@yaklabs-ai/plugin-protocol 0.44.0 → 0.46.0

package/dist/index.js

@@ -36,7 +36,13 @@ function declaredUiIconPaths(manifest) {
         label: `kay.ui command '${command.localId}' icon`,
         path: command.icon
       }
-    ])
+    ]),
+    ...(contributes?.referencePresentations ?? []).flatMap((presentation) => (presentation.claims ?? []).flatMap((claim) => claim.brandIcon === void 0 ? [] : [
+      {
+        label: `kay.ui reference presentation '${presentation.localId}' brand icon`,
+        path: claim.brandIcon
+      }
+    ]))
   ];
 }
 
@@ -254,11 +260,13 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.44.0";
+var KAY_PLUGIN_SDK_VERSION = "0.46.0";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.42.0",
   "0.42.1",
-  "0.43.0"
+  "0.43.0",
+  "0.44.0",
+  "0.45.0"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -378,6 +386,13 @@ function refineWebSessionScopeConfined(webSession, ctx) {
       message: "probe.url host must fall within a declared cookie domain"
     });
   }
+  if (webSession.signInFirst !== void 0 && !confined(webSession.signInFirst)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["signInFirst"],
+      message: "signInFirst host must fall within a declared cookie domain"
+    });
+  }
 }
 
 // packages/plugin-protocol/dist/app-data-read.js
@@ -2754,12 +2769,14 @@ __export(contributions_exports, {
   McpServerContributions: () => McpServerContributions,
   McpServerUrl: () => McpServerUrl,
   PLUGIN_NOTIFICATION_RULE_HOST_KEYS: () => PLUGIN_NOTIFICATION_RULE_HOST_KEYS,
+  PluginCardContribution: () => PluginCardContribution,
   PluginContributionKind: () => PluginContributionKind,
   PluginEventDefinitionContribution: () => PluginEventDefinitionContribution,
   PluginNotificationRuleContribution: () => PluginNotificationRuleContribution,
   PluginProductEventContribution: () => PluginProductEventContribution,
   PluginSkillSourceDeclaration: () => PluginSkillSourceDeclaration,
   ReferenceOpenBehavior: () => ReferenceOpenBehavior,
+  ReferencePresentationAccountLinks: () => ReferencePresentationAccountLinks,
   ReferencePresentationAddress: () => ReferencePresentationAddress,
   ReferencePresentationContribution: () => ReferencePresentationContribution,
   ReferencePresentationTooltip: () => ReferencePresentationTooltip,
@@ -2791,7 +2808,9 @@ __export(contributions_exports, {
   WhiteboardTypeContribution: () => WhiteboardTypeContribution,
   WhiteboardTypeStorage: () => WhiteboardTypeStorage,
   WorkflowContribution: () => WorkflowContribution,
-  canonicalContributionSchemas: () => canonicalContributionSchemas
+  canonicalContributionSchemas: () => canonicalContributionSchemas,
+  isUiAppSourceModule: () => isUiAppSourceModule,
+  uiAppSourceStylePath: () => uiAppSourceStylePath
 });
 import { z as z12 } from "zod";
 
@@ -2948,7 +2967,21 @@ function pluginSignalPayloadJsonSchema() {
 }
 
 // packages/plugin-protocol/dist/where-expression.js
-var TOKEN = /\s*(?:(\|\||&&|==|!=|!|\(|\))|'([^']*)'|"([^"]*)"|([A-Za-z][A-Za-z0-9]*(?:\.[A-Za-z][A-Za-z0-9]*)*))/y;
+var NUMBER_SOURCE = String.raw`-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?`;
+var SEGMENT_SOURCE = "[A-Za-z0-9_][A-Za-z0-9_-]*";
+var TOKEN = new RegExp(String.raw`\s*(?:(\|\||&&|==|!=|!|\(|\))` + String.raw`|'((?:[^'\\]|\\[\s\S])*)'|"((?:[^"\\]|\\[\s\S])*)"` + // A number that runs on into a key's characters is a key: `1.5.2`, `1-a`.
+String.raw`|(${NUMBER_SOURCE})(?![A-Za-z0-9_.-])` + `|(${SEGMENT_SOURCE}(?:\\.${SEGMENT_SOURCE})*))`, "y");
+var WHOLE_NUMBER = new RegExp(`^${NUMBER_SOURCE}$`);
+var WHOLE_KEY = new RegExp(`^${SEGMENT_SOURCE}(?:\\.${SEGMENT_SOURCE})*$`);
+function unescapeString(text) {
+  return text.replace(/\\([\s\S])/g, (_, character) => {
+    if (character === "\\" || character === "'" || character === '"') {
+      return character;
+    }
+    throw new Error(`unknown escape '\\${character}'; a string can escape only \\, ' and "`);
+  });
+}
+var MAX_TOKENS = 2e3;
 function tokenize(source) {
   const tokens = [];
   TOKEN.lastIndex = 0;
@@ -2958,13 +2991,21 @@ function tokenize(source) {
     if (match === null) {
       throw new Error(`unexpected text at '${source.slice(start).trim()}'`);
     }
-    const [, operator, single, double, word] = match;
+    if (tokens.length === MAX_TOKENS) {
+      throw new Error(`the expression has more than ${MAX_TOKENS} parts`);
+    }
+    const [, operator, single, double, number, word] = match;
     if (operator !== void 0)
       tokens.push({ kind: "operator", text: operator });
+    else if (number !== void 0)
+      tokens.push({ kind: "number", text: number });
     else if (word !== void 0)
       tokens.push({ kind: "word", text: word });
     else
-      tokens.push({ kind: "string", text: single ?? double ?? "" });
+      tokens.push({
+        kind: "string",
+        text: unescapeString(single ?? double ?? "")
+      });
   }
   return tokens;
 }
@@ -3016,6 +3057,14 @@ function parseTokens(tokens, keyTypes) {
   };
   const parseKeyAtom = (key) => {
     const keyType = keyTypes?.[key];
+    const next = tokens[position];
+    if (next?.kind === "word" && next.text === "contains") {
+      if (keyTypes !== void 0) {
+        throw new Error(`'${key}' is not a list; compare it with == or !=`);
+      }
+      position += 1;
+      return { kind: "contains", key, value: parseLiteral("contains") };
+    }
     const negated = takeOperator("!=");
     if (!negated && !takeOperator("==")) {
       if (keyType === "string") {
@@ -3023,22 +3072,29 @@ function parseTokens(tokens, keyTypes) {
       }
       return { kind: "key", key };
     }
-    const value = parseLiteral();
+    const value = parseLiteral("== or !=");
     if (keyType !== void 0 && typeof value !== keyType) {
       throw new Error(`'${key}' compares to a ${keyType}`);
     }
     return { kind: "equals", key, value, negated };
   };
