@yaklabs-ai/plugin-protocol 0.8.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 YakLabs
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,58 @@
+# @yaklabs-ai/plugin-protocol
+
+The **`kay.plugin.v1` manifest schema** — the same Zod schema Kay's daemon uses
+to parse `kay-plugin.json` at load time.
+
+Published to the public npm registry under the MIT licence, always at the same
+version as `@yaklabs-ai/plugin-sdk`. No registry configuration and no access
+token are needed. See `@yaklabs-ai/plugin-sdk`'s README for the full authoring
+flow.
+
+```json
+{
+  "dependencies": {
+    "@kay/plugin-protocol": "npm:@yaklabs-ai/plugin-protocol@^0.8.4"
+  }
+}
+```
+
+## Why you want this
+
+Validate your manifest in your own CI, against the real schema, instead of a
+hand-written approximation:
+
+```js
+import { KayPluginManifestV1 } from "@kay/plugin-protocol";
+
+const parsed = KayPluginManifestV1.safeParse(
+  JSON.parse(await readFile("kay-plugin.json", "utf8")),
+);
+if (!parsed.success) {
+  for (const issue of parsed.error.issues) {
+    console.error(`${issue.path.join(".") || "<root>"}: ${issue.message}`);
+  }
+  process.exit(1);
+}
+```
+
+A hand-rolled field check drifts from the contract it claims to enforce and
+passes while the host rejects the plugin at load. This is the host's own schema,
+so it cannot drift — and unlike resolving it out of a Kay checkout, it needs no
+clone, no build, and no `KAY_REPO` environment variable.
+
+## Version it against your Kay app
+
+The schema changes over time — it gains fields, and it can also **remove** one.
+Three skews follow, and only the first two fail on your machine:
+
+- Validating against a **newer** schema than your Kay app runs can accept a
+  manifest the host will reject.
+- Validating against an **older** schema can reject a manifest the host would
+  happily load.
+- Validating against an **older** schema can also _accept_ a field the host has
+  since removed. `KayPluginManifestV1` parses with `strictObject`, so an
+  unrecognized key is a hard rejection: your local validation goes green, and
+  Kay drops the plugin at load with a diagnostic you never see.
+
+Keep this package in step with the Kay version you target — the third skew is
+the one a green local run will not warn you about.

package/THIRD-PARTY-INVENTORY.json

@@ -0,0 +1,23 @@
+{
+  "schemaVersion": 1,
+  "package": "@yaklabs-ai/plugin-protocol",
+  "version": "0.8.4",
+  "target": "npm",
+  "firstPartyLicense": "MIT",
+  "bundled": [],
+  "external": [
+    {
+      "name": "zod",
+      "license": "MIT",
+      "source": "https://github.com/colinhacks/zod",
+      "note": "Installed as a consumer dependency; it is not bundled into the staged artifacts.",
+      "versionRange": "^4.0.0"
+    },
+    {
+      "name": "@typesafe-ai/sdk",
+      "license": "MIT",
+      "source": "https://github.com/typesafe-ai/typesafe-sdk-js",
+      "note": "Types-only: the SDK re-exports the vendor's Jev client types, and the vendor's nominal class must stay a single declaration across entrypoints. Installed as a consumer dependency; a plugin never declares it itself."
+    }
+  ]
+}

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,5 @@
+# Third-party notices
+
+This package bundles 0 first-party-selected component(s). The notices below are reproduced verbatim from each component's upstream MIT license source.
+
+The package's own code is licensed under the MIT License in `LICENSE`.