@yaklabs-ai/plugin-protocol 0.45.0 → 0.46.0

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.45.0"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.46.0"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [],

package/dist/index.d.ts

@@ -1642,6 +1642,8 @@ declare namespace authoringCommonSchemas {
 
 declare namespace authoringContributionSchemas {
     export {
+        isUiAppSourceModule,
+        uiAppSourceStylePath,
         MCP_SIGN_IN_SCHEME_KIND,
         PLUGIN_NOTIFICATION_RULE_HOST_KEYS,
         ApprovalCardForm,
@@ -1694,6 +1696,7 @@ declare namespace authoringContributionSchemas {
         ReferencePresentationUrlClaim,
         ReferencePresentationTooltip,
         ReferencePresentationAddress,
+        ReferencePresentationAccountLinks,
         ReferencePresentationWords,
         ReferencePresentationContribution,
         RichViewContribution,
@@ -2095,6 +2098,7 @@ declare const canonicalContributionSchemas: {
         authScheme: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+        looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"scheme">;
             scheme: z.ZodString;
@@ -2608,7 +2612,7 @@ declare const canonicalContributionSchemas: {
     PluginNotificationRuleContribution: z.ZodObject<{
         localId: z.ZodString;
         event: z.ZodString;
-        where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+        where: z.ZodOptional<z.ZodString>;
         rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
     }, z.core.$strict>;
     PluginProductEventContribution: z.ZodUnion<readonly [z.ZodObject<{
@@ -2675,6 +2679,9 @@ declare const canonicalContributionSchemas: {
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"page">;
         pageId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"local-app">;
+        schemes: z.ZodArray<z.ZodString>;
     }, z.core.$strict>], "kind">;
     ReferencePresentationVariant: z.ZodObject<{
         resourceKind: z.ZodString;
@@ -2724,6 +2731,28 @@ declare const canonicalContributionSchemas: {
             kind: z.ZodLiteral<"none">;
         }, z.core.$strict>>;
     }, z.core.$strict>;
+    ReferencePresentationAccountLinks: z.ZodObject<{
+        label: z.ZodOptional<z.ZodEnum<{
+            email: "email";
+            name: "name";
+        }>>;
+        pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            setPathname: z.ZodOptional<z.ZodString>;
+            addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>>;
+        addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodObject<{
+                protocol: z.ZodString;
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                search: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            url: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
     ReferencePresentationWords: z.ZodObject<{
         glyph: z.ZodOptional<z.ZodEnum<{
             file: "file";
@@ -2788,6 +2817,9 @@ declare const canonicalContributionSchemas: {
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"page">;
             pageId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"local-app">;
+            schemes: z.ZodArray<z.ZodString>;
         }, z.core.$strict>], "kind">>;
         variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             resourceKind: z.ZodString;
@@ -2855,6 +2887,28 @@ declare const canonicalContributionSchemas: {
             target: z.ZodOptional<z.ZodString>;
             kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>;
+        accountLinks: z.ZodOptional<z.ZodObject<{
+            label: z.ZodOptional<z.ZodEnum<{
+                email: "email";
+                name: "name";
+            }>>;
+            pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                setPathname: z.ZodOptional<z.ZodString>;
+                addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+            }, z.core.$strict>>>;
+            addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                pattern: z.ZodObject<{
+                    protocol: z.ZodString;
+                    hostname: z.ZodString;
+                    pathname: z.ZodOptional<z.ZodString>;
+                    search: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                url: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     RichViewContribution: z.ZodObject<{
         localId: z.ZodString;
@@ -3353,6 +3407,11 @@ export declare interface DeclaredKayPluginCompatibility {
     readonly sdk?: string | undefined;
 }
 
+/** The address schemes whose items an app on this machine opens, rather than a page on the web. */
+export declare function declaredLocalAppSchemes<TPlugin extends {
+    readonly contributes: Readonly<Record<string, unknown>>;
+}>(plugins: readonly TPlugin[]): ReadonlySet<string>;
+
 /**
  * Every plugin's reference presentations. The daemon delivers this one kind from the resolved
  * contract rather than the manifest, so its rows carry `schemes`.
@@ -3478,6 +3537,12 @@ export declare const EventGrantRequest: z.ZodObject<{
 
 export declare type EventGrantRequest = z.infer<typeof EventGrantRequest>;
 
+/**
+ * {@link whereProblem}, for a `where` a plugin event is matched against: every key must also be a
+ * safe path, at most 10 identifier segments and 256 bytes.
+ */
+export declare function eventWhereProblem(value: unknown): string | undefined;
+
 export declare const FileExtensionToken: z.ZodString;
 
 export declare type FileExtensionToken = z.infer<typeof FileExtensionToken>;
@@ -3499,6 +3564,9 @@ export declare function finalizeArtifactProvenanceEnvelope(capture: ArtifactProv
 
 export declare function findSkillSuggestionCitations(text: string, options?: SkillSuggestionEvidenceOptions): readonly SkillSuggestionCitation[];
 
+/** One literal as an expression writes it: single-quoted strings, JSON-form numbers. */
+export declare function formatWhereLiteral(value: WhereLiteral): string;
+
 export declare const GitBasicAuthUser: z.ZodString;
 
 export declare type GitBasicAuthUser = z.infer<typeof GitBasicAuthUser>;
@@ -3570,6 +3638,11 @@ export declare function isCompatible(report: KayPluginCompatibilityReport): bool
  */
 export declare function isCredentialShapedText(value: unknown): boolean;
 
+/** Whether `url` uses a link scheme a loaded plugin declared for an app on this machine. */
+export declare function isDeclaredLocalAppLink<TPlugin extends {
+    readonly contributes: Readonly<Record<string, unknown>>;
+}>(url: string, plugins: readonly TPlugin[]): boolean;
+
 /**
  * Whether a refusal `code` came from the compatibility check: the plugin was written for another
  * SDK or protocol, as opposed to being malformed.
@@ -3601,6 +3674,12 @@ export declare function isQualifiedAuthServiceRef(ref: string): boolean;
 /** Whether a range is one {@link satisfiesSemverRange} can answer for at all. */
 export declare function isSupportedSemverRange(range: string): boolean;
 