-  const parseLiteral = () => {
+  const parseLiteral = (after) => {
     const token = tokens[position];
     position += 1;
     if (token?.kind === "string")
       return token.text;
+    if (token?.kind === "number") {
+      const value = Number(token.text);
+      if (!Number.isFinite(value)) {
+        throw new Error(`the number ${token.text} is too large`);
+      }
+      return value;
+    }
     if (token?.kind === "word" && token.text === "true")
       return true;
     if (token?.kind === "word" && token.text === "false")
       return false;
-    throw new Error("expected a string, true or false after == or !=");
+    throw new Error(`expected a string, number, true or false after ${after}`);
   };
   const where = parseOr();
   const extra = tokens[position];
@@ -3053,6 +3109,80 @@ function parseWhere(source, keyTypes) {
     return { ok: false, message: error.message };
   }
 }
+function whereKeyUses(where) {
+  switch (where.kind) {
+    case "literal":
+      return [];
+    case "key":
+      return [{ key: where.key, use: "bare" }];
+    case "equals":
+      return [{ key: where.key, use: "compared" }];
+    case "contains":
+      return [{ key: where.key, use: "contained" }];
+    case "not":
+      return whereKeyUses(where.operand);
+    case "and":
+    case "or":
+      return [...whereKeyUses(where.left), ...whereKeyUses(where.right)];
+  }
+}
+function formatWhereLiteral(value) {
+  return typeof value === "string" ? `'${value.replace(/[\\']/g, "\\$&")}'` : String(value);
+}
+function whereClausesAsExpression(clauses, looksInsideLists = () => false) {
+  if (!Array.isArray(clauses) || clauses.length === 0)
+    return void 0;
+  const written = [];
+  for (const clause of clauses) {
+    if (typeof clause !== "object" || clause === null)
+      return void 0;
+    const { path, equals } = clause;
+    if (Object.keys(clause).length !== 2 || typeof path !== "string" || !WHOLE_KEY.test(path) || !(typeof equals === "string" || typeof equals === "boolean" || typeof equals === "number" && Number.isFinite(equals))) {
+      return void 0;
+    }
+    if (path === "true" || path === "false" || WHOLE_NUMBER.test(path)) {
+      written.push("false");
+      continue;
+    }
+    const literal = formatWhereLiteral(equals);
+    written.push(looksInsideLists(path) ? `(${path} == ${literal} || ${path} contains ${literal})` : `${path} == ${literal}`);
+  }
+  return written.join(" && ");
+}
+function whereNotAStringMessage(value) {
+  const expression = whereClausesAsExpression(value);
+  if (expression !== void 0) {
+    return `where is now an expression, not a list of {path, equals}: write \`${expression}\`, and use \`contains\` to look inside a list`;
+  }
+  return Array.isArray(value) ? "where is now an expression, not a list of {path, equals}, for example `payload.status == 'open' && payload.labels contains 'urgent'`" : "where must be an expression string";
+}
+var WHERE_MAX_BYTES = 256 * 1024;
+function whereProblem(value) {
+  if (typeof value !== "string")
+    return whereNotAStringMessage(value);
+  if (new TextEncoder().encode(value).length > WHERE_MAX_BYTES) {
+    return `where must be at most ${WHERE_MAX_BYTES} bytes of UTF-8`;
+  }
+  const parsed = parseWhere(value);
+  return parsed.ok ? void 0 : `where is not a valid expression: ${parsed.message}`;
+}
+var MAX_EVENT_KEY_BYTES = 256;
+var MAX_EVENT_KEY_SEGMENTS = 10;
+function eventWhereProblem(value) {
+  const problem = whereProblem(value);
+  if (problem !== void 0)
+    return problem;
+  const parsed = parseWhere(value);
+  if (!parsed.ok)
+    return void 0;
+  for (const { key } of whereKeyUses(parsed.where)) {
+    const segments = key.split(".");
+    if (new TextEncoder().encode(key).length > MAX_EVENT_KEY_BYTES || segments.length > MAX_EVENT_KEY_SEGMENTS || segments.some((segment) => !/^[a-zA-Z_]/.test(segment) || ["__proto__", "prototype", "constructor"].includes(segment))) {
+      return `where key '${key}' must be a safe dot path of at most ${MAX_EVENT_KEY_SEGMENTS} identifier segments and ${MAX_EVENT_KEY_BYTES} bytes`;
+    }
+  }
+  return void 0;
+}
 function resolve(where, read) {
   switch (where.kind) {
     case "literal":
@@ -3067,6 +3197,12 @@ function resolve(where, read) {
         return void 0;
       return value === where.value !== where.negated;
     }
+    case "contains": {
+      const value = read(where.key);
+      if (value === void 0)
+        return void 0;
+      return Array.isArray(value) && value.includes(where.value);
+    }
     case "not": {
       const operand = resolve(where.operand, read);
       return operand === void 0 ? void 0 : !operand;
@@ -3113,6 +3249,15 @@ function declarationsOfKind(plugins, kind) {
 function declaredReferencePresentations(plugins) {
   return plugins.flatMap((plugin) => (plugin.contributes["referencePresentations"] ?? []).map((declaration) => ({ plugin, declaration })));
 }
+function declaredLocalAppSchemes(plugins) {
+  return new Set(declaredReferencePresentations(plugins).flatMap(({ declaration }) => declaration.open?.kind === "local-app" ? declaration.schemes ?? [] : []));
+}
+function isDeclaredLocalAppLink(url, plugins) {
+  if (!URL.canParse(url))
+    return false;
+  const scheme = new URL(url).protocol.slice(0, -1).toLowerCase();
+  return declaredReferencePresentations(plugins).some(({ declaration }) => declaration.open?.kind === "local-app" && declaration.open.schemes.includes(scheme));
+}
 function declaredCommandId(pluginId, localId) {
   return `${pluginId}/${localId}`;
 }
@@ -3423,14 +3568,19 @@ function createContributionsSchemas(canonical) {
     // The module's code defines `describeOperation`, the approval card's facts for a call. The
     // daemon reads it here because it may hold only the manifest (a plugin that runs in the
     // plugin host), and the host refuses a module whose code disagrees.
