@yaklabs-ai/plugin-sdk 0.14.0 → 0.15.0

package/dist/kay-app.d.ts

@@ -1,3 +1,4 @@
+import { pathToFileURL } from 'node:url';
 import type { StatementSync } from 'node:sqlite';
 import { z } from 'zod';
 
@@ -78,6 +79,8 @@ export declare interface AgentToolResult<T = JsonValue_2 | undefined> {
      * error, but `details` and `structuredContent` are kept for the UI and programmatic callers.
      */
     isError?: boolean;
+    /** Classification for an `isError` result; the host validates it and stamps identity and attribution. */
+    failure?: ToolCallFailure;
     /**
      * Hint that the agent should stop after the current tool batch.
      * Early termination only happens when every finalized tool result in the batch sets this to true.
@@ -296,6 +299,12 @@ declare interface BackgroundTaskAdoptOptions {
     readonly ownerId?: string;
     readonly inspect?: BackgroundTaskInspector;
     readonly meta?: Readonly<Record<string, unknown>>;
+    /**
+     * The task's owner waits for its result: the work was meant to finish and report back (a build,
+     * a test run). Absent or false: nothing waits on it (a dev server, a watcher). The kernel only
+     * carries this fact on the task's snapshot; what waiting means is the host's to decide.
+     */
+    readonly awaitsResult?: boolean;
     /** Scoped settlement hook for the task created by this adoption only. */
     readonly onSettled?: (completion: BackgroundTaskCompletion) => void;
 }
@@ -370,6 +379,8 @@ declare interface BackgroundTaskSnapshot {
     readonly startedAtMs: number;
     readonly updatedAtMs: number;
     readonly meta?: Readonly<Record<string, unknown>>;
+    /** The owner waits for this task's result; see `BackgroundTaskAdoptOptions.awaitsResult`. */
+    readonly awaitsResult?: boolean;
 }
 
 declare type BackgroundTaskStatus = "queued" | "running" | "completed" | "failed" | "cancelled";
@@ -843,7 +854,7 @@ declare interface DecideChoiceQuestion<L extends string = string> {
 /** What a question asks: text, or a JSON object the client sends as its JSON text. */
 declare type DecideInstructions = string | object;
 
-declare type DecideModelId = "jev" | "clef" | "clef-flash";
+declare type DecideModelId = "jev" | "clef" | "clef-flash" | "gpt-6-luna";
 
 declare type DecideQuestion = DecideBoolQuestion | DecideChoiceQuestion | DecideScoreQuestion;
 
@@ -851,10 +862,10 @@ declare type DecideQuestion = DecideBoolQuestion | DecideChoiceQuestion | Decide
 declare type DecideQuestions = Readonly<Record<string, DecideQuestion>>;
 
 declare interface DecideRequest<Q extends DecideQuestions = DecideQuestions> {
-    /** Defaults to `jev`. */
-    readonly model?: DecideModelId;
+    readonly model: DecideModelId;
     readonly state: DecideState;
     readonly questions: Q;
+    readonly image?: SystemOneImage;
 }
 
 declare interface DecideScoreAnswer {
@@ -1235,7 +1246,10 @@ declare interface ExtensionAuthContext {
 
 /** Optional extension-facing APIs for background task orchestration. */
 declare interface ExtensionBackgroundTasksApi {
-    adopt(taskKind: BackgroundTaskKind, label: string, run: BackgroundTaskRun, options?: BackgroundTaskAdoptOptions): string;
+    adopt(taskKind: BackgroundTaskKind, label: string, run: BackgroundTaskRun, options?: BackgroundTaskAdoptOptions & {
+        readonly awaitsResult?: false;
+    }): string;
+    adopt(taskKind: BackgroundTaskKind, label: string, run: BackgroundTaskRun, options: BackgroundTaskAdoptOptions): string | Promise<string>;
     list(): readonly BackgroundTaskSnapshot[];
     get(taskId: string): BackgroundTaskSnapshot | undefined;
 }
@@ -2093,6 +2107,26 @@ export declare interface KayAppAccountProfileUpdate {
     readonly displayName: string;
 }
 
