it
+     * without naming it. The payload schema is the shared one, so `payloadSchema` is omitted,
+     * and `relatedKeys` holds `thread` plus any of `from`, `to`, `cc`. Turning it on changes
+     * the payload, so bump `version` with it.
+     */
+    signal: z12.boolean().optional()
+  }).superRefine((definition, context) => {
+    if (definition.signal !== true)
+      return;
+    if (definition.payloadSchema !== void 0) {
+      context.addIssue({
+        code: "custom",
+        path: ["payloadSchema"],
+        message: "A signal event uses the shared PluginSignal v1 payload; omit payloadSchema."
+      });
+    }
+    const allowed = PLUGIN_SIGNAL_RELATED_KEYS;
+    const keys = definition.relatedKeys ?? [];
+    if (!keys.includes("thread") || keys.some((key) => !allowed.includes(key))) {
+      context.addIssue({
+        code: "custom",
+        path: ["relatedKeys"],
+        message: `A signal event declares relatedKeys 'thread' plus any of ${allowed.filter((key) => key !== "thread").map((key) => `'${key}'`).join(", ")}.`
+      });
+    }
   });
   const PluginNotificationRuleContribution2 = z12.strictObject({
     localId: LocalContributionId2,
@@ -3691,6 +3830,26 @@ function createContributionsSchemas(canonical) {
     objectId: NonEmptyString3.optional(),
     open: z12.strictObject({ kind: z12.literal("none") }).optional()
   });
+  const ReferencePresentationWords2 = z12.strictObject({
+    /** The row's mark, for a source with no icon of its own. Left out: the plugin's main icon. */
+    glyph: z12.enum(TOOL_GLYPHS).optional(),
+    /** The thing an address names ("channel" in "Read Slack channel"). Left out: the row reads the scheme's own name. */
+    kind: NonEmptyString3.optional(),
+    /** What a tally counts one address as ("Slack message"). Left out: `kind`, else "item". */
+    noun: NonEmptyString3.optional(),
+    /** What the live phrase names ("Slack" in "Reading Slack"). Left out: the bare verb ("Reading"). */
+    target: NonEmptyString3.optional(),
+    /** `kind` already says which source this is: "Edited plan", not "Edited Plan plan". */
+    kindNamesSource: z12.literal(true).optional()
+  }).superRefine((value, ctx) => {
+    if (value.kind === void 0 && (value.glyph !== void 0 || value.kindNamesSource !== void 0)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["kind"],
+        message: "glyph and kindNamesSource describe a row, which needs a kind."
+      });
+    }
+  });
   const ReferencePresentationContribution2 = z12.strictObject({
     localId: LocalContributionId2,
     /** This manifest's URI module. Leave it out only for an address another layer serves. */
@@ -3703,16 +3862,48 @@ function createContributionsSchemas(canonical) {
     scheme: UriScheme2.optional(),
     /** Which of the addresses open the page, and on what. Read by the window. */
     addresses: z12.array(ReferencePresentationAddress2).min(1).optional(),
-    resourceKind: NonEmptyString3,
-    open: ReferenceOpenBehavior2,
+    /** Comes with `open`. A presentation with neither only words its module's addresses. */
+    resourceKind: NonEmptyString3.optional(),
+    /** How the address opens. Left out, it stays plain text. */
+    open: ReferenceOpenBehavior2.optional(),
     /** MIME-specific resource kinds; absent keys use the base presentation. */
     variants: ReferencePresentationVariants2.optional(),
     /** Lexical public URL claims used only for host-rendered browser presentations. */
     claims: z12.array(ReferencePresentationUrlClaim2).optional(),
     /** Informational app presentation matched against the canonical resource URI. */
-    tooltip: ReferencePresentationTooltip2.optional()
+    tooltip: ReferencePresentationTooltip2.optional(),
+    /** What the transcript calls this module's addresses. Needs a `uriModule`. */
+    words: ReferencePresentationWords2.optional()
   }).superRefine((value, ctx) => {
-    if (value.claims !== void 0 && value.claims.length > 0 && value.open.kind !== "browser-pane") {
+    if (value.open === void 0 !== (value.resourceKind === void 0)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["open"],
+        message: "open and resourceKind come together: name both or neither."
+      });
+    }
+    if (value.open === void 0 && value.words === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["words"],
+        message: "A reference presentation that opens nothing must have words."