-    describesOperations: z12.literal(true).optional()
+    describesOperations: z12.literal(true).optional(),
+    // The module's code defines `lookupWebLink`, which finds a resource's page when someone opens
+    // it. The daemon reads it here for the same reason, and the host refuses a module whose code
+    // disagrees.
+    looksUpWebLinks: z12.literal(true).optional()
   });
   const AppUriModuleContribution2 = UriModuleContribution2.omit({
     authActions: true,
     authService: true,
     authScheme: true,
     knownResources: true,
-    describesOperations: true
+    describesOperations: true,
+    looksUpWebLinks: true
   });
   const AppDataSourceStore = z12.discriminatedUnion("shape", [
     z12.strictObject({
@@ -3636,6 +3786,14 @@ function createContributionsSchemas(canonical) {
     localId: LocalContributionId2,
     resultKinds: z12.array(NonEmptyString3).min(1)
   });
+  const PluginCardContribution2 = z12.strictObject({
+    localId: LocalContributionId2,
+    description: NonEmptyString3,
+    inputs: JsonSchema,
+    readEndpoint: LocalContributionId2,
+    submitEndpoint: LocalContributionId2,
+    authService: AuthServiceReference2.optional()
+  });
   const EndpointContribution2 = z12.strictObject({
     localId: LocalContributionId2,
     displayName: OptionalDisplayName,
@@ -3744,7 +3902,7 @@ function createContributionsSchemas(canonical) {
     localId: LocalContributionId2,
     /** The same-plugin `eventDefinitions` local id this rule matches. */
     event: PluginEventLocalId2,
-    where: z12.array(JsonObject).optional(),
+    where: z12.string({ error: (issue) => whereNotAStringMessage(issue.input) }).optional(),
     rule: JsonObject
   });
   const PluginProductEventContribution2 = z12.union([
@@ -3810,6 +3968,15 @@ function createContributionsSchemas(canonical) {
     localId: LocalContributionId2,
     resultKinds: z12.array(NonEmptyString3).min(1)
   });
+  const NOT_LOCAL_APP_SCHEMES = /* @__PURE__ */ new Set([
+    "http",
+    "https",
+    "file",
+    "javascript",
+    "data",
+    "blob",
+    "about"
+  ]);
   const ReferenceOpenBehavior2 = z12.discriminatedUnion("kind", [
     z12.strictObject({ kind: z12.literal("working-document") }),
     z12.strictObject({ kind: z12.literal("browser-pane") }),
@@ -3818,14 +3985,22 @@ function createContributionsSchemas(canonical) {
      * manifest, and the page gets the whole address as its `objectId` unless `addresses` says
      * otherwise. Needs no web address, so a plugin-only resource (`user-todo://items/3`) can pill.
      */
-    z12.strictObject({ kind: z12.literal("page"), pageId: NonEmptyString3 })
+    z12.strictObject({ kind: z12.literal("page"), pageId: NonEmptyString3 }),
+    /**
+     * Hand the address's link to an app on this machine. The module's claims fill the link as its
+     * `sourceUrl`, and `schemes` names every scheme those links may use: main opens a link only when
+     * a loaded plugin declares its scheme here. A plugin the person installed can't declare this.
+     */
+    z12.strictObject({
+      kind: z12.literal("local-app"),
+      schemes: z12.array(UriScheme2.refine((scheme) => !NOT_LOCAL_APP_SCHEMES.has(scheme), "Names the web, a file or script, not an app on this machine")).min(1)
+    })
   ]);
   const ReferencePresentationVariant2 = z12.strictObject({
     resourceKind: NonEmptyString3,
     presentationPluginId: PluginId2.optional()
   });
   const ReferencePresentationVariants2 = z12.record(MimeTypeString2, ReferencePresentationVariant2);
-  const InlineSvg = z12.string().max(64 * 1024).refine((value) => /^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?<svg[\s>]/iu.test(value), { message: "brandIcon must be inline SVG markup." });
   const ReferencePresentationUriPattern2 = z12.strictObject({
     protocol: NonEmptyString3,
     hostname: NonEmptyString3,
@@ -3837,7 +4012,8 @@ function createContributionsSchemas(canonical) {
     pattern: ReferencePresentationUriPattern2.extend({
       protocol: z12.enum(["http", "https"])
     }),
-    brandIcon: InlineSvg.optional()
+    /** The claim's mark: an SVG file in the plugin, drawn in its own colours. */
+    brandIcon: PackageAssetPath2.optional()
   });
   const ReferencePresentationTooltip2 = z12.strictObject({
     /** Same-plugin kay.ui app mounted with read-only reference URI context. */
@@ -3849,6 +4025,26 @@ function createContributionsSchemas(canonical) {
     objectId: NonEmptyString3.optional(),
     open: z12.strictObject({ kind: z12.literal("none") }).optional()
   });
+  const ReferencePresentationAccountLinkPage = z12.strictObject({
+    /** A literal host name. */
+    hostname: z12.string().regex(/^[a-z0-9.-]+$/, "An account link's hostname is a literal lower-case host name."),
+    pathname: z12.string().optional(),
+    /** A page matching one of these already names its account, so it stays as it is. */
+    unlessPathname: z12.array(z12.string()).min(1).optional(),
+    /** The path the page opens at, in place of its own. */
+    setPathname: z12.string().startsWith("/").optional(),
+    /** Query values to add. A page that already has one of these names stays as it is. */
+    addQuery: z12.record(NonEmptyString3, NonEmptyString3)
+  });
+  const ReferencePresentationAccountLinkAddress = z12.strictObject({
+    pattern: ReferencePresentationUriPattern2,
+    url: z12.string().regex(/^https?:\/\//, "An account link's url is a web page.")
