@yaklabs-ai/plugin-sdk 0.48.0 → 0.49.0

package/README.md

@@ -13,7 +13,7 @@ it under the name your plugin code actually imports:
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-sdk": "npm:@yaklabs-ai/plugin-sdk@^0.48.0"
+    "@bonsai/plugin-sdk": "npm:@yaklabs-ai/plugin-sdk@^0.49.0"
   }
 }
 ```
@@ -62,7 +62,7 @@ Every tool the entrypoint registers is declared in the manifest too:
   "description": "Greets people by name.",
   "version": "0.1.0",
   "namespace": "widgets",
-  "compatibility": { "sdk": "^0.48.0" },
+  "compatibility": { "sdk": "^0.49.0" },
   "targets": {
     "kay": {
       "agent": {
@@ -134,22 +134,23 @@ naming both versions, instead of loading it and finding no `activate`.
 
 ## Entrypoints
 
-| Import                                  | What it gives you                                                               |
-| --------------------------------------- | ------------------------------------------------------------------------------- |
-| `@bonsai/plugin-sdk/kay-agent`          | Tools, URI modules, search providers, auth — the per-session agent surface      |
-| `@bonsai/plugin-sdk/kay-app`            | App-lifetime surface: storage, endpoints, app-scoped URI modules                |
-| `@bonsai/plugin-sdk/kay-agent/testing`  | `invokeToolForTest`, `fauxAuthContext` — for your own `node --test` runs        |
-| `@bonsai/plugin-sdk/disclosure`         | The conformance audit Bonsai gates your plugin with — run it before you ship    |
-| `@bonsai/plugin-sdk/time`               | `Temporal` (Bonsai's own instance) and the time-zone helpers, from 0.13.6       |
-| `@bonsai/plugin-sdk/transcript`         | The active-branch walk; the turn walk and run records from 0.13.6               |
-| `@bonsai/plugin-sdk/transcript-review`  | The review fold: a session's spans, tool-call attempts and records, from 0.13.7 |
-| `@bonsai/plugin-sdk/agent-conversation` | How a session's agent-to-agent traffic groups into conversations, from 0.13.7   |
-| `@bonsai/plugin-sdk/app-data`           | The app-data size caps, on an entry with no other import, from 0.13.7           |
-| `@bonsai/plugin-sdk/vendored-mcp`       | The kit for a plugin built on a vendor's hosted MCP server, from 0.13.7         |
-| `@bonsai/plugin-sdk/system-one`         | The types and error class for `api.systemOne` / `app.systemOne`, from 0.13.8    |
-| `@bonsai/plugin-sdk/zod`                | `z` (the host's in the daemon), on an entry with no other import, from 0.13.9   |
-
-A plugin that imports these subpaths declares the current supported SDK range (`^0.19.0`).
+| Import                                  | What it gives you                                                                        |
+| --------------------------------------- | ---------------------------------------------------------------------------------------- |
+| `@bonsai/plugin-sdk/kay-agent`          | Tools, URI modules, search providers, auth — the per-session agent surface               |
+| `@bonsai/plugin-sdk/kay-app`            | App-lifetime surface: storage, endpoints, app-scoped URI modules                         |
+| `@bonsai/plugin-sdk/uri`                | Sessionless resource caller types, revision digest and unavailable fallback, from 0.49.0 |
+| `@bonsai/plugin-sdk/kay-agent/testing`  | `invokeToolForTest`, `fauxAuthContext` — for your own `node --test` runs                 |
+| `@bonsai/plugin-sdk/disclosure`         | The conformance audit Bonsai gates your plugin with — run it before you ship             |
+| `@bonsai/plugin-sdk/time`               | `Temporal` (Bonsai's own instance) and the time-zone helpers, from 0.13.6                |
+| `@bonsai/plugin-sdk/transcript`         | The active-branch walk; the turn walk and run records from 0.13.6                        |
+| `@bonsai/plugin-sdk/transcript-review`  | The review fold: a session's spans, tool-call attempts and records, from 0.13.7          |
+| `@bonsai/plugin-sdk/agent-conversation` | How a session's agent-to-agent traffic groups into conversations, from 0.13.7            |
+| `@bonsai/plugin-sdk/app-data`           | The app-data size caps, on an entry with no other import, from 0.13.7                    |
+| `@bonsai/plugin-sdk/vendored-mcp`       | The kit for a plugin built on a vendor's hosted MCP server, from 0.13.7                  |
+| `@bonsai/plugin-sdk/system-one`         | The types and error class for `api.systemOne` / `app.systemOne`, from 0.13.8             |
+| `@bonsai/plugin-sdk/zod`                | `z` (the host's in the daemon), on an entry with no other import, from 0.13.9            |
+
+A plugin that imports these subpaths declares the current supported SDK range (`^0.49.0`).