+/**
+ * An app entry naming source rather than built JavaScript. Bonsai compiles it when it loads the
+ * plugin, so a plugin in `~/.kay/plugins` needs no build tool for a page.
+ */
+export declare function isUiAppSourceModule(module: string): boolean;
+
 export declare const JsonObject: z.ZodRecord<z.ZodString, z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
 
 export declare type JsonObject = z.infer<typeof JsonObject>;
@@ -4327,9 +4406,19 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * 0.44.0 adds `words.kinds` to a reference presentation (#15905): an ordered list of address patterns
  * and the kind each one names. Additive: a plugin that lists them declares ^0.44.0.
  *
- * 0.45.0 adds declared plugin cards and app.implementCard for their read/submit endpoints.
+ * 0.45.0 adds declared plugin cards and app.implementCard for their read/submit endpoints. It also
+ * lets a plugin declare what the window hardcoded about it (#15906). A reference presentation gains
+ * `accountLinks`, how a page opens under the account an address means, and a `local-app` open, for
+ * an item an app on this machine shows; a plugin the person installed can't declare that open. A
+ * `webSession` gains `signInFirst`. A URI module defines `lookupWebLink` and sets `looksUpWebLinks`
+ * to find a page when someone opens the address, and a preview field marks which `part` of a message
+ * it is. A claim's `brandIcon` is a file path and no longer inline markup, which only this repo's
+ * Microsoft plugin used. Otherwise additive: a plugin using any of these declares ^0.45.0.
+ *
+ * 0.46.0 adds `@bonsai/plugin-sdk/artifact-provenance`, so a plugin shipped as files can finalize
+ * and read the provenance the host captured. Additive: a plugin that imports it declares ^0.46.0.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.45.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.46.0";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -4392,6 +4481,7 @@ export declare const KayAgentTargetManifest: z.ZodObject<{
             authScheme: z.ZodOptional<z.ZodString>;
             knownResources: z.ZodOptional<z.ZodLiteral<true>>;
             describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+            looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
             claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
                 kind: z.ZodLiteral<"scheme">;
                 scheme: z.ZodString;
@@ -4973,7 +5063,7 @@ export declare const KayAppTargetManifest: z.ZodObject<{
         notificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
             event: z.ZodString;
-            where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+            where: z.ZodOptional<z.ZodString>;
             rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
         }, z.core.$strict>>>;
         productEvents: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -5196,6 +5286,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         authScheme: z.ZodOptional<z.ZodString>;
                         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
                         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+                        looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
                         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
                             kind: z.ZodLiteral<"scheme">;
                             scheme: z.ZodString;
@@ -5774,7 +5865,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     notificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
                         event: z.ZodString;
-                        where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+                        where: z.ZodOptional<z.ZodString>;
                         rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
                     }, z.core.$strict>>>;
                     productEvents: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
@@ -5899,6 +5990,9 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         }, z.core.$strict>, z.ZodObject<{
                             kind: z.ZodLiteral<"page">;
                             pageId: z.ZodString;
+                        }, z.core.$strict>, z.ZodObject<{
+                            kind: z.ZodLiteral<"local-app">;
+                            schemes: z.ZodArray<z.ZodString>;
                         }, z.core.$strict>], "kind">>;
                         variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                             resourceKind: z.ZodString;
@@ -5966,6 +6060,28 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                             target: z.ZodOptional<z.ZodString>;
                             kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
                         }, z.core.$strict>>;
+                        accountLinks: z.ZodOptional<z.ZodObject<{
+                            label: z.ZodOptional<z.ZodEnum<{
+                                email: "email";
+                                name: "name";
+                            }>>;
+                            pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                hostname: z.ZodString;
+                                pathname: z.ZodOptional<z.ZodString>;
+                                unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                                setPathname: z.ZodOptional<z.ZodString>;
+                                addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+                            }, z.core.$strict>>>;
+                            addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                pattern: z.ZodObject<{
+                                    protocol: z.ZodString;
+                                    hostname: z.ZodString;
+                                    pathname: z.ZodOptional<z.ZodString>;
+                                    search: z.ZodOptional<z.ZodString>;
+                                }, z.core.$strict>;
+                                url: z.ZodString;
+                            }, z.core.$strict>>>;
+                        }, z.core.$strict>>;
                     }, z.core.$strict>>>;
                     views: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
@@ -6274,6 +6390,7 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                     external: "external";
                     embedded: "embedded";
                 }>;
+                signInFirst: z.ZodOptional<z.ZodString>;
             }, z.core.$strict>>;
         }, z.core.$strict>>>;
     }, z.core.$strict>>;
@@ -7065,6 +7182,9 @@ export declare const KayUiTargetManifest: z.ZodObject<{
             }, z.core.$strict>, z.ZodObject<{
                 kind: z.ZodLiteral<"page">;
                 pageId: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"local-app">;
+                schemes: z.ZodArray<z.ZodString>;
             }, z.core.$strict>], "kind">>;
             variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
                 resourceKind: z.ZodString;
@@ -7132,6 +7252,28 @@ export declare const KayUiTargetManifest: z.ZodObject<{
                 target: z.ZodOptional<z.ZodString>;
                 kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
             }, z.core.$strict>>;
+            accountLinks: z.ZodOptional<z.ZodObject<{
+                label: z.ZodOptional<z.ZodEnum<{
+                    email: "email";
+                    name: "name";
+                }>>;
+                pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    hostname: z.ZodString;
+                    pathname: z.ZodOptional<z.ZodString>;
+                    unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    setPathname: z.ZodOptional<z.ZodString>;
+                    addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+                }, z.core.$strict>>>;
+                addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                    pattern: z.ZodObject<{
+                        protocol: z.ZodString;
+                        hostname: z.ZodString;
+                        pathname: z.ZodOptional<z.ZodString>;
+                        search: z.ZodOptional<z.ZodString>;
+                    }, z.core.$strict>;
+                    url: z.ZodString;
+                }, z.core.$strict>>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>>;
         views: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
@@ -7443,9 +7585,12 @@ export declare function parseResolvedPluginContractV1(value: unknown): ResolvedP
 export declare function parseSemver(value: string): ParsedSemver | undefined;
 
 /**
- * Parses a `where` expression: `||`, `&&`, `!`, parentheses, `==`, `!=`, strings, `true`, `false`
- * and dotted keys, for example `markedForRetirement || proposedRewrite.stale == false`. A bare key
- * means "is set". With `keyTypes`, only those keys parse, and each is checked against its type.
+ * Parses a `where` expression: `||`, `&&`, `!`, parentheses, `==`, `!=`, `contains`, strings,
+ * numbers, `true`, `false` and dotted keys, for example
+ * `markedForRetirement || proposedRewrite.stale == false`. A bare key means "is set". `==` and `!=`
+ * compare a whole value, so a list never equals a scalar; `labels contains 'urgent'` looks inside a
+ * list. With `keyTypes`, only those keys parse, each is checked against its type, and `contains` is
+ * refused, because those keys are scalars.
  */
 export declare function parseWhere(source: string, keyTypes?: WhereKeyTypes): WhereParseResult;
 
@@ -7664,6 +7809,7 @@ export declare const PluginAuthManifest: z.ZodObject<{
                 external: "external";
                 embedded: "embedded";
             }>;
+            signInFirst: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
@@ -7955,6 +8101,7 @@ export declare const PluginAuthService: z.ZodObject<{
             external: "external";
             embedded: "embedded";
         }>;
+        signInFirst: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 
@@ -10053,7 +10200,7 @@ export declare type PluginNamespace = z.infer<typeof PluginNamespace>;
 export declare const PluginNotificationRuleContribution: z.ZodObject<{
     localId: z.ZodString;
     event: z.ZodString;
-    where: z.ZodOptional<z.ZodArray<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>>;
+    where: z.ZodOptional<z.ZodString>;
     rule: z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>;
 }, z.core.$strict>;
 