+  });
+  const ReferencePresentationAccountLinks2 = z12.strictObject({
+    label: z12.enum(["email", "name"]).optional(),
+    pages: z12.array(ReferencePresentationAccountLinkPage).min(1).optional(),
+    addresses: z12.array(ReferencePresentationAccountLinkAddress).min(1).optional()
+  });
   const ReferencePresentationWords2 = z12.strictObject({
     /** The row's mark, for a source with no icon of its own. Left out: the plugin's main icon. */
     glyph: z12.enum(TOOL_GLYPHS).optional(),
@@ -3900,7 +4096,9 @@ function createContributionsSchemas(canonical) {
     /** Informational app presentation matched against the canonical resource URI. */
     tooltip: ReferencePresentationTooltip2.optional(),
     /** What the transcript calls this module's addresses. Needs a `uriModule`. */
-    words: ReferencePresentationWords2.optional()
+    words: ReferencePresentationWords2.optional(),
+    /** How this module's web pages open under the right account. Needs a `uriModule`. */
+    accountLinks: ReferencePresentationAccountLinks2.optional()
   }).superRefine((value, ctx) => {
     if (value.open === void 0 !== (value.resourceKind === void 0)) {
       ctx.addIssue({
@@ -3909,13 +4107,20 @@ function createContributionsSchemas(canonical) {
         message: "open and resourceKind come together: name both or neither."
       });
     }
-    if (value.open === void 0 && value.words === void 0) {
+    if (value.open === void 0 && value.words === void 0 && value.accountLinks === void 0) {
       ctx.addIssue({
         code: "custom",
         path: ["words"],
         message: "A reference presentation that opens nothing must have words."
       });
     }
+    if (value.accountLinks !== void 0 && value.uriModule === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["accountLinks"],
+        message: "Account links belong to a URI module: name its uriModule."
+      });
+    }
     if (value.words !== void 0 && value.uriModule === void 0) {
       ctx.addIssue({
         code: "custom",
@@ -4138,6 +4343,7 @@ function createContributionsSchemas(canonical) {
     "entityResolver",
     "agentRenderer",
     "endpoint",
+    "pluginCard",
     "command",
     "eventDefinition",
     "eventSubscription",
@@ -4188,6 +4394,7 @@ function createContributionsSchemas(canonical) {
     EntityResolverContribution: EntityResolverContribution2,
     AgentRenderContribution: AgentRenderContribution2,
     EndpointContribution: EndpointContribution2,
+    PluginCardContribution: PluginCardContribution2,
     WorkflowContribution: WorkflowContribution2,
     McpServerUrl: McpServerUrl2,
     McpServerAuthMode: McpServerAuthMode2,
@@ -4212,6 +4419,7 @@ function createContributionsSchemas(canonical) {
     ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2,
     ReferencePresentationTooltip: ReferencePresentationTooltip2,
     ReferencePresentationAddress: ReferencePresentationAddress2,
+    ReferencePresentationAccountLinks: ReferencePresentationAccountLinks2,
     ReferencePresentationWords: ReferencePresentationWords2,
     ReferencePresentationContribution: ReferencePresentationContribution2,
     RichViewContribution: RichViewContribution2,
@@ -4227,8 +4435,15 @@ function createContributionsSchemas(canonical) {
     PluginContributionKind: PluginContributionKind2
   };
 }
-var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, PluginProductEventContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationWords, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
+var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, PluginCardContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, PluginProductEventContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationAccountLinks, ReferencePresentationWords, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
 var canonicalContributionSchemas = createContributionsSchemas(true);
+var UI_APP_SOURCE_MODULE = /\.(?:tsx|ts|jsx)$/;
+function isUiAppSourceModule(module) {
+  return UI_APP_SOURCE_MODULE.test(module);
+}
+function uiAppSourceStylePath(module) {
+  return module.replace(UI_APP_SOURCE_MODULE, ".css");
+}
 
 // packages/plugin-protocol/dist/icon-shape.js
 var SVG_PROLOG = String.raw`^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?`;
@@ -4301,7 +4516,7 @@ var KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS = [
 var KAY_UI_NATIVE_EVENT_ALLOWLIST = new Set(KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS);
 var RETIRED_COMPATIBILITY_KEYS = ["policy"];
 function createManifestSchemas(canonical) {