+/**
+ * Service/scheme IDs are local when owned, globally qualified when consumed.
+ * Omitting scheme searches all admitted schemes.
+ */
+export declare interface KayAppAccountRequest {
+    readonly serviceId: string;
+    readonly schemeId?: string;
+}
+
+/** Stored account state, without resolving or refreshing its credential. */
+export declare interface KayAppAccountSummary {
+    readonly accountId: string;
+    /** Global scheme ID, matching a resolved credential's schemeId. */
+    readonly schemeId: string;
+    readonly label?: string;
+    readonly scopes?: readonly string[];
+    /** Last recorded health; unknown means no health observation was stored. */
+    readonly status: "ok" | "needs_reauth" | "refresh_failed" | "revoked" | "unknown";
+}
+
 /**
  * A plugin's `kay.app` activation — receives only the brokered {@link KayAppPluginApi}. Runs ONCE at
  * host start, fully awaited before any session starts.
@@ -2343,22 +2377,25 @@ export declare interface KayAppAssistantMessageSessionEvent extends KayAppSessio
 
 /** The brokered credential capability. Present only when granted. */
 export declare interface KayAppAuth {
+    /** Resolve a granted credential for a declared purpose. */
+    resolve(request: KayAppResolveCredentialRequest): Promise<KayAppResolvedCredential>;
     /**
-     * Resolve the credential for a declared, granted service+scheme. Rejects when the grant is absent,
-     * the account is not connected, or the purpose is not one the service declared.
+     * Enumerate an owned or consumed service under an explicit list grant in
+     * permissions.byTarget["kay.app"].auth. Consumption or resolve alone does not allow listing;
+     * shared-identity services also require auth.shared-identity authorization.
+     * Includes accounts needing repair within admitted schemes, without broadening resolve grants.
+     * Never resolves, decrypts secret material, refreshes, or calls a provider. Invalid or
+     * unauthorized requests reject; an authorized service with no accounts returns an empty list.
      */
-    resolve(request: KayAppResolveCredentialRequest): Promise<KayAppResolvedCredential>;
+    listAccounts(request: KayAppAccountRequest): Promise<readonly KayAppAccountSummary[]>;
     /**
-     * Whether a credential is currently resolvable. Intended for availability-style probes a
-     * settings screen calls repeatedly.
-     *
-     * Answers `false` rather than throwing when nothing is connected, and never returns material to
-     * the caller. It does NOT yet answer without resolving: today it runs the full resolve internally
-     * and discards the result, so it can decrypt a secret — and, for a refreshable scheme, take the
-     * network — to produce a boolean. Do not read this as a cheap probe. Tracked in #1048; the fix is
-     * a `list`-scoped grant plus `listAccounts`, which answers from record metadata alone.
+     * Stored availability, not proof that a provider request will authenticate. False for no
+     * matching account or only revoked/needs-reauth accounts. Uses explicit list permission for
+     * owned or consumed services when present, otherwise resolve permission within its account
+     * bounds. Never resolves, decrypts secrets, refreshes, or calls a provider.
+     * Storage and authorization failures reject.
      */
-    has(request: Omit<KayAppResolveCredentialRequest, "purpose">): Promise<boolean>;
+    has(request: KayAppAccountRequest): Promise<boolean>;
 }
 
 /**
@@ -3863,11 +3900,11 @@ export declare interface KayAppPluginApi {
      */
     readonly sessionEvents: KayAppSessionEvents;
     /**
-     * Grant-gated time-triggered workflow registration. PRESENT ONLY for a plugin holding the
-     * `workflows.define` claim in the user's grant ledger — no manifest request and no source-class
-     * gate; `undefined` otherwise. Same deny-by-default rule as {@link corpus}: an ungranted plugin
-     * cannot even reference the capability, so guard with `if (app.workflows === undefined) return;`
-     * rather than assuming it is there.
+     * Grant-gated time-triggered workflow registration. Present for a plugin the host has a workflow
+     * namespace for; `undefined` otherwise. The first `define` asks for the `workflows.define` claim
+     * in the user's grant ledger — no manifest request and no source-class gate — and it is decided
+     * once `activate()` resolves: an ungranted plugin does not start until the user allows it. A
+     * plugin that defines no workflow is never asked.
      */
     readonly workflows?: KayAppWorkflows;
     /**
@@ -3887,7 +3924,7 @@ export declare interface KayAppPluginApi {
     readonly permissions?: KayAppPermissions;
     /**
      * Credential resolution for an auth service this plugin declares. PRESENT ONLY for plugins whose
-     * manifest wires `auth.operations: ["resolve"]` on this target (deny-by-default); `undefined`
+     * manifest wires `auth.operations` including `"list"` or `"resolve"` on this target (deny-by-default); `undefined`
      * otherwise. Auth is manifest WIRING (the host binds the credential vault before any code runs),
      * so its presence is declaration-driven, unlike the claim-checked capabilities above.
      */
@@ -3973,12 +4010,7 @@ export declare interface KayAppPluginApi {
 }
 