@@ -10880,6 +11027,7 @@ export declare const PluginWebSessionDeclaration: z.ZodObject<{
         external: "external";
         embedded: "embedded";
     }>;
+    signInFirst: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 
 export declare type PluginWebSessionDeclaration = z.infer<typeof PluginWebSessionDeclaration>;
@@ -10930,10 +11078,38 @@ export declare const ReferenceOpenBehavior: z.ZodDiscriminatedUnion<[z.ZodObject
 }, z.core.$strict>, z.ZodObject<{
     kind: z.ZodLiteral<"page">;
     pageId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"local-app">;
+    schemes: z.ZodArray<z.ZodString>;
 }, z.core.$strict>], "kind">;
 
 export declare type ReferenceOpenBehavior = z.infer<typeof ReferenceOpenBehavior>;
 
+export declare const ReferencePresentationAccountLinks: z.ZodObject<{
+    label: z.ZodOptional<z.ZodEnum<{
+        email: "email";
+        name: "name";
+    }>>;
+    pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        hostname: z.ZodString;
+        pathname: z.ZodOptional<z.ZodString>;
+        unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        setPathname: z.ZodOptional<z.ZodString>;
+        addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strict>>>;
+    addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        pattern: z.ZodObject<{
+            protocol: z.ZodString;
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            search: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+        url: z.ZodString;
+    }, z.core.$strict>>>;
+}, z.core.$strict>;
+
+export declare type ReferencePresentationAccountLinks = z.infer<typeof ReferencePresentationAccountLinks>;
+
 export declare const ReferencePresentationAddress: z.ZodObject<{
     pattern: z.ZodObject<{
         protocol: z.ZodString;
@@ -10973,6 +11149,9 @@ export declare const ReferencePresentationContribution: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"page">;
         pageId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"local-app">;
+        schemes: z.ZodArray<z.ZodString>;
     }, z.core.$strict>], "kind">>;
     variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         resourceKind: z.ZodString;
@@ -11040,6 +11219,28 @@ export declare const ReferencePresentationContribution: z.ZodObject<{
         target: z.ZodOptional<z.ZodString>;
         kindNamesSource: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>>;
+    accountLinks: z.ZodOptional<z.ZodObject<{
+        label: z.ZodOptional<z.ZodEnum<{
+            email: "email";
+            name: "name";
+        }>>;
+        pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            setPathname: z.ZodOptional<z.ZodString>;
+            addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>>;
+        addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodObject<{
+                protocol: z.ZodString;
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                search: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            url: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 
 export declare type ReferencePresentationContribution = z.infer<typeof ReferencePresentationContribution>;
@@ -11155,6 +11356,7 @@ export declare function refineWebSessionScopeConfined(webSession: {
     readonly probe: {
         readonly url: string;
     };
+    readonly signInFirst?: string | undefined;
 }, ctx: z.RefinementCtx): void;
 
 export declare const RegistrableDomain: z.ZodString;
@@ -11510,6 +11712,7 @@ export declare const ResolvedKayAgentUriModule: z.ZodObject<{
     authSchemeId: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+    looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
 }, z.core.$strict>;
 
 export declare type ResolvedKayAgentUriModule = z.infer<typeof ResolvedKayAgentUriModule>;
@@ -12047,6 +12250,7 @@ export declare const ResolvedPluginAuthService: z.ZodObject<{
             external: "external";
             embedded: "embedded";
         }>;
+        signInFirst: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 
@@ -12286,6 +12490,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
                 external: "external";
                 embedded: "embedded";
             }>;
+            signInFirst: z.ZodOptional<z.ZodString>;
         }, z.core.$strict>>;
     }, z.core.$strict>>;
     grants: z.ZodOptional<z.ZodObject<{
@@ -12745,6 +12950,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         authSchemeId: z.ZodOptional<z.ZodString>;
         knownResources: z.ZodOptional<z.ZodLiteral<true>>;
         describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+        looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>>>;
     kayAgentArtifactUriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
         localId: z.ZodString;
@@ -12996,6 +13202,29 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         uriModule: z.ZodOptional<z.ZodString>;
         schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
         displayName: z.ZodOptional<z.ZodString>;
+        authService: z.ZodOptional<z.ZodString>;
+        accountLinks: z.ZodOptional<z.ZodObject<{
+            label: z.ZodOptional<z.ZodEnum<{
+                email: "email";
+                name: "name";
+            }>>;
+            pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                setPathname: z.ZodOptional<z.ZodString>;
+                addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+            }, z.core.$strict>>>;
+            addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                pattern: z.ZodObject<{
+                    protocol: z.ZodString;
+                    hostname: z.ZodString;
+                    pathname: z.ZodOptional<z.ZodString>;
+                    search: z.ZodOptional<z.ZodString>;
+                }, z.core.$strict>;
+                url: z.ZodString;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
         addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
             pattern: z.ZodObject<{
                 protocol: z.ZodString;
@@ -13016,6 +13245,9 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         }, z.core.$strict>, z.ZodObject<{
             kind: z.ZodLiteral<"page">;
             pageId: z.ZodString;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"local-app">;
+            schemes: z.ZodArray<z.ZodString>;
         }, z.core.$strict>], "kind">>;
         variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
             resourceKind: z.ZodString;
@@ -13506,6 +13738,7 @@ export declare const ResolvedPluginWebSession: z.ZodObject<{
         external: "external";
         embedded: "embedded";
     }>;
+    signInFirst: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 
 export declare type ResolvedPluginWebSession = z.infer<typeof ResolvedPluginWebSession>;
@@ -13516,6 +13749,29 @@ export declare const ResolvedReferencePresentation: z.ZodObject<{
     uriModule: z.ZodOptional<z.ZodString>;
     schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
     displayName: z.ZodOptional<z.ZodString>;
+    authService: z.ZodOptional<z.ZodString>;
+    accountLinks: z.ZodOptional<z.ZodObject<{
+        label: z.ZodOptional<z.ZodEnum<{
+            email: "email";
+            name: "name";
+        }>>;
+        pages: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            hostname: z.ZodString;
+            pathname: z.ZodOptional<z.ZodString>;
+            unlessPathname: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            setPathname: z.ZodOptional<z.ZodString>;
+            addQuery: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strict>>>;
+        addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            pattern: z.ZodObject<{
+                protocol: z.ZodString;
+                hostname: z.ZodString;
+                pathname: z.ZodOptional<z.ZodString>;
+                search: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>;
+            url: z.ZodString;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>>;
     addresses: z.ZodOptional<z.ZodArray<z.ZodObject<{
         pattern: z.ZodObject<{
             protocol: z.ZodString;
@@ -13536,6 +13792,9 @@ export declare const ResolvedReferencePresentation: z.ZodObject<{
     }, z.core.$strict>, z.ZodObject<{
         kind: z.ZodLiteral<"page">;
         pageId: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"local-app">;
+        schemes: z.ZodArray<z.ZodString>;
     }, z.core.$strict>], "kind">>;
     variants: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
         resourceKind: z.ZodString;
@@ -14849,6 +15108,9 @@ export declare const UiAppContribution: z.ZodObject<{
 
 export declare type UiAppContribution = z.infer<typeof UiAppContribution>;
 