+      });
+    }
+    if (value.words !== void 0 && value.uriModule === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["words"],
+        message: "Words belong to a URI module: name its uriModule."
+      });
+    }
+    if (value.open === void 0 && (value.variants !== void 0 || value.tooltip !== void 0)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["open"],
+        message: "variants and tooltip need an open."
+      });
+    }
+    if (value.claims !== void 0 && value.claims.length > 0 && value.open?.kind !== "browser-pane") {
       ctx.addIssue({
         code: "custom",
         path: ["claims"],
@@ -3726,14 +3917,14 @@ function createContributionsSchemas(canonical) {
         message: "A reference presentation names a uriModule or a scheme."
       });
     }
-    if ((value.scheme !== void 0 || value.addresses !== void 0) && value.open.kind !== "page") {
+    if ((value.scheme !== void 0 || value.addresses !== void 0) && value.open?.kind !== "page") {
       ctx.addIssue({
         code: "custom",
         path: ["open"],
         message: "scheme and addresses require page opening."
       });
     }
-    if (value.tooltip !== void 0 && value.open.kind === "page") {
+    if (value.tooltip !== void 0 && value.open?.kind === "page") {
       ctx.addIssue({
         code: "custom",
         path: ["tooltip"],
@@ -3994,6 +4185,7 @@ function createContributionsSchemas(canonical) {
     ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2,
     ReferencePresentationTooltip: ReferencePresentationTooltip2,
     ReferencePresentationAddress: ReferencePresentationAddress2,
+    ReferencePresentationWords: ReferencePresentationWords2,
     ReferencePresentationContribution: ReferencePresentationContribution2,
     RichViewContribution: RichViewContribution2,
     KayUiAppHostCapability: KayUiAppHostCapability2,
@@ -4008,7 +4200,7 @@ function createContributionsSchemas(canonical) {
     PluginContributionKind: PluginContributionKind2
   };
 }
-var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
+var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationWords, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
 var canonicalContributionSchemas = createContributionsSchemas(true);
 
 // packages/plugin-protocol/dist/icon-shape.js
@@ -4833,7 +5025,7 @@ function createManifestSchemas(canonical) {
           message: `reference presentation ${presentation.localId} references unknown ui app ${presentation.tooltip.app}`
         });
       }
-      if (presentation.open.kind === "page" && !declaredPageIds.has(presentation.open.pageId)) {
+      if (presentation.open?.kind === "page" && !declaredPageIds.has(presentation.open.pageId)) {
         ctx.addIssue({
           code: "custom",
           path: [...path, "open", "pageId"],
@@ -4879,6 +5071,27 @@ function createManifestSchemas(canonical) {
         });
       }
     }
+    const ownSchemes = new Set([
+      ...manifest.targets?.kay?.agent?.contributes?.uriModules ?? [],
+      ...manifest.targets?.kay?.app?.contributes?.uriModules ?? []
+    ].flatMap((module) => module.schemes));
+    for (const [index, definition] of (manifest.targets?.kay?.app?.contributes?.eventDefinitions ?? []).entries()) {
+      if (definition.signal !== true || ownSchemes.has(definition.uriScheme))
+        continue;
+      ctx.addIssue({
+        code: "custom",
+        path: [
+          "targets",
+          "kay",
+          "app",
+          "contributes",
+          "eventDefinitions",
+          index,
+          "uriScheme"
+        ],
+        message: `signal event ${definition.localId} must use a URI scheme one of this plugin's own URI modules serves; '${definition.uriScheme}' is not among them`
+      });
+    }
     reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "workflows"], manifest.targets?.kay?.app?.contributes?.workflows, "workflow");
     for (const [index, workflow] of (manifest.targets?.kay?.app?.contributes?.workflows ?? []).entries()) {
       const path = [
@@ -5532,7 +5745,7 @@ function boundPluginDiagnosticMessage(message) {
 import { z as z14 } from "zod";
 function createResolvedContractSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
-  const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
