@yaklabs-ai/plugin-protocol 0.55.4 → 0.55.6

package/dist/index.js

@@ -260,8 +260,10 @@ var JsonSchema = z4.record(z4.string(), JsonValue);
 var KAY_PLUGIN_MANIFEST_SIZE_CAP_BYTES = 1024 * 1024;
 var KAY_PLUGIN_PROTOCOL_VERSION = "kay.plugin.v1";
 var KAY_PLUGIN_PROTOCOL_PACKAGE_NAME = "@bonsai/plugin-protocol";
-var KAY_PLUGIN_SDK_VERSION = "0.55.4";
+var KAY_PLUGIN_SDK_VERSION = "0.55.6";
 var KAY_PLUGIN_COMPATIBLE_SDK_VERSIONS = [
+  "0.55.5",
+  "0.55.4",
   "0.55.3",
   "0.55.2",
   "0.55.1",
@@ -1815,6 +1817,8 @@ var PLUGIN_CAPABILITY_SLUGS = [
   "process.run",
   "sessions.annotate",
   "sessions.compact",
+  "sessions.state",
+  "compaction.reset-text",
   "soul.write",
   "tools.describe",
   "workspace.command",
@@ -1865,7 +1869,8 @@ var PRIVATE_PLUGIN_CAPABILITY_SLUGS = [
   "workflows.signals",
   "sessions.assign-project",
   "artifacts.resolve-file",
-  "process.run"
+  "process.run",
+  "compaction.reset-text"
 ];
 function isPrivateCapabilityClaim(claim) {
   return PRIVATE_PLUGIN_CAPABILITY_SLUGS.includes(claim.slug);
@@ -2063,6 +2068,23 @@ function createAuthoritySchemas(canonical) {
       slug: z11.literal("sessions.compact"),
       envelope: z11.strictObject({})
     }),
+    z11.strictObject({
+      // Read and write this plugin's own state entries in a session's transcript
+      // (`app.sessions.readState` / `writeState`): custom entries stored under the plugin's own
+      // id, each write checked against the newest one. A write is bound like `sessions.annotate`
+      // to the session whose event the calling handler is answering; a read is not bound.
+      target: z11.literal("kay.app"),
+      slug: z11.literal("sessions.state"),
+      envelope: z11.strictObject({})
+    }),
+    z11.strictObject({
+      // Supply the working state a conversation's reset uses in place of the summary: the text the
+      // plugin's declared `contributes.resetText` entry holds, checked by herd before it is used.
+      // Private (PRIVATE_PLUGIN_CAPABILITY_SLUGS): only a plugin the release carries may hold it.
+      target: z11.literal("kay.app"),
+      slug: z11.literal("compaction.reset-text"),
+      envelope: z11.strictObject({})
+    }),
     z11.strictObject({
       // Read and rewrite the soul file every new conversation is told. Private
       // (PRIVATE_PLUGIN_CAPABILITY_SLUGS): only a plugin the release carries may hold it.
@@ -2382,6 +2404,8 @@ function sameClaim(a, b) {
     case "process.run":
     case "sessions.annotate":
     case "sessions.compact":
+    case "sessions.state":
+    case "compaction.reset-text":
     case "soul.write":
     case "tools.describe":
     case "workspace.command":
@@ -2478,6 +2502,8 @@ function envelopePairs(a, b) {
     case "process.run":
     case "sessions.annotate":
     case "sessions.compact":
+    case "sessions.state":
+    case "compaction.reset-text":
     case "soul.write":
     case "tools.describe":
     case "workspace.command":
@@ -4934,7 +4960,7 @@ var ShellCommandStep = z16.discriminatedUnion("kind", [
 ]);
 
 // packages/plugin-protocol/dist/manifest.js
-import { z as z18 } from "zod";
+import { z as z19 } from "zod";
 
 // packages/plugin-protocol/dist/workload-purposes.js
 import { z as z17 } from "zod";
@@ -4943,6 +4969,42 @@ var PluginWorkloadPurpose = z17.strictObject({
   workloadClass: z17.enum(["dreaming", "hindsight"])
 });
 