+/** Where a source entry's compiled stylesheet sits in its package, beside the entry. */
+export declare function uiAppSourceStylePath(module: string): string;
+
 export declare const UiCommandContribution: z.ZodObject<{
     localId: z.ZodString;
     title: z.ZodString;
@@ -14931,6 +15193,7 @@ export declare const UriModuleContribution: z.ZodObject<{
     authScheme: z.ZodOptional<z.ZodString>;
     knownResources: z.ZodOptional<z.ZodLiteral<true>>;
     describesOperations: z.ZodOptional<z.ZodLiteral<true>>;
+    looksUpWebLinks: z.ZodOptional<z.ZodLiteral<true>>;
     claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"scheme">;
         scheme: z.ZodString;
@@ -15324,8 +15587,12 @@ export declare type Where = {
 } | {
     readonly kind: "equals";
     readonly key: string;
-    readonly value: boolean | string;
+    readonly value: WhereLiteral;
     readonly negated: boolean;
+} | {
+    readonly kind: "contains";
+    readonly key: string;
+    readonly value: WhereLiteral;
 } | {
     readonly kind: "not";
     readonly operand: Where;
@@ -15341,9 +15608,33 @@ declare const WHERE_KEY_TYPES: {
     readonly "app.channel": "string";
 };
 
+/** The longest `where`: the largest a rule file can be, so anything that loaded still loads. */
+export declare const WHERE_MAX_BYTES: number;
+
+/**
+ * The old list form of `where`, written as an expression: each clause is
+ * `path == value`, or `(path == value || path contains value)` where `looksInsideLists` says so, and
+ * all must hold. A path spelled `true`, `false` or as a number never resolved to anything, so its
+ * clause is `false`. Undefined when the list isn't a non-empty list of `{ path, equals }`.
+ */
+export declare function whereClausesAsExpression(clauses: unknown, looksInsideLists?: (path: string) => boolean): string | undefined;
+
 /** What a caller's keys are, when it has a fixed set. A bare string key must be compared. */
 export declare type WhereKeyTypes = Readonly<Record<string, "boolean" | "string">>;
 
+export declare type WhereKeyUse = "bare" | "compared" | "contained";
+
+/** Every key an expression reads, each with how that read uses it. */
+export declare function whereKeyUses(where: Where): readonly {
+    readonly key: string;
+    readonly use: WhereKeyUse;
+}[];
+
+export declare type WhereLiteral = boolean | number | string;
+
+/** Why a value that isn't a string can't be a `where`, showing an old list in its new form. */
+export declare function whereNotAStringMessage(value: unknown): string;
+
 export declare type WhereParseResult = {
     readonly ok: true;
     readonly where: Where;
@@ -15352,6 +15643,9 @@ export declare type WhereParseResult = {
     readonly message: string;
 };
 
+/** Why a value can't be a saved `where`, or undefined when it can. */
+export declare function whereProblem(value: unknown): string | undefined;
+
 /** Construct the exact claim row for one Whiteboard scope and operation. */
 export declare function whiteboardCapabilityClaim(operation: WhiteboardCapabilityOperation, scope: WhiteboardCapabilityScope, target?: "kay.agent"): WhiteboardCapabilityClaimV1;
 

package/dist/index.js

@@ -36,7 +36,13 @@ function declaredUiIconPaths(manifest) {
         label: `kay.ui command '${command.localId}' icon`,
         path: command.icon
       }
-    ])
+    ]),
+    ...(contributes?.referencePresentations ?? []).flatMap((presentation) => (presentation.claims ?? []).flatMap((claim) => claim.brandIcon === void 0 ? [] : [
+      {
+        label: `kay.ui reference presentation '${presentation.localId}' brand icon`,
+        path: claim.brandIcon
+      }
+    ]))
   ];
 }
 
@@ -254,12 +260,13 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.45.0";
+var KAY_PLUGIN_SDK_VERSION = "0.46.0";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
   "0.42.0",
   "0.42.1",
   "0.43.0",
-  "0.44.0"
+  "0.44.0",
+  "0.45.0"
 ];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
@@ -379,6 +386,13 @@ function refineWebSessionScopeConfined(webSession, ctx) {
       message: "probe.url host must fall within a declared cookie domain"
     });
   }
+  if (webSession.signInFirst !== void 0 && !confined(webSession.signInFirst)) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["signInFirst"],
+      message: "signInFirst host must fall within a declared cookie domain"
+    });
+  }
 }
 
 // packages/plugin-protocol/dist/app-data-read.js
@@ -2762,6 +2776,7 @@ __export(contributions_exports, {
   PluginProductEventContribution: () => PluginProductEventContribution,
   PluginSkillSourceDeclaration: () => PluginSkillSourceDeclaration,
   ReferenceOpenBehavior: () => ReferenceOpenBehavior,
+  ReferencePresentationAccountLinks: () => ReferencePresentationAccountLinks,
   ReferencePresentationAddress: () => ReferencePresentationAddress,
   ReferencePresentationContribution: () => ReferencePresentationContribution,
   ReferencePresentationTooltip: () => ReferencePresentationTooltip,
@@ -2793,7 +2808,9 @@ __export(contributions_exports, {
   WhiteboardTypeContribution: () => WhiteboardTypeContribution,
   WhiteboardTypeStorage: () => WhiteboardTypeStorage,
   WorkflowContribution: () => WorkflowContribution,
-  canonicalContributionSchemas: () => canonicalContributionSchemas
+  canonicalContributionSchemas: () => canonicalContributionSchemas,
+  isUiAppSourceModule: () => isUiAppSourceModule,
+  uiAppSourceStylePath: () => uiAppSourceStylePath
 });
 import { z as z12 } from "zod";
 
