@yaklabs-ai/plugin-protocol 0.49.0 → 0.51.0

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.49.0"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.51.0"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [

package/dist/index.d.ts

@@ -3230,6 +3230,12 @@ declare const canonicalContributionSchemas: {
         panel: z.ZodOptional<z.ZodObject<{
             body: z.ZodString;
         }, z.core.$strict>>;
+        featureFlagVariant: z.ZodOptional<z.ZodObject<{
+            flag: z.ZodString;
+            title: z.ZodOptional<z.ZodString>;
+            icon: z.ZodOptional<z.ZodString>;
+            panel: z.ZodOptional<z.ZodLiteral<false>>;
+        }, z.core.$strict>>;
     }, z.core.$strict>;
     UiToastPreviewContribution: z.ZodObject<{
         rule: z.ZodString;
@@ -4741,8 +4747,13 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * types; callers use the resource surface instead. Previously admitted SDK contracts are no
  * longer served because they included app.memory on notebook hosts. No compatibility alias
  * restores it; callers migrate and declare ^0.49.0.
+ *
+ * 0.50.0 adds explicit cross-plugin endpoint calls on both backend targets. The URI-only 0.49.0
+ * contract remains served.
+ *
+ * 0.51.0 adds flag-dependent title, icon and panel presence on rail entries.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.51.0";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -6718,6 +6729,12 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         panel: z.ZodOptional<z.ZodObject<{
                             body: z.ZodString;
                         }, z.core.$strict>>;
+                        featureFlagVariant: z.ZodOptional<z.ZodObject<{
+                            flag: z.ZodString;
+                            title: z.ZodOptional<z.ZodString>;
+                            icon: z.ZodOptional<z.ZodString>;
+                            panel: z.ZodOptional<z.ZodLiteral<false>>;
+                        }, z.core.$strict>>;
                     }, z.core.$strict>>>;
                     toastPreviews: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         rule: z.ZodString;
@@ -7899,6 +7916,12 @@ export declare const KayUiTargetManifest: z.ZodObject<{
             panel: z.ZodOptional<z.ZodObject<{
                 body: z.ZodString;
             }, z.core.$strict>>;
+            featureFlagVariant: z.ZodOptional<z.ZodObject<{
+                flag: z.ZodString;
+                title: z.ZodOptional<z.ZodString>;
+                icon: z.ZodOptional<z.ZodString>;
+                panel: z.ZodOptional<z.ZodLiteral<false>>;
+            }, z.core.$strict>>;
         }, z.core.$strict>>>;
         toastPreviews: z.ZodOptional<z.ZodArray<z.ZodObject<{
             rule: z.ZodString;
@@ -8127,7 +8150,7 @@ export declare function parseSemver(value: string): ParsedSemver | undefined;
 export declare function parseWhere(source: string, keyTypes?: WhereKeyTypes): WhereParseResult;
 
 /** Every capability slug {@link PluginCapabilityClaimV1} can express, for exhaustive table checks. */
-export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "sessions.read", "signals.read", "uri.call", "skills.read", "skills.write", "skills.share", "plugins.set-enabled", "sessions.annotate", "sessions.compact", "soul.write", "tools.describe", "workspace.command", "sessions.create", "sessions.update", "models.complete", "systemOne.use", "automations.write", "automations.run", "workflows.define", "workflows.signals", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "knowledge-source.register", "artifacts.read", "session-artifacts.read", "session-artifacts.create", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "mcp.host-server", "prompt.resident", "skills.declared-source", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove", "model-selection.register", "system-prompt.register"];
+export declare const PLUGIN_CAPABILITY_SLUGS: readonly ["sessions.run", "network.connect", "web-session.request", "web-session.download", "process.spawn", "sessions.read", "signals.read", "uri.call", "endpoints.invoke", "skills.read", "skills.write", "skills.share", "plugins.set-enabled", "sessions.annotate", "sessions.compact", "soul.write", "tools.describe", "workspace.command", "sessions.create", "sessions.update", "models.complete", "systemOne.use", "automations.write", "automations.run", "workflows.define", "workflows.signals", "session-events.subscribe", "agents.run", "dynamic-context.register", "app-data.register", "knowledge-source.register", "artifacts.read", "session-artifacts.read", "session-artifacts.create", "account.assert", "account.update", "agents.permissions", "tool-interception.register", "interaction.surface", "config.declare-section", "auth.own-service", "auth.shared-identity", "cli.bind", "mcp.host-server", "prompt.resident", "skills.declared-source", "whiteboard.discover", "whiteboard.read", "whiteboard.create", "whiteboard.update", "whiteboard.remove", "model-selection.register", "system-prompt.register"];
 
