@yaklabs-ai/plugin-protocol 0.54.0 → 0.54.2

package/README.md

@@ -11,7 +11,7 @@ flow.
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.54.0"
+    "@bonsai/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.54.2"
   }
 }
 ```

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-protocol",
-  "version": "0.54.0",
+  "version": "0.54.2",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [

package/dist/index.d.ts

@@ -1801,6 +1801,7 @@ declare namespace authoringContributionSchemas {
         AppDataSourceContribution,
         WhiteboardTypeStorage,
         WhiteboardTypeContribution,
+        WorkingDocumentProviderContribution,
         AppDataMaterializerContribution,
         ArtifactUriModuleContribution,
         CliBindingContribution,
@@ -2770,6 +2771,23 @@ declare const canonicalContributionSchemas: {
         }, z.core.$strict>>;
         handover: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strict>;
+    WorkingDocumentProviderContribution: z.ZodObject<{
+        localId: z.ZodString;
+        displayName: z.ZodString;
+        schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        authService: z.ZodOptional<z.ZodString>;
+        authScheme: z.ZodOptional<z.ZodString>;
+        scopeRequirement: z.ZodOptional<z.ZodObject<{
+            purpose: z.ZodString;
+            alternatives: z.ZodArray<z.ZodObject<{
+                allOf: z.ZodArray<z.ZodObject<{
+                    scope: z.ZodString;
+                    reason: z.ZodExactOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
     AppDataMaterializerContribution: z.ZodObject<{
         source: z.ZodString;
     }, z.core.$strict>;
@@ -3305,7 +3323,10 @@ declare const canonicalContributionSchemas: {
             plugins: "plugins";
         }>>;
         badge: z.ZodOptional<z.ZodObject<{
-            source: z.ZodString;
+            source: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                pluginId: z.ZodString;
+                localId: z.ZodString;
+            }, z.core.$strict>]>;
             where: z.ZodOptional<z.ZodString>;
             label: z.ZodObject<{
                 one: z.ZodOptional<z.ZodString>;
@@ -3315,11 +3336,9 @@ declare const canonicalContributionSchemas: {
         panel: z.ZodOptional<z.ZodObject<{
             body: z.ZodString;
         }, z.core.$strict>>;
-        featureFlagVariant: z.ZodOptional<z.ZodObject<{
+        visibleWhen: z.ZodOptional<z.ZodObject<{
             flag: z.ZodString;
-            title: z.ZodOptional<z.ZodString>;
-            icon: z.ZodOptional<z.ZodString>;
-            panel: z.ZodOptional<z.ZodLiteral<false>>;
+            enabled: z.ZodBoolean;
         }, z.core.$strict>>;
     }, z.core.$strict>;
     UiToastPreviewContribution: z.ZodObject<{
@@ -3511,6 +3530,7 @@ declare const canonicalContributionSchemas: {
         eventSubscription: "eventSubscription";
         appDataSource: "appDataSource";
         whiteboardType: "whiteboardType";
+        workingDocumentProvider: "workingDocumentProvider";
         approvalType: "approvalType";
         workflow: "workflow";
         contextContributor: "contextContributor";
@@ -4893,8 +4913,16 @@ export declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * 0.54.0 adds named UI host grants for shared configuration/auth/account reads, retained connection
  * progress/dismissal and support. Built-in-only page capability scopes are removed; executable
  * pages declare capabilities on apps[].
+ *
+ * 0.54.1 adds manifest-declared plugin workers on both backend targets and exposes the canonical
+ * transcript placement and answer-stretch rules through the SDK.
+ *
+ * 0.54.2 lets a signal list the files that came with it (epic #15668). `PluginSignal` gains an
+ * optional `attachments`: each file's name, media type, size and the address its bytes are read
+ * from, never the bytes. Gmail lists a mail's attachments there, so Flows can file them. Additive:
+ * a plugin that publishes attachments declares ^0.54.2.
  */
-export declare const KAY_PLUGIN_SDK_VERSION: "0.54.0";
+export declare const KAY_PLUGIN_SDK_VERSION: "0.54.2";
 
 export declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -5570,6 +5598,23 @@ export declare const KayAppTargetManifest: z.ZodObject<{
             }, z.core.$strict>>;
             handover: z.ZodOptional<z.ZodLiteral<true>>;
         }, z.core.$strict>>>;
+        workingDocumentProviders: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            localId: z.ZodString;
+            displayName: z.ZodString;
+            schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            authService: z.ZodOptional<z.ZodString>;
+            authScheme: z.ZodOptional<z.ZodString>;
+            scopeRequirement: z.ZodOptional<z.ZodObject<{
+                purpose: z.ZodString;
+                alternatives: z.ZodArray<z.ZodObject<{
+                    allOf: z.ZodArray<z.ZodObject<{
+                        scope: z.ZodString;
+                        reason: z.ZodExactOptional<z.ZodString>;
+                    }, z.core.$strict>>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>>;
         approvalTypes: z.ZodOptional<z.ZodArray<z.ZodObject<{
             localId: z.ZodString;
             kind: z.ZodLiteral<"message">;
@@ -5844,6 +5889,10 @@ export declare const KayPluginManifestV1: z.ZodObject<{
     icon: z.ZodOptional<z.ZodString>;
     iconDark: z.ZodOptional<z.ZodString>;
     namespace: z.ZodOptional<z.ZodString>;
+    workers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        localId: z.ZodString;
+        module: z.ZodString;
+    }, z.core.$strict>>>;
     targets: z.ZodOptional<z.ZodObject<{