 The rows record when each subpath appeared, not retained runtime compatibility. `vendored-mcp` builds the plugin's URI module (its link cards and help); hosting the
 vendor's MCP server itself is a separate host decision: Bonsai hosts it once a person approves
 the plugin's `mcp.host-server` grant for that server's name and URL. A server that needs an OAuth
@@ -157,7 +158,7 @@ sign-in names one of the plugin's auth services in `authService`; that service m
 one `delegated` scheme, which Bonsai uses to sign the person in to the server. Bonsai declares that
 scheme at runtime; the plugin's code must not declare it again. From 0.16.2 a plugin's code can also
 call the server's tools through `api.vendoredMcp.port(<server>)`, typed by this subpath's
-`VendoredMcpPort` and `VendoredMcpOutcome` (declare `^0.19.0`).
+`VendoredMcpPort` and `VendoredMcpOutcome` (declare `^0.49.0`).
 
 From 0.13.10 the manifest schema carries two facts Bonsai reads for its own plugins only; another
 plugin's are ignored, with a load diagnostic. An `external-cli` auth scheme's `cli` says how Bonsai
@@ -227,6 +228,19 @@ A newer floor always has a release: every change to the rule set publishes a
 version of this package as it lands, so "update and re-run" is never blocked on
 someone remembering to cut one. If the numbers differ, a newer version exists.
 
+## Sessionless calls (0.49.0)
+
+Both backend targets expose `uri.read/list/search/write/edit/delete`. Calls return native
+resources, bytes and revisions. Exact `uri.call` grants name the canonical scheme and verb;
+declaring a dependency grants no authority. Declared cross-plugin endpoint calls are deferred
+to the next slice of #15758.
+
+`app.memory` and its `KayAppMemory*` types are removed. Use complete `memory://` addresses
+through `app.uri`, parse returned Markdown in the consuming plugin, and retain the read's
+revision (or `contentDigest` from `/uri`) for edits. The old `memory.read` and `memory.write`
+grants do not authorize the replacement scheme-and-verb calls. Earlier SDK contracts are
+refused; migrate and declare `^0.49.0`.
+
 ## What this package is, and is not, at runtime
 
 Installing this SDK gives you **types, editor completion, and a runtime you can

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-sdk",
-  "version": "0.48.0",
+  "version": "0.49.0",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [

package/dist/disclosure.d.ts

@@ -2446,8 +2446,15 @@ declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * 0.47.0 adds card layouts and builders; successful card submits now require a summary.
  *
  * 0.48.0 adds the models.complete UI capability.
+ *
+ * 0.48.1 adds app-tool metadata, conditional tool permissions and screen-action declarations.
+ *
+ * 0.49.0 adds sessionless URI calls on both backend targets. It removes app.memory and its note
+ * types; callers use the resource surface instead. Previously admitted SDK contracts are no
+ * longer served because they included app.memory on notebook hosts. No compatibility alias
+ * restores it; callers migrate and declare ^0.49.0.
  */
-declare const KAY_PLUGIN_SDK_VERSION: "0.48.0";
+declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
 
 declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2672,7 +2679,7 @@ declare interface KayAgentNetwork {
  * here; the plugin never touches an `ExtensionApi`, `child_process`, credentials, or Electron.