 export declare interface KayAppPluginEvents {
-    publish(localId: string, payload: unknown, options?: {
-        readonly subject?: {
-            readonly kind: string;
-            readonly id?: string;
-        };
-    }): void;
+    publish(localId: string, input: PluginEventPublishInput): void;
 }
 
 export declare type KayAppProcessingSpeed = "standard" | "fast";
@@ -4111,12 +4143,12 @@ export declare interface KayAppRepos {
 
 /** What the plugin is asking for, and what it intends to do with it. */
 export declare interface KayAppResolveCredentialRequest {
-    /** An auth service this plugin's own manifest declares, by its LOCAL id. */
+    /** A granted service: local ID when owned, globally qualified ID when consumed. */
     readonly serviceId: string;
-    /** Exact scheme to require; omit to resolve the service's sole connected scheme. */
+    /** Local scheme ID when owned, globally qualified when consumed; omit for the sole connected scheme. */
     readonly schemeId?: string;
     /**
-     * One of the `purposes` the declared service lists. The host pins the resolved grant to it, so a
+     * One of the service's `purposes` admitted by the manifest grant. The host pins the grant to it, so a
      * credential taken for `"transcription"` cannot be replayed for anything else.
      */
     readonly purpose: string;
@@ -4125,8 +4157,8 @@ export declare interface KayAppResolveCredentialRequest {
 /**
  * ---
  * responsibility: The plugin-facing credential surface of the `kay.app` target SDK. A daemon-hosted
- *   plugin resolves the credential for an auth service **it declared in its own manifest**, so a
- *   cloud adapter's secret is read where the work happens and never crosses a process boundary.
+ *   plugin lists account metadata or resolves credentials for an owned or consumed auth service
+ *   under explicit grants. Credential material is read where the work happens.
  * owns:
  *   - {@link KayAppAuth}, {@link KayAppResolvedCredential}.
  * does_not_own:
@@ -4137,8 +4169,8 @@ export declare interface KayAppResolveCredentialRequest {
  * ## Deny-by-default
  *
  * `KayAppPluginApi.auth` is **present only for plugins the host grants** (`auth.operations`
- * containing `"resolve"` in `permissions.byTarget["kay.app"]`, against a service the manifest
- * declares) and `undefined` otherwise — an ungranted plugin cannot even reference the capability.
+ * containing `"list"` or `"resolve"` in `permissions.byTarget["kay.app"]`, against an owned or consumed
+ * service) and `undefined` otherwise — an ungranted plugin cannot even reference the capability.
  * This mirrors `KayAppPluginApi.corpus`, and it is the rule for every capability behind a grant:
  * never hand a plugin an object whose grant is decorative.
  *
@@ -5952,6 +5984,8 @@ export declare interface KayAppWhiteboardTypes {
  *   different process. Anything you need later belongs in a step's return value.
  */
 export declare interface KayAppWorkflowContext {
+    /** State from the last successful run; undefined until a run saves it. */
+    readonly state: JsonValue | undefined;
     readonly automationId: string;
     readonly runId: string;
     readonly match: Extract<KayAppAutomationMatch, {
@@ -6024,6 +6058,8 @@ export declare interface KayAppWorkflowDefinition {
         readonly kind: "time";
     }>;
     readonly run: (context: KayAppWorkflowContext) => Promise<{
+        /** Replacement JSON state, at most 64 KiB; omission keeps the previous value. */
+        readonly state?: JsonValue | undefined;
         readonly summary: KayAppRunSummary;
         readonly produced?: KayAppRunProduced;
         readonly effect?: KayAppRunEffect;
@@ -7134,6 +7170,8 @@ declare function Partial_2<Type extends TSchema>(type: Type, options?: TSchemaOp
 /** Creates a deferred Partial action. */
 declare function PartialDeferred<Type extends TSchema>(type: Type, options?: TSchemaOptions): TPartialDeferred<Type>;
 