         kay: z.ZodOptional<z.ZodObject<{
             agent: z.ZodOptional<z.ZodObject<{
@@ -6501,6 +6550,23 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         }, z.core.$strict>>;
                         handover: z.ZodOptional<z.ZodLiteral<true>>;
                     }, z.core.$strict>>>;
+                    workingDocumentProviders: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                        localId: z.ZodString;
+                        displayName: z.ZodString;
+                        schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                        authService: z.ZodOptional<z.ZodString>;
+                        authScheme: z.ZodOptional<z.ZodString>;
+                        scopeRequirement: z.ZodOptional<z.ZodObject<{
+                            purpose: z.ZodString;
+                            alternatives: z.ZodArray<z.ZodObject<{
+                                allOf: z.ZodArray<z.ZodObject<{
+                                    scope: z.ZodString;
+                                    reason: z.ZodExactOptional<z.ZodString>;
+                                }, z.core.$strict>>;
+                            }, z.core.$strict>>;
+                        }, z.core.$strict>>;
+                    }, z.core.$strict>>>;
                     approvalTypes: z.ZodOptional<z.ZodArray<z.ZodObject<{
                         localId: z.ZodString;
                         kind: z.ZodLiteral<"message">;
@@ -6932,7 +6998,10 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                             plugins: "plugins";
                         }>>;
                         badge: z.ZodOptional<z.ZodObject<{
-                            source: z.ZodString;
+                            source: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                                pluginId: z.ZodString;
+                                localId: z.ZodString;
+                            }, z.core.$strict>]>;
                             where: z.ZodOptional<z.ZodString>;
                             label: z.ZodObject<{
                                 one: z.ZodOptional<z.ZodString>;
@@ -6942,11 +7011,9 @@ export declare const KayPluginManifestV1: z.ZodObject<{
                         panel: z.ZodOptional<z.ZodObject<{
                             body: z.ZodString;
                         }, z.core.$strict>>;
-                        featureFlagVariant: z.ZodOptional<z.ZodObject<{
+                        visibleWhen: z.ZodOptional<z.ZodObject<{
                             flag: z.ZodString;
-                            title: z.ZodOptional<z.ZodString>;
-                            icon: z.ZodOptional<z.ZodString>;
-                            panel: z.ZodOptional<z.ZodLiteral<false>>;
+                            enabled: z.ZodBoolean;
                         }, z.core.$strict>>;
                     }, z.core.$strict>>>;
                     toastPreviews: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -8301,7 +8368,10 @@ export declare const KayUiTargetManifest: z.ZodObject<{
                 plugins: "plugins";
             }>>;
             badge: z.ZodOptional<z.ZodObject<{
-                source: z.ZodString;
+                source: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+                    pluginId: z.ZodString;
+                    localId: z.ZodString;
+                }, z.core.$strict>]>;
                 where: z.ZodOptional<z.ZodString>;
                 label: z.ZodObject<{
                     one: z.ZodOptional<z.ZodString>;
@@ -8311,11 +8381,9 @@ export declare const KayUiTargetManifest: z.ZodObject<{
             panel: z.ZodOptional<z.ZodObject<{
                 body: z.ZodString;
             }, z.core.$strict>>;
-            featureFlagVariant: z.ZodOptional<z.ZodObject<{
+            visibleWhen: z.ZodOptional<z.ZodObject<{
                 flag: z.ZodString;
-                title: z.ZodOptional<z.ZodString>;
-                icon: z.ZodOptional<z.ZodString>;
-                panel: z.ZodOptional<z.ZodLiteral<false>>;
+                enabled: z.ZodBoolean;
             }, z.core.$strict>>;
         }, z.core.$strict>>>;
         toastPreviews: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -8663,6 +8731,15 @@ export declare const PLUGIN_NOTIFICATION_RULE_HOST_KEYS: readonly ["id", "match"
  */
 export declare const PLUGIN_PRODUCT_EVENT_NAME_PATTERN: RegExp;
 
+/** An attachment's file name, at most this many characters. */
+export declare const PLUGIN_SIGNAL_ATTACHMENT_NAME_MAX = 255;
+
+/** An attachment's media type (`application/pdf`), at most this many characters. */
+export declare const PLUGIN_SIGNAL_ATTACHMENT_TYPE_MAX = 127;
+
+/** At most this many entries in a signal's `attachments`; a source lists the first ones. */
+export declare const PLUGIN_SIGNAL_ATTACHMENTS_MAX = 10;
+
 /** The `kind` values of `PluginSignal` v1. `status` is system state that clears itself. */
 export declare const PLUGIN_SIGNAL_KINDS: readonly ["message", "request", "mention", "invite", "status"];
 
@@ -11376,6 +11453,7 @@ export declare const PluginContributionKind: z.ZodEnum<{
     eventSubscription: "eventSubscription";
     appDataSource: "appDataSource";
     whiteboardType: "whiteboardType";
+    workingDocumentProvider: "workingDocumentProvider";
     approvalType: "approvalType";
     workflow: "workflow";
     contextContributor: "contextContributor";
@@ -12405,6 +12483,12 @@ export declare const PluginSignal: z.ZodObject<{
         open: "open";
         resolved: "resolved";
     }>>;
+    attachments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodString;
+        size: z.ZodNumber;