+  const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, ReferencePresentationWords: ReferencePresentationWords2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, GlobalContributionId: GlobalContributionId2, HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, PluginToolName: PluginToolName2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginExternalCliConnect: PluginExternalCliConnect2, PluginOAuthClientSupplier: PluginOAuthClientSupplier2 } = canonical ? canonicalManifestSchemas : manifest_exports;
   const { ResolvedPluginGrants: ResolvedPluginGrants2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
@@ -5696,18 +5909,22 @@ function createResolvedContractSchemas(canonical) {
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     uriModule: GlobalContributionId2.optional(),
-    /** The schemes a page-opening presentation answers for: its `scheme`, or its module's. */
+    /** The schemes this presentation is about: its `scheme`, or its module's. */
     schemes: z14.array(UriScheme2).min(1).optional(),
+    /** The module's `displayName`: the source's name in a row. */
+    displayName: NonEmptyString3.optional(),
     addresses: z14.array(ReferencePresentationAddress2).min(1).optional(),
-    resourceKind: NonEmptyString3,
-    open: ReferenceOpenBehavior2,
+    /** Comes with `open`. A presentation with neither only words its module's addresses. */
+    resourceKind: NonEmptyString3.optional(),
+    open: ReferenceOpenBehavior2.optional(),
     /** MIME-specific resource kinds; absent keys use the base presentation. */
     variants: ReferencePresentationVariants2.optional(),
     claims: z14.array(ReferencePresentationUrlClaim2).optional(),
     tooltip: z14.strictObject({
       app: GlobalContributionId2,
       pattern: ReferencePresentationUriPattern2
-    }).optional()
+    }).optional(),
+    words: ReferencePresentationWords2.optional()
   });
   const ResolvedPluginProvisioningRequirement2 = z14.strictObject({
     id: LocalContributionId2,
@@ -6323,10 +6540,13 @@ function resolveKayPluginContractV1(manifest) {
     ...presentation.uriModule === void 0 ? {} : {
       uriModule: resolveGlobalContributionId(namespace, presentation.uriModule)
     },
-    ...presentationSchemes(manifest, presentation),
+    ...presentationSource(manifest, presentation),
     ...presentation.addresses === void 0 ? {} : { addresses: presentation.addresses },
-    resourceKind: presentation.resourceKind,
-    open: presentation.open,
+    ...presentation.open === void 0 || presentation.resourceKind === void 0 ? {} : {
+      resourceKind: presentation.resourceKind,
+      open: presentation.open
+    },
+    ...presentation.words === void 0 ? {} : { words: { ...presentation.words } },
     ...presentation.tooltip === void 0 ? {} : {
       tooltip: {
         app: resolveGlobalContributionId(namespace, presentation.tooltip.app),
@@ -6409,18 +6629,17 @@ function safeResolveKayPluginContractV1(manifest) {
     throw error;
   }
 }
-function presentationSchemes(manifest, presentation) {
-  if (presentation.scheme !== void 0) {
-    return { schemes: [presentation.scheme] };
-  }
-  if (presentation.open.kind !== "page")
-    return {};
+function presentationSource(manifest, presentation) {
   const contributes = manifest.targets?.kay;
   const module = [
     ...contributes?.agent?.contributes?.uriModules ?? [],
     ...contributes?.app?.contributes?.uriModules ?? []
   ].find((candidate) => candidate.localId === presentation.uriModule);
-  return module === void 0 ? {} : { schemes: [...module.schemes] };
+  const schemes = presentation.scheme === void 0 ? module?.schemes : [presentation.scheme];
+  return {
+    ...schemes === void 0 ? {} : { schemes: [...schemes] },
+    ...module?.displayName === void 0 ? {} : { displayName: module.displayName }
+  };
 }
 function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
   return facts;
@@ -7046,6 +7265,45 @@ var ArtifactOutputChange = z20.union([
   z20.strictObject({ sessionId: Segment })
 ]);
 
+// packages/plugin-protocol/dist/credential-text.js
+var CREDENTIAL_VALUE_PATTERNS = [
+  // Anthropic / OpenAI-style secret keys (`sk-`, `sk-ant-`, `sk-proj-`).
+  /^sk-[A-Za-z0-9_-]{16,}$/u,
+  // GitHub classic, fine-grained, app, and OAuth tokens.
+  /^gh[pousr]_[A-Za-z0-9]{16,}$/u,
+  /^github_pat_[A-Za-z0-9_]{20,}$/u,
+  // GitLab personal access tokens.
+  /^glpat-[A-Za-z0-9_-]{16,}$/u,
+  // Slack bot/user/app tokens.