+// packages/plugin-protocol/dist/reset-text.js
+import { z as z18 } from "zod";
+
+// packages/plugin-protocol/dist/session-state.js
+var PLUGIN_STATE_ENTRY_NAME_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+var PLUGIN_STATE_ENTRY_MAX_BYTES = 256 * 1024;
+var PLUGIN_STATE_ENTRY_MAX_DEPTH = 64;
+var PLUGIN_STATE_ENTRY_TYPE_PREFIX = "plugin-state:";
+function pluginStateEntryCustomType(pluginId, name) {
+  return PLUGIN_STATE_ENTRY_NAME_PATTERN.test(name) ? `${PLUGIN_STATE_ENTRY_TYPE_PREFIX}${pluginId}:${name}` : void 0;
+}
+function isPluginStateEntryCustomType(customType) {
+  return customType.startsWith(PLUGIN_STATE_ENTRY_TYPE_PREFIX);
+}
+
+// packages/plugin-protocol/dist/reset-text.js
+var RESET_TEXT_MAX_CHARS = 18e3;
+var EntryAddress = z18.strictObject({
+  sessionId: z18.string().min(1),
+  entryId: z18.string().min(1)
+});
+var ResetTextEntry = z18.strictObject({
+  version: z18.literal(1),
+  /**
+   * The newest conversation entry the text accounts for: a message of the session's context, by the
+   * transcript id the plugin reads it under. It names the session the text was written for, so a
+   * fork's copy of its parent's entry covers nothing in the fork.
+   */
+  coveredThrough: EntryAddress,
+  /** The working state as Markdown, without the harness ledger. */
+  text: z18.string().min(1).max(RESET_TEXT_MAX_CHARS)
+});
+var ResetTextContribution = z18.strictObject({
+  entry: z18.string().regex(PLUGIN_STATE_ENTRY_NAME_PATTERN)
+});
+
 // packages/plugin-protocol/dist/synthetic-contributions.js
 function resolveConfigSectionContributionLocalId(section) {
   return `config-${toLocalContributionIdFragment(section)}`;
@@ -4966,34 +5028,34 @@ function createManifestSchemas(canonical) {
   const { AgentRenderContribution: AgentRenderContribution2, ApprovalTypeContribution: ApprovalTypeContribution2, WorkflowContribution: WorkflowContribution2, PluginCardContribution: PluginCardContribution2, AppDataMaterializerContribution: AppDataMaterializerContribution2, AppDataSourceContribution: AppDataSourceContribution2, AppUriModuleContribution: AppUriModuleContribution2, AppEventSubscription: AppEventSubscription2, ArtifactUriModuleContribution: ArtifactUriModuleContribution2, CliBindingContribution: CliBindingContribution2, CommandContribution: CommandContribution2, ContextContributorContribution: ContextContributorContribution2, ConverterContribution: ConverterContribution2, SessionReaderContribution: SessionReaderContribution2, DeviceDelegationContribution: DeviceDelegationContribution2, EndpointContribution: EndpointContribution2, EntityResolverContribution: EntityResolverContribution2, GitHostContribution: GitHostContribution2, McpServerContributions: McpServerContributions2, PluginEventDefinitionContribution: PluginEventDefinitionContribution2, PluginNotificationRuleContribution: PluginNotificationRuleContribution2, PluginProductEventContribution: PluginProductEventContribution2, ResourceContribution: ResourceContribution2, ReferencePresentationContribution: ReferencePresentationContribution2, PluginSkillSourceDeclaration: PluginSkillSourceDeclaration2, InteractionDriverContribution: InteractionDriverContribution2, SearchProviderContribution: SearchProviderContribution2, SkillContribution: SkillContribution2, ThemeContribution: ThemeContribution2, AgentToolContribution: AgentToolContribution2, ToolContribution: ToolContribution2, UiCommandContribution: UiCommandContribution2, UiAppContribution: UiAppContribution2, UiRailEntryContribution: UiRailEntryContribution2, UiToastPreviewContribution: UiToastPreviewContribution2, UiPageContribution: UiPageContribution2, UiEventSubscriptionContribution: UiEventSubscriptionContribution2, UiSlotContribution: UiSlotContribution2, UriModuleContribution: UriModuleContribution2, WhiteboardTypeContribution: WhiteboardTypeContribution2, WorkingDocumentProviderContribution: WorkingDocumentProviderContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginPermissionManifest: PluginPermissionManifest2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
-  const KayAgentTargetManifest2 = z18.strictObject({
+  const KayAgentTargetManifest2 = z19.strictObject({
     entrypoint: TargetEntrypoint2,
-    contributes: z18.strictObject({
-      tools: z18.array(AgentToolContribution2).optional(),
-      converters: z18.array(ConverterContribution2).optional(),
-      uriModules: z18.array(UriModuleContribution2).optional(),
+    contributes: z19.strictObject({
+      tools: z19.array(AgentToolContribution2).optional(),
+      converters: z19.array(ConverterContribution2).optional(),
+      uriModules: z19.array(UriModuleContribution2).optional(),
       // Host-composed artifact-backed schemes (see `ArtifactUriModuleContribution`): the plugin
       // declares scheme + editability; the daemon binds each to the kernel's artifact lifecycle
       // per session. Separate from `uriModules` (plugin-implemented backends) precisely because
       // the plugin registers NOTHING for these at activation.
-      artifactUriModules: z18.array(ArtifactUriModuleContribution2).optional(),
-      cliBindings: z18.array(CliBindingContribution2).optional(),
+      artifactUriModules: z19.array(ArtifactUriModuleContribution2).optional(),
+      cliBindings: z19.array(CliBindingContribution2).optional(),
       // Which git hosts this plugin's credential serves (see `GitHostContribution`): a
       // declaration, so a plugin for any git backend gets credentialed clones without
       // the daemon learning its name. Sibling of `cliBindings` because both answer the
       // same question - which of this plugin's auth services a host-side consumer
       // resolves - for two different transports.
-      gitHosts: z18.array(GitHostContribution2).optional(),
-      resources: z18.array(ResourceContribution2).optional(),
-      skills: z18.array(SkillContribution2).optional(),
-      searchProviders: z18.array(SearchProviderContribution2).optional(),
-      interactionDrivers: z18.array(InteractionDriverContribution2).optional(),
-      entityResolvers: z18.array(EntityResolverContribution2).optional(),
-      renderers: z18.array(AgentRenderContribution2).optional(),
+      gitHosts: z19.array(GitHostContribution2).optional(),
+      resources: z19.array(ResourceContribution2).optional(),
+      skills: z19.array(SkillContribution2).optional(),
+      searchProviders: z19.array(SearchProviderContribution2).optional(),
+      interactionDrivers: z19.array(InteractionDriverContribution2).optional(),
+      entityResolvers: z19.array(EntityResolverContribution2).optional(),
+      renderers: z19.array(AgentRenderContribution2).optional(),
       // Handler restricted to skill | tool by the manifest-level refinement below (see
       // `CommandContribution`'s doc for why the restriction is not expressed in the type, and
       // `CommandHandler`'s doc for why there is no promptTemplate variant to declare here).
-      commands: z18.array(CommandContribution2).optional()
+      commands: z19.array(CommandContribution2).optional()
     }).optional(),
     /**
      * The plugin's primer skill - the `localId` of one of its own declared
@@ -5029,8 +5091,8 @@ function createManifestSchemas(canonical) {
      * grant a person approved), and a body over 500 words is dropped.
      */
     prompt: PackageAssetPath2.optional(),
-    promptOrder: z18.number().finite().optional(),
-    familyFolder: z18.strictObject({ scope: z18.literal("root") }).optional(),
+    promptOrder: z19.number().finite().optional(),
+    familyFolder: z19.strictObject({ scope: z19.literal("root") }).optional(),
     /**
      * External origins of skills this plugin claims as its own (see
      * {@link PluginSkillSourceDeclaration}). Acquired by the daemon at boot and landed under the
@@ -5041,64 +5103,67 @@ function createManifestSchemas(canonical) {
      * acquisition, not declared here, so there is nothing for the resolved contract to mint a
      * `globalId` for at parse time.
      */
-    skillSources: z18.array(PluginSkillSourceDeclaration2).optional()
+    skillSources: z19.array(PluginSkillSourceDeclaration2).optional()
   });
-  const KayAppTargetManifest2 = z18.strictObject({
+  const KayAppTargetManifest2 = z19.strictObject({
     // Optional, like `kay.ui`'s: a target may carry only declarative `contributes` (e.g. a plugin
     // that ships nothing but `mcpServers`) with no app-lifetime module for the host to load.
     entrypoint: TargetEntrypoint2.optional(),
-    artifacts: z18.strictObject({ outputs: z18.literal(true) }).optional(),
-    contributes: z18.strictObject({
+    artifacts: z19.strictObject({ outputs: z19.literal(true) }).optional(),
+    contributes: z19.strictObject({
       // Session tools implemented by the app-lifetime activation (registered once, injected into
       // every session with a host-stamped session context) - the tool counterpart of `uriModules`
       // below. Same descriptor shape as kay.agent tools; `toolName` shares ONE flat session
       // namespace with them (enforced by the manifest-level refinement below).
-      tools: z18.array(ToolContribution2).optional(),
-      endpoints: z18.array(EndpointContribution2).optional(),
-      cards: z18.array(PluginCardContribution2).optional(),
-      uriModules: z18.array(AppUriModuleContribution2).optional(),
-      dataSources: z18.array(AppDataSourceContribution2).optional(),
-      whiteboardTypes: z18.array(WhiteboardTypeContribution2).optional(),
+      tools: z19.array(ToolContribution2).optional(),
+      endpoints: z19.array(EndpointContribution2).optional(),
+      cards: z19.array(PluginCardContribution2).optional(),
+      uriModules: z19.array(AppUriModuleContribution2).optional(),
+      dataSources: z19.array(AppDataSourceContribution2).optional(),
+      whiteboardTypes: z19.array(WhiteboardTypeContribution2).optional(),
       // Document sources whose pull, push and revision check the app entrypoint registers.
-      workingDocumentProviders: z18.array(WorkingDocumentProviderContribution2).optional(),
-      approvalTypes: z18.array(ApprovalTypeContribution2).optional(),
-      workflows: z18.array(WorkflowContribution2).optional(),
-      eventDefinitions: z18.array(PluginEventDefinitionContribution2).optional(),
+      workingDocumentProviders: z19.array(WorkingDocumentProviderContribution2).optional(),
+      approvalTypes: z19.array(ApprovalTypeContribution2).optional(),
+      workflows: z19.array(WorkflowContribution2).optional(),
+      eventDefinitions: z19.array(PluginEventDefinitionContribution2).optional(),
       // Default notification rules over this plugin's own `eventDefinitions`; seeded by the host
       // (see `PluginNotificationRuleContribution`).
-      notificationRules: z18.array(PluginNotificationRuleContribution2).optional(),
-      productEvents: z18.array(PluginProductEventContribution2).optional(),
-      eventSubscriptions: z18.array(AppEventSubscription2).optional(),
-      deviceDelegations: z18.array(DeviceDelegationContribution2).optional(),
-      sessionReaders: z18.array(SessionReaderContribution2).optional(),
-      contextContributors: z18.array(ContextContributorContribution2).optional(),
+      notificationRules: z19.array(PluginNotificationRuleContribution2).optional(),
+      productEvents: z19.array(PluginProductEventContribution2).optional(),
+      eventSubscriptions: z19.array(AppEventSubscription2).optional(),
+      deviceDelegations: z19.array(DeviceDelegationContribution2).optional(),
+      sessionReaders: z19.array(SessionReaderContribution2).optional(),
+      contextContributors: z19.array(ContextContributorContribution2).optional(),
+      // The state entry holding the working state a reset may use in place of the summary
+      // (`reset-text.ts`). Honored only for a plugin holding `compaction.reset-text`.
+      resetText: ResetTextContribution.optional(),
       // Vendored MCP servers this plugin ships (see `McpServerContributions`). Each is hosted only
       // for a plugin holding `mcp.host-server` for its name and URL; that is decided at
       // composition, not here (see AGENTS.md).
       mcpServers: McpServerContributions2.optional(),
       // Handler restricted to endpoint-only by the manifest-level refinement below.
-      commands: z18.array(CommandContribution2).optional()
+      commands: z19.array(CommandContribution2).optional()
     }).optional()
   });
-  const KayUiTargetManifest2 = z18.strictObject({
+  const KayUiTargetManifest2 = z19.strictObject({
     entrypoint: TargetEntrypoint2.extend({
-      format: z18.literal("compiled-bundle").optional()
+      format: z19.literal("compiled-bundle").optional()
     }).optional(),
-    contributes: z18.strictObject({
-      commands: z18.array(UiCommandContribution2).optional(),
-      slots: z18.array(UiSlotContribution2).optional(),
-      referencePresentations: z18.array(ReferencePresentationContribution2).optional(),
-      apps: z18.array(UiAppContribution2).optional(),
-      railEntries: z18.array(UiRailEntryContribution2).optional(),
-      toastPreviews: z18.array(UiToastPreviewContribution2).optional(),
-      pages: z18.array(UiPageContribution2).optional(),
-      themes: z18.array(ThemeContribution2).optional(),
-      eventSubscriptions: z18.array(UiEventSubscriptionContribution2).optional(),
-      dataMaterializers: z18.array(AppDataMaterializerContribution2).optional()
+    contributes: z19.strictObject({
+      commands: z19.array(UiCommandContribution2).optional(),
+      slots: z19.array(UiSlotContribution2).optional(),
+      referencePresentations: z19.array(ReferencePresentationContribution2).optional(),
+      apps: z19.array(UiAppContribution2).optional(),
+      railEntries: z19.array(UiRailEntryContribution2).optional(),
+      toastPreviews: z19.array(UiToastPreviewContribution2).optional(),
+      pages: z19.array(UiPageContribution2).optional(),
+      themes: z19.array(ThemeContribution2).optional(),
+      eventSubscriptions: z19.array(UiEventSubscriptionContribution2).optional(),
+      dataMaterializers: z19.array(AppDataMaterializerContribution2).optional()
     }).optional()
   });
-  const PluginConfigScope2 = z18.enum(["global", "project", "agent"]);
-  const PluginConfigSectionManifest2 = z18.strictObject({
+  const PluginConfigScope2 = z19.enum(["global", "project", "agent"]);
+  const PluginConfigSectionManifest2 = z19.strictObject({
     section: NonEmptyString3.optional(),
     schema: JsonSchema,
     /**
@@ -5116,23 +5181,23 @@ function createManifestSchemas(canonical) {
      * is the baseline every section has; `agent` has no runtime mapping (the
      * agent/entity fold is downstream of the document protocol).
      */
-    scopes: z18.array(PluginConfigScope2).optional()
+    scopes: z19.array(PluginConfigScope2).optional()
   });
-  const PluginConfigManifest2 = z18.array(PluginConfigSectionManifest2).min(1);
-  const PluginStorageManifest2 = z18.strictObject({
-    sqlite: z18.strictObject({
-      enabled: z18.boolean(),
-      ownerTarget: z18.literal("kay.app").optional(),
+  const PluginConfigManifest2 = z19.array(PluginConfigSectionManifest2).min(1);
+  const PluginStorageManifest2 = z19.strictObject({
+    sqlite: z19.strictObject({
+      enabled: z19.boolean(),
+      ownerTarget: z19.literal("kay.app").optional(),
       migrations: NonEmptyString3.optional()
     }).optional(),
-    dataDir: z18.strictObject({
-      enabled: z18.boolean(),
-      ownerTarget: z18.literal("kay.app").optional(),
+    dataDir: z19.strictObject({
+      enabled: z19.boolean(),
+      ownerTarget: z19.literal("kay.app").optional(),
       sharedWith: PluginId2.optional()
     }).optional()
   });
-  const PluginOAuthClientSupplier2 = z18.enum(["kay", "user"]);
-  const PluginProvisioningProbe2 = z18.strictObject({
+  const PluginOAuthClientSupplier2 = z19.enum(["kay", "user"]);
+  const PluginProvisioningProbe2 = z19.strictObject({
     /**
      * The API endpoint that answers the question. The host sends the service's OWN credential here,
      * so this must belong to the provider that minted it - enforced by the daemon against the
@@ -5140,13 +5205,13 @@ function createManifestSchemas(canonical) {
      */
     url: HttpsUrl2,
     /** Absent => `GET`. */
-    method: z18.enum(["GET"]).optional(),
+    method: z19.enum(["GET"]).optional(),
     /**
      * The statuses that make the response a VERDICT at all. Anything else (a 401 from a stale
      * token, a 5xx, a rate limit) means the probe learned nothing and reports `unknown` - never
      * `unsatisfied`, which would tell a user to go fix setup that is fine.
      */
-    verdictStatuses: z18.array(SignedInStatusCode2).min(1),
+    verdictStatuses: z19.array(SignedInStatusCode2).min(1),
     /**
      * Dot-path to a JSON array in the response body that must be NON-EMPTY for the requirement to
      * count as satisfied (e.g. `installations`). Absent means a verdict status alone is enough.
