@yaklabs-ai/plugin-protocol 0.44.0 → 0.46.0

package/dist/index.d.ts

@@ -1642,6 +1642,8 @@ declare namespace authoringCommonSchemas {
 
 declare namespace authoringContributionSchemas {
     export {
+        isUiAppSourceModule,
+        uiAppSourceStylePath,
         MCP_SIGN_IN_SCHEME_KIND,
         PLUGIN_NOTIFICATION_RULE_HOST_KEYS,
         ApprovalCardForm,
@@ -1669,6 +1671,7 @@ declare namespace authoringContributionSchemas {
         EntityResolverContribution,
         AgentRenderContribution,
         EndpointContribution,
+        PluginCardContribution,
         WorkflowContribution,
         McpServerUrl,
         McpServerAuthMode,
@@ -1693,6 +1696,7 @@ declare namespace authoringContributionSchemas {
         ReferencePresentationUrlClaim,
         ReferencePresentationTooltip,
         ReferencePresentationAddress,
+        ReferencePresentationAccountLinks,
         ReferencePresentationWords,
         ReferencePresentationContribution,
         RichViewContribution,
@@ -1706,7 +1710,8 @@ declare namespace authoringContributionSchemas {
         CommandHandler,
         CommandContribution,
         PluginContributionKind,
-        canonicalContributionSchemas
+        canonicalContributionSchemas,
+        PluginCardResult
     }
 }
 
@@ -2093,6 +2098,7 @@ declare const canonicalContributionSchemas: {
         authScheme: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+        looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"scheme">;
             scheme: z.ZodString;
@@ -2541,6 +2547,14 @@ declare const canonicalContributionSchemas: {
         }, z.core.$strict>>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strict>;
+    PluginCardContribution: z.ZodObject<{
+        localId: z.ZodString;
+        description: z.ZodString;
+        inputs: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
+        readEndpoint: z.ZodString;
+        submitEndpoint: z.ZodString;
+        authService: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
     WorkflowContribution: z.ZodObject<{
         localId: z.ZodString;
         name: z.ZodString;
@@ -2598,7 +2612,7 @@ declare const canonicalContributionSchemas: {
     PluginNotificationRuleContribution: z.ZodObject<{
         localId: z.ZodString;
         event: z.ZodString;
-        where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+        where: z.ZodOptional<z.ZodString>;
         rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
     }, z.core.$strict>;
     PluginProductEventContribution: z.ZodUnion<readonly [z.ZodObject<{
@@ -2665,6 +2679,9 @@ declare const canonicalContributionSchemas: {
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"page">;
         pageId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"local-app">;
+        schemes: z.ZodArray<z.ZodString>;
     }, z.core.$strict>], "kind">;
     ReferencePresentationVariant: z.ZodObject<{
         resourceKind: z.ZodString;
@@ -2714,6 +2731,28 @@ declare const canonicalContributionSchemas: {
             kind: z.ZodLiteral<"none">;
         }, z.core.$strict>>;
     }, z.core.$strict>;
+    ReferencePresentationAccountLinks: z.ZodObject<{
+        label: z.ZodOptional<z.ZodEnum<{
+            email: "email";
+            name: "name";
+        }>>;
+        pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            setPathname: z.ZodOptional<z.ZodString>;
+            addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>>;
+        addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodObject<{
+                protocol: z.ZodString;
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                search: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            url: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
     ReferencePresentationWords: z.ZodObject<{
         glyph: z.ZodOptional<z.ZodEnum<{
             file: "file";
@@ -2778,6 +2817,9 @@ declare const canonicalContributionSchemas: {
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"page">;
             pageId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"local-app">;
+            schemes: z.ZodArray<z.ZodString>;
         }, z.core.$strict>], "kind">>;
         variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             resourceKind: z.ZodString;
@@ -2845,6 +2887,28 @@ declare const canonicalContributionSchemas: {
             target: z.ZodOptional<z.ZodString>;
             kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
+        accountLinks: z.ZodOptional<z.ZodObject<{
+            label: z.ZodOptional<z.ZodEnum<{
+                email: "email";
+                name: "name";
+            }>>;
+            pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                setPathname: z.ZodOptional<z.ZodString>;
+                addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+            }, z.core.$strict>>>;
+            addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                pattern: z.ZodObject<{
+                    protocol: z.ZodString;
+                    hostname: z.ZodString;
+                    pathname: z.ZodOptional<z.ZodString>;
+                    search: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                url: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     RichViewContribution: z.ZodObject<{
         localId: z.ZodString;
@@ -3048,6 +3112,7 @@ declare const canonicalContributionSchemas: {
         interactionDriver: "interactionDriver";
         entityResolver: "entityResolver";
         agentRenderer: "agentRenderer";
+        pluginCard: "pluginCard";
         eventDefinition: "eventDefinition";
         eventSubscription: "eventSubscription";
         appDataSource: "appDataSource";
@@ -3342,6 +3407,11 @@ export declare interface DeclaredKayPluginCompatibility {
     readonly sdk?: string | undefined;
 }
 