@@ -2950,7 +2967,21 @@ function pluginSignalPayloadJsonSchema() {
 }
 
 // packages/plugin-protocol/dist/where-expression.js
-var TOKEN = /\s*(?:(\|\||&&|==|!=|!|\(|\))|'([^']*)'|"([^"]*)"|([A-Za-z][A-Za-z0-9]*(?:\.[A-Za-z][A-Za-z0-9]*)*))/y;
+var NUMBER_SOURCE = String.raw`-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?`;
+var SEGMENT_SOURCE = "[A-Za-z0-9_][A-Za-z0-9_-]*";
+var TOKEN = new RegExp(String.raw`\s*(?:(\|\||&&|==|!=|!|\(|\))` + String.raw`|'((?:[^'\\]|\\[\s\S])*)'|"((?:[^"\\]|\\[\s\S])*)"` + // A number that runs on into a key's characters is a key: `1.5.2`, `1-a`.
+String.raw`|(${NUMBER_SOURCE})(?![A-Za-z0-9_.-])` + `|(${SEGMENT_SOURCE}(?:\\.${SEGMENT_SOURCE})*))`, "y");
+var WHOLE_NUMBER = new RegExp(`^${NUMBER_SOURCE}$`);
+var WHOLE_KEY = new RegExp(`^${SEGMENT_SOURCE}(?:\\.${SEGMENT_SOURCE})*$`);
+function unescapeString(text) {
+  return text.replace(/\\([\s\S])/g, (_, character) => {
+    if (character === "\\" || character === "'" || character === '"') {
+      return character;
+    }
+    throw new Error(`unknown escape '\\${character}'; a string can escape only \\, ' and "`);
+  });
+}
+var MAX_TOKENS = 2e3;
 function tokenize(source) {
   const tokens = [];
   TOKEN.lastIndex = 0;
@@ -2960,13 +2991,21 @@ function tokenize(source) {
     if (match === null) {
       throw new Error(`unexpected text at '${source.slice(start).trim()}'`);
     }
-    const [, operator, single, double, word] = match;
+    if (tokens.length === MAX_TOKENS) {
+      throw new Error(`the expression has more than ${MAX_TOKENS} parts`);
+    }
+    const [, operator, single, double, number, word] = match;
     if (operator !== void 0)
       tokens.push({ kind: "operator", text: operator });
+    else if (number !== void 0)
+      tokens.push({ kind: "number", text: number });
     else if (word !== void 0)
       tokens.push({ kind: "word", text: word });
     else
-      tokens.push({ kind: "string", text: single ?? double ?? "" });
+      tokens.push({
+        kind: "string",
+        text: unescapeString(single ?? double ?? "")
+      });
   }
   return tokens;
 }
@@ -3018,6 +3057,14 @@ function parseTokens(tokens, keyTypes) {
   };
   const parseKeyAtom = (key) => {
     const keyType = keyTypes?.[key];
+    const next = tokens[position];
+    if (next?.kind === "word" && next.text === "contains") {
+      if (keyTypes !== void 0) {
+        throw new Error(`'${key}' is not a list; compare it with == or !=`);
+      }
+      position += 1;
+      return { kind: "contains", key, value: parseLiteral("contains") };
+    }
     const negated = takeOperator("!=");
     if (!negated && !takeOperator("==")) {
       if (keyType === "string") {
@@ -3025,22 +3072,29 @@ function parseTokens(tokens, keyTypes) {
       }
       return { kind: "key", key };
     }
-    const value = parseLiteral();
+    const value = parseLiteral("== or !=");
     if (keyType !== void 0 && typeof value !== keyType) {
       throw new Error(`'${key}' compares to a ${keyType}`);
     }
     return { kind: "equals", key, value, negated };
   };
-  const parseLiteral = () => {
+  const parseLiteral = (after) => {
     const token = tokens[position];
     position += 1;
     if (token?.kind === "string")
       return token.text;
+    if (token?.kind === "number") {
+      const value = Number(token.text);
+      if (!Number.isFinite(value)) {
+        throw new Error(`the number ${token.text} is too large`);
+      }
+      return value;
+    }
     if (token?.kind === "word" && token.text === "true")
       return true;
     if (token?.kind === "word" && token.text === "false")
       return false;
-    throw new Error("expected a string, true or false after == or !=");
+    throw new Error(`expected a string, number, true or false after ${after}`);
   };
   const where = parseOr();
   const extra = tokens[position];
@@ -3055,6 +3109,80 @@ function parseWhere(source, keyTypes) {
     return { ok: false, message: error.message };
   }
 }
+function whereKeyUses(where) {
+  switch (where.kind) {
+    case "literal":
+      return [];
+    case "key":
+      return [{ key: where.key, use: "bare" }];
+    case "equals":
+      return [{ key: where.key, use: "compared" }];
+    case "contains":
+      return [{ key: where.key, use: "contained" }];
+    case "not":
+      return whereKeyUses(where.operand);
+    case "and":
+    case "or":
+      return [...whereKeyUses(where.left), ...whereKeyUses(where.right)];
+  }
+}
+function formatWhereLiteral(value) {
+  return typeof value === "string" ? `'${value.replace(/[\\']/g, "\\$&")}'` : String(value);
+}
+function whereClausesAsExpression(clauses, looksInsideLists = () => false) {
+  if (!Array.isArray(clauses) || clauses.length === 0)
+    return void 0;
+  const written = [];
+  for (const clause of clauses) {
+    if (typeof clause !== "object" || clause === null)
+      return void 0;
+    const { path, equals } = clause;
+    if (Object.keys(clause).length !== 2 || typeof path !== "string" || !WHOLE_KEY.test(path) || !(typeof equals === "string" || typeof equals === "boolean" || typeof equals === "number" && Number.isFinite(equals))) {
+      return void 0;
+    }
+    if (path === "true" || path === "false" || WHOLE_NUMBER.test(path)) {
+      written.push("false");
+      continue;
+    }
+    const literal = formatWhereLiteral(equals);
+    written.push(looksInsideLists(path) ? `(${path} == ${literal} || ${path} contains ${literal})` : `${path} == ${literal}`);
+  }
+  return written.join(" && ");
+}
+function whereNotAStringMessage(value) {
+  const expression = whereClausesAsExpression(value);
+  if (expression !== void 0) {
+    return `where is now an expression, not a list of {path, equals}: write \`${expression}\`, and use \`contains\` to look inside a list`;
+  }
+  return Array.isArray(value) ? "where is now an expression, not a list of {path, equals}, for example `payload.status == 'open' && payload.labels contains 'urgent'`" : "where must be an expression string";
+}
+var WHERE_MAX_BYTES = 256 * 1024;
+function whereProblem(value) {
+  if (typeof value !== "string")
+    return whereNotAStringMessage(value);
+  if (new TextEncoder().encode(value).length > WHERE_MAX_BYTES) {
+    return `where must be at most ${WHERE_MAX_BYTES} bytes of UTF-8`;
+  }
+  const parsed = parseWhere(value);
+  return parsed.ok ? void 0 : `where is not a valid expression: ${parsed.message}`;
+}
+var MAX_EVENT_KEY_BYTES = 256;
+var MAX_EVENT_KEY_SEGMENTS = 10;
+function eventWhereProblem(value) {
+  const problem = whereProblem(value);
+  if (problem !== void 0)
+    return problem;
+  const parsed = parseWhere(value);
+  if (!parsed.ok)
+    return void 0;
+  for (const { key } of whereKeyUses(parsed.where)) {
+    const segments = key.split(".");
+    if (new TextEncoder().encode(key).length > MAX_EVENT_KEY_BYTES || segments.length > MAX_EVENT_KEY_SEGMENTS || segments.some((segment) => !/^[a-zA-Z_]/.test(segment) || ["__proto__", "prototype", "constructor"].includes(segment))) {
+      return `where key '${key}' must be a safe dot path of at most ${MAX_EVENT_KEY_SEGMENTS} identifier segments and ${MAX_EVENT_KEY_BYTES} bytes`;
+    }
+  }
+  return void 0;
+}
 function resolve(where, read) {
   switch (where.kind) {
     case "literal":
@@ -3069,6 +3197,12 @@ function resolve(where, read) {
         return void 0;
       return value === where.value !== where.negated;
     }
+    case "contains": {
+      const value = read(where.key);
+      if (value === void 0)
+        return void 0;
+      return Array.isArray(value) && value.includes(where.value);
+    }
     case "not": {
       const operand = resolve(where.operand, read);
       return operand === void 0 ? void 0 : !operand;
@@ -3115,6 +3249,15 @@ function declarationsOfKind(plugins, kind) {
 function declaredReferencePresentations(plugins) {
   return plugins.flatMap((plugin) => (plugin.contributes["referencePresentations"] ?? []).map((declaration) => ({ plugin, declaration })));
 }
+function declaredLocalAppSchemes(plugins) {
+  return new Set(declaredReferencePresentations(plugins).flatMap(({ declaration }) => declaration.open?.kind === "local-app" ? declaration.schemes ?? [] : []));
+}
+function isDeclaredLocalAppLink(url, plugins) {
+  if (!URL.canParse(url))
+    return false;
+  const scheme = new URL(url).protocol.slice(0, -1).toLowerCase();
+  return declaredReferencePresentations(plugins).some(({ declaration }) => declaration.open?.kind === "local-app" && declaration.open.schemes.includes(scheme));
+}
 function declaredCommandId(pluginId, localId) {
   return `${pluginId}/${localId}`;
 }
@@ -3425,14 +3568,19 @@ function createContributionsSchemas(canonical) {
     // The module's code defines `describeOperation`, the approval card's facts for a call. The