-  const { AgentRenderContribution: AgentRenderContribution2, ApprovalTypeContribution: ApprovalTypeContribution2, WorkflowContribution: WorkflowContribution2, AppDataMaterializerContribution: AppDataMaterializerContribution2, AppDataSourceContribution: AppDataSourceContribution2, AppUriModuleContribution: AppUriModuleContribution2, AppEventSubscription: AppEventSubscription2, ArtifactUriModuleContribution: ArtifactUriModuleContribution2, CliBindingContribution: CliBindingContribution2, CommandContribution: CommandContribution2, ContextContributorContribution: ContextContributorContribution2, ConverterContribution: ConverterContribution2, SessionReaderContribution: SessionReaderContribution2, DeviceDelegationContribution: DeviceDelegationContribution2, EndpointContribution: EndpointContribution2, EntityResolverContribution: EntityResolverContribution2, GitHostContribution: GitHostContribution2, McpServerContributions: McpServerContributions2, PluginEventDefinitionContribution: PluginEventDefinitionContribution2, PluginNotificationRuleContribution: PluginNotificationRuleContribution2, PluginProductEventContribution: PluginProductEventContribution2, ResourceContribution: ResourceContribution2, ReferencePresentationContribution: ReferencePresentationContribution2, ResultRendererContribution: ResultRendererContribution2, RichViewContribution: RichViewContribution2, PluginSkillSourceDeclaration: PluginSkillSourceDeclaration2, InteractionDriverContribution: InteractionDriverContribution2, SearchProviderContribution: SearchProviderContribution2, SkillContribution: SkillContribution2, SettingsPanelContribution: SettingsPanelContribution2, ThemeContribution: ThemeContribution2, AgentToolContribution: AgentToolContribution2, ToolContribution: ToolContribution2, UiCommandContribution: UiCommandContribution2, UiAppContribution: UiAppContribution2, UiRailEntryContribution: UiRailEntryContribution2, UiToastPreviewContribution: UiToastPreviewContribution2, UiPageContribution: UiPageContribution2, UiEventSubscriptionContribution: UiEventSubscriptionContribution2, UiSlotContribution: UiSlotContribution2, UriModuleContribution: UriModuleContribution2, WhiteboardTypeContribution: WhiteboardTypeContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
+  const { AgentRenderContribution: AgentRenderContribution2, ApprovalTypeContribution: ApprovalTypeContribution2, WorkflowContribution: WorkflowContribution2, PluginCardContribution: PluginCardContribution2, AppDataMaterializerContribution: AppDataMaterializerContribution2, AppDataSourceContribution: AppDataSourceContribution2, AppUriModuleContribution: AppUriModuleContribution2, AppEventSubscription: AppEventSubscription2, ArtifactUriModuleContribution: ArtifactUriModuleContribution2, CliBindingContribution: CliBindingContribution2, CommandContribution: CommandContribution2, ContextContributorContribution: ContextContributorContribution2, ConverterContribution: ConverterContribution2, SessionReaderContribution: SessionReaderContribution2, DeviceDelegationContribution: DeviceDelegationContribution2, EndpointContribution: EndpointContribution2, EntityResolverContribution: EntityResolverContribution2, GitHostContribution: GitHostContribution2, McpServerContributions: McpServerContributions2, PluginEventDefinitionContribution: PluginEventDefinitionContribution2, PluginNotificationRuleContribution: PluginNotificationRuleContribution2, PluginProductEventContribution: PluginProductEventContribution2, ResourceContribution: ResourceContribution2, ReferencePresentationContribution: ReferencePresentationContribution2, ResultRendererContribution: ResultRendererContribution2, RichViewContribution: RichViewContribution2, PluginSkillSourceDeclaration: PluginSkillSourceDeclaration2, InteractionDriverContribution: InteractionDriverContribution2, SearchProviderContribution: SearchProviderContribution2, SkillContribution: SkillContribution2, SettingsPanelContribution: SettingsPanelContribution2, ThemeContribution: ThemeContribution2, AgentToolContribution: AgentToolContribution2, ToolContribution: ToolContribution2, UiCommandContribution: UiCommandContribution2, UiAppContribution: UiAppContribution2, UiRailEntryContribution: UiRailEntryContribution2, UiToastPreviewContribution: UiToastPreviewContribution2, UiPageContribution: UiPageContribution2, UiEventSubscriptionContribution: UiEventSubscriptionContribution2, UiSlotContribution: UiSlotContribution2, UriModuleContribution: UriModuleContribution2, WhiteboardTypeContribution: WhiteboardTypeContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginPermissionManifest: PluginPermissionManifest2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const KayAgentTargetManifest2 = z13.strictObject({
@@ -4390,6 +4605,7 @@ function createManifestSchemas(canonical) {
       // namespace with them (enforced by the manifest-level refinement below).
       tools: z13.array(ToolContribution2).optional(),
       endpoints: z13.array(EndpointContribution2).optional(),
+      cards: z13.array(PluginCardContribution2).optional(),
       uriModules: z13.array(AppUriModuleContribution2).optional(),
       dataSources: z13.array(AppDataSourceContribution2).optional(),
       whiteboardTypes: z13.array(WhiteboardTypeContribution2).optional(),
@@ -4703,7 +4919,13 @@ function createManifestSchemas(canonical) {
     loginUrl: HttpsUrl2,
     cookieDomains: z13.array(RegistrableDomain2).min(1),
     probe: PluginWebSessionProbe2,
-    oauthVenue: z13.enum(["embedded", "external"])
+    oauthVenue: z13.enum(["embedded", "external"]),
+    /**
+     * Where a page goes first when it opens in one of Bonsai's browser panes and this site login
+     * is missing: a sign-in page that continues to the page. A template with `:email` and `:url`
+     * (see `UriClaimTemplate`), on a host within `cookieDomains`.