+/** The address schemes whose items an app on this machine opens, rather than a page on the web. */
+export declare function declaredLocalAppSchemes<TPlugin extends {
+    readonly contributes: Readonly<Record<string, unknown>>;
+}>(plugins: readonly TPlugin[]): ReadonlySet<string>;
+
 /**
  * Every plugin's reference presentations. The daemon delivers this one kind from the resolved
  * contract rather than the manifest, so its rows carry `schemes`.
@@ -3467,6 +3537,12 @@ export declare const EventGrantRequest: z.ZodObject<{
 
 export declare type EventGrantRequest = z.infer<typeof EventGrantRequest>;
 
+/**
+ * {@link whereProblem}, for a `where` a plugin event is matched against: every key must also be a
+ * safe path, at most 10 identifier segments and 256 bytes.
+ */
+export declare function eventWhereProblem(value: unknown): string | undefined;
+
 export declare const FileExtensionToken: z.ZodString;
 
 export declare type FileExtensionToken = z.infer<typeof FileExtensionToken>;
@@ -3488,6 +3564,9 @@ export declare function finalizeArtifactProvenanceEnvelope(capture: ArtifactProv
 
 export declare function findSkillSuggestionCitations(text: string, options?: SkillSuggestionEvidenceOptions): readonly SkillSuggestionCitation[];
 
+/** One literal as an expression writes it: single-quoted strings, JSON-form numbers. */
+export declare function formatWhereLiteral(value: WhereLiteral): string;
+
 export declare const GitBasicAuthUser: z.ZodString;
 
 export declare type GitBasicAuthUser = z.infer<typeof GitBasicAuthUser>;
@@ -3559,6 +3638,11 @@ export declare function isCompatible(report: KayPluginCompatibilityReport): bool
  */
 export declare function isCredentialShapedText(value: unknown): boolean;
 
+/** Whether `url` uses a link scheme a loaded plugin declared for an app on this machine. */
+export declare function isDeclaredLocalAppLink<TPlugin extends {
+    readonly contributes: Readonly<Record<string, unknown>>;
+}>(url: string, plugins: readonly TPlugin[]): boolean;
+
 /**
  * Whether a refusal `code` came from the compatibility check: the plugin was written for another
  * SDK or protocol, as opposed to being malformed.
@@ -3590,6 +3674,12 @@ export declare function isQualifiedAuthServiceRef(ref: string): boolean;
 /** Whether a range is one {@link satisfiesSemverRange} can answer for at all. */
 export declare function isSupportedSemverRange(range: string): boolean;
 
+/**
+ * An app entry naming source rather than built JavaScript. Bonsai compiles it when it loads the
+ * plugin, so a plugin in `~/.kay/plugins` needs no build tool for a page.
+ */
+export declare function isUiAppSourceModule(module: string): boolean;
+
 export declare const JsonObject: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
 