+        uri: z.ZodString;
+    }, z.core.$strict>>>;
 }, z.core.$strict>;
 
 export declare type PluginSignal = z.infer<typeof PluginSignal>;
@@ -12449,6 +12533,12 @@ export declare const PluginSignalPublish: z.ZodObject<{
             open: "open";
             resolved: "resolved";
         }>>;
+        attachments: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            type: z.ZodString;
+            size: z.ZodNumber;
+            uri: z.ZodString;
+        }, z.core.$strict>>>;
     }, z.core.$strict>;
     related: z.ZodObject<{
         thread: z.ZodString;
@@ -13557,6 +13647,27 @@ export declare const ResolvedKayAppWorkflow: z.ZodObject<{
 
 export declare type ResolvedKayAppWorkflow = z.infer<typeof ResolvedKayAppWorkflow>;
 
+export declare const ResolvedKayAppWorkingDocumentProvider: z.ZodObject<{
+    localId: z.ZodString;
+    globalId: z.ZodString;
+    displayName: z.ZodString;
+    schemes: z.ZodArray<z.ZodString>;
+    hosts: z.ZodArray<z.ZodString>;
+    authServiceId: z.ZodOptional<z.ZodString>;
+    authSchemeId: z.ZodOptional<z.ZodString>;
+    scopeRequirement: z.ZodOptional<z.ZodObject<{
+        purpose: z.ZodString;
+        alternatives: z.ZodArray<z.ZodObject<{
+            allOf: z.ZodArray<z.ZodObject<{
+                scope: z.ZodString;
+                reason: z.ZodExactOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+
+export declare type ResolvedKayAppWorkingDocumentProvider = z.infer<typeof ResolvedKayAppWorkingDocumentProvider>;
+
 export declare const ResolvedKayUiApp: z.ZodObject<{
     localId: z.ZodString;
     globalId: z.ZodString;
@@ -14044,6 +14155,7 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
             eventSubscription: "eventSubscription";
             appDataSource: "appDataSource";
             whiteboardType: "whiteboardType";
+            workingDocumentProvider: "workingDocumentProvider";
             approvalType: "approvalType";
             workflow: "workflow";
             contextContributor: "contextContributor";
@@ -14063,6 +14175,10 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
     consumesAuthServices: z.ZodArray<z.ZodString>;
     explicitDependencies: z.ZodArray<z.ZodString>;
     dataDirSharedWith: z.ZodOptional<z.ZodString>;
+    workers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        localId: z.ZodString;
+        module: z.ZodString;
+    }, z.core.$strict>>>;
     workloadPurposes: z.ZodOptional<z.ZodArray<z.ZodObject<{
         purpose: z.ZodString;
         workloadClass: z.ZodEnum<{
@@ -15099,6 +15215,24 @@ export declare const ResolvedPluginContractV1: z.ZodObject<{
         handover: z.ZodOptional<z.ZodLiteral<true>>;
         globalId: z.ZodString;
     }, z.core.$strict>>>;
+    kayAppWorkingDocumentProviders: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        localId: z.ZodString;
+        globalId: z.ZodString;
+        displayName: z.ZodString;
+        schemes: z.ZodArray<z.ZodString>;
+        hosts: z.ZodArray<z.ZodString>;
+        authServiceId: z.ZodOptional<z.ZodString>;
+        authSchemeId: z.ZodOptional<z.ZodString>;
+        scopeRequirement: z.ZodOptional<z.ZodObject<{
+            purpose: z.ZodString;
+            alternatives: z.ZodArray<z.ZodObject<{
+                allOf: z.ZodArray<z.ZodObject<{
+                    scope: z.ZodString;
+                    reason: z.ZodExactOptional<z.ZodString>;
+                }, z.core.$strict>>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>>;
     kayAppMcpServers: z.ZodOptional<z.ZodArray<z.ZodObject<{
         name: z.ZodString;
         pluginId: z.ZodString;
@@ -15330,6 +15464,7 @@ export declare const ResolvedPluginContributionId: z.ZodObject<{
         eventSubscription: "eventSubscription";
         appDataSource: "appDataSource";
         whiteboardType: "whiteboardType";
+        workingDocumentProvider: "workingDocumentProvider";
         approvalType: "approvalType";
         workflow: "workflow";
         contextContributor: "contextContributor";
@@ -17398,7 +17533,10 @@ export declare const UiRailEntryContribution: z.ZodObject<{
         plugins: "plugins";
     }>>;
     badge: z.ZodOptional<z.ZodObject<{
-        source: z.ZodString;
+        source: z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+            pluginId: z.ZodString;
+            localId: z.ZodString;
+        }, z.core.$strict>]>;
         where: z.ZodOptional<z.ZodString>;
         label: z.ZodObject<{
             one: z.ZodOptional<z.ZodString>;
@@ -17408,11 +17546,9 @@ export declare const UiRailEntryContribution: z.ZodObject<{
     panel: z.ZodOptional<z.ZodObject<{
         body: z.ZodString;
     }, z.core.$strict>>;
-    featureFlagVariant: z.ZodOptional<z.ZodObject<{
+    visibleWhen: z.ZodOptional<z.ZodObject<{
         flag: z.ZodString;
-        title: z.ZodOptional<z.ZodString>;
-        icon: z.ZodOptional<z.ZodString>;
-        panel: z.ZodOptional<z.ZodLiteral<false>>;
+        enabled: z.ZodBoolean;
     }, z.core.$strict>>;
 }, z.core.$strict>;
 
@@ -18175,4 +18311,24 @@ export declare const WorkflowContribution: z.ZodObject<{
 
 export declare type WorkflowContribution = z.infer<typeof WorkflowContribution>;
 
+export declare const WorkingDocumentProviderContribution: z.ZodObject<{
+    localId: z.ZodString;
+    displayName: z.ZodString;
+    schemes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    authService: z.ZodOptional<z.ZodString>;
+    authScheme: z.ZodOptional<z.ZodString>;
+    scopeRequirement: z.ZodOptional<z.ZodObject<{
+        purpose: z.ZodString;
+        alternatives: z.ZodArray<z.ZodObject<{
+            allOf: z.ZodArray<z.ZodObject<{