+export { pathToFileURL }
+
 declare const Pattern: (input: string) => [unknown, string] | [];
 
 declare const PatternBase: (input: string) => [unknown, string] | [];
@@ -7294,6 +7332,42 @@ export declare const PluginAgentDefinitionPermissionRule: z.ZodObject<{
 
 export declare type PluginAgentDefinitionPermissionRule = z.infer<typeof PluginAgentDefinitionPermissionRule>;
 
+export declare const PluginEventEnvelope: z.ZodObject<{
+    id: z.ZodString;
+    localId: z.ZodString;
+    type: z.ZodString;
+    version: z.ZodNumber;
+    uri: z.ZodString;
+    related: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    key: z.ZodOptional<z.ZodString>;
+    occurredAt: z.ZodISODateTime;
+    publishedAt: z.ZodISODateTime;
+    source: z.ZodObject<{
+        poller: z.ZodOptional<z.ZodString>;
+        runId: z.ZodOptional<z.ZodString>;
+        layer: z.ZodLiteral<"runtime">;
+        pluginId: z.ZodString;
+        sessionId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    payload: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+}, z.core.$strict>;
+
+export declare type PluginEventEnvelope = z.infer<typeof PluginEventEnvelope>;
+
+export declare const PluginEventPublishInput: z.ZodObject<{
+    uri: z.ZodString;
+    related: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;
+    key: z.ZodOptional<z.ZodString>;
+    occurredAt: z.ZodOptional<z.ZodISODateTime>;
+    source: z.ZodOptional<z.ZodObject<{
+        poller: z.ZodOptional<z.ZodString>;
+        runId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+    payload: z.ZodOptional<z.ZodType<JsonValue, unknown, z.core.$ZodTypeInternals<JsonValue, unknown>>>;
+}, z.core.$strict>;
+
+export declare type PluginEventPublishInput = z.infer<typeof PluginEventPublishInput>;
+
 declare const Properties: (input: string) => [unknown, string] | [];
 
 declare function PropertiesMapping(input: [unknown, unknown, unknown]): unknown;
@@ -8590,7 +8664,7 @@ declare interface SystemOneClient {
     decide<const Q extends DecideQuestions>(request: DecideRequest<Q>, options?: SystemOneCallOptions): Promise<Decision<Q>>;
     extract<const F extends ExtractFields>(request: ExtractRequest<F>, options?: SystemOneCallOptions): Promise<Extraction<F>>;
     /** Whether some provider in the current order can serve `(kind, model)`. Never rejects. */
-    availability(kind: SystemOneKind, model?: SystemOneModelId): Promise<Availability>;
+    availability(kind: SystemOneKind, model: SystemOneModelId): Promise<Availability>;
 }
 
 /**
@@ -8625,6 +8699,12 @@ declare type SystemOneFailureCause = {
     readonly kind: "invalid-answer";
 };
 
+/** One PNG attachment. `data` is padded base64, without a data-URL prefix. */
+declare interface SystemOneImage {
+    readonly mimeType: "image/png";
+    readonly data: string;
+}
+
 /**
  * ---
  * responsibility: The data shapes of the System One surface: models, the decide and extract
@@ -10818,6 +10898,14 @@ declare interface Tool<TParameters extends TSchema = TSchema> {
     constrainedSampling?: false | ConstrainedSamplingConfig;
 }
 
+/**
+ * The closed vocabulary of tool call failure codes. The engine and the tools
+ * mint only these; a returned failure with a code outside it is not a
+ * classification (the engine records the rejection on an unexplained failure),
+ * and a stored record with one reads as none.
+ */
+declare const TOOL_CALL_FAILURE_CODES: readonly ["tool.invalid_input", "tool.blocked", "tool.cancelled", "tool.timeout", "tool.not_found", "tool.unavailable", "tool.execution_failed", "provider.http", "provider.api", "provider.transport", "uri.not_found", "uri.unsupported_operation", "uri.not_connected", "uri.auth_unavailable", "permission.denied", "edit.empty_edits", "edit.text_not_found", "edit.text_not_unique", "edit.empty_old_text", "edit.overlapping_edits", "edit.no_change"];
+
 /**
  * ---
  * responsibility: The declarative permission classification a tool carries on its definition
@@ -10862,6 +10950,56 @@ declare interface ToolCall {
     argumentsError?: string;
 }
 