 export declare type JsonObject = z.infer<typeof JsonObject>;
@@ -4315,8 +4405,20 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  *
  * 0.44.0 adds `words.kinds` to a reference presentation (#15905): an ordered list of address patterns
  * and the kind each one names. Additive: a plugin that lists them declares ^0.44.0.
+ *
+ * 0.45.0 adds declared plugin cards and app.implementCard for their read/submit endpoints. It also
+ * lets a plugin declare what the window hardcoded about it (#15906). A reference presentation gains
+ * `accountLinks`, how a page opens under the account an address means, and a `local-app` open, for
+ * an item an app on this machine shows; a plugin the person installed can't declare that open. A
+ * `webSession` gains `signInFirst`. A URI module defines `lookupWebLink` and sets `looksUpWebLinks`
+ * to find a page when someone opens the address, and a preview field marks which `part` of a message
+ * it is. A claim's `brandIcon` is a file path and no longer inline markup, which only this repo's
+ * Microsoft plugin used. Otherwise additive: a plugin using any of these declares ^0.45.0.
+ *
+ * 0.46.0 adds `@bonsai/plugin-sdk/artifact-provenance`, so a plugin shipped as files can finalize
+ * and read the provenance the host captured. Additive: a plugin that imports it declares ^0.46.0.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.44.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.46.0";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -4379,6 +4481,7 @@ export declare const KayAgentTargetManifest: z.ZodObject<{
             authScheme: z.ZodOptional<z.ZodString>;
             knownResources: z.ZodOptional<z.ZodLiteral<true>>;
             describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+            looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
             claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
                 kind: z.ZodLiteral<"scheme">;
                 scheme: z.ZodString;
@@ -4671,6 +4774,14 @@ export declare const KayAppTargetManifest: z.ZodObject<{
             }, z.core.$strict>>;
             timeoutMs: z.ZodOptional<z.ZodNumber>;
         }, z.core.$strict>>>;
+        cards: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            localId: z.ZodString;
+            description: z.ZodString;
+            inputs: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
+            readEndpoint: z.ZodString;
+            submitEndpoint: z.ZodString;
+            authService: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>>;
         uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
             description: z.ZodExactOptional<z.ZodString>;
             localId: z.ZodString;
@@ -4952,7 +5063,7 @@ export declare const KayAppTargetManifest: z.ZodObject<{
         notificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
             event: z.ZodString;
-            where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+            where: z.ZodOptional<z.ZodString>;
             rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
         }, z.core.$strict>>>;
         productEvents: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -5175,6 +5286,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         authScheme: z.ZodOptional<z.ZodString>;
                         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
                         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+                        looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
                         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
                             kind: z.ZodLiteral<"scheme">;
                             scheme: z.ZodString;
@@ -5464,6 +5576,14 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         }, z.core.$strict>>;
                         timeoutMs: z.ZodOptional<z.ZodNumber>;
                     }, z.core.$strict>>>;
+                    cards: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        localId: z.ZodString;
+                        description: z.ZodString;
+                        inputs: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
+                        readEndpoint: z.ZodString;
+                        submitEndpoint: z.ZodString;
+                        authService: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>>>;
                     uriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         description: z.ZodExactOptional<z.ZodString>;
                         localId: z.ZodString;
@@ -5745,7 +5865,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     notificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
                         event: z.ZodString;
-                        where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+                        where: z.ZodOptional<z.ZodString>;
                         rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
                     }, z.core.$strict>>>;
                     productEvents: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -5870,6 +5990,9 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         }, z.core.$strict>, z.ZodObject<{
                             kind: z.ZodLiteral<"page">;
                             pageId: z.ZodString;
+                        }, z.core.$strict>, z.ZodObject<{
+                            kind: z.ZodLiteral<"local-app">;
+                            schemes: z.ZodArray<z.ZodString>;
                         }, z.core.$strict>], "kind">>;
                         variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                             resourceKind: z.ZodString;
@@ -5937,6 +6060,28 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                             target: z.ZodOptional<z.ZodString>;
                             kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
                         }, z.core.$strict>>;
+                        accountLinks: z.ZodOptional<z.ZodObject<{
+                            label: z.ZodOptional<z.ZodEnum<{
+                                email: "email";
+                                name: "name";
+                            }>>;
+                            pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                hostname: z.ZodString;
+                                pathname: z.ZodOptional<z.ZodString>;
+                                unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                                setPathname: z.ZodOptional<z.ZodString>;
+                                addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+                            }, z.core.$strict>>>;
+                            addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                pattern: z.ZodObject<{
+                                    protocol: z.ZodString;
+                                    hostname: z.ZodString;
+                                    pathname: z.ZodOptional<z.ZodString>;
+                                    search: z.ZodOptional<z.ZodString>;
+                                }, z.core.$strict>;
+                                url: z.ZodString;
+                            }, z.core.$strict>>>;
+                        }, z.core.$strict>>;
                     }, z.core.$strict>>>;
                     views: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
@@ -6245,6 +6390,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     external: "external";
                     embedded: "embedded";
                 }>;
+                signInFirst: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>;
@@ -7036,6 +7182,9 @@ export declare const KayUiTargetManifest: z.ZodObject<{
             }, z.core.$strict>, z.ZodObject<{
                 kind: z.ZodLiteral<"page">;
                 pageId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"local-app">;
+                schemes: z.ZodArray<z.ZodString>;
             }, z.core.$strict>], "kind">>;
             variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 resourceKind: z.ZodString;
@@ -7103,6 +7252,28 @@ export declare const KayUiTargetManifest: z.ZodObject<{
                 target: z.ZodOptional<z.ZodString>;
                 kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
             }, z.core.$strict>>;
+            accountLinks: z.ZodOptional<z.ZodObject<{
+                label: z.ZodOptional<z.ZodEnum<{
+                    email: "email";
+                    name: "name";
+                }>>;
+                pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    hostname: z.ZodString;
+                    pathname: z.ZodOptional<z.ZodString>;
+                    unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    setPathname: z.ZodOptional<z.ZodString>;
+                    addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+                }, z.core.$strict>>>;
+                addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    pattern: z.ZodObject<{
+                        protocol: z.ZodString;
+                        hostname: z.ZodString;
+                        pathname: z.ZodOptional<z.ZodString>;
+                        search: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>;
+                    url: z.ZodString;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>>;
         views: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
@@ -7414,9 +7585,12 @@ export declare function parseResolvedPluginContractV1(value: unknown): ResolvedP
 export declare function parseSemver(value: string): ParsedSemver | undefined;
 
