@yaklabs-ai/plugin-sdk 0.14.1 → 0.15.1

package/dist/vendored-mcp.d.ts

@@ -22,8 +22,8 @@
  * This module's `read` is a pure projection of the URI it was handed — no network, no credential.
  * Declaring `requiresAuth` anyway would not be a harmless formality: an auth-gated module whose
  * binding is unsatisfied has its public-web `urlPattern` claims suppressed and its `matches()`
- * wrapped to decline `http(s)` (`agent-session.ts` `_suppressPublicUrlClaims`, and
- * `authSuppressedCatalogModule` for discovery). A pasted Supabase link would therefore stay
+ * wrapped to decline `http(s)` (herd-agent's `uri-catalog-projection.ts`: `suppressPublicUrlClaims`,
+ * and `authSuppressedCatalogModule` for discovery). A pasted Supabase link would therefore stay
  * unbranded for every user who has not yet connected Supabase — which is exactly the user the
  * branded pill is for. The vendor's MCP tools remain gated on their own, by the MCP host.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-sdk",
-  "version": "0.14.1",
+  "version": "0.15.1",
   "description": "The Kay plugin SDK — types and helpers for authoring a Kay directory plugin.",
   "author": "YakLabs",
   "type": "module",

package/skills/directory-plugin-authoring/SKILL.md

@@ -289,10 +289,10 @@ on the plugin's row (or on the plugin source's row, when the whole source found
 
 A directory plugin does not request workflows in its manifest. During `kay.app` activation, call
 `app.workflows.define(localId, { name, trigger, run })` to put a durable, daemon-scheduled row on
-the Automations page. The host raises the `workflows.define` claim for every `kay.app` plugin; a
-bundled install holds every grant, while a directory plugin needs the user to add that grant to its
-`installs` row. Source class no longer decides workflow authority, and the capability is ABSENT
-rather than refused when ungranted, so guard on `app.workflows === undefined`.
+the Automations page. The first `define` raises the `workflows.define` claim, decided once
+`activate()` resolves; a bundled install holds every grant, while a directory plugin needs the user
+to add that grant to its `installs` row, and until then it does not start. Source class no longer
+decides workflow authority. `app.workflows` is absent only for a plugin with no workflow namespace.
 
 The product-agent procedure is the builtin skill `create-workflow`
 (`packages/agent-runtime/src/kay/builtin-skills/`), and the API reference is the "Durable Workflows