+/**
+ * The lane's classification of why one tool invocation failed: a searchable
+ * machine code and the cause the tool or engine classified at execution.
+ */
+declare interface ToolCallFailure extends ToolCallFailureCause {
+    readonly code: ToolCallFailureCode;
+}
+
+declare type ToolCallFailureCause = z.infer<typeof toolCallFailureCauseSchema>;
+
+declare const toolCallFailureCauseSchema: z.ZodObject<{
+    category: z.ZodEnum<{
+        cancelled: "cancelled";
+        timeout: "timeout";
+        unknown: "unknown";
+        provider: "provider";
+        "invalid-input": "invalid-input";
+        "not-connected": "not-connected";
+        "unsupported-operation": "unsupported-operation";
+        "not-found": "not-found";
+        permission: "permission";
+        unavailable: "unavailable";
+    }>;
+    retryable: z.ZodBoolean;
+    action: z.ZodEnum<{
+        unknown: "unknown";
+        none: "none";
+        retry: "retry";
+        "correct-input": "correct-input";
+        connect: "connect";
+    }>;
+    details: z.ZodOptional<z.ZodObject<{
+        moduleId: z.ZodOptional<z.ZodString>;
+        toolOwnerId: z.ZodOptional<z.ZodString>;
+        operation: z.ZodOptional<z.ZodString>;
+        uri: z.ZodOptional<z.ZodString>;
+        path: z.ZodOptional<z.ZodString>;
+        validationField: z.ZodOptional<z.ZodString>;
+        errorName: z.ZodOptional<z.ZodString>;
+        errorCode: z.ZodOptional<z.ZodString>;
+        providerCode: z.ZodOptional<z.ZodString>;
+        status: z.ZodOptional<z.ZodNumber>;
+        editIndex: z.ZodOptional<z.ZodNumber>;
+        occurrences: z.ZodOptional<z.ZodNumber>;
+        retryAfterMs: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+
+declare type ToolCallFailureCode = (typeof TOOL_CALL_FAILURE_CODES)[number];
+
 /** A call to judge with {@link ToolContext.checkToolCallPermission}. */
 declare interface ToolCallPermissionCheck {
     readonly toolName: string;

package/dist/kay-app.js

@@ -163,6 +163,9 @@ function invalidObservation(input) {
   };
 }
 
+// packages/plugin-sdk/dist/kay-app/index.js
+import { pathToFileURL } from "node:url";
+
 // packages/herd-uri/dist/errors.js
 var UriError = class extends Error {
 };
@@ -537,6 +540,7 @@ export {
   invalidObservation,
   isRetryable,
   parseLineSelector,
+  pathToFileURL,
   payload,
   transcriptMessageText,
   transcriptMessageTexts,

package/dist/system-one.d.ts

@@ -42,7 +42,7 @@ export declare interface DecideChoiceQuestion<L extends string = string> {
 /** What a question asks: text, or a JSON object the client sends as its JSON text. */
 export declare type DecideInstructions = string | object;
 
-export declare type DecideModelId = "jev" | "clef" | "clef-flash";
+export declare type DecideModelId = "jev" | "clef" | "clef-flash" | "gpt-6-luna";
 
 export declare type DecideQuestion = DecideBoolQuestion | DecideChoiceQuestion | DecideScoreQuestion;
 
@@ -50,10 +50,10 @@ export declare type DecideQuestion = DecideBoolQuestion | DecideChoiceQuestion |
 export declare type DecideQuestions = Readonly<Record<string, DecideQuestion>>;
 
 export declare interface DecideRequest<Q extends DecideQuestions = DecideQuestions> {
-    /** Defaults to `jev`. */
-    readonly model?: DecideModelId;
+    readonly model: DecideModelId;
     readonly state: DecideState;
     readonly questions: Q;
+    readonly image?: SystemOneImage;
 }
 
 export declare interface DecideScoreAnswer {
@@ -243,7 +243,7 @@ export declare interface SystemOneClient {
     decide<const Q extends DecideQuestions>(request: DecideRequest<Q>, options?: SystemOneCallOptions): Promise<Decision<Q>>;
     extract<const F extends ExtractFields>(request: ExtractRequest<F>, options?: SystemOneCallOptions): Promise<Extraction<F>>;
     /** Whether some provider in the current order can serve `(kind, model)`. Never rejects. */
-    availability(kind: SystemOneKind, model?: SystemOneModelId): Promise<SystemOneAvailability>;
+    availability(kind: SystemOneKind, model: SystemOneModelId): Promise<SystemOneAvailability>;
 }
 
 /**
@@ -297,6 +297,12 @@ export declare type SystemOneFailureCause = {
     readonly kind: "invalid-answer";
 };
 