     // daemon reads it here because it may hold only the manifest (a plugin that runs in the
     // plugin host), and the host refuses a module whose code disagrees.
-    describesOperations: z12.literal(true).optional()
+    describesOperations: z12.literal(true).optional(),
+    // The module's code defines `lookupWebLink`, which finds a resource's page when someone opens
+    // it. The daemon reads it here for the same reason, and the host refuses a module whose code
+    // disagrees.
+    looksUpWebLinks: z12.literal(true).optional()
   });
   const AppUriModuleContribution2 = UriModuleContribution2.omit({
     authActions: true,
     authService: true,
     authScheme: true,
     knownResources: true,
-    describesOperations: true
+    describesOperations: true,
+    looksUpWebLinks: true
   });
   const AppDataSourceStore = z12.discriminatedUnion("shape", [
     z12.strictObject({
@@ -3754,7 +3902,7 @@ function createContributionsSchemas(canonical) {
     localId: LocalContributionId2,
     /** The same-plugin `eventDefinitions` local id this rule matches. */
     event: PluginEventLocalId2,
-    where: z12.array(JsonObject).optional(),
+    where: z12.string({ error: (issue) => whereNotAStringMessage(issue.input) }).optional(),
     rule: JsonObject
   });
   const PluginProductEventContribution2 = z12.union([
@@ -3820,6 +3968,15 @@ function createContributionsSchemas(canonical) {
     localId: LocalContributionId2,
     resultKinds: z12.array(NonEmptyString3).min(1)
   });
+  const NOT_LOCAL_APP_SCHEMES = /* @__PURE__ */ new Set([
+    "http",
+    "https",
+    "file",
+    "javascript",
+    "data",
+    "blob",
+    "about"
+  ]);
   const ReferenceOpenBehavior2 = z12.discriminatedUnion("kind", [
     z12.strictObject({ kind: z12.literal("working-document") }),
     z12.strictObject({ kind: z12.literal("browser-pane") }),
@@ -3828,14 +3985,22 @@ function createContributionsSchemas(canonical) {
      * manifest, and the page gets the whole address as its `objectId` unless `addresses` says
      * otherwise. Needs no web address, so a plugin-only resource (`user-todo://items/3`) can pill.
      */
-    z12.strictObject({ kind: z12.literal("page"), pageId: NonEmptyString3 })
+    z12.strictObject({ kind: z12.literal("page"), pageId: NonEmptyString3 }),
+    /**
+     * Hand the address's link to an app on this machine. The module's claims fill the link as its
+     * `sourceUrl`, and `schemes` names every scheme those links may use: main opens a link only when
+     * a loaded plugin declares its scheme here. A plugin the person installed can't declare this.
+     */
+    z12.strictObject({
+      kind: z12.literal("local-app"),
+      schemes: z12.array(UriScheme2.refine((scheme) => !NOT_LOCAL_APP_SCHEMES.has(scheme), "Names the web, a file or script, not an app on this machine")).min(1)
+    })
   ]);
   const ReferencePresentationVariant2 = z12.strictObject({
     resourceKind: NonEmptyString3,
     presentationPluginId: PluginId2.optional()
   });
   const ReferencePresentationVariants2 = z12.record(MimeTypeString2, ReferencePresentationVariant2);
-  const InlineSvg = z12.string().max(64 * 1024).refine((value) => /^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?<svg[\s>]/iu.test(value), { message: "brandIcon must be inline SVG markup." });
   const ReferencePresentationUriPattern2 = z12.strictObject({
     protocol: NonEmptyString3,
     hostname: NonEmptyString3,
@@ -3847,7 +4012,8 @@ function createContributionsSchemas(canonical) {
     pattern: ReferencePresentationUriPattern2.extend({
       protocol: z12.enum(["http", "https"])
     }),
-    brandIcon: InlineSvg.optional()
+    /** The claim's mark: an SVG file in the plugin, drawn in its own colours. */
+    brandIcon: PackageAssetPath2.optional()
   });
   const ReferencePresentationTooltip2 = z12.strictObject({
     /** Same-plugin kay.ui app mounted with read-only reference URI context. */
@@ -3859,6 +4025,26 @@ function createContributionsSchemas(canonical) {
     objectId: NonEmptyString3.optional(),
     open: z12.strictObject({ kind: z12.literal("none") }).optional()
   });
+  const ReferencePresentationAccountLinkPage = z12.strictObject({
+    /** A literal host name. */
+    hostname: z12.string().regex(/^[a-z0-9.-]+$/, "An account link's hostname is a literal lower-case host name."),
+    pathname: z12.string().optional(),
+    /** A page matching one of these already names its account, so it stays as it is. */
+    unlessPathname: z12.array(z12.string()).min(1).optional(),
+    /** The path the page opens at, in place of its own. */
+    setPathname: z12.string().startsWith("/").optional(),
+    /** Query values to add. A page that already has one of these names stays as it is. */
+    addQuery: z12.record(NonEmptyString3, NonEmptyString3)
+  });
+  const ReferencePresentationAccountLinkAddress = z12.strictObject({
+    pattern: ReferencePresentationUriPattern2,
+    url: z12.string().regex(/^https?:\/\//, "An account link's url is a web page.")
+  });
+  const ReferencePresentationAccountLinks2 = z12.strictObject({
+    label: z12.enum(["email", "name"]).optional(),
+    pages: z12.array(ReferencePresentationAccountLinkPage).min(1).optional(),
+    addresses: z12.array(ReferencePresentationAccountLinkAddress).min(1).optional()
+  });
   const ReferencePresentationWords2 = z12.strictObject({
     /** The row's mark, for a source with no icon of its own. Left out: the plugin's main icon. */
     glyph: z12.enum(TOOL_GLYPHS).optional(),
@@ -3910,7 +4096,9 @@ function createContributionsSchemas(canonical) {
     /** Informational app presentation matched against the canonical resource URI. */
     tooltip: ReferencePresentationTooltip2.optional(),
     /** What the transcript calls this module's addresses. Needs a `uriModule`. */
-    words: ReferencePresentationWords2.optional()
+    words: ReferencePresentationWords2.optional(),
+    /** How this module's web pages open under the right account. Needs a `uriModule`. */
+    accountLinks: ReferencePresentationAccountLinks2.optional()
   }).superRefine((value, ctx) => {
     if (value.open === void 0 !== (value.resourceKind === void 0)) {
       ctx.addIssue({
@@ -3919,13 +4107,20 @@ function createContributionsSchemas(canonical) {
         message: "open and resourceKind come together: name both or neither."
       });
     }
-    if (value.open === void 0 && value.words === void 0) {
+    if (value.open === void 0 && value.words === void 0 && value.accountLinks === void 0) {
       ctx.addIssue({
         code: "custom",
         path: ["words"],
         message: "A reference presentation that opens nothing must have words."
       });
     }
+    if (value.accountLinks !== void 0 && value.uriModule === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["accountLinks"],
+        message: "Account links belong to a URI module: name its uriModule."
+      });
+    }
     if (value.words !== void 0 && value.uriModule === void 0) {
       ctx.addIssue({
         code: "custom",
@@ -4224,6 +4419,7 @@ function createContributionsSchemas(canonical) {
     ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2,
     ReferencePresentationTooltip: ReferencePresentationTooltip2,
     ReferencePresentationAddress: ReferencePresentationAddress2,
+    ReferencePresentationAccountLinks: ReferencePresentationAccountLinks2,
     ReferencePresentationWords: ReferencePresentationWords2,
     ReferencePresentationContribution: ReferencePresentationContribution2,
     RichViewContribution: RichViewContribution2,
@@ -4239,8 +4435,15 @@ function createContributionsSchemas(canonical) {
     PluginContributionKind: PluginContributionKind2
   };
 }
-var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, PluginCardContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, PluginProductEventContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationWords, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
+var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, PluginCardContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, PluginProductEventContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, SettingsPanelContribution, ResultRendererContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationAccountLinks, ReferencePresentationWords, ReferencePresentationContribution, RichViewContribution, KayUiAppHostCapability, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
 var canonicalContributionSchemas = createContributionsSchemas(true);
+var UI_APP_SOURCE_MODULE = /\.(?:tsx|ts|jsx)$/;
+function isUiAppSourceModule(module) {
+  return UI_APP_SOURCE_MODULE.test(module);
+}
+function uiAppSourceStylePath(module) {
+  return module.replace(UI_APP_SOURCE_MODULE, ".css");
+}
 