+     */
+    signInFirst: z13.string().optional()
   }).superRefine(refineWebSessionScopeConfined);
   const PluginAuthService2 = z13.strictObject({
     localId: LocalContributionId2,
@@ -5120,6 +5342,39 @@ function createManifestSchemas(canonical) {
         message: `signal event ${definition.localId} must use a URI scheme one of this plugin's own URI modules serves; '${definition.uriScheme}' is not among them`
       });
     }
+    for (const [index, card] of (manifest.targets?.kay?.app?.contributes?.cards ?? []).entries()) {
+      const path = ["targets", "kay", "app", "contributes", "cards", index];
+      if (manifest.targets?.kay?.app?.entrypoint === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path,
+          message: `plugin card ${card.localId} needs a kay.app entrypoint to implement it`
+        });
+      }
+      for (const field of ["readEndpoint", "submitEndpoint"]) {
+        if (!endpointIds.has(card[field])) {
+          ctx.addIssue({
+            code: "custom",
+            path: [...path, field],
+            message: `plugin card ${card.localId} references unknown endpoint ${card[field]}`
+          });
+        }
+      }
+      if (card.readEndpoint === card.submitEndpoint) {
+        ctx.addIssue({
+          code: "custom",
+          path: [...path, "submitEndpoint"],
+          message: `plugin card ${card.localId} needs distinct read and submit endpoints`
+        });
+      }
+      if (card.authService !== void 0 && !isQualifiedAuthServiceRef(card.authService) && !authServices.has(card.authService)) {
+        ctx.addIssue({
+          code: "custom",
+          path: [...path, "authService"],
+          message: `plugin card ${card.localId} references unknown auth service ${card.authService}`
+        });
+      }
+    }
     reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "workflows"], manifest.targets?.kay?.app?.contributes?.workflows, "workflow");
     for (const [index, workflow] of (manifest.targets?.kay?.app?.contributes?.workflows ?? []).entries()) {
       const path = [
@@ -5744,6 +5999,7 @@ function collectKayAppContributionIds(manifest) {
   const contributes = manifest.targets?.kay?.app?.contributes;
   const output = [];
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "approvalTypes"], contributes?.approvalTypes);
+  pushContributionIds(output, ["targets", "kay", "app", "contributes", "cards"], contributes?.cards);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "workflows"], contributes?.workflows);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "tools"], contributes?.tools);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "endpoints"], contributes?.endpoints);
@@ -5820,7 +6076,7 @@ function boundPluginDiagnosticMessage(message) {
 import { z as z14 } from "zod";
 function createResolvedContractSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
-  const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, ReferencePresentationWords: ReferencePresentationWords2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
+  const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAccountLinks: ReferencePresentationAccountLinks2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, ReferencePresentationWords: ReferencePresentationWords2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, GlobalContributionId: GlobalContributionId2, HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, PluginToolName: PluginToolName2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginExternalCliConnect: PluginExternalCliConnect2, PluginOAuthClientSupplier: PluginOAuthClientSupplier2 } = canonical ? canonicalManifestSchemas : manifest_exports;
   const { ResolvedPluginGrants: ResolvedPluginGrants2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
@@ -5905,6 +6161,22 @@ function createResolvedContractSchemas(canonical) {
     /** The auth service that module signs in through, whose accounts a card may send from. */
     authService: GlobalContributionId2.optional()
   });
+  const ResolvedPluginCard2 = z14.strictObject({
+    localId: LocalContributionId2,
+    globalId: GlobalContributionId2,
+    pluginId: PluginId2,
+    description: NonEmptyString3,
+    inputs: JsonSchema,
+    readEndpoint: z14.strictObject({
+      localId: LocalContributionId2,
+      globalId: GlobalContributionId2
+    }),
+    submitEndpoint: z14.strictObject({
+      localId: LocalContributionId2,
+      globalId: GlobalContributionId2
+    }),
+    authService: GlobalContributionId2.optional()
+  });
   const ResolvedKayAppWorkflow2 = z14.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
@@ -5947,6 +6219,8 @@ function createResolvedContractSchemas(canonical) {
     knownResources: z14.literal(true).optional(),
     /** Mirrors `UriModuleContribution.describesOperations`. */
     describesOperations: z14.literal(true).optional(),
+    /** Mirrors `UriModuleContribution.looksUpWebLinks`. */
+    looksUpWebLinks: z14.literal(true).optional(),
     ...UriModuleFacts2.shape
   });
   const ResolvedKayAgentArtifactUriModule2 = z14.strictObject({
@@ -5983,6 +6257,9 @@ function createResolvedContractSchemas(canonical) {
     mimeTypes: z14.array(MimeTypeString2).min(1),
     extensions: z14.array(FileExtensionToken2).min(1).optional()
   });
+  const ResolvedReferencePresentationUrlClaim = ReferencePresentationUrlClaim2.extend({
+    brandIcon: z14.string().max(64 * 1024).optional()
+  });
   const ResolvedReferencePresentation2 = z14.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
@@ -5991,13 +6268,16 @@ function createResolvedContractSchemas(canonical) {
     schemes: z14.array(UriScheme2).min(1).optional(),
     /** The module's `displayName`: the source's name in a row. */
     displayName: NonEmptyString3.optional(),
+    /** The module's auth service, qualified: whose accounts `accountLinks` reads. */
+    authService: GlobalContributionId2.optional(),
+    accountLinks: ReferencePresentationAccountLinks2.optional(),
     addresses: z14.array(ReferencePresentationAddress2).min(1).optional(),
     /** Comes with `open`. A presentation with neither only words its module's addresses. */
     resourceKind: NonEmptyString3.optional(),