@@ -5155,7 +5220,7 @@ function createManifestSchemas(canonical) {
      */
     nonEmptyArrayAt: NonEmptyString3.optional()
   });
-  const PluginProvisioningRequirement2 = z18.strictObject({
+  const PluginProvisioningRequirement2 = z19.strictObject({
     /** Stable id, unique within the scheme. */
     id: LocalContributionId2,
     /** Human-facing requirement name, e.g. "GitHub App installation". */
@@ -5172,7 +5237,7 @@ function createManifestSchemas(canonical) {
     probe: PluginProvisioningProbe2
   });
   const PluginProvisioningField = {
-    provisioning: z18.array(PluginProvisioningRequirement2).optional()
+    provisioning: z19.array(PluginProvisioningRequirement2).optional()
   };
   const PluginAuthSchemeDescriptionFields = {
     /** Human-facing flow name; absent, the service's name stands in. */
@@ -5189,20 +5254,20 @@ function createManifestSchemas(canonical) {
     authorizationUrl: HttpsUrl2,
     tokenUrl: HttpsUrl2,
     /** Initial connect scopes; absent uses `scopes`, while an empty array requests none. */
-    connectScopes: z18.array(NonEmptyString3).optional(),
+    connectScopes: z19.array(NonEmptyString3).optional(),
     /** Provider-specific query parameters added to the authorize URL. */
-    extraAuthorizeParams: z18.record(NonEmptyString3, z18.string()).optional(),
+    extraAuthorizeParams: z19.record(NonEmptyString3, z19.string()).optional(),
     /** Additional authorization parameters when this service already holds an account. */
-    extraAuthorizeParamsWhenAccountHeld: z18.record(NonEmptyString3, z18.string()).optional()
+    extraAuthorizeParamsWhenAccountHeld: z19.record(NonEmptyString3, z19.string()).optional()
   };
-  const PluginAuthSchemeAccountLookup = z18.literal("lookup");
-  const PluginAuthSchemeOAuthPkce = z18.strictObject({
+  const PluginAuthSchemeAccountLookup = z19.literal("lookup");
+  const PluginAuthSchemeOAuthPkce = z19.strictObject({
     ...PluginProvisioningField,
     ...PluginAuthSchemeDescriptionFields,
     ...PluginAuthSchemeOAuthEndpointFields,
     localId: LocalContributionId2,
-    kind: z18.literal("oauth2"),
-    exchange: z18.literal("pkce"),
+    kind: z19.literal("oauth2"),
+    exchange: z19.literal("pkce"),
     byoocProfile: PluginByoocProfile.optional(),
     /**
      * A public client id the plugin ships for its own sign-in. Only an installed plugin's is used:
@@ -5226,7 +5291,7 @@ function createManifestSchemas(canonical) {
      * runs on an untrusted manifest, so a hand-built `["kay","kay"]` must be refused here, not
      * silently normalized).
      */
-    clientSuppliers: z18.array(PluginOAuthClientSupplier2).nonempty().superRefine((suppliers, ctx) => {
+    clientSuppliers: z19.array(PluginOAuthClientSupplier2).nonempty().superRefine((suppliers, ctx) => {
       if (new Set(suppliers).size !== suppliers.length) {
         ctx.addIssue({
           code: "custom",
@@ -5234,7 +5299,7 @@ function createManifestSchemas(canonical) {
         });
       }
     }),
-    scopes: z18.array(NonEmptyString3).optional()
+    scopes: z19.array(NonEmptyString3).optional()
   }).refine((scheme) => scheme.byoocProfile === void 0 || scheme.clientSuppliers.includes("user"), {
     message: "An own-client profile requires the user client supplier.",
     path: ["byoocProfile"]
@@ -5245,33 +5310,33 @@ function createManifestSchemas(canonical) {
     message: "a scheme with its own clientId names where its account comes from (`account`)",
     path: ["account"]
   });
-  const PluginAuthSchemeOAuthConfidential = z18.strictObject({
+  const PluginAuthSchemeOAuthConfidential = z19.strictObject({
     ...PluginProvisioningField,
     ...PluginAuthSchemeDescriptionFields,
     ...PluginAuthSchemeOAuthEndpointFields,
     localId: LocalContributionId2,
-    kind: z18.literal("oauth2"),
-    exchange: z18.literal("confidential"),
+    kind: z19.literal("oauth2"),
+    exchange: z19.literal("confidential"),
     /** Absent means `["kay"]` - a confidential exchange's secret may only ever be Bonsai's. */
-    clientSuppliers: z18.tuple([z18.literal("kay")]).optional(),
-    scopes: z18.array(NonEmptyString3).optional(),
+    clientSuppliers: z19.tuple([z19.literal("kay")]).optional(),
+    scopes: z19.array(NonEmptyString3).optional(),
     /** Where the account comes from (see {@link PluginAuthSchemeAccountLookup}). */
-    account: z18.union([PluginAuthSchemeAccountLookup, z18.literal("sign-in")])
+    account: z19.union([PluginAuthSchemeAccountLookup, z19.literal("sign-in")])
   });
-  const PluginAuthSchemeOAuth2 = z18.discriminatedUnion("exchange", [
+  const PluginAuthSchemeOAuth2 = z19.discriminatedUnion("exchange", [
     PluginAuthSchemeOAuthPkce,
     PluginAuthSchemeOAuthConfidential
   ]);
-  const PluginAuthSchemeApiKey = z18.strictObject({
+  const PluginAuthSchemeApiKey = z19.strictObject({
     ...PluginProvisioningField,
     ...PluginAuthSchemeDescriptionFields,
     localId: LocalContributionId2,
-    kind: z18.literal("api-key"),
-    scopes: z18.array(NonEmptyString3).optional(),
+    kind: z19.literal("api-key"),
+    scopes: z19.array(NonEmptyString3).optional(),
     /** The connect prompt's label for the key. Absent: "<service name> API key". */
     inputLabel: NonEmptyString3.optional(),
     /** Two or more labeled inputs for a secret that comes in parts; absent asks for one key. */
-    fields: z18.array(z18.strictObject({ id: LocalContributionId2, label: NonEmptyString3 })).min(2).superRefine((fields, ctx) => {
+    fields: z19.array(z19.strictObject({ id: LocalContributionId2, label: NonEmptyString3 })).min(2).superRefine((fields, ctx) => {
       if (new Set(fields.map((field) => field.id)).size !== fields.length) {
         ctx.addIssue({
           code: "custom",
@@ -5280,7 +5345,7 @@ function createManifestSchemas(canonical) {
       }
     }).optional(),
     /** Where and how the person creates the key outside Bonsai. */
-    setup: z18.strictObject({ instructions: NonEmptyString3, url: HttpsUrl2 }).optional(),
+    setup: z19.strictObject({ instructions: NonEmptyString3, url: HttpsUrl2 }).optional(),
     /**
      * `"lookup"`: the plugin checks a key before it is saved and names its account, with the function
      * it registers (`api.auth.registerAccountLookup`). Absent: the key is saved unchecked, under the
@@ -5288,27 +5353,27 @@ function createManifestSchemas(canonical) {
      */
     account: PluginAuthSchemeAccountLookup.optional()
   });
-  const PluginAuthSchemeDelegated = z18.strictObject({
+  const PluginAuthSchemeDelegated = z19.strictObject({
     ...PluginAuthSchemeDescriptionFields,
     localId: LocalContributionId2,
-    kind: z18.literal("delegated"),
-    scopes: z18.array(NonEmptyString3).optional()
+    kind: z19.literal("delegated"),
+    scopes: z19.array(NonEmptyString3).optional()
   });
-  const ExternalCliArgument = z18.string().min(1).max(16384).refine((value) => ![...value].some(isUnsafeArgumentCharacter), {
+  const ExternalCliArgument = z19.string().min(1).max(16384).refine((value) => ![...value].some(isUnsafeArgumentCharacter), {
     message: "an argument may hold tabs and line breaks, but no other control character, no invisible character and no bidirectional override"
   });
-  const ExternalCliCommand = z18.string().max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/, {
+  const ExternalCliCommand = z19.string().max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/, {
     message: "a command is an executable's basename (letters, digits, '.', '_', '+', '-'), never a path"
   });
   const ExternalCliHint = NonEmptyString3.max(2048);
-  const ExternalCliArguments = z18.array(ExternalCliArgument).max(64);
+  const ExternalCliArguments = z19.array(ExternalCliArgument).max(64);
   const SignedOutMarker = ExternalCliArgument.refine((value) => value.trim() !== "", { message: "a signed-out marker needs text beyond whitespace" });
-  const PluginExternalCliConnect2 = z18.strictObject({
+  const PluginExternalCliConnect2 = z19.strictObject({
     /** A basename the host finds on `PATH` (`osascript`, `wrangler`), never a path. */
     binary: ExternalCliCommand,
-    probe: z18.strictObject({
+    probe: z19.strictObject({
       args: ExternalCliArguments.min(1),
-      timeoutMs: z18.number().int().min(1).max(12e4).optional(),
+      timeoutMs: z19.number().int().min(1).max(12e4).optional(),
       /**
        * The CLI's own signed-out marker: text a failed probe's output (stderr, else stdout) contains
        * when the CLI is signed out. A failure that carries it is a sign-in problem, and only such a
@@ -5316,13 +5381,13 @@ function createManifestSchemas(canonical) {
        * unavailable. Required when `login` is declared, so a timeout never starts a sign-in. A list
        * is for a CLI with several signed-out messages; any one of them counts.
        */
-      signedOutMarker: z18.union([SignedOutMarker, z18.array(SignedOutMarker).min(1)]).optional()
+      signedOutMarker: z19.union([SignedOutMarker, z19.array(SignedOutMarker).min(1)]).optional()
     }),
     /** The CLI's interactive sign-in. Absent: connect only probes and reports. */
-    login: z18.strictObject({
+    login: z19.strictObject({
       args: ExternalCliArguments.min(1),
-      timeoutMs: z18.number().int().min(1).max(6e5).optional(),
-      pasteCode: z18.strictObject({
+      timeoutMs: z19.number().int().min(1).max(6e5).optional(),
+      pasteCode: z19.strictObject({
         /** The redeeming argv; the host appends the code as its last argument. */
         args: ExternalCliArguments.min(1),
         /** What the prompt says, for a person. */
@@ -5334,12 +5399,12 @@ function createManifestSchemas(canonical) {
      * for display, or hands it to an agent session that runs it behind the ordinary bash approval.
      * Absent for a binary the OS ships (`osascript`).
      */
-    install: z18.strictObject({
+    install: z19.strictObject({
       command: ExternalCliCommand,
       args: ExternalCliArguments
     }).optional(),
     /** Prose for a person: `install` when the binary is missing, `login` when the probe fails. */
-    hints: z18.strictObject({
+    hints: z19.strictObject({
       install: ExternalCliHint,
       login: ExternalCliHint
     })
@@ -5352,50 +5417,50 @@ function createManifestSchemas(canonical) {
       });
     }
   });
-  const PluginAuthSchemeExternalCli = z18.strictObject({
+  const PluginAuthSchemeExternalCli = z19.strictObject({
     ...PluginAuthSchemeDescriptionFields,
     localId: LocalContributionId2,
-    kind: z18.literal("external-cli"),
-    scopes: z18.array(NonEmptyString3).optional(),
+    kind: z19.literal("external-cli"),
+    scopes: z19.array(NonEmptyString3).optional(),
     cli: PluginExternalCliConnect2.optional()
   });
-  const PluginAuthScheme2 = z18.discriminatedUnion("kind", [
+  const PluginAuthScheme2 = z19.discriminatedUnion("kind", [
     PluginAuthSchemeOAuth2,
     PluginAuthSchemeApiKey,
     PluginAuthSchemeDelegated,
     PluginAuthSchemeExternalCli
   ]);
-  const PluginWebSessionProbe2 = z18.strictObject({
+  const PluginWebSessionProbe2 = z19.strictObject({
     url: HttpsUrl2,
     /** Absent => `GET`. `POST` sends an empty JSON object body. */
-    method: z18.enum(["GET", "POST"]).optional(),
-    signedInStatuses: z18.array(SignedInStatusCode2).min(1)
+    method: z19.enum(["GET", "POST"]).optional(),
+    signedInStatuses: z19.array(SignedInStatusCode2).min(1)
   });
-  const PluginWebSessionDeclaration2 = z18.strictObject({
+  const PluginWebSessionDeclaration2 = z19.strictObject({
     /** `required`: capabilities degrade without the site login; `recommended`: it only smooths UX. */
-    importance: z18.enum(["required", "recommended"]),
+    importance: z19.enum(["required", "recommended"]),
     loginUrl: HttpsUrl2,
-    cookieDomains: z18.array(RegistrableDomain2).min(1),
+    cookieDomains: z19.array(RegistrableDomain2).min(1),
     probe: PluginWebSessionProbe2,
-    oauthVenue: z18.enum(["embedded", "external"]),
+    oauthVenue: z19.enum(["embedded", "external"]),
     /**
      * Where a page goes first when it opens in one of Bonsai's browser panes and this site login
      * is missing: a sign-in page that continues to the page. A template with `:email` and `:url`
      * (see `UriClaimTemplate`), on a host within `cookieDomains`.
      */
-    signInFirst: z18.string().optional()
+    signInFirst: z19.string().optional()
   }).superRefine(refineWebSessionScopeConfined);
-  const PluginAuthService2 = z18.strictObject({
+  const PluginAuthService2 = z19.strictObject({
     localId: LocalContributionId2,
     displayName: NonEmptyString3,
     /** One plain sentence on what connecting this service gives Bonsai. */
     summary: NonEmptyString3.optional(),
-    schemes: z18.array(PluginAuthScheme2).min(1),
-    purposes: z18.array(NonEmptyString3).min(1),
+    schemes: z19.array(PluginAuthScheme2).min(1),
+    purposes: z19.array(NonEmptyString3).min(1),
     webSession: PluginWebSessionDeclaration2.optional()
   });
-  const PluginAuthManifest2 = z18.strictObject({
-    services: z18.array(PluginAuthService2).optional()
+  const PluginAuthManifest2 = z19.strictObject({
+    services: z19.array(PluginAuthService2).optional()
   });
   function stripRetiredCompatibilityKeys(value) {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
@@ -5406,17 +5471,17 @@ function createManifestSchemas(canonical) {
       delete remaining[key];
     return remaining;
   }
-  const PluginCompatibilityFields = z18.strictObject({
-    supportedProtocols: z18.array(KayPluginProtocolVersion).optional(),
+  const PluginCompatibilityFields = z19.strictObject({
+    supportedProtocols: z19.array(KayPluginProtocolVersion).optional(),
     minKayVersion: NonEmptyString3.optional(),
     sdk: NonEmptyString3.optional()
   });
-  const PluginCompatibilityManifest2 = canonical ? PluginCompatibilityFields : z18.preprocess(stripRetiredCompatibilityKeys, PluginCompatibilityFields);
+  const PluginCompatibilityManifest2 = canonical ? PluginCompatibilityFields : z19.preprocess(stripRetiredCompatibilityKeys, PluginCompatibilityFields);
   const KayVersionString2 = NonEmptyString3.regex(SEMVER_PATTERN, {
     message: "version must be semver, for example 1.2.3"
   });
-  const KayPluginManifestV12 = z18.strictObject({
-    protocol: z18.literal(KAY_PLUGIN_PROTOCOL_VERSION),
+  const KayPluginManifestV12 = z19.strictObject({
+    protocol: z19.literal(KAY_PLUGIN_PROTOCOL_VERSION),
     id: PluginId2,
     displayName: NonEmptyString3,
     version: KayVersionString2,
@@ -5444,12 +5509,12 @@ function createManifestSchemas(canonical) {
     icon: PackageAssetPath2.optional(),
     iconDark: PackageAssetPath2.optional(),
     namespace: PluginNamespace2.optional(),
-    workers: z18.array(z18.strictObject({
+    workers: z19.array(z19.strictObject({
       localId: LocalContributionId2,
       module: PackageAssetPath2
     })).optional(),
-    targets: z18.strictObject({
-      kay: z18.strictObject({
+    targets: z19.strictObject({
+      kay: z19.strictObject({
         agent: KayAgentTargetManifest2.optional(),
         app: KayAppTargetManifest2.optional(),
         ui: KayUiTargetManifest2.optional()
@@ -5457,8 +5522,8 @@ function createManifestSchemas(canonical) {
     }).optional(),
     config: PluginConfigManifest2.optional(),
     storage: PluginStorageManifest2.optional(),
-    workloadPurposes: z18.array(PluginWorkloadPurpose).optional(),
-    shellCommands: z18.array(PluginShellCommand).optional(),
+    workloadPurposes: z19.array(PluginWorkloadPurpose).optional(),
+    shellCommands: z19.array(PluginShellCommand).optional(),
     projectDirectories: PluginProjectDirectories.optional(),
     auth: PluginAuthManifest2.optional(),
     permissions: PluginPermissionManifest2.optional(),
@@ -5469,15 +5534,15 @@ function createManifestSchemas(canonical) {
      * schemes then report `ownedByBonsai`. Honoured only for a plugin that ships with Bonsai: the
      * host reads any other plugin's flag as false. Absent => false.
      */
-    ownedByBonsai: z18.boolean().optional(),
+    ownedByBonsai: z19.boolean().optional(),
     /**
      * Explicit plugin-level dependencies - other plugins this plugin requires to be present in the
      * composed roster. At composition time the runtime checks each id against the accepted
      * registration list and derives a provenance-complete dependency graph (together with implicit
      * auth-service edges from `consumesAuthServices`). Absent => no explicit dependencies.
      */
-    dependencies: z18.strictObject({
-      plugins: z18.array(PluginId2).optional()
+    dependencies: z19.strictObject({
+      plugins: z19.array(PluginId2).optional()
     }).optional()
   }).superRefine((manifest, ctx) => {
     reportDuplicateLocalIds(ctx, ["workers"], manifest.workers, "worker");
@@ -6729,7 +6794,7 @@ function pushContributionIds(output, path, items) {
 }
 