+                scope: z.ZodString;
+                reason: z.ZodExactOptional<z.ZodString>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+
+export declare type WorkingDocumentProviderContribution = z.infer<typeof WorkingDocumentProviderContribution>;
+
 export { }

package/dist/index.js

@@ -30,12 +30,6 @@ function declaredUiIconPaths(manifest) {
   const contributes = manifest.targets?.kay?.ui?.contributes;
   return [
     ...(contributes?.railEntries ?? []).flatMap((entry) => entry.icon === void 0 ? [] : [{ label: `kay.ui rail entry '${entry.id}' icon`, path: entry.icon }]),
-    ...(contributes?.railEntries ?? []).flatMap((entry) => entry.featureFlagVariant?.icon === void 0 ? [] : [
-      {
-        label: "kay.ui rail variant icon",
-        path: entry.featureFlagVariant.icon
-      }
-    ]),
     ...(contributes?.pages ?? []).flatMap((page) => page.icon === void 0 ? [] : [{ label: `kay.ui page '${page.id}' icon`, path: page.icon }]),
     ...(contributes?.commands ?? []).flatMap((command) => command.icon === void 0 ? [] : [
       {
@@ -266,8 +260,10 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.54.0";
+var KAY_PLUGIN_SDK_VERSION = "0.54.2";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
+  "0.54.1",
+  "0.54.0",
   "0.53.0",
   "0.52.1",
   "0.52.0",
@@ -2939,6 +2935,7 @@ __export(contributions_exports, {
   WhiteboardTypeContribution: () => WhiteboardTypeContribution,
   WhiteboardTypeStorage: () => WhiteboardTypeStorage,
   WorkflowContribution: () => WorkflowContribution,
+  WorkingDocumentProviderContribution: () => WorkingDocumentProviderContribution,
   canonicalContributionSchemas: () => canonicalContributionSchemas,
   isUiAppSourceModule: () => isUiAppSourceModule,
   uiAppSourceStylePath: () => uiAppSourceStylePath
@@ -2950,6 +2947,9 @@ var plugin_events_exports = {};
 __export(plugin_events_exports, {
   PLUGIN_EVENT_ID_MAX_BYTES: () => PLUGIN_EVENT_ID_MAX_BYTES,
   PLUGIN_EVENT_REFUSED_ERROR_NAME: () => PLUGIN_EVENT_REFUSED_ERROR_NAME,
+  PLUGIN_SIGNAL_ATTACHMENTS_MAX: () => PLUGIN_SIGNAL_ATTACHMENTS_MAX,
+  PLUGIN_SIGNAL_ATTACHMENT_NAME_MAX: () => PLUGIN_SIGNAL_ATTACHMENT_NAME_MAX,
+  PLUGIN_SIGNAL_ATTACHMENT_TYPE_MAX: () => PLUGIN_SIGNAL_ATTACHMENT_TYPE_MAX,
   PLUGIN_SIGNAL_KINDS: () => PLUGIN_SIGNAL_KINDS,
   PLUGIN_SIGNAL_LABELS_MAX: () => PLUGIN_SIGNAL_LABELS_MAX,
   PLUGIN_SIGNAL_LABEL_MAX: () => PLUGIN_SIGNAL_LABEL_MAX,
@@ -2985,6 +2985,9 @@ var PLUGIN_SIGNAL_TITLE_MAX = 300;
 var PLUGIN_SIGNAL_SNIPPET_MAX = 500;
 var PLUGIN_SIGNAL_LABELS_MAX = 20;
 var PLUGIN_SIGNAL_LABEL_MAX = 64;
+var PLUGIN_SIGNAL_ATTACHMENTS_MAX = 10;
+var PLUGIN_SIGNAL_ATTACHMENT_NAME_MAX = 255;
+var PLUGIN_SIGNAL_ATTACHMENT_TYPE_MAX = 127;
 var PLUGIN_SIGNAL_RELATED_KEYS = [
   "thread",
   "from",
@@ -3056,7 +3059,19 @@ function createPluginEventsSchemas(canonical) {
     addressed: z12.enum(["direct", "cc", "mention", "group", "none"]).optional(),
     labels: z12.array(z12.string().min(1).max(PLUGIN_SIGNAL_LABEL_MAX)).max(PLUGIN_SIGNAL_LABELS_MAX).optional(),
     dueAt: PluginEventTimestamp2.optional(),
-    state: z12.enum(["open", "resolved"]).optional()
+    state: z12.enum(["open", "resolved"]).optional(),
+    /**
+     * Files that came with the item, such as a mail's attachments: each one's name, media type,
+     * size in bytes, and the address its bytes are read from. Never the bytes themselves. A
+     * source leaves out what it knows is not a document of the person's (a mail's inline
+     * signature image), and lists at most `PLUGIN_SIGNAL_ATTACHMENTS_MAX`.
+     */
+    attachments: z12.array(z12.strictObject({
+      name: z12.string().min(1).max(PLUGIN_SIGNAL_ATTACHMENT_NAME_MAX),
+      type: z12.string().min(1).max(PLUGIN_SIGNAL_ATTACHMENT_TYPE_MAX),
+      size: z12.number().int().nonnegative(),
+      uri: PluginEventUri2
+    })).max(PLUGIN_SIGNAL_ATTACHMENTS_MAX).optional()
   }).refine((signal) => signal.state === void 0 || signal.kind === "status", {
     message: "state is only for a status signal",
     path: ["state"]
@@ -3891,6 +3906,42 @@ function createContributionsSchemas(canonical) {
       });
     }
   });
+  const WorkingDocumentProviderContribution2 = z14.strictObject({
+    localId: LocalContributionId2,
+    /** What it pulls, as a short noun phrase for copy: `a Google Doc`. */
+    displayName: NonEmptyString3,
+    /** URI schemes it claims (`gdrive`), compared without case. */
+    schemes: z14.array(UriScheme2).min(1).optional(),
+    /** Web hosts it claims (`docs.google.com`), compared without case. */
+    hosts: z14.array(NonEmptyString3).min(1).optional(),
+    /** The sign-in its token comes from, as on a URI module. */
+    authService: AuthServiceReference2.optional(),
+    /** The scheme of `authService` every call uses, as on a URI module. */
+    authScheme: AuthSchemeReference2.optional(),
+    /** What a stored grant must carry; absent means any credential of the scheme. */
+    scopeRequirement: ScopeRequirement2.optional()
+  }).superRefine((provider, ctx) => {
+    if (provider.schemes === void 0 && provider.hosts === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        message: "A working-document provider must claim a scheme or a host."
+      });
+    }
+    if (provider.authService === void 0 !== (provider.authScheme === void 0)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["authScheme"],
+        message: "authService and authScheme are declared together."
+      });
+    }
+    if (provider.scopeRequirement !== void 0 && provider.authService === void 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["scopeRequirement"],
+        message: "A scope requirement needs an authService."