  */
 declare interface KayAgentPluginApi {
-    readonly uri: {
+    readonly uri: PluginUriCaller & {
         /** Register a whole URI module (a scheme handler that owns its address space, e.g. `drive://`). */
         registerModule(module: UriExtensionModule): void;
     };
@@ -4497,6 +4504,38 @@ declare const PluginToolName: z.ZodString;
 
 declare type PluginToolName = z.infer<typeof PluginToolName>;
 
+/**
+ * Sessionless resource calls. Each call checks the calling target's exact scheme and verb grant.
+ * Results retain provider bytes, metadata and revisions; provider failures retain their URI tags.
+ * A cancellation or lost response does not prove a mutation was not applied.
+ */
+declare interface PluginUriCaller {
+    read(input: string, options?: PluginUriReadOptions): Promise<RawResource>;
+    list(input: string, params?: UriListParams, options?: PluginUriCallOptions): Promise<UriListResult>;
+    search(input: string, params: UriSearchParams, options?: PluginUriCallOptions): Promise<UriSearchResult>;
+    write(input: string, content?: UriPayload | Uint8Array, options?: PluginUriWriteOptions): Promise<UriMutationResult | void>;
+    edit(input: string, payload: UriPayload, options?: PluginUriMutationOptions): Promise<UriMutationResult>;
+    delete(input: string, options?: PluginUriMutationOptions): Promise<UriMutationResult>;
+}
+
+declare interface PluginUriCallOptions {
+    readonly cwd?: string;
+    readonly signal?: AbortSignal;
+}
+
+declare interface PluginUriMutationOptions extends PluginUriCallOptions {
+    readonly expectedRevision?: string;
+}
+
+declare interface PluginUriReadOptions extends PluginUriCallOptions {
+    readonly knownRevision?: string;
+}
+
+declare interface PluginUriWriteOptions extends PluginUriMutationOptions {
+    readonly sources?: readonly UriWriteSource[];
+    readonly writeSource?: UriSourceDescriptor;
+}
+
 declare const Properties: (input: string) => [unknown, string] | [];
 
 declare function PropertiesMapping(input: [unknown, unknown, unknown]): unknown;
@@ -10061,6 +10100,8 @@ declare interface UriResolveContext {
      * resolve a URI outside any verb call.
      */
     readonly sessionId?: string;
+    /** Host-stamped calling plugin; absent for session dispatch and resolver matching. */
+    readonly callerPluginId?: string;
     /**
      * WHO the dispatching session acts as, stamped by the host at the same dispatch site as
      * {@link UriResolveContext.sessionId} and just as un-influenceable by the caller - so a module

package/dist/disclosure.js

@@ -722,6 +722,21 @@ async function auditSkillCodegenPairFile(skill, declaration, packageDir) {
   return violations;
 }
 
+// packages/plugin-sdk/dist/uri.js
+function createUnavailableUriCaller(message) {
+  const unavailable = async () => {
+    throw new Error(message);
+  };
+  return {
+    read: unavailable,
+    list: unavailable,
+    search: unavailable,
+    write: unavailable,
+    edit: unavailable,
+    delete: unavailable
+  };
+}
+
 // packages/plugin-sdk/dist/kay-agent/endpoints.js
 function createUnavailableEndpoints(message) {
   return {
@@ -917,6 +932,7 @@ function collectUriModulesFromKayAgentActivate(activate) {
   const modules = [];
   const fakeApi = {
     uri: {
+      ...createUnavailableUriCaller("URI calls are unavailable while probing a plugin"),
       registerModule: (module) => {
         modules.push(module);
       }

package/dist/kay-agent-testing.d.ts

@@ -1196,7 +1196,7 @@ declare function FactorMapping(input: [unknown, unknown, unknown, unknown, unkno
 export declare function fauxAuthContext(overrides?: Partial<ExtensionAuthContext>): ExtensionAuthContext;
 
 /** The capability handles a `KayAgentPluginApi` always carries - authority is decided per call. */
-export declare type FauxKayAgentCapabilities = Pick<KayAgentPluginApi, "network" | "webSession" | "process" | "whiteboard" | "interaction" | "interceptToolCall" | "implementTool" | "systemOne" | "events" | "featureFlags" | "time" | "log" | "userFiles" | "familyFolder" | "vendoredMcp" | "endpoints" | "compiler">;
+export declare type FauxKayAgentCapabilities = Pick<KayAgentPluginApi, "uri" | "network" | "webSession" | "process" | "whiteboard" | "interaction" | "interceptToolCall" | "implementTool" | "systemOne" | "events" | "featureFlags" | "time" | "log" | "userFiles" | "familyFolder" | "vendoredMcp" | "endpoints" | "compiler">;
 
 export declare function fauxKayAgentCapabilities(): FauxKayAgentCapabilities;
 
@@ -2500,8 +2500,15 @@ declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * 0.47.0 adds card layouts and builders; successful card submits now require a summary.