 // packages/plugin-protocol/dist/plugin-directory-verdict.js
-import { z as z20 } from "zod";
+import { z as z21 } from "zod";
 
 // packages/plugin-protocol/dist/plugin-load-diagnostic.js
 var PLUGIN_DIAGNOSTIC_MESSAGE_CAP = 300;
@@ -6738,14 +6803,14 @@ function boundPluginDiagnosticMessage(message) {
 }
 
 // packages/plugin-protocol/dist/resolved-contract.js
-import { z as z19 } from "zod";
+import { z as z20 } from "zod";
 function createResolvedContractSchemas(canonical) {
   const { PluginEventLocalId: PluginEventLocalId2 } = canonical ? canonicalPluginEventSchemas : plugin_events_exports;
   const { ApprovalTypeContribution: ApprovalTypeContribution2, KayUiAppHostCapability: KayUiAppHostCapability2, McpServerAuthMode: McpServerAuthMode2, McpServerUrl: McpServerUrl2, PluginContributionKind: PluginContributionKindSchema, ReferenceOpenBehavior: ReferenceOpenBehavior2, ReferencePresentationUriPattern: ReferencePresentationUriPattern2, ReferencePresentationAccountLinks: ReferencePresentationAccountLinks2, ReferencePresentationAddress: ReferencePresentationAddress2, ReferencePresentationUrlClaim: ReferencePresentationUrlClaim2, ReferencePresentationVariants: ReferencePresentationVariants2, ReferencePresentationWords: ReferencePresentationWords2, UriModuleFacts: UriModuleFacts2, WhiteboardTypeContribution: WhiteboardTypeContribution2 } = canonical ? canonicalContributionSchemas : contributions_exports;
   const { FileExtensionToken: FileExtensionToken2, GitBasicAuthUser: GitBasicAuthUser2, GitHostName: GitHostName2, GlobalContributionId: GlobalContributionId2, HttpsUrl: HttpsUrl2, LocalContributionId: LocalContributionId2, MimeTypeString: MimeTypeString2, NonEmptyString: NonEmptyString3, PackageAssetPath: PackageAssetPath2, PluginId: PluginId2, PluginNamespace: PluginNamespace2, PluginToolName: PluginToolName2, RegistrableDomain: RegistrableDomain2, SignedInStatusCode: SignedInStatusCode2, TargetEntrypoint: TargetEntrypoint2, UriScheme: UriScheme2 } = canonical ? canonicalCommonSchemas : common_exports;
   const { PluginExternalCliConnect: PluginExternalCliConnect2, PluginOAuthClientSupplier: PluginOAuthClientSupplier2 } = canonical ? canonicalManifestSchemas : manifest_exports;
   const { ResolvedPluginGrants: ResolvedPluginGrants2, ScopeRequirement: ScopeRequirement2 } = canonical ? canonicalPermissionSchemas : permissions_exports;
-  const ResolvedPluginContributionId2 = z19.strictObject({
+  const ResolvedPluginContributionId2 = z20.strictObject({
     target: PluginTargetName,
     kind: PluginContributionKindSchema,
     localId: PluginEventLocalId2,
@@ -6759,20 +6824,20 @@ function createResolvedContractSchemas(canonical) {
       });
     }
   });
-  const ResolvedKayToolId = z19.strictObject({
+  const ResolvedKayToolId = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     toolName: PluginToolName2
   });
-  const ResolvedKayAgentTool2 = z19.strictObject({
+  const ResolvedKayAgentTool2 = z20.strictObject({
     ...ResolvedKayToolId.shape,
     displayName: NonEmptyString3.optional(),
     description: NonEmptyString3.optional(),
     parameters: JsonSchema.optional(),
-    executionMode: z19.enum(["sequential", "parallel"]).optional(),
+    executionMode: z20.enum(["sequential", "parallel"]).optional(),
     promptSnippet: NonEmptyString3.optional(),
-    promptGuidelines: z19.array(NonEmptyString3).optional(),
-    requiresAuth: z19.strictObject({
+    promptGuidelines: z20.array(NonEmptyString3).optional(),
+    requiresAuth: z20.strictObject({
       serviceId: GlobalContributionId2,
       schemeId: GlobalContributionId2.optional()
     }).optional(),
@@ -6781,37 +6846,37 @@ function createResolvedContractSchemas(canonical) {
   const ResolvedKayAppTool2 = ResolvedKayAgentTool2.omit({
     requiresAuth: true
   }).extend({
-    availability: z19.strictObject({ scope: z19.literal("app") }).optional()
+    availability: z20.strictObject({ scope: z20.literal("app") }).optional()
   });
-  const ResolvedKayAppDataSource2 = z19.strictObject({
+  const ResolvedKayAppDataSource2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
-    scope: z19.enum(["runtime", "account", "session"]),
-    snapshot: z19.strictObject({
-      version: z19.number().int().positive(),
-      schema: z19.record(z19.string(), z19.unknown())
+    scope: z20.enum(["runtime", "account", "session"]),
+    snapshot: z20.strictObject({
+      version: z20.number().int().positive(),
+      schema: z20.record(z20.string(), z20.unknown())
     }),
-    change: z19.strictObject({
-      version: z19.number().int().positive(),
-      schema: z19.record(z19.string(), z19.unknown()),
-      semantics: z19.discriminatedUnion("kind", [
-        z19.strictObject({ kind: z19.literal("incremental") }),
-        z19.strictObject({
-          kind: z19.literal("snapshot-replacement"),
-          maxEncodedBytes: z19.number().int().positive(),
+    change: z20.strictObject({
+      version: z20.number().int().positive(),
+      schema: z20.record(z20.string(), z20.unknown()),
+      semantics: z20.discriminatedUnion("kind", [
+        z20.strictObject({ kind: z20.literal("incremental") }),
+        z20.strictObject({
+          kind: z20.literal("snapshot-replacement"),
+          maxEncodedBytes: z20.number().int().positive(),
           rationale: pluginString(canonical).min(1).max(1024)
         })
       ]).optional()
     }),
     read: AppDataSourceRead.optional(),
-    messageDraft: z19.strictObject({ schemes: z19.array(UriScheme2).min(1) }).optional(),
-    store: z19.discriminatedUnion("shape", [
-      z19.strictObject({
-        shape: z19.literal("rows"),
-        rowsField: z19.string().min(1),
-        key: z19.array(z19.string().min(1)).min(1)
+    messageDraft: z20.strictObject({ schemes: z20.array(UriScheme2).min(1) }).optional(),
+    store: z20.discriminatedUnion("shape", [
+      z20.strictObject({
+        shape: z20.literal("rows"),
+        rowsField: z20.string().min(1),
+        key: z20.array(z20.string().min(1)).min(1)
       }),
-      z19.strictObject({ shape: z19.literal("value") })
+      z20.strictObject({ shape: z20.literal("value") })
     ]).optional()
   }).superRefine((source, ctx) => {
     if (source.read !== void 0 && source.scope !== "session") {
@@ -6831,134 +6896,134 @@ function createResolvedContractSchemas(canonical) {
     /** The auth service that module signs in through, whose accounts a card may send from. */
     authService: GlobalContributionId2.optional()
   });
-  const ResolvedPluginCard2 = z19.strictObject({
+  const ResolvedPluginCard2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     pluginId: PluginId2,
     description: NonEmptyString3,
     inputs: JsonSchema,
-    readEndpoint: z19.strictObject({
+    readEndpoint: z20.strictObject({
       localId: LocalContributionId2,
       globalId: GlobalContributionId2
     }),
-    submitEndpoint: z19.strictObject({
+    submitEndpoint: z20.strictObject({
       localId: LocalContributionId2,
       globalId: GlobalContributionId2
     }),
     authService: GlobalContributionId2.optional()
   });
-  const ResolvedKayAppWorkflow2 = z19.strictObject({
+  const ResolvedKayAppWorkflow2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     name: NonEmptyString3,
     description: NonEmptyString3,
-    everyMs: z19.number().int().positive(),
-    auth: z19.strictObject({
+    everyMs: z20.number().int().positive(),
+    auth: z20.strictObject({
       serviceId: GlobalContributionId2,
       schemeId: GlobalContributionId2,
-      scopes: z19.array(NonEmptyString3).min(1).optional()
+      scopes: z20.array(NonEmptyString3).min(1).optional()
     }).optional()
   });
   const ResolvedKayAppWhiteboardType2 = WhiteboardTypeContribution2.safeExtend({
     globalId: GlobalContributionId2
   });
-  const ResolvedKayAppMcpServer2 = z19.strictObject({
+  const ResolvedKayAppMcpServer2 = z20.strictObject({
     name: LocalContributionId2,
     pluginId: PluginId2,
     url: McpServerUrl2,
     auth: McpServerAuthMode2,
     authServiceId: GlobalContributionId2.optional()
   });
-  const ResolvedKayAppWorkingDocumentProvider2 = z19.strictObject({
+  const ResolvedKayAppWorkingDocumentProvider2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     displayName: NonEmptyString3,
-    schemes: z19.array(UriScheme2),
-    hosts: z19.array(NonEmptyString3),
+    schemes: z20.array(UriScheme2),
+    hosts: z20.array(NonEmptyString3),
     authServiceId: GlobalContributionId2.optional(),
     authSchemeId: GlobalContributionId2.optional(),
     scopeRequirement: ScopeRequirement2.optional()
   });
-  const ResolvedKayAgentUriModule2 = z19.strictObject({
+  const ResolvedKayAgentUriModule2 = z20.strictObject({
     localId: LocalContributionId2,
-    adapterId: z19.string().min(1).optional(),
+    adapterId: z20.string().min(1).optional(),
     globalId: GlobalContributionId2,
-    schemes: z19.array(UriScheme2).min(1),
+    schemes: z20.array(UriScheme2).min(1),
     displayName: NonEmptyString3.optional(),
     authServiceId: GlobalContributionId2.optional(),
     /** Mirrors `UriModuleContribution.authScheme`; a local ref takes the plugin's namespace. */
     authSchemeId: GlobalContributionId2.optional(),
-    requiredScopes: z19.array(NonEmptyString3).optional(),
+    requiredScopes: z20.array(NonEmptyString3).optional(),
     /** Mirrors `UriModuleContribution.knownResources` (host-side recording opt-in). */
-    knownResources: z19.literal(true).optional(),
+    knownResources: z20.literal(true).optional(),
     /** Mirrors `UriModuleContribution.describesOperations`. */
-    describesOperations: z19.literal(true).optional(),
+    describesOperations: z20.literal(true).optional(),
     /** Mirrors `UriModuleContribution.looksUpWebLinks`. */
-    looksUpWebLinks: z19.literal(true).optional(),
+    looksUpWebLinks: z20.literal(true).optional(),
     ...UriModuleFacts2.shape
   });
-  const ResolvedKayAgentArtifactUriModule2 = z19.strictObject({
+  const ResolvedKayAgentArtifactUriModule2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     scheme: UriScheme2,
-    editable: z19.boolean(),
-    listable: z19.boolean(),
-    deletable: z19.boolean(),
-    appendable: z19.boolean(),
-    storageScope: z19.enum(["session", "family"])
+    editable: z20.boolean(),
+    listable: z20.boolean(),
+    deletable: z20.boolean(),
+    appendable: z20.boolean(),
+    storageScope: z20.enum(["session", "family"])
   });
-  const ResolvedKayAgentEntityResolver2 = z19.strictObject({
+  const ResolvedKayAgentEntityResolver2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     displayName: NonEmptyString3.optional(),
     uriModule: GlobalContributionId2,
-    entityTypes: z19.array(NonEmptyString3).min(1),
+    entityTypes: z20.array(NonEmptyString3).min(1),
     uriHint: NonEmptyString3
   });
-  const ResolvedKayAgentGitHostClaim2 = z19.strictObject({
+  const ResolvedKayAgentGitHostClaim2 = z20.strictObject({
     host: GitHostName2,
     authServiceId: GlobalContributionId2,
     /** Manifest-declared order; the clone ladder tries them in sequence. */
-    authSchemeIds: z19.array(GlobalContributionId2).min(1),
+    authSchemeIds: z20.array(GlobalContributionId2).min(1),
     /** Non-secret display copy for the claiming service, for clone failure text. */
-    authServiceDisplayName: z19.string(),
+    authServiceDisplayName: z20.string(),
     basicAuthUser: GitBasicAuthUser2
   });
-  const ResolvedKayAgentConverter2 = z19.strictObject({
+  const ResolvedKayAgentConverter2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     description: NonEmptyString3.optional(),
-    mimeTypes: z19.array(MimeTypeString2).min(1),
-    extensions: z19.array(FileExtensionToken2).min(1).optional()
+    mimeTypes: z20.array(MimeTypeString2).min(1),
+    extensions: z20.array(FileExtensionToken2).min(1).optional()
   });
   const ResolvedReferencePresentationUrlClaim = ReferencePresentationUrlClaim2.extend({
-    brandIcon: z19.string().max(64 * 1024).optional()
+    brandIcon: z20.string().max(64 * 1024).optional()
   });
-  const ResolvedReferencePresentation2 = z19.strictObject({
+  const ResolvedReferencePresentation2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     uriModule: GlobalContributionId2.optional(),
     /** The schemes this presentation is about: its `scheme`, or its module's. */
-    schemes: z19.array(UriScheme2).min(1).optional(),
+    schemes: z20.array(UriScheme2).min(1).optional(),
     /** The module's `displayName`: the source's name in a row. */
     displayName: NonEmptyString3.optional(),
     /** The module's auth service, qualified: whose accounts `accountLinks` reads. */
     authService: GlobalContributionId2.optional(),
     accountLinks: ReferencePresentationAccountLinks2.optional(),
-    addresses: z19.array(ReferencePresentationAddress2).min(1).optional(),
+    addresses: z20.array(ReferencePresentationAddress2).min(1).optional(),
     /** Comes with `open`. A presentation with neither only words its module's addresses. */
     resourceKind: NonEmptyString3.optional(),
     open: ReferenceOpenBehavior2.optional(),
     /** MIME-specific resource kinds; absent keys use the base presentation. */
     variants: ReferencePresentationVariants2.optional(),
-    claims: z19.array(ResolvedReferencePresentationUrlClaim).optional(),
-    tooltip: z19.strictObject({
+    claims: z20.array(ResolvedReferencePresentationUrlClaim).optional(),
+    tooltip: z20.strictObject({
       app: GlobalContributionId2,
       pattern: ReferencePresentationUriPattern2
     }).optional(),
     words: ReferencePresentationWords2.optional()
   });
-  const ResolvedPluginProvisioningRequirement2 = z19.strictObject({
+  const ResolvedPluginProvisioningRequirement2 = z20.strictObject({
     id: LocalContributionId2,
     displayName: NonEmptyString3,
     description: NonEmptyString3,
@@ -6968,15 +7033,15 @@ function createResolvedContractSchemas(canonical) {
      * URL degrades to "Reconnect" in the UI instead of a broken link.
      */
     remediationUrl: HttpsUrl2.optional(),
-    probe: z19.strictObject({
+    probe: z20.strictObject({
       url: HttpsUrl2,
-      method: z19.enum(["GET"]),
-      verdictStatuses: z19.array(SignedInStatusCode2).min(1),
+      method: z20.enum(["GET"]),
+      verdictStatuses: z20.array(SignedInStatusCode2).min(1),
       nonEmptyArrayAt: NonEmptyString3.optional()
     })
   });
   const ResolvedProvisioningField = {
-    provisioning: z19.array(ResolvedPluginProvisioningRequirement2).optional()
+    provisioning: z20.array(ResolvedPluginProvisioningRequirement2).optional()
   };
   const ResolvedPluginAuthSchemeDescriptionFields = {