 /** Diagnostic messages carry plugin-controlled text (parse errors, module errors); bound it so a
  *  hostile or accidental multi-megabyte error can never blow up a log line or a render surface. */
@@ -8692,6 +8715,13 @@ export declare const PluginCapabilityClaimInputV1: z.ZodCustom<{
         scheme: string;
         verb: "search" | "list" | "read" | "write" | "edit" | "delete";
     };
+} | {
+    target: "kay.agent" | "kay.app";
+    slug: "endpoints.invoke";
+    envelope: {
+        pluginId: string;
+        endpointId: string;
+    };
 } | {
     target: "kay.app";
     slug: "skills.read";
@@ -8952,6 +8982,13 @@ export declare const PluginCapabilityClaimInputV1: z.ZodCustom<{
         scheme: string;
         verb: "search" | "list" | "read" | "write" | "edit" | "delete";
     };
+} | {
+    target: "kay.agent" | "kay.app";
+    slug: "endpoints.invoke";
+    envelope: {
+        pluginId: string;
+        endpointId: string;
+    };
 } | {
     target: "kay.app";
     slug: "skills.read";
@@ -9218,6 +9255,16 @@ export declare const PluginCapabilityClaimV1: z.ZodDiscriminatedUnion<[z.ZodObje
             delete: "delete";
         }>;
     }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    target: z.ZodEnum<{
+        "kay.agent": "kay.agent";
+        "kay.app": "kay.app";
+    }>;
+    slug: z.ZodLiteral<"endpoints.invoke">;
+    envelope: z.ZodObject<{
+        pluginId: z.ZodString;
+        endpointId: z.ZodString;
+    }, z.core.$strict>;
 }, z.core.$strict>, z.ZodObject<{
     target: z.ZodLiteral<"kay.app">;
     slug: z.ZodLiteral<"skills.read">;
@@ -9530,6 +9577,16 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
                 delete: "delete";
             }>;
         }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodEnum<{
+            "kay.agent": "kay.agent";
+            "kay.app": "kay.app";
+        }>;
+        slug: z.ZodLiteral<"endpoints.invoke">;
+        envelope: z.ZodObject<{
+            pluginId: z.ZodString;
+            endpointId: z.ZodString;
+        }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"skills.read">;
@@ -9841,6 +9898,16 @@ export declare const PluginCapabilityDecisionV1: z.ZodDiscriminatedUnion<[z.ZodO
                     delete: "delete";
                 }>;
             }, z.core.$strict>;
+        }, z.core.$strict>, z.ZodObject<{
+            target: z.ZodEnum<{
+                "kay.agent": "kay.agent";
+                "kay.app": "kay.app";
+            }>;
+            slug: z.ZodLiteral<"endpoints.invoke">;
+            envelope: z.ZodObject<{
+                pluginId: z.ZodString;
+                endpointId: z.ZodString;
+            }, z.core.$strict>;
         }, z.core.$strict>, z.ZodObject<{
             target: z.ZodLiteral<"kay.app">;
             slug: z.ZodLiteral<"skills.read">;
@@ -10186,6 +10253,16 @@ export declare const PluginCapabilityRefusalV1: z.ZodObject<{
                 delete: "delete";
             }>;
         }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodEnum<{
+            "kay.agent": "kay.agent";
+            "kay.app": "kay.app";
+        }>;
+        slug: z.ZodLiteral<"endpoints.invoke">;
+        envelope: z.ZodObject<{
+            pluginId: z.ZodString;
+            endpointId: z.ZodString;
+        }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"skills.read">;
@@ -16015,6 +16092,12 @@ export declare const UiRailEntryContribution: z.ZodObject<{
     panel: z.ZodOptional<z.ZodObject<{
         body: z.ZodString;
     }, z.core.$strict>>;
+    featureFlagVariant: z.ZodOptional<z.ZodObject<{
+        flag: z.ZodString;
+        title: z.ZodOptional<z.ZodString>;
+        icon: z.ZodOptional<z.ZodString>;
+        panel: z.ZodOptional<z.ZodLiteral<false>>;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 
 export declare type UiRailEntryContribution = z.infer<typeof UiRailEntryContribution>;