 /**
- * Parses a `where` expression: `||`, `&&`, `!`, parentheses, `==`, `!=`, strings, `true`, `false`
- * and dotted keys, for example `markedForRetirement || proposedRewrite.stale == false`. A bare key
- * means "is set". With `keyTypes`, only those keys parse, and each is checked against its type.
+ * Parses a `where` expression: `||`, `&&`, `!`, parentheses, `==`, `!=`, `contains`, strings,
+ * numbers, `true`, `false` and dotted keys, for example
+ * `markedForRetirement || proposedRewrite.stale == false`. A bare key means "is set". `==` and `!=`
+ * compare a whole value, so a list never equals a scalar; `labels contains 'urgent'` looks inside a
+ * list. With `keyTypes`, only those keys parse, each is checked against its type, and `contains` is
+ * refused, because those keys are scalars.
  */
 export declare function parseWhere(source: string, keyTypes?: WhereKeyTypes): WhereParseResult;
 
@@ -7635,6 +7809,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
                 external: "external";
                 embedded: "embedded";
             }>;
+            signInFirst: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
@@ -7926,6 +8101,7 @@ export declare const PluginAuthService: z.ZodObject<{
             external: "external";
             embedded: "embedded";
         }>;
+        signInFirst: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 
@@ -9715,6 +9891,26 @@ export declare type PluginCapabilityRefusalV1 = z.infer<typeof PluginCapabilityR
 
 export declare type PluginCapabilitySlug = (typeof PLUGIN_CAPABILITY_SLUGS)[number];
 