     displayName: NonEmptyString3.optional(),
@@ -6988,120 +7053,120 @@ function createResolvedContractSchemas(canonical) {
     ...ResolvedPluginAuthSchemeDescriptionFields,
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
-    kind: z19.literal("oauth2"),
-    scopes: z19.array(z19.string()).optional(),
-    connectScopes: z19.array(NonEmptyString3).optional(),
+    kind: z20.literal("oauth2"),
+    scopes: z20.array(z20.string()).optional(),
+    connectScopes: z20.array(NonEmptyString3).optional(),
     authorizationUrl: HttpsUrl2,
     tokenUrl: HttpsUrl2,
-    extraAuthorizeParams: z19.record(z19.string(), z19.string()).optional(),
-    extraAuthorizeParamsWhenAccountHeld: z19.record(NonEmptyString3, z19.string()).optional()
+    extraAuthorizeParams: z20.record(z20.string(), z20.string()).optional(),
+    extraAuthorizeParamsWhenAccountHeld: z20.record(NonEmptyString3, z20.string()).optional()
   };
-  const ResolvedPluginAuthSchemeOAuthPkce = z19.strictObject({
+  const ResolvedPluginAuthSchemeOAuthPkce = z20.strictObject({
     ...ResolvedPluginAuthSchemeOAuthBase,
-    exchange: z19.literal("pkce"),
+    exchange: z20.literal("pkce"),
     byoocProfile: PluginByoocProfile.optional(),
-    clientSuppliers: z19.array(PluginOAuthClientSupplier2).nonempty(),
+    clientSuppliers: z20.array(PluginOAuthClientSupplier2).nonempty(),
     clientId: NonEmptyString3.optional(),
     clientSecret: NonEmptyString3.optional(),
-    account: z19.literal("lookup").optional()
+    account: z20.literal("lookup").optional()
   });
-  const ResolvedPluginAuthSchemeOAuthConfidential = z19.strictObject({
+  const ResolvedPluginAuthSchemeOAuthConfidential = z20.strictObject({
     ...ResolvedPluginAuthSchemeOAuthBase,
-    exchange: z19.literal("confidential"),
-    clientSuppliers: z19.tuple([z19.literal("kay")]),
-    account: z19.enum(["lookup", "sign-in"])
+    exchange: z20.literal("confidential"),
+    clientSuppliers: z20.tuple([z20.literal("kay")]),
+    account: z20.enum(["lookup", "sign-in"])
   });
-  const ResolvedPluginAuthSchemeOAuth2 = z19.discriminatedUnion("exchange", [
+  const ResolvedPluginAuthSchemeOAuth2 = z20.discriminatedUnion("exchange", [
     ResolvedPluginAuthSchemeOAuthPkce,
     ResolvedPluginAuthSchemeOAuthConfidential
   ]);
-  const ResolvedPluginAuthSchemeApiKey = z19.strictObject({
+  const ResolvedPluginAuthSchemeApiKey = z20.strictObject({
     ...ResolvedProvisioningField,
     ...ResolvedPluginAuthSchemeDescriptionFields,
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
-    kind: z19.literal("api-key"),
-    scopes: z19.array(z19.string()).optional(),
+    kind: z20.literal("api-key"),
+    scopes: z20.array(z20.string()).optional(),
     /** Resolution applies the manifest's default, "<service name> API key". */
     inputLabel: NonEmptyString3,
-    fields: z19.array(z19.strictObject({ id: z19.string(), label: z19.string() })).optional(),
-    setup: z19.strictObject({ instructions: z19.string(), url: HttpsUrl2 }).optional(),
-    account: z19.literal("lookup").optional()
+    fields: z20.array(z20.strictObject({ id: z20.string(), label: z20.string() })).optional(),
+    setup: z20.strictObject({ instructions: z20.string(), url: HttpsUrl2 }).optional(),
+    account: z20.literal("lookup").optional()
   });
-  const ResolvedPluginAuthSchemeDelegated = z19.strictObject({
+  const ResolvedPluginAuthSchemeDelegated = z20.strictObject({
     ...ResolvedPluginAuthSchemeDescriptionFields,
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
-    kind: z19.literal("delegated"),
-    scopes: z19.array(z19.string()).optional()
+    kind: z20.literal("delegated"),
+    scopes: z20.array(z20.string()).optional()
   });
-  const ResolvedPluginAuthSchemeExternalCli = z19.strictObject({
+  const ResolvedPluginAuthSchemeExternalCli = z20.strictObject({
     ...ResolvedPluginAuthSchemeDescriptionFields,
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
-    kind: z19.literal("external-cli"),
-    scopes: z19.array(z19.string()).optional(),
+    kind: z20.literal("external-cli"),
+    scopes: z20.array(z20.string()).optional(),
     /** The manifest's connect facts, verbatim. */
     cli: PluginExternalCliConnect2.optional()
   });
-  const ResolvedPluginAuthScheme2 = z19.discriminatedUnion("kind", [
+  const ResolvedPluginAuthScheme2 = z20.discriminatedUnion("kind", [
     ResolvedPluginAuthSchemeOAuth2,
     ResolvedPluginAuthSchemeApiKey,
     ResolvedPluginAuthSchemeDelegated,
     ResolvedPluginAuthSchemeExternalCli
   ]);
-  const ResolvedPluginWebSession2 = z19.strictObject({
-    importance: z19.enum(["required", "recommended"]),
+  const ResolvedPluginWebSession2 = z20.strictObject({
+    importance: z20.enum(["required", "recommended"]),
     loginUrl: HttpsUrl2,
-    cookieDomains: z19.array(RegistrableDomain2).min(1),
-    probe: z19.strictObject({
+    cookieDomains: z20.array(RegistrableDomain2).min(1),
+    probe: z20.strictObject({
       url: HttpsUrl2,
-      method: z19.enum(["GET", "POST"]),
-      signedInStatuses: z19.array(SignedInStatusCode2).min(1)
+      method: z20.enum(["GET", "POST"]),
+      signedInStatuses: z20.array(SignedInStatusCode2).min(1)
     }),
-    oauthVenue: z19.enum(["embedded", "external"]),
-    signInFirst: z19.string().optional()
+    oauthVenue: z20.enum(["embedded", "external"]),
+    signInFirst: z20.string().optional()
   }).superRefine(refineWebSessionScopeConfined);
-  const ResolvedPluginAuthService2 = z19.strictObject({
+  const ResolvedPluginAuthService2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
-    displayName: z19.string(),
-    summary: z19.string().optional(),
-    schemes: z19.array(ResolvedPluginAuthScheme2).min(1),
-    purposes: z19.array(z19.string()).min(1),
+    displayName: z20.string(),
+    summary: z20.string().optional(),
+    schemes: z20.array(ResolvedPluginAuthScheme2).min(1),
+    purposes: z20.array(z20.string()).min(1),
     /** The service's browser half, when the manifest declares one. */
     webSession: ResolvedPluginWebSession2.optional()
   });
-  const ResolvedKayUiAppEndpointCapability2 = z19.union([
-    z19.strictObject({
+  const ResolvedKayUiAppEndpointCapability2 = z20.union([
+    z20.strictObject({
       localId: LocalContributionId2,
       globalId: GlobalContributionId2
     }),
-    z19.strictObject({ pluginId: PluginId2, localId: LocalContributionId2 })
+    z20.strictObject({ pluginId: PluginId2, localId: LocalContributionId2 })
   ]);
-  const ResolvedKayUiApp2 = z19.strictObject({
+  const ResolvedKayUiApp2 = z20.strictObject({
     localId: LocalContributionId2,
     globalId: GlobalContributionId2,
     displayName: NonEmptyString3,
-    contextOnly: z19.literal(true).optional(),
+    contextOnly: z20.literal(true).optional(),
     description: NonEmptyString3.optional(),
     icon: PackageAssetPath2.optional(),
-    runtime: z19.literal("kay.react-app.v1"),
-    sdk: z19.strictObject({ range: NonEmptyString3 }),
+    runtime: z20.literal("kay.react-app.v1"),
+    sdk: z20.strictObject({ range: NonEmptyString3 }),
     entrypoint: TargetEntrypoint2,
-    styles: z19.array(PackageAssetPath2).optional(),
-    assets: z19.array(PackageAssetPath2).optional(),
-    capabilities: z19.strictObject({
-      endpoints: z19.array(ResolvedKayUiAppEndpointCapability2).optional(),
-      host: z19.array(KayUiAppHostCapability2).optional(),
-      feeds: z19.array((canonical ? canonicalContributionSchemas : contributions_exports).UiAppCapabilityReference).optional()
+    styles: z20.array(PackageAssetPath2).optional(),
+    assets: z20.array(PackageAssetPath2).optional(),
+    capabilities: z20.strictObject({
+      endpoints: z20.array(ResolvedKayUiAppEndpointCapability2).optional(),
+      host: z20.array(KayUiAppHostCapability2).optional(),
+      feeds: z20.array((canonical ? canonicalContributionSchemas : contributions_exports).UiAppCapabilityReference).optional()
     }).optional()
   });
-  const ResolvedPluginContractV12 = z19.strictObject({
-    protocol: z19.literal("kay.plugin.v1"),
+  const ResolvedPluginContractV12 = z20.strictObject({
+    protocol: z20.literal("kay.plugin.v1"),
     pluginId: PluginId2,
     namespace: PluginNamespace2,
-    contributions: z19.array(ResolvedPluginContributionId2),
+    contributions: z20.array(ResolvedPluginContributionId2),
     // The deduplicated set of qualified (dotted) external auth-service ids this
     // plugin references, from agent uriModule, tool and cliBinding
     // `authService` refs, card sign-in refs, and auth-grant `service` refs. Always present - a plugin
@@ -7109,19 +7174,19 @@ function createResolvedContractSchemas(canonical) {
     // is a recorded dependency, not a resolution: there is no runtime plugin
     // loader in v1, so nothing here verifies the reference resolves within a
     // composed roster (a composition-time concern owned elsewhere).
-    consumesAuthServices: z19.array(GlobalContributionId2),
+    consumesAuthServices: z20.array(GlobalContributionId2),
     // The explicit plugin-level dependency ids declared in `dependencies.plugins` on the manifest,
     // deduped and validated at parse time. Always present; a plugin with no explicit dependencies
     // carries an empty array. Composition checks each id against the accepted roster and derives the
     // full dependency graph together with auth-inferred edges from `consumesAuthServices`.
-    explicitDependencies: z19.array(PluginId2),
+    explicitDependencies: z20.array(PluginId2),
     dataDirSharedWith: PluginId2.optional(),
-    workers: z19.array(z19.strictObject({
+    workers: z20.array(z20.strictObject({
       localId: LocalContributionId2,
       module: PackageAssetPath2
     })).optional(),
-    workloadPurposes: z19.array(PluginWorkloadPurpose).optional(),
-    shellCommands: z19.array(PluginShellCommand.omit({ endpoint: true }).extend({
+    workloadPurposes: z20.array(PluginWorkloadPurpose).optional(),
+    shellCommands: z20.array(PluginShellCommand.omit({ endpoint: true }).extend({
       endpointId: GlobalContributionId2
     })).optional(),
     projectDirectories: PluginProjectDirectories.omit({ endpoint: true }).extend({ endpointId: GlobalContributionId2 }).optional(),
@@ -7129,27 +7194,27 @@ function createResolvedContractSchemas(canonical) {
     // target must register and the credential authority keys on. Always present;
     // a plugin that declares no `auth.services` carries an empty array. The dual
     // of `consumesAuthServices` (services it merely references).
-    authServices: z19.array(ResolvedPluginAuthService2),
+    authServices: z20.array(ResolvedPluginAuthService2),
     grants: ResolvedPluginGrants2.optional(),
-    kayAgentFamilyFolder: z19.strictObject({ scope: z19.literal("root") }).optional(),
-    kayAgentUriModules: z19.array(ResolvedKayAgentUriModule2).optional(),
-    kayAgentArtifactUriModules: z19.array(ResolvedKayAgentArtifactUriModule2).optional(),
-    kayAgentEntityResolvers: z19.array(ResolvedKayAgentEntityResolver2).optional(),
-    kayAgentGitHostClaims: z19.array(ResolvedKayAgentGitHostClaim2).optional(),
-    kayAgentTools: z19.array(ResolvedKayAgentTool2).optional(),
-    kayAppArtifacts: z19.strictObject({ outputs: z19.literal(true) }).optional(),
-    kayAppUriModules: z19.array(ResolvedKayAgentUriModule2).optional(),
-    kayAppTools: z19.array(ResolvedKayAppTool2).optional(),
-    kayAppApprovalTypes: z19.array(ResolvedKayAppApprovalType2).optional(),
-    kayAppWorkflows: z19.array(ResolvedKayAppWorkflow2).optional(),
-    kayAppCards: z19.array(ResolvedPluginCard2).optional(),
-    kayAppDataSources: z19.array(ResolvedKayAppDataSource2).optional(),
-    kayAppWhiteboardTypes: z19.array(ResolvedKayAppWhiteboardType2).optional(),
-    kayAppWorkingDocumentProviders: z19.array(ResolvedKayAppWorkingDocumentProvider2).optional(),
-    kayAppMcpServers: z19.array(ResolvedKayAppMcpServer2).optional(),
-    kayAgentConverters: z19.array(ResolvedKayAgentConverter2).optional(),
-    referencePresentations: z19.array(ResolvedReferencePresentation2).optional(),
-    kayUiApps: z19.array(ResolvedKayUiApp2).optional()
+    kayAgentFamilyFolder: z20.strictObject({ scope: z20.literal("root") }).optional(),
+    kayAgentUriModules: z20.array(ResolvedKayAgentUriModule2).optional(),
+    kayAgentArtifactUriModules: z20.array(ResolvedKayAgentArtifactUriModule2).optional(),
+    kayAgentEntityResolvers: z20.array(ResolvedKayAgentEntityResolver2).optional(),
+    kayAgentGitHostClaims: z20.array(ResolvedKayAgentGitHostClaim2).optional(),
+    kayAgentTools: z20.array(ResolvedKayAgentTool2).optional(),
+    kayAppArtifacts: z20.strictObject({ outputs: z20.literal(true) }).optional(),
+    kayAppUriModules: z20.array(ResolvedKayAgentUriModule2).optional(),
+    kayAppTools: z20.array(ResolvedKayAppTool2).optional(),
+    kayAppApprovalTypes: z20.array(ResolvedKayAppApprovalType2).optional(),
+    kayAppWorkflows: z20.array(ResolvedKayAppWorkflow2).optional(),
+    kayAppCards: z20.array(ResolvedPluginCard2).optional(),
+    kayAppDataSources: z20.array(ResolvedKayAppDataSource2).optional(),
+    kayAppWhiteboardTypes: z20.array(ResolvedKayAppWhiteboardType2).optional(),
+    kayAppWorkingDocumentProviders: z20.array(ResolvedKayAppWorkingDocumentProvider2).optional(),
+    kayAppMcpServers: z20.array(ResolvedKayAppMcpServer2).optional(),
+    kayAgentConverters: z20.array(ResolvedKayAgentConverter2).optional(),
+    referencePresentations: z20.array(ResolvedReferencePresentation2).optional(),
+    kayUiApps: z20.array(ResolvedKayUiApp2).optional()
   });
   return {
     ResolvedPluginContributionId: ResolvedPluginContributionId2,
@@ -7929,14 +7994,14 @@ function kayPluginCompatibilityAdvisories(input) {
     message: boundPluginDiagnosticMessage(`${manifest.displayName} (${manifest.id}) ${advisory.message}`)
   }));
 }
-var ReadableCompatibility = z20.object({
-  supportedProtocols: z20.array(z20.string()).optional().catch(void 0),
+var ReadableCompatibility = z21.object({
+  supportedProtocols: z21.array(z21.string()).optional().catch(void 0),
   minKayVersion: NonEmptyString.optional().catch(void 0),
   sdk: NonEmptyString.optional().catch(void 0)
 });
-var ReadableManifestHead = z20.object({
-  id: z20.string().optional().catch(void 0),
-  displayName: z20.string().optional().catch(void 0),
+var ReadableManifestHead = z21.object({
+  id: z21.string().optional().catch(void 0),
+  displayName: z21.string().optional().catch(void 0),
   compatibility: ReadableCompatibility.optional().catch(void 0)
 });
 function keepNamespaceDerivedTools(contract, grandfathered) {
@@ -8043,28 +8108,28 @@ function errorText(error) {
 }
 