+/** One PNG attachment. `data` is padded base64, without a data-URL prefix. */
+export declare interface SystemOneImage {
+    readonly mimeType: "image/png";
+    readonly data: string;
+}
+
 /**
  * ---
  * responsibility: The data shapes of the System One surface: models, the decide and extract

package/dist/system-one.js

@@ -23,20 +23,6 @@ function isSystemOneError(error) {
   return error instanceof SystemOneError;
 }
 
-// packages/system-one/dist/models.js
-var DEFAULT_DECIDE_MODEL = "jev";
-var SYSTEM_ONE_LIMITS = {
-  /** The serialized request body, in bytes. */
-  maxBodyBytes: 64 * 1024,
-  maxQuestions: 64,
-  maxFields: 32,
-  minChoiceOptions: 2,
-  maxChoiceOptions: 255,
-  minScoreLevels: 2,
-  maxScoreLevels: 10,
-  maxForecastHorizon: 64
-};
-
 // packages/system-one/dist/unavailable.js
 var NOT_SERVED = {
   available: false,
@@ -48,7 +34,7 @@ function createUnavailableSystemOneClient() {
     decide(request) {
       return Promise.reject(new SystemOneError({
         kind: "decide",
-        model: request.model ?? DEFAULT_DECIDE_MODEL,
+        model: request.model,
         cause: { kind: "not-served" }
       }));
     },
@@ -62,6 +48,22 @@ function createUnavailableSystemOneClient() {
     availability: () => Promise.resolve(NOT_SERVED)
   };
 }
+
+// packages/system-one/dist/models.js
+var SYSTEM_ONE_LIMITS = {
+  /** The serialized state and questions, in bytes; images have a separate budget. */
+  maxBodyBytes: 64 * 1024,
+  maxImageBytes: 4 * 1024 * 1024,
+  maxImagePixels: 16e6,
+  maxImageBodyBytes: 6 * 1024 * 1024,
+  maxQuestions: 64,
+  maxFields: 32,
+  minChoiceOptions: 2,
+  maxChoiceOptions: 255,
+  minScoreLevels: 2,
+  maxScoreLevels: 10,
+  maxForecastHorizon: 64
+};
 export {
   SystemOneError,
   createUnavailableSystemOneClient,

package/dist/transcript.d.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod';
 
+export declare const ATTACHMENTS_CUSTOM_TYPE = "attachments";
+
 /**
  * The ids on a session's active branch: the leaf chain walked parent-ward from
  * the tip, which a trailing `leaf` marker moves. Empty for an empty log.
@@ -43,6 +45,36 @@ export declare function matchesWorkBlock(coverage: WorkBlockCoverage, toolResult
  */
 export declare const NON_ACTIVITY_TOOL_NAMES: readonly string[];
 
+/**
+ * What a run did to a URI. The words match the automation run wire's artifact actions. When one
+ * run both creates and updates a URI, the reader reports `created`.
+ */
+declare type ProducedResourceAction = "created" | "updated";
+
+/** One URI a tool call created or updated as a side effect. */
+declare interface ProducedResourceDeclaration {
+    /** A `scheme://…` URI or an absolute local file path, compared as an exact string. */
+    readonly uri: string;
+    readonly action: ProducedResourceAction;
+}
+
+/**
+ * One tool result's declarations. `absent` covers every result that makes no claim, including a
+ * non-object `details` and an empty list. `malformed` means a claim was made that cannot be
+ * trusted; the reader reports a gap for it instead of keeping the parts that look valid.
+ */
+declare type ProducedResourceDeclarationsRead = {
+    readonly kind: "absent";
+} | {
+    readonly kind: "malformed";
+} | {
+    readonly kind: "declared";
+    readonly resources: readonly ProducedResourceDeclaration[];
+};
+
+/** Read the declarations that one persisted tool result's `details` carries. */
+export declare function readProducedResourceDeclarations(details: unknown): ProducedResourceDeclarationsRead;
+
 /**
  * The daemon's own run-start record. A run's entries begin here, before the
  * user message that opened it.