+export declare const PluginCardContribution: z.ZodObject<{
+    localId: z.ZodString;
+    description: z.ZodString;
+    inputs: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
+    readEndpoint: z.ZodString;
+    submitEndpoint: z.ZodString;
+    authService: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+
+export declare type PluginCardContribution = z.infer<typeof PluginCardContribution>;
+
+export declare type PluginCardResult<T> = {
+    readonly ok: true;
+    readonly data: T;
+} | {
+    readonly ok: false;
+    readonly reason: "needs-auth" | "failed";
+    readonly message: string;
+};
+
 export declare const PluginCompatibilityManifest: z.ZodObject<{
     supportedProtocols: z.ZodOptional<z.ZodArray<z.ZodLiteral<"kay.plugin.v1">>>;
     minKayVersion: z.ZodOptional<z.ZodString>;
@@ -9779,6 +9975,7 @@ export declare const PluginContributionKind: z.ZodEnum<{
     interactionDriver: "interactionDriver";
     entityResolver: "entityResolver";
     agentRenderer: "agentRenderer";
+    pluginCard: "pluginCard";
     eventDefinition: "eventDefinition";
     eventSubscription: "eventSubscription";
     appDataSource: "appDataSource";
@@ -10003,7 +10200,7 @@ export declare type PluginNamespace = z.infer<typeof PluginNamespace>;
 export declare const PluginNotificationRuleContribution: z.ZodObject<{
     localId: z.ZodString;
     event: z.ZodString;
-    where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+    where: z.ZodOptional<z.ZodString>;
     rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
 }, z.core.$strict>;
 
@@ -10830,6 +11027,7 @@ export declare const PluginWebSessionDeclaration: z.ZodObject<{
         external: "external";
         embedded: "embedded";
     }>;
+    signInFirst: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 
 export declare type PluginWebSessionDeclaration = z.infer<typeof PluginWebSessionDeclaration>;
@@ -10880,10 +11078,38 @@ export declare const ReferenceOpenBehavior: z.ZodDiscriminatedUnion<[z.ZodObject
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"page">;
     pageId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"local-app">;
+    schemes: z.ZodArray<z.ZodString>;
 }, z.core.$strict>], "kind">;
 
 export declare type ReferenceOpenBehavior = z.infer<typeof ReferenceOpenBehavior>;
 
+export declare const ReferencePresentationAccountLinks: z.ZodObject<{
+    label: z.ZodOptional<z.ZodEnum<{
+        email: "email";
+        name: "name";
+    }>>;
+    pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        hostname: z.ZodString;
+        pathname: z.ZodOptional<z.ZodString>;
+        unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        setPathname: z.ZodOptional<z.ZodString>;
+        addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>>;
+    addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        pattern: z.ZodObject<{
+            protocol: z.ZodString;
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            search: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        url: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+
+export declare type ReferencePresentationAccountLinks = z.infer<typeof ReferencePresentationAccountLinks>;
+
 export declare const ReferencePresentationAddress: z.ZodObject<{
     pattern: z.ZodObject<{
         protocol: z.ZodString;
@@ -10923,6 +11149,9 @@ export declare const ReferencePresentationContribution: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"page">;
         pageId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"local-app">;
+        schemes: z.ZodArray<z.ZodString>;
     }, z.core.$strict>], "kind">>;
     variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         resourceKind: z.ZodString;
@@ -10990,6 +11219,28 @@ export declare const ReferencePresentationContribution: z.ZodObject<{
         target: z.ZodOptional<z.ZodString>;
         kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>>;
+    accountLinks: z.ZodOptional<z.ZodObject<{
+        label: z.ZodOptional<z.ZodEnum<{
+            email: "email";
+            name: "name";
+        }>>;
+        pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            setPathname: z.ZodOptional<z.ZodString>;
+            addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>>;
+        addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodObject<{
+                protocol: z.ZodString;
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                search: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            url: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 
 export declare type ReferencePresentationContribution = z.infer<typeof ReferencePresentationContribution>;
@@ -11105,6 +11356,7 @@ export declare function refineWebSessionScopeConfined(webSession: {
     readonly probe: {
         readonly url: string;
     };
+    readonly signInFirst?: string | undefined;
 }, ctx: z.RefinementCtx): void;
 
 export declare const RegistrableDomain: z.ZodString;
@@ -11460,6 +11712,7 @@ export declare const ResolvedKayAgentUriModule: z.ZodObject<{
     authSchemeId: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+    looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 
 export declare type ResolvedKayAgentUriModule = z.infer<typeof ResolvedKayAgentUriModule>;
@@ -11997,11 +12250,31 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
             external: "external";
             embedded: "embedded";
         }>;
+        signInFirst: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 
 export declare type ResolvedPluginAuthService = z.infer<typeof ResolvedPluginAuthService>;
 