+  /^xox[baprse]-[A-Za-z0-9-]{10,}$/u,
+  // AWS access key ids, long-lived and STS-issued.
+  /^(?:AKIA|ASIA)[0-9A-Z]{16}$/u,
+  // Google API keys, both published shapes.
+  /^AIza[0-9A-Za-z_-]{35}$/u,
+  /^AQ\.[A-Za-z0-9_-]{20,}$/u,
+  // npm automation tokens.
+  /^npm_[A-Za-z0-9]{30,}$/u,
+  // SendGrid API keys (SG.<key id>.<secret>).
+  /^SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}$/u,
+  // HashiCorp Vault service/batch/recovery tokens.
+  /^hv[sbr]\.[A-Za-z0-9_-]{20,}$/u,
+  // Shopify access tokens.
+  /^shp(?:at|ss|ca|pa)_[a-fA-F0-9]{32}$/u,
+  // Stripe live/test secret and restricted keys.
+  /^(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}$/u,
+  // JSON Web Tokens - header.payload.signature, header always starts `eyJ`.
+  /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/u,
+  // A whole Authorization header value carried as data.
+  /^(?:Bearer|Basic) [A-Za-z0-9+/._~-]{16,}={0,2}$/iu,
+  // PEM private key blocks, anywhere in the string.
+  /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/u
+];
+function isCredentialShapedText(value) {
+  if (typeof value !== "string" || value.length === 0)
+    return false;
+  return CREDENTIAL_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
+
 // packages/plugin-protocol/dist/ui-module-bundle.js
 import { z as z21 } from "zod";
 var KAY_UI_MODULE_BUNDLE_PROTOCOL = "kay.ui.module-bundle.v1";
@@ -7216,8 +7474,15 @@ export {
   PLUGIN_CAPABILITY_SLUGS,
   PLUGIN_DIAGNOSTIC_MESSAGE_CAP,
   PLUGIN_EVENT_ID_MAX_BYTES,
+  PLUGIN_EVENT_REFUSED_ERROR_NAME,
   PLUGIN_ICON_SHAPE_ATTRIBUTE,
   PLUGIN_NOTIFICATION_RULE_HOST_KEYS,
+  PLUGIN_SIGNAL_KINDS,
+  PLUGIN_SIGNAL_LABELS_MAX,
+  PLUGIN_SIGNAL_LABEL_MAX,
+  PLUGIN_SIGNAL_RELATED_KEYS,
+  PLUGIN_SIGNAL_SNIPPET_MAX,
+  PLUGIN_SIGNAL_TITLE_MAX,
   PRIVATE_PLUGIN_CAPABILITY_SLUGS,
   PackageAssetPath,
   PluginAgentDefinitionPermissionRule,
@@ -7253,6 +7518,8 @@ export {
   PluginPermissionManifest,
   PluginProvisioningProbe,
   PluginProvisioningRequirement,
+  PluginSignal,
+  PluginSignalPublish,
   PluginSkillSourceDeclaration,
   PluginSourceClass,
   PluginStorageManifest,
@@ -7274,6 +7541,7 @@ export {
   ReferencePresentationUrlClaim,
   ReferencePresentationVariant,
   ReferencePresentationVariants,
+  ReferencePresentationWords,
   RegistrableDomain,
   ResolvedAuthGrantRequest,
   ResolvedEndpointGrantRequest,
@@ -7325,6 +7593,7 @@ export {
   SignedInStatusCode,
   SkillContribution,
   StorageGrantRequest,
+  TOOL_GLYPHS,
   TargetEntrypoint,
   TargetPermissionSet,
   TargetPermissionWiring,
@@ -7381,6 +7650,7 @@ export {
   hostWithinDomain,
   isCanonicalArtifactOutputUri,
   isCompatible,
+  isCredentialShapedText,
   isKayPluginCompatibilityRefusal,
   isPrivateCapabilityClaim,
   isQualifiedAuthSchemeRef,
@@ -7404,6 +7674,7 @@ export {
   parseSemver,
   parseWhere,
   pluginIconShape,
+  pluginSignalPayloadJsonSchema,
   precedingPersonMessages,
   readKayPluginDeclaredCompatibility,
   refineWebSessionScopeConfined,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.37.1",
+  "version": "0.39.0",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",