package/dist/transcript.js

@@ -94,7 +94,47 @@ var NON_ACTIVITY_TOOL_NAMES = [
 ];
 var WORK_HEADLINE_MIN_CHARS = 12;
 var WORK_HEADLINE_MAX_CHARS = 90;
+
+// packages/herd-transcript/dist/context-messages.js
+var ATTACHMENTS_CUSTOM_TYPE = "attachments";
+
+// packages/herd-uri/dist/produced-resources.js
+var PRODUCED_RESOURCES_DETAILS_KEY = "producedResources";
+var ABSENT = { kind: "absent" };
+var MALFORMED = { kind: "malformed" };
+var SCHEME_URI = /^[a-z][a-z0-9+.-]*:\/\/./;
+var WINDOWS_ABSOLUTE_PATH = /^[A-Za-z]:[\\/]./;
+function isProducedResourceUri(value) {
+  if (typeof value !== "string" || value.trim() !== value)
+    return false;
+  return SCHEME_URI.test(value) || value.startsWith("/") && value.length > 1 || WINDOWS_ABSOLUTE_PATH.test(value);
+}
+function isProducedResourceDeclaration(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const keys = Object.keys(value);
+  if (keys.length !== 2 || !keys.includes("uri") || !keys.includes("action")) {
+    return false;
+  }
+  const record = value;
+  return isProducedResourceUri(record.uri) && (record.action === "created" || record.action === "updated");
+}
+function readProducedResourceDeclarations(details) {
+  if (typeof details !== "object" || details === null || Array.isArray(details) || !Object.hasOwn(details, PRODUCED_RESOURCES_DETAILS_KEY)) {
+    return ABSENT;
+  }
+  const claimed = details[PRODUCED_RESOURCES_DETAILS_KEY];
+  if (!Array.isArray(claimed))
+    return MALFORMED;
+  if (claimed.length === 0)
+    return ABSENT;
+  if (!claimed.every(isProducedResourceDeclaration))
+    return MALFORMED;
+  return { kind: "declared", resources: claimed };
+}
 export {
+  ATTACHMENTS_CUSTOM_TYPE,
   NON_ACTIVITY_TOOL_NAMES,
   RUN_STARTED_CUSTOM_TYPE,
   RUN_TERMINAL_CUSTOM_TYPE,
@@ -105,6 +145,7 @@ export {
   branchEntryIds,
   customEntriesFromEntries,
   matchesWorkBlock,
+  readProducedResourceDeclarations,
   turnSegments,
   workBlockCoverage,
   workBlockKey

package/dist/vendored-mcp.d.ts

@@ -22,8 +22,8 @@
  * This module's `read` is a pure projection of the URI it was handed — no network, no credential.
  * Declaring `requiresAuth` anyway would not be a harmless formality: an auth-gated module whose
  * binding is unsatisfied has its public-web `urlPattern` claims suppressed and its `matches()`
- * wrapped to decline `http(s)` (`agent-session.ts` `_suppressPublicUrlClaims`, and
- * `authSuppressedCatalogModule` for discovery). A pasted Supabase link would therefore stay
+ * wrapped to decline `http(s)` (herd-agent's `uri-catalog-projection.ts`: `suppressPublicUrlClaims`,
+ * and `authSuppressedCatalogModule` for discovery). A pasted Supabase link would therefore stay
  * unbranded for every user who has not yet connected Supabase — which is exactly the user the
  * branded pill is for. The vendor's MCP tools remain gated on their own, by the MCP host.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-sdk",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "The Kay plugin SDK — types and helpers for authoring a Kay directory plugin.",
   "author": "YakLabs",
   "type": "module",

package/skills/directory-plugin-authoring/SKILL.md

@@ -289,10 +289,10 @@ on the plugin's row (or on the plugin source's row, when the whole source found
 
 A directory plugin does not request workflows in its manifest. During `kay.app` activation, call
 `app.workflows.define(localId, { name, trigger, run })` to put a durable, daemon-scheduled row on
-the Automations page. The host raises the `workflows.define` claim for every `kay.app` plugin; a
-bundled install holds every grant, while a directory plugin needs the user to add that grant to its
-`installs` row. Source class no longer decides workflow authority, and the capability is ABSENT
-rather than refused when ungranted, so guard on `app.workflows === undefined`.
+the Automations page. The first `define` raises the `workflows.define` claim, decided once
+`activate()` resolves; a bundled install holds every grant, while a directory plugin needs the user
+to add that grant to its `installs` row, and until then it does not start. Source class no longer
+decides workflow authority. `app.workflows` is absent only for a plugin with no workflow namespace.
 
 The product-agent procedure is the builtin skill `create-workflow`
 (`packages/agent-runtime/src/kay/builtin-skills/`), and the API reference is the "Durable Workflows