+      });
+    }
+  });
   const WhiteboardTypeStorage2 = z14.discriminatedUnion("kind", [
     z14.strictObject({ kind: z14.literal("json") }),
     z14.strictObject({ kind: z14.literal("payload") }),
@@ -4520,7 +4571,7 @@ function createContributionsSchemas(canonical) {
     }
   });
   const UiRailBadge = z14.strictObject({
-    source: LocalContributionId2,
+    source: UiAppCapabilityReference2,
     where: NonEmptyString3.optional(),
     label: z14.strictObject({
       one: NonEmptyString3.optional(),
@@ -4549,12 +4600,7 @@ function createContributionsSchemas(canonical) {
     section: z14.enum(["primary", "plugins"]).optional(),
     badge: UiRailBadge.optional(),
     panel: z14.strictObject({ body: LocalContributionId2 }).optional(),
-    featureFlagVariant: z14.strictObject({
-      flag: NonEmptyString3,
-      title: NonEmptyString3.optional(),
-      icon: PackageAssetPath2.optional(),
-      panel: z14.literal(false).optional()
-    }).optional()
+    visibleWhen: z14.strictObject({ flag: NonEmptyString3, enabled: z14.boolean() }).optional()
   });
   const UiToastPreviewContribution2 = z14.strictObject({
     rule: LocalContributionId2,
@@ -4642,6 +4688,7 @@ function createContributionsSchemas(canonical) {
     "eventSubscription",
     "appDataSource",
     "whiteboardType",
+    "workingDocumentProvider",
     "approvalType",
     "workflow",
     "contextContributor",
@@ -4672,6 +4719,7 @@ function createContributionsSchemas(canonical) {
     AppDataSourceContribution: AppDataSourceContribution2,
     WhiteboardTypeStorage: WhiteboardTypeStorage2,
     WhiteboardTypeContribution: WhiteboardTypeContribution2,
+    WorkingDocumentProviderContribution: WorkingDocumentProviderContribution2,
     AppDataMaterializerContribution: AppDataMaterializerContribution2,
     ArtifactUriModuleContribution: ArtifactUriModuleContribution2,
     CliBindingContribution: CliBindingContribution2,
@@ -4723,7 +4771,7 @@ function createContributionsSchemas(canonical) {
     PluginContributionKind: PluginContributionKind2
   };
 }
-var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, PluginCardContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, PluginProductEventContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationAccountLinks, ReferencePresentationWords, ReferencePresentationContribution, KayUiAppHostCapability, UiAppCapabilityReference, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
+var { ApprovalCardForm, ApprovalCardStoredForm, ApprovalTypeContribution, UriModuleFacts, ToolContribution, ToolPermission, AgentToolContribution, ConverterContribution, UriModuleContribution, AppUriModuleContribution, AppDataSourceContribution, WhiteboardTypeStorage, WhiteboardTypeContribution, WorkingDocumentProviderContribution, AppDataMaterializerContribution, ArtifactUriModuleContribution, CliBindingContribution, GitHostContribution, ResourceContribution, SkillContribution, PluginSkillSourceDeclaration, SearchProviderContribution, InteractionDriverContribution, EntityResolverContribution, AgentRenderContribution, EndpointContribution, PluginCardContribution, WorkflowContribution, McpServerUrl, McpServerAuthMode, McpServerContribution, McpServerContributions, AppEventSubscription, ContextContributorContribution, PluginEventDefinitionContribution, PluginNotificationRuleContribution, PluginProductEventContribution, UiEventSubscriptionContribution, DeviceDelegationContribution, SessionReaderContribution, UiCommandContribution, UiSlotContribution, ReferenceOpenBehavior, ReferencePresentationVariant, ReferencePresentationVariants, ReferencePresentationUriPattern, ReferencePresentationUrlClaim, ReferencePresentationTooltip, ReferencePresentationAddress, ReferencePresentationAccountLinks, ReferencePresentationWords, ReferencePresentationContribution, KayUiAppHostCapability, UiAppCapabilityReference, UiAppCapabilities, UiRailEntryContribution, UiToastPreviewContribution, UiPageContribution, UiAppContribution, ThemeContribution, CommandHandler, CommandContribution, PluginContributionKind } = createContributionsSchemas(false);
 var canonicalContributionSchemas = createContributionsSchemas(true);
 var UI_APP_SOURCE_MODULE = /\.(?:tsx|ts|jsx)$/;
 function isUiAppSourceModule(module) {
@@ -4878,7 +4926,7 @@ var KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS = [
 var KAY_UI_NATIVE_EVENT_ALLOWLIST = new Set(KAY_UI_NATIVE_EVENT_SUBSCRIPTIONS);
 var RETIRED_COMPATIBILITY_KEYS = ["policy"];
 function createManifestSchemas(canonical) {
-  const { AgentRenderContribution: AgentRenderContribution2, ApprovalTypeContribution: ApprovalTypeContribution2, WorkflowContribution: WorkflowContribution2, PluginCardContribution: PluginCardContribution2, AppDataMaterializerContribution: AppDataMaterializerContribution2, AppDataSourceContribution: AppDataSourceContribution2, AppUriModuleContribution: AppUriModuleContribution2, AppEventSubscription: AppEventSubscription2, ArtifactUriModuleContribution: ArtifactUriModuleContribution2, CliBindingContribution: CliBindingContribution2, CommandContribution: CommandContribution2, ContextContributorContribution: ContextContributorContribution2, ConverterContribution: ConverterContribution2, SessionReaderContribution: SessionReaderContribution2, DeviceDelegationContribution: DeviceDelegationContribution2, EndpointContribution: EndpointContribution2, EntityResolverContribution: EntityResolverContribution2, GitHostContribution: GitHostContribution2, McpServerContributions: McpServerContributions2, PluginEventDefinitionContribution: PluginEventDefinitionContribution2, PluginNotificationRuleContribution: PluginNotificationRuleContribution2, PluginProductEventContribution: PluginProductEventContribution2, ResourceContribution: ResourceContribution2, ReferencePresentationContribution: ReferencePresentationContribution2, PluginSkillSourceDeclaration: PluginSkillSourceDeclaration2, InteractionDriverContribution: InteractionDriverContribution2, SearchProviderContribution: SearchProviderContribution2, SkillContribution: SkillContribution2, ThemeContribution: ThemeContribution2, AgentToolContribution: AgentToolContribution2, ToolContribution: ToolContribution2, UiCommandContribution: UiCommandContribution2, UiAppContribution: UiAppContribution2, UiRailEntryContribution: UiRailEntryContribution2, UiToastPreviewContribution: UiToastPreviewContribution2, UiPageContribution: UiPageContribution2, UiEventSubscriptionContribution: UiEventSubscriptionContribution2, UiSlotContribution: UiSlotContribution2, UriModuleContribution: UriModuleContribution2, WhiteboardTypeContribution: WhiteboardTypeContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
+  const { AgentRenderContribution: AgentRenderContribution2, ApprovalTypeContribution: ApprovalTypeContribution2, WorkflowContribution: WorkflowContribution2, PluginCardContribution: PluginCardContribution2, AppDataMaterializerContribution: AppDataMaterializerContribution2, AppDataSourceContribution: AppDataSourceContribution2, AppUriModuleContribution: AppUriModuleContribution2, AppEventSubscription: AppEventSubscription2, ArtifactUriModuleContribution: ArtifactUriModuleContribution2, CliBindingContribution: CliBindingContribution2, CommandContribution: CommandContribution2, ContextContributorContribution: ContextContributorContribution2, ConverterContribution: ConverterContribution2, SessionReaderContribution: SessionReaderContribution2, DeviceDelegationContribution: DeviceDelegationContribution2, EndpointContribution: EndpointContribution2, EntityResolverContribution: EntityResolverContribution2, GitHostContribution: GitHostContribution2, McpServerContributions: McpServerContributions2, PluginEventDefinitionContribution: PluginEventDefinitionContribution2, PluginNotificationRuleContribution: PluginNotificationRuleContribution2, PluginProductEventContribution: PluginProductEventContribution2, ResourceContribution: ResourceContribution2, ReferencePresentationContribution: ReferencePresentationContribution2, PluginSkillSourceDeclaration: PluginSkillSourceDeclaration2, InteractionDriverContribution: InteractionDriverContribution2, SearchProviderContribution: SearchProviderContribution2, SkillContribution: SkillContribution2, ThemeContribution: ThemeContribution2, AgentToolContribution: AgentToolContribution2, ToolContribution: ToolContribution2, UiCommandContribution: UiCommandContribution2, UiAppContribution: UiAppContribution2, UiRailEntryContribution: UiRailEntryContribution2, UiToastPreviewContribution: UiToastPreviewContribution2, UiPageContribution: UiPageContribution2, UiEventSubscriptionContribution: UiEventSubscriptionContribution2, UiSlotContribution: UiSlotContribution2, UriModuleContribution: UriModuleContribution2, WhiteboardTypeContribution: WhiteboardTypeContribution2, WorkingDocumentProviderContribution: WorkingDocumentProviderContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginPermissionManifest: PluginPermissionManifest2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const KayAgentTargetManifest2 = z18.strictObject({
@@ -4973,6 +5021,8 @@ function createManifestSchemas(canonical) {
       uriModules: z18.array(AppUriModuleContribution2).optional(),
       dataSources: z18.array(AppDataSourceContribution2).optional(),
       whiteboardTypes: z18.array(WhiteboardTypeContribution2).optional(),
+      // Document sources whose pull, push and revision check the app entrypoint registers.