 // packages/plugin-protocol/dist/icon-shape.js
 var SVG_PROLOG = String.raw`^\s*(?:<\?xml[^>]*>\s*)?(?:<!--[\s\S]*?-->\s*)*(?:<!DOCTYPE[^>]*>\s*)?`;
@@ -4716,7 +4919,13 @@ function createManifestSchemas(canonical) {
     loginUrl: HttpsUrl2,
     cookieDomains: z13.array(RegistrableDomain2).min(1),
     probe: PluginWebSessionProbe2,
-    oauthVenue: z13.enum(["embedded", "external"])
+    oauthVenue: z13.enum(["embedded", "external"]),
+    /**
+     * Where a page goes first when it opens in one of Bonsai's browser panes and this site login
+     * is missing: a sign-in page that continues to the page. A template with `:email` and `:url`
+     * (see `UriClaimTemplate`), on a host within `cookieDomains`.
+     */
+    signInFirst: z13.string().optional()
   }).superRefine(refineWebSessionScopeConfined);
   const PluginAuthService2 = z13.strictObject({
     localId: LocalContributionId2,
@@ -5867,7 +6076,7 @@ function boundPluginDiagnosticMessage(message) {
 import { z as z14 } from "zod";
 function createResolvedContractSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
-  const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, ReferencePresentationWords: ReferencePresentationWords2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
+  const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAccountLinks: ReferencePresentationAccountLinks2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, ReferencePresentationWords: ReferencePresentationWords2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeStorage: WhiteboardTypeStorage2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, GlobalContributionId: GlobalContributionId2, HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, PluginToolName: PluginToolName2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginExternalCliConnect: PluginExternalCliConnect2, PluginOAuthClientSupplier: PluginOAuthClientSupplier2 } = canonical ? canonicalManifestSchemas : manifest_exports;
   const { ResolvedPluginGrants: ResolvedPluginGrants2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
@@ -6010,6 +6219,8 @@ function createResolvedContractSchemas(canonical) {
     knownResources: z14.literal(true).optional(),
     /** Mirrors `UriModuleContribution.describesOperations`. */
     describesOperations: z14.literal(true).optional(),
+    /** Mirrors `UriModuleContribution.looksUpWebLinks`. */
+    looksUpWebLinks: z14.literal(true).optional(),
     ...UriModuleFacts2.shape
   });
   const ResolvedKayAgentArtifactUriModule2 = z14.strictObject({
@@ -6046,6 +6257,9 @@ function createResolvedContractSchemas(canonical) {
     mimeTypes: z14.array(MimeTypeString2).min(1),
     extensions: z14.array(FileExtensionToken2).min(1).optional()
   });
+  const ResolvedReferencePresentationUrlClaim = ReferencePresentationUrlClaim2.extend({
+    brandIcon: z14.string().max(64 * 1024).optional()
+  });
   const ResolvedReferencePresentation2 = z14.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
@@ -6054,13 +6268,16 @@ function createResolvedContractSchemas(canonical) {
     schemes: z14.array(UriScheme2).min(1).optional(),
     /** The module's `displayName`: the source's name in a row. */
     displayName: NonEmptyString3.optional(),
+    /** The module's auth service, qualified: whose accounts `accountLinks` reads. */
+    authService: GlobalContributionId2.optional(),
+    accountLinks: ReferencePresentationAccountLinks2.optional(),
     addresses: z14.array(ReferencePresentationAddress2).min(1).optional(),
     /** Comes with `open`. A presentation with neither only words its module's addresses. */
     resourceKind: NonEmptyString3.optional(),
     open: ReferenceOpenBehavior2.optional(),
     /** MIME-specific resource kinds; absent keys use the base presentation. */
     variants: ReferencePresentationVariants2.optional(),
-    claims: z14.array(ReferencePresentationUrlClaim2).optional(),
+    claims: z14.array(ResolvedReferencePresentationUrlClaim).optional(),
     tooltip: z14.strictObject({
       app: GlobalContributionId2,
       pattern: ReferencePresentationUriPattern2
@@ -6165,7 +6382,8 @@ function createResolvedContractSchemas(canonical) {
       method: z14.enum(["GET", "POST"]),
       signedInStatuses: z14.array(SignedInStatusCode2).min(1)
     }),
-    oauthVenue: z14.enum(["embedded", "external"])
+    oauthVenue: z14.enum(["embedded", "external"]),
+    signInFirst: z14.string().optional()
   }).superRefine(refineWebSessionScopeConfined);
   const ResolvedPluginAuthService2 = z14.strictObject({
     localId: LocalContributionId2,
@@ -6435,7 +6653,8 @@ function resolveAuthServices(namespace, manifest) {
           method: service.webSession.probe.method ?? "GET",
           signedInStatuses: [...service.webSession.probe.signedInStatuses]
         },
-        oauthVenue: service.webSession.oauthVenue
+        oauthVenue: service.webSession.oauthVenue,
+        ...service.webSession.signInFirst === void 0 ? {} : { signInFirst: service.webSession.signInFirst }
       }
     },
     schemes: service.schemes.map((scheme) => {
@@ -6674,6 +6893,7 @@ function resolveKayPluginContractV1(manifest) {
     },
     ...module.knownResources === void 0 ? {} : { knownResources: module.knownResources },
     ...module.describesOperations === void 0 ? {} : { describesOperations: module.describesOperations },
+    ...module.looksUpWebLinks === void 0 ? {} : { looksUpWebLinks: module.looksUpWebLinks },
     ...uriModuleFacts(module)
   }));
   const kayAgentArtifactUriModules = manifest.targets?.kay?.agent?.contributes?.artifactUriModules?.map((module) => ({
@@ -6709,13 +6929,14 @@ function resolveKayPluginContractV1(manifest) {
     ...presentation.uriModule === void 0 ? {} : {
       uriModule: resolveGlobalContributionId(namespace, presentation.uriModule)
     },
-    ...presentationSource(manifest, presentation),
+    ...presentationSource(namespace, manifest, presentation),
     ...presentation.addresses === void 0 ? {} : { addresses: presentation.addresses },
     ...presentation.open === void 0 || presentation.resourceKind === void 0 ? {} : {
       resourceKind: presentation.resourceKind,
       open: presentation.open
     },
     ...presentation.words === void 0 ? {} : { words: { ...presentation.words } },
+    ...presentation.accountLinks === void 0 ? {} : { accountLinks: presentation.accountLinks },
     ...presentation.tooltip === void 0 ? {} : {
       tooltip: {
         app: resolveGlobalContributionId(namespace, presentation.tooltip.app),
@@ -6800,19 +7021,23 @@ function safeResolveKayPluginContractV1(manifest) {
     throw error;
   }
 }
-function presentationSource(manifest, presentation) {
+function presentationSource(namespace, manifest, presentation) {
   const contributes = manifest.targets?.kay;
   const module = [
     ...contributes?.agent?.contributes?.uriModules ?? [],
     ...contributes?.app?.contributes?.uriModules ?? []
   ].find((candidate) => candidate.localId === presentation.uriModule);
   const schemes = presentation.scheme === void 0 ? module?.schemes : [presentation.scheme];
+  const authService = module !== void 0 && "authService" in module ? module.authService : void 0;
   return {
     ...schemes === void 0 ? {} : { schemes: [...schemes] },
-    ...module?.displayName === void 0 ? {} : { displayName: module.displayName }
+    ...module?.displayName === void 0 ? {} : { displayName: module.displayName },
+    ...typeof authService === "string" ? {
+      authService: isQualifiedAuthServiceRef(authService) ? authService : resolveGlobalContributionId(namespace, authService)
+    } : {}
   };
 }
-function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, ...facts }) {
+function uriModuleFacts({ localId: _localId, schemes: _schemes, displayName: _displayName, authService: _authService, authScheme: _authScheme, knownResources: _knownResources, describesOperations: _describesOperations, looksUpWebLinks: _looksUpWebLinks, ...facts }) {
   return facts;
 }
 