  *
  * 0.48.0 adds the models.complete UI capability.
+ *
+ * 0.48.1 adds app-tool metadata, conditional tool permissions and screen-action declarations.
+ *
+ * 0.49.0 adds sessionless URI calls on both backend targets. It removes app.memory and its note
+ * types; callers use the resource surface instead. Previously admitted SDK contracts are no
+ * longer served because they included app.memory on notebook hosts. No compatibility alias
+ * restores it; callers migrate and declare ^0.49.0.
  */
-declare const KAY_PLUGIN_SDK_VERSION: "0.48.0";
+declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
 
 declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2723,7 +2730,7 @@ declare interface KayAgentNetwork {
  * here; the plugin never touches an `ExtensionApi`, `child_process`, credentials, or Electron.
  */
 declare interface KayAgentPluginApi {
-    readonly uri: {
+    readonly uri: PluginUriCaller & {
         /** Register a whole URI module (a scheme handler that owns its address space, e.g. `drive://`). */
         registerModule(module: UriExtensionModule): void;
     };
@@ -4493,6 +4500,38 @@ declare const PluginToolName: z.ZodString;
 
 declare type PluginToolName = z.infer<typeof PluginToolName>;
 
+/**
+ * Sessionless resource calls. Each call checks the calling target's exact scheme and verb grant.
+ * Results retain provider bytes, metadata and revisions; provider failures retain their URI tags.
+ * A cancellation or lost response does not prove a mutation was not applied.
+ */
+declare interface PluginUriCaller {
+    read(input: string, options?: PluginUriReadOptions): Promise<RawResource>;
+    list(input: string, params?: UriListParams, options?: PluginUriCallOptions): Promise<UriListResult>;
+    search(input: string, params: UriSearchParams, options?: PluginUriCallOptions): Promise<UriSearchResult>;
+    write(input: string, content?: UriPayload | Uint8Array, options?: PluginUriWriteOptions): Promise<UriMutationResult | void>;
+    edit(input: string, payload: UriPayload, options?: PluginUriMutationOptions): Promise<UriMutationResult>;
+    delete(input: string, options?: PluginUriMutationOptions): Promise<UriMutationResult>;
+}
+
+declare interface PluginUriCallOptions {
+    readonly cwd?: string;
+    readonly signal?: AbortSignal;
+}
+
+declare interface PluginUriMutationOptions extends PluginUriCallOptions {
+    readonly expectedRevision?: string;
+}
+
+declare interface PluginUriReadOptions extends PluginUriCallOptions {
+    readonly knownRevision?: string;
+}
+
+declare interface PluginUriWriteOptions extends PluginUriMutationOptions {
+    readonly sources?: readonly UriWriteSource[];
+    readonly writeSource?: UriSourceDescriptor;
+}
+
 /**
  * What a run did to a URI. The words match the automation run wire's artifact actions. When one
  * run both creates and updates a URI, the reader reports `created`.