+      workingDocumentProviders: z18.array(WorkingDocumentProviderContribution2).optional(),
       approvalTypes: z18.array(ApprovalTypeContribution2).optional(),
       workflows: z18.array(WorkflowContribution2).optional(),
       eventDefinitions: z18.array(PluginEventDefinitionContribution2).optional(),
@@ -5356,6 +5406,10 @@ function createManifestSchemas(canonical) {
     icon: PackageAssetPath2.optional(),
     iconDark: PackageAssetPath2.optional(),
     namespace: PluginNamespace2.optional(),
+    workers: z18.array(z18.strictObject({
+      localId: LocalContributionId2,
+      module: PackageAssetPath2
+    })).optional(),
     targets: z18.strictObject({
       kay: z18.strictObject({
         agent: KayAgentTargetManifest2.optional(),
@@ -5388,6 +5442,7 @@ function createManifestSchemas(canonical) {
       plugins: z18.array(PluginId2).optional()
     }).optional()
   }).superRefine((manifest, ctx) => {
+    reportDuplicateLocalIds(ctx, ["workers"], manifest.workers, "worker");
     const sharedWith = manifest.storage?.dataDir?.sharedWith;
     if (sharedWith !== void 0 && (!manifest.storage?.dataDir?.enabled || sharedWith === manifest.id || !manifest.dependencies?.plugins?.includes(sharedWith))) {
       ctx.addIssue({
@@ -5552,7 +5607,7 @@ function createManifestSchemas(canonical) {
         index,
         "badge"
       ];
-      if (!declaredRowsStores.has(entry.badge.source)) {
+      if (typeof entry.badge.source === "string" && !declaredRowsStores.has(entry.badge.source)) {
         ctx.addIssue({
           code: "custom",
           path: [...path, "source"],
@@ -5570,6 +5625,34 @@ function createManifestSchemas(canonical) {
       });
     }
     reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "whiteboardTypes"], manifest.targets?.kay?.app?.contributes?.whiteboardTypes, "Whiteboard type");
+    reportDuplicateLocalIds(ctx, ["targets", "kay", "app", "contributes", "workingDocumentProviders"], manifest.targets?.kay?.app?.contributes?.workingDocumentProviders, "Working-document provider");
+    for (const [index, provider] of (manifest.targets?.kay?.app?.contributes?.workingDocumentProviders ?? []).entries()) {
+      const path = [
+        "targets",
+        "kay",
+        "app",
+        "contributes",
+        "workingDocumentProviders",
+        index
+      ];
+      if (manifest.targets?.kay?.app?.entrypoint === void 0) {
+        ctx.addIssue({
+          code: "custom",
+          path,
+          message: `working-document provider ${provider.localId} needs a kay.app entrypoint to implement it`
+        });
+      }
+      if (provider.authService === void 0)
+        continue;
+      const granted = manifest.permissions?.byTarget["kay.app"]?.auth?.some((grant) => grant.service === provider.authService && grant.operations.includes("resolve"));
+      if (granted !== true) {
+        ctx.addIssue({
+          code: "custom",
+          path: [...path, "authService"],
+          message: `working-document provider ${provider.localId} needs a kay.app auth grant that resolves ${provider.authService}`
+        });
+      }
+    }
     const uiAppIds = new Set(manifest.targets?.kay?.ui?.contributes?.apps?.map((app) => app.localId) ?? []);
     for (const [index, entry] of (manifest.targets?.kay?.ui?.contributes?.railEntries ?? []).entries()) {
       const body = entry.panel?.body;
@@ -6545,6 +6628,7 @@ function collectKayAppContributionIds(manifest) {
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "uriModules"], contributes?.uriModules);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "dataSources"], contributes?.dataSources);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "whiteboardTypes"], contributes?.whiteboardTypes);
+  pushContributionIds(output, ["targets", "kay", "app", "contributes", "workingDocumentProviders"], contributes?.workingDocumentProviders);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "eventDefinitions"], contributes?.eventDefinitions);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "eventSubscriptions"], contributes?.eventSubscriptions);
   pushContributionIds(output, ["targets", "kay", "app", "contributes", "deviceDelegations"], contributes?.deviceDelegations);
@@ -6615,7 +6699,7 @@ function createResolvedContractSchemas(canonical) {
   const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAccountLinks: ReferencePresentationAccountLinks2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, ReferencePresentationWords: ReferencePresentationWords2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeContribution: WhiteboardTypeContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, GlobalContributionId: GlobalContributionId2, HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, PluginToolName: PluginToolName2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginExternalCliConnect: PluginExternalCliConnect2, PluginOAuthClientSupplier: PluginOAuthClientSupplier2 } = canonical ? canonicalManifestSchemas : manifest_exports;
-  const { ResolvedPluginGrants: ResolvedPluginGrants2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
+  const { ResolvedPluginGrants: ResolvedPluginGrants2, ScopeRequirement: ScopeRequirement2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
   const ResolvedPluginContributionId2 = z19.strictObject({
     target: PluginTargetName,
     kind: PluginContributionKindSchema,
@@ -6736,6 +6820,16 @@ function createResolvedContractSchemas(canonical) {
     auth: McpServerAuthMode2,
     authServiceId: GlobalContributionId2.optional()
   });
+  const ResolvedKayAppWorkingDocumentProvider2 = z19.strictObject({
+    localId: LocalContributionId2,
+    globalId: GlobalContributionId2,
+    displayName: NonEmptyString3,
+    schemes: z19.array(UriScheme2),
+    hosts: z19.array(NonEmptyString3),
+    authServiceId: GlobalContributionId2.optional(),
+    authSchemeId: GlobalContributionId2.optional(),
+    scopeRequirement: ScopeRequirement2.optional()
+  });
   const ResolvedKayAgentUriModule2 = z19.strictObject({
     localId: LocalContributionId2,
     adapterId: z19.string().min(1).optional(),
@@ -6972,6 +7066,10 @@ function createResolvedContractSchemas(canonical) {
     // full dependency graph together with auth-inferred edges from `consumesAuthServices`.