package/dist/index.js

@@ -30,6 +30,12 @@ function declaredUiIconPaths(manifest) {
   const contributes = manifest.targets?.kay?.ui?.contributes;
   return [
     ...(contributes?.railEntries ?? []).flatMap((entry) => entry.icon === void 0 ? [] : [{ label: `kay.ui rail entry '${entry.id}' icon`, path: entry.icon }]),
+    ...(contributes?.railEntries ?? []).flatMap((entry) => entry.featureFlagVariant?.icon === void 0 ? [] : [
+      {
+        label: "kay.ui rail variant icon",
+        path: entry.featureFlagVariant.icon
+      }
+    ]),
     ...(contributes?.pages ?? []).flatMap((page) => page.icon === void 0 ? [] : [{ label: `kay.ui page '${page.id}' icon`, path: page.icon }]),
     ...(contributes?.commands ?? []).flatMap((command) => command.icon === void 0 ? [] : [
       {
@@ -260,8 +266,11 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.49.0";
-var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [];
+var KAY_PLUGIN_SDK_VERSION = "0.51.0";
+var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
+  "0.50.0",
+  "0.49.0"
+];
 var KAY_PLUGIN_TARGET_NAMES = [
   "kay.agent",
   "kay.app",
@@ -1741,6 +1750,7 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "sessions.read",
   "signals.read",
   "uri.call",
+  "endpoints.invoke",
   "skills.read",
   "skills.write",
   "skills.share",
@@ -1806,7 +1816,7 @@ var AGENT_PERMISSION_RULE_FIELDS = [
   "mode"
 ];
 function createAuthoritySchemas(canonical) {
-  const { ArtifactGenerationId: ArtifactGenerationId2, NonEmptyString: NonEmptyString3, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
+  const { ArtifactGenerationId: ArtifactGenerationId2, NonEmptyString: NonEmptyString3, UriScheme: UriScheme2, PluginId: PluginId2, LocalContributionId: LocalContributionId2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginAgentDefinitionPermissionRule: PluginAgentDefinitionPermissionRule2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const WhiteboardCapabilityScope2 = z10.enum(["own-types", "all-types"]);
   const WhiteboardCapabilityOperation2 = z10.enum([
@@ -1904,6 +1914,14 @@ function createAuthoritySchemas(canonical) {
         verb: z10.enum(["read", "list", "search", "write", "edit", "delete"])
       })
     }),
+    z10.strictObject({
+      target: z10.enum(["kay.agent", "kay.app"]),
+      slug: z10.literal("endpoints.invoke"),
+      envelope: z10.strictObject({
+        pluginId: PluginId2,
+        endpointId: LocalContributionId2
+      })
+    }),
     z10.strictObject({
       // Read every managed skill and its history: identity, versions, revisions, changes against
       // the source, past versions, suggestions. Never a write. An empty envelope because the
@@ -2274,6 +2292,8 @@ function sameClaim(a, b) {
       return true;
     case "uri.call":
       return b.slug === "uri.call" && a.envelope.scheme === b.envelope.scheme && a.envelope.verb === b.envelope.verb;
+    case "endpoints.invoke":
+      return b.slug === "endpoints.invoke" && a.envelope.pluginId === b.envelope.pluginId && a.envelope.endpointId === b.envelope.endpointId;
     case "network.connect":
       return b.slug === "network.connect" && a.envelope.connect === b.envelope.connect;
     case "web-session.request":
@@ -2364,6 +2384,11 @@ function envelopePairs(a, b) {
         [a.envelope.scheme, b.envelope.scheme],
         [a.envelope.verb, b.envelope.verb]
       ] : [];
+    case "endpoints.invoke":
+      return b.slug === "endpoints.invoke" ? [
+        [a.envelope.pluginId, b.envelope.pluginId],
+        [a.envelope.endpointId, b.envelope.endpointId]
+      ] : [];
     case "network.connect":
       return b.slug === "network.connect" ? [[a.envelope.connect, b.envelope.connect]] : [];
     case "web-session.request":
@@ -4236,6 +4261,7 @@ function createContributionsSchemas(canonical) {
     // Draws Bonsai's markdown document view in the app's page (`BonsaiMarkdownDocumentView`).
     // It reads and saves nothing: the app supplies the text and keeps the edits.
     "markdown.document-view",
+    "models.complete",
     // Draws links the host resolves and opens (`BonsaiReferencePill`, `BonsaiReferenceRow`,
     // `BonsaiReferenceMarkdown`). A person's click on one can open a session or another plugin's page.
     "references.open",
@@ -4311,7 +4337,13 @@ function createContributionsSchemas(canonical) {
     order: z12.number().finite().optional(),
     section: z12.enum(["primary", "plugins"]).optional(),
     badge: UiRailBadge.optional(),
-    panel: z12.strictObject({ body: LocalContributionId2 }).optional()
+    panel: z12.strictObject({ body: LocalContributionId2 }).optional(),
+    featureFlagVariant: z12.strictObject({
+      flag: NonEmptyString3,
+      title: NonEmptyString3.optional(),
+      icon: PackageAssetPath2.optional(),
+      panel: z12.literal(false).optional()
+    }).optional()
   });
   const UiToastPreviewContribution2 = z12.strictObject({
     rule: LocalContributionId2,
@@ -5177,13 +5209,6 @@ function createManifestSchemas(canonical) {
           message: `rail entry ${entry.id} counts ${entry.badge.source}, which is not one of this plugin's data sources with a rows store`
         });
       }
-      if (manifest.targets?.kay?.ui?.entrypoint === void 0) {
-        ctx.addIssue({
-          code: "custom",
-          path,
-          message: `rail entry ${entry.id} declares a badge, so its plugin needs a kay.ui entrypoint: the window starts a plugin's data sources when it loads that code`
-        });
-      }
     }
     for (const source of declaredAppDataSources) {
       if (materializedAppDataSources.has(source) || declaredAppDataStores.has(source))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.49.0",
+  "version": "0.51.0",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",