 // packages/plugin-protocol/dist/session-health.js
-import { z as z21 } from "zod";
+import { z as z22 } from "zod";
 var SESSION_HEALTH_EXTENSION_ID = "kay.session-health";
 var SESSION_HEALTH_ENTRY_NAME = "session_health";
 var SESSION_HEALTH_CUSTOM_TYPE = `ext:${SESSION_HEALTH_EXTENSION_ID}:${SESSION_HEALTH_ENTRY_NAME}`;
 var SESSION_HEALTH_CLASSIFIER_IDS = ["jev"];
-var sessionHealthEntrySchema = z21.object({
-  v: z21.literal(1),
-  verdict: z21.enum(["well", "bad", "unknown"]),
+var sessionHealthEntrySchema = z22.object({
+  v: z22.literal(1),
+  verdict: z22.enum(["well", "bad", "unknown"]),
   /**
    * The model's calibrated confidence in `well`, 0..1, or null when the
    * classifier declined to produce one. Never exported raw: the telemetry
    * event carries only the decile bucket.
    */
-  p_well: z21.number().min(0).max(1).nullable(),
-  classifier: z21.enum(SESSION_HEALTH_CLASSIFIER_IDS),
-  classifier_version: z21.string().min(1).max(64),
-  judged_at: z21.number().int().nonnegative(),
-  user_entry_id: z21.string().min(1).max(256),
-  through_entry_id: z21.string().min(1).max(256),
-  usage: z21.strictObject({
-    input_tokens: z21.number().int().nonnegative(),
-    output_tokens: z21.number().int().nonnegative()
+  p_well: z22.number().min(0).max(1).nullable(),
+  classifier: z22.enum(SESSION_HEALTH_CLASSIFIER_IDS),
+  classifier_version: z22.string().min(1).max(64),
+  judged_at: z22.number().int().nonnegative(),
+  user_entry_id: z22.string().min(1).max(256),
+  through_entry_id: z22.string().min(1).max(256),
+  usage: z22.strictObject({
+    input_tokens: z22.number().int().nonnegative(),
+    output_tokens: z22.number().int().nonnegative()
   }).optional()
 });
 function sessionHealthPWellDecile(pWell) {
@@ -8074,28 +8139,28 @@ function sessionHealthPWellDecile(pWell) {
 }
 