     explicitDependencies: z19.array(PluginId2),
     dataDirSharedWith: PluginId2.optional(),
+    workers: z19.array(z19.strictObject({
+      localId: LocalContributionId2,
+      module: PackageAssetPath2
+    })).optional(),
     workloadPurposes: z19.array(PluginWorkloadPurpose).optional(),
     shellCommands: z19.array(PluginShellCommand.omit({ endpoint: true }).extend({
       endpointId: GlobalContributionId2
@@ -6995,6 +7093,7 @@ function createResolvedContractSchemas(canonical) {
     kayAppCards: z19.array(ResolvedPluginCard2).optional(),
     kayAppDataSources: z19.array(ResolvedKayAppDataSource2).optional(),
     kayAppWhiteboardTypes: z19.array(ResolvedKayAppWhiteboardType2).optional(),
+    kayAppWorkingDocumentProviders: z19.array(ResolvedKayAppWorkingDocumentProvider2).optional(),
     kayAppMcpServers: z19.array(ResolvedKayAppMcpServer2).optional(),
     kayAgentConverters: z19.array(ResolvedKayAgentConverter2).optional(),
     referencePresentations: z19.array(ResolvedReferencePresentation2).optional(),
@@ -7009,6 +7108,7 @@ function createResolvedContractSchemas(canonical) {
     ResolvedPluginCard: ResolvedPluginCard2,
     ResolvedKayAppDataSource: ResolvedKayAppDataSource2,
     ResolvedKayAppWhiteboardType: ResolvedKayAppWhiteboardType2,
+    ResolvedKayAppWorkingDocumentProvider: ResolvedKayAppWorkingDocumentProvider2,
     ResolvedKayAppMcpServer: ResolvedKayAppMcpServer2,
     ResolvedKayAgentUriModule: ResolvedKayAgentUriModule2,
     ResolvedKayAgentArtifactUriModule: ResolvedKayAgentArtifactUriModule2,
@@ -7025,7 +7125,7 @@ function createResolvedContractSchemas(canonical) {
     ResolvedPluginContractV1: ResolvedPluginContractV12
   };
 }
-var { ResolvedKayAppApprovalType, ResolvedKayAppWorkflow, ResolvedPluginCard, ResolvedPluginContributionId, ResolvedKayAgentTool, ResolvedKayAppTool, ResolvedKayAppDataSource, ResolvedKayAppWhiteboardType, ResolvedKayAppMcpServer, ResolvedKayAgentUriModule, ResolvedKayAgentArtifactUriModule, ResolvedKayAgentEntityResolver, ResolvedKayAgentGitHostClaim, ResolvedKayAgentConverter, ResolvedReferencePresentation, ResolvedPluginProvisioningRequirement, ResolvedPluginAuthScheme, ResolvedPluginWebSession, ResolvedPluginAuthService, ResolvedKayUiAppEndpointCapability, ResolvedKayUiApp, ResolvedPluginContractV1 } = createResolvedContractSchemas(false);
+var { ResolvedKayAppApprovalType, ResolvedKayAppWorkflow, ResolvedPluginCard, ResolvedPluginContributionId, ResolvedKayAgentTool, ResolvedKayAppTool, ResolvedKayAppDataSource, ResolvedKayAppWhiteboardType, ResolvedKayAppWorkingDocumentProvider, ResolvedKayAppMcpServer, ResolvedKayAgentUriModule, ResolvedKayAgentArtifactUriModule, ResolvedKayAgentEntityResolver, ResolvedKayAgentGitHostClaim, ResolvedKayAgentConverter, ResolvedReferencePresentation, ResolvedPluginProvisioningRequirement, ResolvedPluginAuthScheme, ResolvedPluginWebSession, ResolvedPluginAuthService, ResolvedKayUiAppEndpointCapability, ResolvedKayUiApp, ResolvedPluginContractV1 } = createResolvedContractSchemas(false);
 var canonicalResolvedContractSchemas = createResolvedContractSchemas(true);
 function narrowestAccountSelectors() {
   return [{ kind: "active" }];
@@ -7065,6 +7165,7 @@ function collectContributionSources(manifest) {
   pushAll(output, "kay.app", "uriModule", app?.uriModules);
   pushAll(output, "kay.app", "appDataSource", app?.dataSources);
   pushAll(output, "kay.app", "whiteboardType", app?.whiteboardTypes);
+  pushAll(output, "kay.app", "workingDocumentProvider", app?.workingDocumentProviders);
   pushAll(output, "kay.app", "approvalType", app?.approvalTypes);
   pushAll(output, "kay.app", "workflow", app?.workflows);
   pushAll(output, "kay.app", "command", app?.commands);
@@ -7166,6 +7267,9 @@ function collectConsumedAuthServiceIds(manifest) {
   for (const card of manifest.targets?.kay?.app?.contributes?.cards ?? []) {
     add(card.authService);
   }
+  for (const provider of manifest.targets?.kay?.app?.contributes?.workingDocumentProviders ?? []) {
+    add(provider.authService);
+  }
   for (const target of KAY_PLUGIN_TARGET_NAMES) {
     for (const grant of manifest.permissions?.byTarget[target]?.auth ?? []) {
       add(grant.service);
@@ -7418,6 +7522,20 @@ function resolveKayPluginContractV1(manifest) {
     ...type.reference === void 0 ? {} : { reference: type.reference },
     ...type.handover === void 0 ? {} : { handover: type.handover }
   }));
+  const kayAppWorkingDocumentProviders = manifest.targets?.kay?.app?.contributes?.workingDocumentProviders?.map((provider) => ({