+export declare const ResolvedPluginCard: z.ZodObject<{
+    localId: z.ZodString;
+    globalId: z.ZodString;
+    pluginId: z.ZodString;
+    description: z.ZodString;
+    inputs: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
+    readEndpoint: z.ZodObject<{
+        localId: z.ZodString;
+        globalId: z.ZodString;
+    }, z.core.$strict>;
+    submitEndpoint: z.ZodObject<{
+        localId: z.ZodString;
+        globalId: z.ZodString;
+    }, z.core.$strict>;
+    authService: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+
+export declare type ResolvedPluginCard = z.infer<typeof ResolvedPluginCard>;
+
 export declare const ResolvedPluginContractV1: z.ZodObject<{
     protocol: z.ZodLiteral<"kay.plugin.v1">;
     pluginId: z.ZodString;
@@ -12030,6 +12303,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             interactionDriver: "interactionDriver";
             entityResolver: "entityResolver";
             agentRenderer: "agentRenderer";
+            pluginCard: "pluginCard";
             eventDefinition: "eventDefinition";
             eventSubscription: "eventSubscription";
             appDataSource: "appDataSource";
@@ -12216,6 +12490,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 external: "external";
                 embedded: "embedded";
             }>;
+            signInFirst: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     grants: z.ZodOptional<z.ZodObject<{
@@ -12675,6 +12950,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         authSchemeId: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+        looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>>>;
     kayAgentArtifactUriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
         localId: z.ZodString;
@@ -12827,6 +13103,22 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
         }, z.core.$strict>>;
     }, z.core.$strict>>>;
+    kayAppCards: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        localId: z.ZodString;
+        globalId: z.ZodString;
+        pluginId: z.ZodString;
+        description: z.ZodString;
+        inputs: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
+        readEndpoint: z.ZodObject<{
+            localId: z.ZodString;
+            globalId: z.ZodString;
+        }, z.core.$strict>;
+        submitEndpoint: z.ZodObject<{
+            localId: z.ZodString;
+            globalId: z.ZodString;
+        }, z.core.$strict>;
+        authService: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>>;
     kayAppDataSources: z.ZodOptional<z.ZodArray<z.ZodObject<{
         localId: z.ZodString;
         globalId: z.ZodString;
@@ -12910,6 +13202,29 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         uriModule: z.ZodOptional<z.ZodString>;
         schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
         displayName: z.ZodOptional<z.ZodString>;
+        authService: z.ZodOptional<z.ZodString>;
+        accountLinks: z.ZodOptional<z.ZodObject<{
+            label: z.ZodOptional<z.ZodEnum<{
+                email: "email";
+                name: "name";
+            }>>;
+            pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                setPathname: z.ZodOptional<z.ZodString>;
+                addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+            }, z.core.$strict>>>;
+            addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                pattern: z.ZodObject<{
+                    protocol: z.ZodString;
+                    hostname: z.ZodString;
+                    pathname: z.ZodOptional<z.ZodString>;
+                    search: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                url: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
         addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
             pattern: z.ZodObject<{
                 protocol: z.ZodString;
@@ -12930,6 +13245,9 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"page">;
             pageId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"local-app">;
+            schemes: z.ZodArray<z.ZodString>;
         }, z.core.$strict>], "kind">>;
         variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             resourceKind: z.ZodString;
@@ -13066,6 +13384,7 @@ export declare const ResolvedPluginContributionId: z.ZodObject<{
         interactionDriver: "interactionDriver";
         entityResolver: "entityResolver";
         agentRenderer: "agentRenderer";
+        pluginCard: "pluginCard";
         eventDefinition: "eventDefinition";
         eventSubscription: "eventSubscription";
         appDataSource: "appDataSource";
@@ -13419,6 +13738,7 @@ export declare const ResolvedPluginWebSession: z.ZodObject<{
         external: "external";
         embedded: "embedded";
     }>;
+    signInFirst: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 
 export declare type ResolvedPluginWebSession = z.infer<typeof ResolvedPluginWebSession>;
@@ -13429,6 +13749,29 @@ export declare const ResolvedReferencePresentation: z.ZodObject<{
     uriModule: z.ZodOptional<z.ZodString>;
     schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     displayName: z.ZodOptional<z.ZodString>;
+    authService: z.ZodOptional<z.ZodString>;
+    accountLinks: z.ZodOptional<z.ZodObject<{
+        label: z.ZodOptional<z.ZodEnum<{
+            email: "email";
+            name: "name";
+        }>>;
+        pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            setPathname: z.ZodOptional<z.ZodString>;
+            addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>>;
+        addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodObject<{
+                protocol: z.ZodString;
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                search: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            url: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
     addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
         pattern: z.ZodObject<{
             protocol: z.ZodString;
@@ -13449,6 +13792,9 @@ export declare const ResolvedReferencePresentation: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"page">;
         pageId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"local-app">;
+        schemes: z.ZodArray<z.ZodString>;
     }, z.core.$strict>], "kind">>;
     variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         resourceKind: z.ZodString;
@@ -14762,6 +15108,9 @@ export declare const UiAppContribution: z.ZodObject<{
 