     open: ReferenceOpenBehavior2.optional(),
     /** MIME-specific resource kinds; absent keys use the base presentation. */
     variants: ReferencePresentationVariants2.optional(),
-    claims: z14.array(ReferencePresentationUrlClaim2).optional(),
+    claims: z14.array(ResolvedReferencePresentationUrlClaim).optional(),
     tooltip: z14.strictObject({
       app: GlobalContributionId2,
       pattern: ReferencePresentationUriPattern2
@@ -6102,7 +6382,8 @@ function createResolvedContractSchemas(canonical) {
       method: z14.enum(["GET", "POST"]),
       signedInStatuses: z14.array(SignedInStatusCode2).min(1)
     }),
-    oauthVenue: z14.enum(["embedded", "external"])
+    oauthVenue: z14.enum(["embedded", "external"]),
+    signInFirst: z14.string().optional()
   }).superRefine(refineWebSessionScopeConfined);
   const ResolvedPluginAuthService2 = z14.strictObject({
     localId: LocalContributionId2,
@@ -6143,7 +6424,7 @@ function createResolvedContractSchemas(canonical) {
     contributions: z14.array(ResolvedPluginContributionId2),
     // The deduplicated set of qualified (dotted) external auth-service ids this
     // plugin references, from agent uriModule, tool and cliBinding
-    // `authService` refs, and auth-grant `service` refs. Always present - a plugin
+    // `authService` refs, card sign-in refs, and auth-grant `service` refs. Always present - a plugin
     // that only references its own local services carries an empty array. This
     // is a recorded dependency, not a resolution: there is no runtime plugin
     // loader in v1, so nothing here verifies the reference resolves within a
@@ -6168,6 +6449,7 @@ function createResolvedContractSchemas(canonical) {
     kayAppTools: z14.array(ResolvedKayAppTool2).optional(),
     kayAppApprovalTypes: z14.array(ResolvedKayAppApprovalType2).optional(),
     kayAppWorkflows: z14.array(ResolvedKayAppWorkflow2).optional(),
+    kayAppCards: z14.array(ResolvedPluginCard2).optional(),
     kayAppDataSources: z14.array(ResolvedKayAppDataSource2).optional(),
     kayAppWhiteboardTypes: z14.array(ResolvedKayAppWhiteboardType2).optional(),
     kayAppMcpServers: z14.array(ResolvedKayAppMcpServer2).optional(),
@@ -6181,6 +6463,7 @@ function createResolvedContractSchemas(canonical) {
     ResolvedKayAppTool: ResolvedKayAppTool2,
     ResolvedKayAppApprovalType: ResolvedKayAppApprovalType2,
     ResolvedKayAppWorkflow: ResolvedKayAppWorkflow2,
+    ResolvedPluginCard: ResolvedPluginCard2,
     ResolvedKayAppDataSource: ResolvedKayAppDataSource2,
     ResolvedKayAppWhiteboardType: ResolvedKayAppWhiteboardType2,
     ResolvedKayAppMcpServer: ResolvedKayAppMcpServer2,
@@ -6199,7 +6482,7 @@ function createResolvedContractSchemas(canonical) {
     ResolvedPluginContractV1: ResolvedPluginContractV12
   };
 }
-var { ResolvedKayAppApprovalType, ResolvedKayAppWorkflow, ResolvedPluginContributionId, ResolvedKayAgentTool, ResolvedKayAppTool, ResolvedKayAppDataSource, ResolvedKayAppWhiteboardType, ResolvedKayAppMcpServer, ResolvedKayAgentUriModule, ResolvedKayAgentArtifactUriModule, ResolvedKayAgentEntityResolver, ResolvedKayAgentGitHostClaim, ResolvedKayAgentConverter, ResolvedReferencePresentation, ResolvedPluginProvisioningRequirement, ResolvedPluginAuthScheme, ResolvedPluginWebSession, ResolvedPluginAuthService, ResolvedKayUiAppEndpointCapability, ResolvedKayUiApp, ResolvedPluginContractV1 } = createResolvedContractSchemas(false);
+var { ResolvedKayAppApprovalType, ResolvedKayAppWorkflow, ResolvedPluginCard, ResolvedPluginContributionId, ResolvedKayAgentTool, ResolvedKayAppTool, ResolvedKayAppDataSource, ResolvedKayAppWhiteboardType, ResolvedKayAppMcpServer, ResolvedKayAgentUriModule, ResolvedKayAgentArtifactUriModule, ResolvedKayAgentEntityResolver, ResolvedKayAgentGitHostClaim, ResolvedKayAgentConverter, ResolvedReferencePresentation, ResolvedPluginProvisioningRequirement, ResolvedPluginAuthScheme, ResolvedPluginWebSession, ResolvedPluginAuthService, ResolvedKayUiAppEndpointCapability, ResolvedKayUiApp, ResolvedPluginContractV1 } = createResolvedContractSchemas(false);
 var canonicalResolvedContractSchemas = createResolvedContractSchemas(true);
 function narrowestAccountSelectors() {
   return [{ kind: "active" }];
@@ -6235,6 +6518,7 @@ function collectContributionSources(manifest) {
   const app = manifest.targets?.kay?.app?.contributes;
   pushAll(output, "kay.app", "tool", app?.tools);
   pushAll(output, "kay.app", "endpoint", app?.endpoints);
+  pushAll(output, "kay.app", "pluginCard", app?.cards);
   pushAll(output, "kay.app", "uriModule", app?.uriModules);
   pushAll(output, "kay.app", "appDataSource", app?.dataSources);
   pushAll(output, "kay.app", "whiteboardType", app?.whiteboardTypes);
@@ -6339,6 +6623,9 @@ function collectConsumedAuthServiceIds(manifest) {
   for (const binding of manifest.targets?.kay?.agent?.contributes?.cliBindings ?? []) {
     add(binding.authService);
   }
+  for (const card of manifest.targets?.kay?.app?.contributes?.cards ?? []) {
+    add(card.authService);
+  }
   for (const target of KAY_PLUGIN_TARGET_NAMES) {
     for (const grant of manifest.permissions?.byTarget[target]?.auth ?? []) {
       add(grant.service);
@@ -6366,7 +6653,8 @@ function resolveAuthServices(namespace, manifest) {
           method: service.webSession.probe.method ?? "GET",
           signedInStatuses: [...service.webSession.probe.signedInStatuses]
         },
-        oauthVenue: service.webSession.oauthVenue
+        oauthVenue: service.webSession.oauthVenue,
+        ...service.webSession.signInFirst === void 0 ? {} : { signInFirst: service.webSession.signInFirst }
       }
     },
     schemes: service.schemes.map((scheme) => {
@@ -6521,6 +6809,24 @@ function resolveKayPluginContractV1(manifest) {
     globalId: resolveGlobalContributionId(namespace, tool.localId),
     toolName: tool.toolName
   }));
+  const kayAppCards = manifest.targets?.kay?.app?.contributes?.cards?.map((card) => ({
+    localId: card.localId,
+    globalId: resolveGlobalContributionId(namespace, card.localId),
+    pluginId: manifest.id,
+    description: card.description,
+    inputs: card.inputs,