+    localId: provider.localId,
+    globalId: resolveGlobalContributionId(namespace, provider.localId),
+    displayName: provider.displayName,
+    schemes: (provider.schemes ?? []).map((scheme) => scheme.toLowerCase()),
+    hosts: (provider.hosts ?? []).map((host) => host.toLowerCase()),
+    ...provider.authService === void 0 ? {} : {
+      authServiceId: isQualifiedAuthServiceRef(provider.authService) ? provider.authService : resolveGlobalContributionId(namespace, provider.authService)
+    },
+    ...provider.authScheme === void 0 ? {} : {
+      authSchemeId: isQualifiedAuthSchemeRef(provider.authScheme) ? provider.authScheme : resolveGlobalContributionId(namespace, provider.authScheme)
+    },
+    ...provider.scopeRequirement === void 0 ? {} : { scopeRequirement: provider.scopeRequirement }
+  }));
   const kayAppMcpServers = Object.entries(manifest.targets?.kay?.app?.contributes?.mcpServers ?? {}).map(([name, server]) => ({
     name,
     pluginId: manifest.id,
@@ -7538,6 +7656,7 @@ function resolveKayPluginContractV1(manifest) {
       ...manifest.dependencies?.plugins ?? []
     ],
     authServices,
+    ...manifest.workers === void 0 ? {} : { workers: manifest.workers },
     ...manifest.storage?.dataDir?.sharedWith === void 0 ? {} : { dataDirSharedWith: manifest.storage.dataDir.sharedWith },
     ...manifest.workloadPurposes === void 0 ? {} : { workloadPurposes: manifest.workloadPurposes },
     ...manifest.shellCommands === void 0 ? {} : {
@@ -7565,6 +7684,7 @@ function resolveKayPluginContractV1(manifest) {
     ...kayAppWorkflows && kayAppWorkflows.length > 0 ? { kayAppWorkflows } : {},
     ...kayAppDataSources && kayAppDataSources.length > 0 ? { kayAppDataSources } : {},
     ...kayAppWhiteboardTypes && kayAppWhiteboardTypes.length > 0 ? { kayAppWhiteboardTypes } : {},
+    ...kayAppWorkingDocumentProviders && kayAppWorkingDocumentProviders.length > 0 ? { kayAppWorkingDocumentProviders } : {},
     ...kayAppMcpServers.length > 0 ? { kayAppMcpServers } : {},
     ...kayAgentConverters && kayAgentConverters.length > 0 ? { kayAgentConverters } : {},
     ...referencePresentations && referencePresentations.length > 0 ? { referencePresentations } : {},
@@ -7714,6 +7834,17 @@ async function judgeKayPluginDirectory(input) {
       return refuse("contract-resolve", "path-escapes-plugin-dir", `${reference.label} path '${reference.path}' resolves outside the plugin directory (no symlink escapes, no traversal)`);
     }
   }
+  for (const worker of manifest.workers ?? []) {
+    let entry;
+    try {
+      entry = await tree.entry(worker.module);
+    } catch {
+      return refuse("contract-resolve", "invalid-worker-module", "A declared worker module could not be inspected.");
+    }
+    if (entry?.kind !== "file") {
+      return refuse("contract-resolve", "invalid-worker-module", `worker '${worker.localId}' must name an existing regular file`);
+    }
+  }
   return {
     outcome: "loads",
     hostSdkVersion,
@@ -7789,7 +7920,10 @@ function namedIn(head) {
   return head.displayName === void 0 ? head.id : `${head.displayName} (${head.id})`;
 }
 function referencedPaths(manifest) {
-  const refs = [];
+  const refs = (manifest.workers ?? []).map((worker) => ({
+    label: `worker '${worker.localId}'`,
+    path: worker.module
+  }));
   const kayAgent = manifest.targets?.kay?.agent;
   if (kayAgent !== void 0) {
     refs.push({
@@ -8432,6 +8566,9 @@ export {
   PLUGIN_ICON_SHAPE_ATTRIBUTE,
   PLUGIN_NOTIFICATION_RULE_HOST_KEYS,
   PLUGIN_PRODUCT_EVENT_NAME_PATTERN,
+  PLUGIN_SIGNAL_ATTACHMENTS_MAX,
+  PLUGIN_SIGNAL_ATTACHMENT_NAME_MAX,
+  PLUGIN_SIGNAL_ATTACHMENT_TYPE_MAX,
   PLUGIN_SIGNAL_KINDS,
   PLUGIN_SIGNAL_LABELS_MAX,
   PLUGIN_SIGNAL_LABEL_MAX,
@@ -8524,6 +8661,7 @@ export {
   ResolvedKayAppTool,
   ResolvedKayAppWhiteboardType,
   ResolvedKayAppWorkflow,
+  ResolvedKayAppWorkingDocumentProvider,
   ResolvedKayUiApp,
   ResolvedKayUiAppEndpointCapability,
   ResolvedPluginAuthScheme,
@@ -8598,6 +8736,7 @@ export {
   WhiteboardTypeStorage,
   WhiteboardValue,
   WorkflowContribution,
+  WorkingDocumentProviderContribution,
   appDataSourceDeclaration,
   approvalKindSchema,
   boundPluginDiagnosticMessage,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-protocol",
-  "version": "0.54.0",
+  "version": "0.54.2",
   "description": "The Kay plugin manifest schema (`kay.plugin.v1`) — parse and validate a kay-plugin.json.",
   "author": "YakLabs",
   "type": "module",