@@ -7746,6 +7971,7 @@ export {
   RETIRED_PLUGIN_CAPABILITY_SLUGS,
   RETIRED_WEB_SESSION_ROW_KEYS,
   ReferenceOpenBehavior,
+  ReferencePresentationAccountLinks,
   ReferencePresentationAddress,
   ReferencePresentationContribution,
   ReferencePresentationTooltip,
@@ -7824,6 +8050,7 @@ export {
   UriModuleContribution,
   UriScheme,
   WEB_SESSION_CSRF_SELECTOR_PATTERN,
+  WHERE_MAX_BYTES,
   WebSessionCsrfSelector,
   WebSessionGrantRequest,
   WhiteboardCapabilityClaimV1,
@@ -7851,25 +8078,30 @@ export {
   configSectionKeysForManifest,
   declarationsOfKind,
   declaredCommandId,
+  declaredLocalAppSchemes,
   declaredReferencePresentations,
   declaredUiIconPaths,
   dedupeClaims,
   deriveDirectoryPluginToolName,
   evaluateCommandWhere,
   evaluateWhere,
+  eventWhereProblem,
   finalizeArtifactProvenanceEnvelope,
   findSkillSuggestionCitations,
+  formatWhereLiteral,
   hasClaim,
   hostWithinDomain,
   isCanonicalArtifactOutputUri,
   isCompatible,
   isCredentialShapedText,
+  isDeclaredLocalAppLink,
   isKayPluginCompatibilityRefusal,
   isPluginProductEventName,
   isPrivateCapabilityClaim,
   isQualifiedAuthSchemeRef,
   isQualifiedAuthServiceRef,
   isSupportedSemverRange,
+  isUiAppSourceModule,
   judgeKayPluginDirectory,
   kayPluginCompatibilityAdvisories,
   kayPluginHostCompatibility,
@@ -7910,8 +8142,13 @@ export {
   skillSuggestionEvidenceKey,
   turnMessageOrigin,
   turnPacket,
+  uiAppSourceStylePath,
   urlHostWithinDomain,
   validateKayUiEventSubscription,
   webSessionPathWithinPrefix,
+  whereClausesAsExpression,
+  whereKeyUses,
+  whereNotAStringMessage,
+  whereProblem,
   whiteboardCapabilityClaim
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",