+    readEndpoint: {
+      localId: card.readEndpoint,
+      globalId: resolveGlobalContributionId(namespace, card.readEndpoint)
+    },
+    submitEndpoint: {
+      localId: card.submitEndpoint,
+      globalId: resolveGlobalContributionId(namespace, card.submitEndpoint)
+    },
+    ...card.authService === void 0 ? {} : {
+      authService: isQualifiedAuthServiceRef(card.authService) ? card.authService : resolveGlobalContributionId(namespace, card.authService)
+    }
+  }));
   const kayAppWorkflows = manifest.targets?.kay?.app?.contributes?.workflows?.map(({ auth, ...workflow }) => ({
     ...workflow,
     globalId: resolveGlobalContributionId(namespace, workflow.localId),
@@ -6587,6 +6893,7 @@ function resolveKayPluginContractV1(manifest) {
     },
     ...module.knownResources === void 0 ? {} : { knownResources: module.knownResources },
     ...module.describesOperations === void 0 ? {} : { describesOperations: module.describesOperations },
+    ...module.looksUpWebLinks === void 0 ? {} : { looksUpWebLinks: module.looksUpWebLinks },
     ...uriModuleFacts(module)
   }));
   const kayAgentArtifactUriModules = manifest.targets?.kay?.agent?.contributes?.artifactUriModules?.map((module) => ({
@@ -6622,13 +6929,14 @@ function resolveKayPluginContractV1(manifest) {
     ...presentation.uriModule === void 0 ? {} : {
       uriModule: resolveGlobalContributionId(namespace, presentation.uriModule)
     },
-    ...presentationSource(manifest, presentation),
+    ...presentationSource(namespace, manifest, presentation),
     ...presentation.addresses === void 0 ? {} : { addresses: presentation.addresses },
     ...presentation.open === void 0 || presentation.resourceKind === void 0 ? {} : {
       resourceKind: presentation.resourceKind,
       open: presentation.open
     },
     ...presentation.words === void 0 ? {} : { words: { ...presentation.words } },
+    ...presentation.accountLinks === void 0 ? {} : { accountLinks: presentation.accountLinks },
     ...presentation.tooltip === void 0 ? {} : {
       tooltip: {
         app: resolveGlobalContributionId(namespace, presentation.tooltip.app),
@@ -6689,6 +6997,7 @@ function resolveKayPluginContractV1(manifest) {
     ...kayAgentGitHostClaims.length > 0 ? { kayAgentGitHostClaims } : {},
     ...kayAgentTools && kayAgentTools.length > 0 ? { kayAgentTools } : {},
     ...kayAppTools && kayAppTools.length > 0 ? { kayAppTools } : {},
+    ...kayAppCards && kayAppCards.length > 0 ? { kayAppCards } : {},
     ...kayAppApprovalTypes && kayAppApprovalTypes.length > 0 ? { kayAppApprovalTypes } : {},
     ...kayAppWorkflows && kayAppWorkflows.length > 0 ? { kayAppWorkflows } : {},
     ...kayAppDataSources && kayAppDataSources.length > 0 ? { kayAppDataSources } : {},
@@ -6712,19 +7021,23 @@ function safeResolveKayPluginContractV1(manifest) {
     throw error;
   }
 }
-function presentationSource(manifest, presentation) {
+function presentationSource(namespace, manifest, presentation) {
   const contributes = manifest.targets?.kay;
   const module = [
     ...contributes?.agent?.contributes?.uriModules ?? [],
     ...contributes?.app?.contributes?.uriModules ?? []
   ].find((candidate) => candidate.localId === presentation.uriModule);
   const schemes = presentation.scheme === void 0 ? module?.schemes : [presentation.scheme];
+  const authService = module !== void 0 && "authService" in module ? module.authService : void 0;
   return {
     ...schemes === void 0 ? {} : { schemes: [...schemes] },
-    ...module?.displayName === void 0 ? {} : { displayName: module.displayName }
+    ...module?.displayName === void 0 ? {} : { displayName: module.displayName },
+    ...typeof authService === "string" ? {
+      authService: isQualifiedAuthServiceRef(authService) ? authService : resolveGlobalContributionId(namespace, authService)
+    } : {}
   };
 }
-function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
+function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, looksUpWebLinks: _looksUpWebLinks, ...facts }) {
   return facts;
 }
 
@@ -7616,6 +7929,7 @@ export {
   PluginCapabilityRefusalCode,
   PluginCapabilityRefusalLayer,
   PluginCapabilityRefusalV1,
+  PluginCardContribution,
   PluginCompatibilityManifest,
   PluginConfigManifest,
   PluginConfigScope,
@@ -7657,6 +7971,7 @@ export {
   RETIRED_PLUGIN_CAPABILITY_SLUGS,
   RETIRED_WEB_SESSION_ROW_KEYS,
   ReferenceOpenBehavior,
+  ReferencePresentationAccountLinks,
   ReferencePresentationAddress,
   ReferencePresentationContribution,
   ReferencePresentationTooltip,
@@ -7684,6 +7999,7 @@ export {
   ResolvedKayUiAppEndpointCapability,
   ResolvedPluginAuthScheme,
   ResolvedPluginAuthService,
+  ResolvedPluginCard,
   ResolvedPluginContractV1,
   ResolvedPluginContributionId,
   ResolvedPluginGrants,
@@ -7734,6 +8050,7 @@ export {
   UriModuleContribution,
   UriScheme,
   WEB_SESSION_CSRF_SELECTOR_PATTERN,
+  WHERE_MAX_BYTES,
   WebSessionCsrfSelector,
   WebSessionGrantRequest,
   WhiteboardCapabilityClaimV1,
@@ -7761,25 +8078,30 @@ export {
   configSectionKeysForManifest,
   declarationsOfKind,
   declaredCommandId,
+  declaredLocalAppSchemes,
   declaredReferencePresentations,
   declaredUiIconPaths,
   dedupeClaims,
   deriveDirectoryPluginToolName,
   evaluateCommandWhere,
   evaluateWhere,
+  eventWhereProblem,
   finalizeArtifactProvenanceEnvelope,
   findSkillSuggestionCitations,
+  formatWhereLiteral,
   hasClaim,
   hostWithinDomain,
   isCanonicalArtifactOutputUri,
   isCompatible,
   isCredentialShapedText,
+  isDeclaredLocalAppLink,
   isKayPluginCompatibilityRefusal,
   isPluginProductEventName,
   isPrivateCapabilityClaim,
   isQualifiedAuthSchemeRef,
   isQualifiedAuthServiceRef,
   isSupportedSemverRange,
+  isUiAppSourceModule,
   judgeKayPluginDirectory,
   kayPluginCompatibilityAdvisories,
   kayPluginHostCompatibility,
@@ -7820,8 +8142,13 @@ export {
   skillSuggestionEvidenceKey,
   turnMessageOrigin,
   turnPacket,
+  uiAppSourceStylePath,
   urlHostWithinDomain,
   validateKayUiEventSubscription,
   webSessionPathWithinPrefix,
+  whereClausesAsExpression,
+  whereKeyUses,
+  whereNotAStringMessage,
+  whereProblem,
   whiteboardCapabilityClaim
 };