 export declare type UiAppContribution = z.infer<typeof UiAppContribution>;
 
+/** Where a source entry's compiled stylesheet sits in its package, beside the entry. */
+export declare function uiAppSourceStylePath(module: string): string;
+
 export declare const UiCommandContribution: z.ZodObject<{
     localId: z.ZodString;
     title: z.ZodString;
@@ -14844,6 +15193,7 @@ export declare const UriModuleContribution: z.ZodObject<{
     authScheme: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+    looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
     claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"scheme">;
         scheme: z.ZodString;
@@ -15237,8 +15587,12 @@ export declare type Where = {
 } | {
     readonly kind: "equals";
     readonly key: string;
-    readonly value: boolean | string;
+    readonly value: WhereLiteral;
     readonly negated: boolean;
+} | {
+    readonly kind: "contains";
+    readonly key: string;
+    readonly value: WhereLiteral;
 } | {
     readonly kind: "not";
     readonly operand: Where;
@@ -15254,9 +15608,33 @@ declare const WHERE_KEY_TYPES: {
     readonly "app.channel": "string";
 };
 
+/** The longest `where`: the largest a rule file can be, so anything that loaded still loads. */
+export declare const WHERE_MAX_BYTES: number;
+
+/**
+ * The old list form of `where`, written as an expression: each clause is
+ * `path == value`, or `(path == value || path contains value)` where `looksInsideLists` says so, and
+ * all must hold. A path spelled `true`, `false` or as a number never resolved to anything, so its
+ * clause is `false`. Undefined when the list isn't a non-empty list of `{ path, equals }`.
+ */
+export declare function whereClausesAsExpression(clauses: unknown, looksInsideLists?: (path: string) => boolean): string | undefined;
+
 /** What a caller's keys are, when it has a fixed set. A bare string key must be compared. */
 export declare type WhereKeyTypes = Readonly<Record<string, "boolean" | "string">>;
 
+export declare type WhereKeyUse = "bare" | "compared" | "contained";
+
+/** Every key an expression reads, each with how that read uses it. */
+export declare function whereKeyUses(where: Where): readonly {
+    readonly key: string;
+    readonly use: WhereKeyUse;
+}[];
+
+export declare type WhereLiteral = boolean | number | string;
+
+/** Why a value that isn't a string can't be a `where`, showing an old list in its new form. */
+export declare function whereNotAStringMessage(value: unknown): string;
+
 export declare type WhereParseResult = {
     readonly ok: true;
     readonly where: Where;
@@ -15265,6 +15643,9 @@ export declare type WhereParseResult = {
     readonly message: string;
 };
 
+/** Why a value can't be a saved `where`, or undefined when it can. */
+export declare function whereProblem(value: unknown): string | undefined;
+
 /** Construct the exact claim row for one Whiteboard scope and operation. */
 export declare function whiteboardCapabilityClaim(operation: WhiteboardCapabilityOperation, scope: WhiteboardCapabilityScope, target?: "kay.agent"): WhiteboardCapabilityClaimV1;