 // packages/plugin-protocol/dist/resource-invocations.js
-import { z as z23 } from "zod";
+import { z as z24 } from "zod";
 
 // packages/plugin-protocol/dist/resource-invocation-cursor.js
-import { z as z22 } from "zod";
-var CorpusResourceInvocationCursor = z22.strictObject({
-  at: z22.iso.datetime({ offset: true }),
-  eventId: z22.string().min(1)
+import { z as z23 } from "zod";
+var CorpusResourceInvocationCursor = z23.strictObject({
+  at: z23.iso.datetime({ offset: true }),
+  eventId: z23.string().min(1)
 });
 
 // packages/plugin-protocol/dist/resource-invocations.js
-var CorpusResourceKind = z23.enum([
+var CorpusResourceKind = z24.enum([
   "skill",
   "context-file",
   "prompt-command"
 ]);
-var CorpusResourceInvocationQuery = z23.strictObject({
+var CorpusResourceInvocationQuery = z24.strictObject({
   kind: CorpusResourceKind,
-  since: z23.iso.datetime({ offset: true }),
-  until: z23.iso.datetime({ offset: true }),
+  since: z24.iso.datetime({ offset: true }),
+  until: z24.iso.datetime({ offset: true }),
   after: CorpusResourceInvocationCursor.optional(),
-  limit: z23.number().int().min(1).max(1e3).optional(),
-  rootCreatedByKind: z23.enum(AGENT_RUNTIME_SESSION_CREATOR_KINDS).optional()
+  limit: z24.number().int().min(1).max(1e3).optional(),
+  rootCreatedByKind: z24.enum(AGENT_RUNTIME_SESSION_CREATOR_KINDS).optional()
 }).refine((value) => Date.parse(value.since) < Date.parse(value.until), {
   message: "since must precede until"
 });
@@ -8275,14 +8340,14 @@ function skillSuggestionEvidenceItems(evidence, options = {}) {
 }
 
 // packages/plugin-protocol/dist/ui-app-package.js
-import { z as z24 } from "zod";
+import { z as z25 } from "zod";
 var KAY_UI_APP_PACKAGE_PROTOCOL = "kay.ui.app-package.v1";
 var KAY_UI_BUNDLE_INDEX_PROTOCOL = "kay.ui.bundle-index.v1";
-var KayUiBundleOutputPath = z24.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.startsWith("./") && !value.includes("\\") && !value.split("/").includes(".."), { message: "bundle output path must stay relative to the bundle root" });
-var KayUiBundleIndexV1 = z24.strictObject({
-  protocol: z24.literal(KAY_UI_BUNDLE_INDEX_PROTOCOL),
+var KayUiBundleOutputPath = z25.string().trim().min(1).refine((value) => !value.startsWith("/") && !value.startsWith("./") && !value.includes("\\") && !value.split("/").includes(".."), { message: "bundle output path must stay relative to the bundle root" });
+var KayUiBundleIndexV1 = z25.strictObject({
+  protocol: z25.literal(KAY_UI_BUNDLE_INDEX_PROTOCOL),
   entryPath: KayUiBundleOutputPath,
-  files: z24.array(z24.strictObject({
+  files: z25.array(z25.strictObject({
     path: KayUiBundleOutputPath,
     mediaType: NonEmptyString
   })).min(1)
@@ -8309,19 +8374,19 @@ var KayUiBundleIndexV1 = z24.strictObject({
 function parseKayUiBundleIndexV1(input) {
   return KayUiBundleIndexV1.parse(input);
 }
-var KayUiAppPackageFile = z24.strictObject({
+var KayUiAppPackageFile = z25.strictObject({
   path: PackageAssetPath,
   mediaType: NonEmptyString,
-  bytes: z24.instanceof(Uint8Array).refine((bytes) => bytes.byteLength > 0, {
+  bytes: z25.instanceof(Uint8Array).refine((bytes) => bytes.byteLength > 0, {
     message: "app package file bytes must not be empty"
   })
 });
-var KayUiAppPackageV1 = z24.strictObject({
-  protocol: z24.literal(KAY_UI_APP_PACKAGE_PROTOCOL),
+var KayUiAppPackageV1 = z25.strictObject({
+  protocol: z25.literal(KAY_UI_APP_PACKAGE_PROTOCOL),
   appLocalId: LocalContributionId,
   entry: KayUiAppPackageFile,
-  styles: z24.array(KayUiAppPackageFile).optional(),
-  assets: z24.array(KayUiAppPackageFile).optional()
+  styles: z25.array(KayUiAppPackageFile).optional(),
+  assets: z25.array(KayUiAppPackageFile).optional()
 }).superRefine((appPackage, ctx) => {
   if (appPackage.entry.mediaType !== "application/javascript") {
     ctx.addIssue({
@@ -8358,28 +8423,28 @@ function parseKayUiAppPackageV1(input) {
 }
 
 // packages/plugin-protocol/dist/product-events.js
-import { z as z25 } from "zod";
+import { z as z26 } from "zod";
 var exportable = {
-  class: z25.literal("exportable"),
-  optional: z25.boolean().optional()
+  class: z26.literal("exportable"),
+  optional: z26.boolean().optional()
 };
-var PluginProductEventField = z25.union([
-  z25.strictObject({ class: z25.literal("local") }),
-  z25.strictObject({
+var PluginProductEventField = z26.union([
+  z26.strictObject({ class: z26.literal("local") }),
+  z26.strictObject({
     ...exportable,
-    type: z25.literal("enum"),
-    values: z25.array(z25.string())
+    type: z26.literal("enum"),
+    values: z26.array(z26.string())
   }),
-  z25.strictObject({
+  z26.strictObject({
     ...exportable,
-    type: z25.literal("number"),
-    min: z25.number(),
-    max: z25.number(),
-    integer: z25.boolean().optional()
+    type: z26.literal("number"),
+    min: z26.number(),
+    max: z26.number(),
+    integer: z26.boolean().optional()
   }),
-  z25.strictObject({
+  z26.strictObject({
     ...exportable,
-    type: z25.enum([
+    type: z26.enum([
       "boolean",
       "id",
       "identifier",
@@ -8395,9 +8460,9 @@ function isPluginProductEventName(name) {
 }
 
 // packages/plugin-protocol/dist/artifact-outputs.js
-import { z as z26 } from "zod";
+import { z as z27 } from "zod";
 var ARTIFACT_OUTPUT_PAGE_MAX = 200;
-var Segment = z26.string().min(1).max(1024).refine((value) => !/[^A-Za-z0-9._-]/.test(value)).refine((value) => value !== "." && value !== "..");
+var Segment = z27.string().min(1).max(1024).refine((value) => !/[^A-Za-z0-9._-]/.test(value)).refine((value) => value !== "." && value !== "..");
 function parseArtifactOutputUri(uri) {
   const match = /^output:\/\/([^/]+)\/([^/]+)$/.exec(uri);
   if (match === null || !Segment.safeParse(match[1]).success || !Segment.safeParse(match[2]).success)
@@ -8407,12 +8472,12 @@ function parseArtifactOutputUri(uri) {
 function isCanonicalArtifactOutputUri(uri) {
   return parseArtifactOutputUri(uri) !== void 0;
 }
-var ArtifactOutputUri = z26.string().refine(isCanonicalArtifactOutputUri, "Expected a canonical output://session/name URI");
-var ArtifactOutputChange = z26.union([
-  z26.strictObject({
-    uris: z26.array(ArtifactOutputUri).min(1).max(ARTIFACT_OUTPUT_PAGE_MAX)
+var ArtifactOutputUri = z27.string().refine(isCanonicalArtifactOutputUri, "Expected a canonical output://session/name URI");
+var ArtifactOutputChange = z27.union([
+  z27.strictObject({
+    uris: z27.array(ArtifactOutputUri).min(1).max(ARTIFACT_OUTPUT_PAGE_MAX)
   }),
-  z26.strictObject({ sessionId: Segment })
+  z27.strictObject({ sessionId: Segment })
 ]);
 
 // packages/plugin-protocol/dist/credential-text.js
@@ -8455,25 +8520,25 @@ function isCredentialShapedText(value) {
 }
 
 // packages/plugin-protocol/dist/ui-module-bundle.js
-import { z as z27 } from "zod";
+import { z as z28 } from "zod";
 var KAY_UI_MODULE_BUNDLE_PROTOCOL = "kay.ui.module-bundle.v1";
 var KAY_UI_MODULE_FILE_MAX_BYTES = 8 * 1024 * 1024;
 var KAY_UI_MODULE_BUNDLE_MAX_BYTES = 32 * 1024 * 1024;
 var KAY_UI_MODULE_BUNDLE_MAX_FILES = 256;
-var OutputPath = z27.string().min(1).max(1024).refine((value) => {
+var OutputPath = z28.string().min(1).max(1024).refine((value) => {
   const parsed = KayUiBundleIndexV1.shape.entryPath.safeParse(value);
   return parsed.success && parsed.data === value && value.split("/").every((part) => part !== "" && part !== ".") && // oxlint-disable-next-line eslint/no-control-regex -- Untrusted artifact paths must reject literal control characters.
   !/[\u0000-\u001f?#:%]/.test(value);
 }, { message: "bundle path must contain only unambiguous relative segments" });
-var Sha256 = z27.string().regex(/^[a-f0-9]{64}$/);
-var KayUiModuleBundleIndexV1 = z27.strictObject({
-  protocol: z27.literal(KAY_UI_MODULE_BUNDLE_PROTOCOL),
+var Sha256 = z28.string().regex(/^[a-f0-9]{64}$/);
+var KayUiModuleBundleIndexV1 = z28.strictObject({
+  protocol: z28.literal(KAY_UI_MODULE_BUNDLE_PROTOCOL),
   entryPath: OutputPath,
-  stylePaths: z27.array(OutputPath).max(KAY_UI_MODULE_BUNDLE_MAX_FILES),
-  files: z27.array(z27.strictObject({
+  stylePaths: z28.array(OutputPath).max(KAY_UI_MODULE_BUNDLE_MAX_FILES),
+  files: z28.array(z28.strictObject({
     path: OutputPath,
-    mediaType: z27.string().min(1).max(128).regex(/^[a-zA-Z0-9!#$&^_.+-]+\/[a-zA-Z0-9!#$&^_.+-]+$/),
-    byteLength: z27.number().int().min(1).max(KAY_UI_MODULE_FILE_MAX_BYTES),
+    mediaType: z28.string().min(1).max(128).regex(/^[a-zA-Z0-9!#$&^_.+-]+\/[a-zA-Z0-9!#$&^_.+-]+$/),
+    byteLength: z28.number().int().min(1).max(KAY_UI_MODULE_FILE_MAX_BYTES),
     sha256: Sha256
   })).min(1).max(KAY_UI_MODULE_BUNDLE_MAX_FILES)
 }).superRefine((index, ctx) => {
@@ -8503,9 +8568,9 @@ var KayUiModuleBundleIndexV1 = z27.strictObject({
       message: "bundle exceeds byte cap"
     });
 });
-var KayUiModuleBundleReference = z27.strictObject({
+var KayUiModuleBundleReference = z28.strictObject({
   generationId: Sha256,
-  revision: z27.string().min(1).max(4096).refine((value) => value.trim() === value),
+  revision: z28.string().min(1).max(4096).refine((value) => value.trim() === value),
   index: KayUiModuleBundleIndexV1
 });
 export {
@@ -8638,6 +8703,10 @@ export {
   PLUGIN_SIGNAL_RELATED_KEYS,
   PLUGIN_SIGNAL_SNIPPET_MAX,
   PLUGIN_SIGNAL_TITLE_MAX,
+  PLUGIN_STATE_ENTRY_MAX_BYTES,
+  PLUGIN_STATE_ENTRY_MAX_DEPTH,
+  PLUGIN_STATE_ENTRY_NAME_PATTERN,
+  PLUGIN_STATE_ENTRY_TYPE_PREFIX,
   PRIVATE_PLUGIN_CAPABILITY_SLUGS,
   PackageAssetPath,
   PluginAgentDefinitionPermissionRule,
@@ -8695,6 +8764,7 @@ export {
   ProjectDirectoryResponse,
   RENAMED_PLUGIN_CAPABILITY_SLUGS,
   RESERVED_DIRECTORY_PLUGIN_ID_PREFIXES,
+  RESET_TEXT_MAX_CHARS,
   RETIRED_COMPATIBILITY_KEYS,
   RETIRED_PERMISSION_ASK_KEYS,
   RETIRED_PLUGIN_CAPABILITY_SLUGS,
@@ -8710,6 +8780,8 @@ export {
   ReferencePresentationVariants,
   ReferencePresentationWords,
   RegistrableDomain,
+  ResetTextContribution,
+  ResetTextEntry,
   ResolvedAuthGrantRequest,
   ResolvedEndpointGrantRequest,
   ResolvedKayAgentArtifactUriModule,
@@ -8830,6 +8902,7 @@ export {
   isDeclaredLocalAppLink,
   isKayPluginCompatibilityRefusal,
   isPluginProductEventName,
+  isPluginStateEntryCustomType,
   isPrivateCapabilityClaim,
   isQualifiedAuthSchemeRef,
   isQualifiedAuthServiceRef,
@@ -8854,6 +8927,7 @@ export {
   parseWhere,
   pluginIconShape,
   pluginSignalPayloadJsonSchema,
+  pluginStateEntryCustomType,
   precedingPersonMessages,
   readKayPluginDeclaredCompatibility,
   refineWebSessionScopeConfined,