@@ -5364,6 +5403,32 @@ declare const ResolvedPluginContractV1: z.ZodObject<{
         }, z.core.$strict>;
     }, z.core.$strict>>;
     kayAgentUriModules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        screenActions: z.ZodExactOptional<z.ZodObject<{
+            scheme: z.ZodString;
+            hosts: z.ZodArray<z.ZodString>;
+            paths: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            apps: z.ZodArray<z.ZodString>;
+            options: z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<[z.ZodObject<{
+                kind: z.ZodLiteral<"exact">;
+                description: z.ZodString;
+                verb: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                    edit: "edit";
+                    delete: "delete";
+                }>;
+                uri: z.ZodString;
+            }, z.core.$strict>, z.ZodObject<{
+                kind: z.ZodLiteral<"catch-all">;
+                description: z.ZodString;
+                verb: z.ZodEnum<{
+                    read: "read";
+                    write: "write";
+                    edit: "edit";
+                    delete: "delete";
+                }>;
+            }, z.core.$strict>], "kind">>;
+        }, z.core.$strict>>;
         claims: z.ZodExactOptional<z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             kind: z.ZodLiteral<"scheme">;
             scheme: z.ZodString;
@@ -5400,27 +5465,27 @@ declare const ResolvedPluginContractV1: z.ZodObject<{
                 list: "list";
                 read: "read";
                 write: "write";
-                help: "help";
                 edit: "edit";
                 delete: "delete";
+                help: "help";
             }>>>;
             operationDocs: z.ZodExactOptional<z.ZodRecord<z.ZodEnum<{
                 search: "search";
                 list: "list";
                 read: "read";
                 write: "write";
-                help: "help";
                 edit: "edit";
                 delete: "delete";
+                help: "help";
             }> & z.core.$partial, z.ZodString>>;
             operationDefaults: z.ZodExactOptional<z.ZodRecord<z.ZodEnum<{
                 search: "search";
                 list: "list";
                 read: "read";
                 write: "write";
-                help: "help";
                 edit: "edit";
                 delete: "delete";
+                help: "help";
             }> & z.core.$partial, z.ZodEnum<{
                 never: "never";
                 allow: "allow";
@@ -5482,9 +5547,9 @@ declare const ResolvedPluginContractV1: z.ZodObject<{
                     list: "list";
                     read: "read";
                     write: "write";
-                    help: "help";
                     edit: "edit";
                     delete: "delete";
+                    help: "help";
                 }>>>;
                 routes: z.ZodExactOptional<z.ZodArray<z.ZodString>>;
                 query: z.ZodExactOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -5495,9 +5560,9 @@ declare const ResolvedPluginContractV1: z.ZodObject<{
                     list: "list";
                     read: "read";
                     write: "write";
-                    help: "help";
                     edit: "edit";
                     delete: "delete";
+                    help: "help";
                 }>>>;
                 routes: z.ZodExactOptional<z.ZodArray<z.ZodString>>;
                 query: z.ZodExactOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -5586,15 +5651,80 @@ declare const ResolvedPluginContractV1: z.ZodObject<{
             scheme: z.ZodOptional<z.ZodString>;
             resourcePrefix: z.ZodOptional<z.ZodString>;
             resourceArgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            resourceTrim: z.ZodOptional<z.ZodLiteral<true>>;
+            defaultPermission: z.ZodOptional<z.ZodEnum<{
+                never: "never";
+                allow: "allow";
+                ask: "ask";
+            }>>;
+            classificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                when: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                    arg: z.ZodString;
+                    equals: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+                }, z.core.$strict>, z.ZodObject<{
+                    arg: z.ZodString;
+                    present: z.ZodBoolean;
+                }, z.core.$strict>]>>;
+                kind: z.ZodEnum<{
+                    read: "read";
+                    mutate: "mutate";
+                    destructive: "destructive";
+                    execute: "execute";
+                }>;
+                ruleKey: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
         }, z.core.$strict>>;
         localId: z.ZodString;
         globalId: z.ZodString;
         toolName: z.ZodString;
     }, z.core.$strict>>>;
     kayAppTools: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        description: z.ZodOptional<z.ZodString>;
         localId: z.ZodString;
-        globalId: z.ZodString;
+        displayName: z.ZodOptional<z.ZodString>;
         toolName: z.ZodString;
+        parameters: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodType<authoringCommonSchemas.JsonValue, unknown, z.core.$ZodTypeInternals<authoringCommonSchemas.JsonValue, unknown>>>>;
+        executionMode: z.ZodOptional<z.ZodEnum<{
+            sequential: "sequential";
+            parallel: "parallel";
+        }>>;
+        promptSnippet: z.ZodOptional<z.ZodString>;
+        promptGuidelines: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        permission: z.ZodOptional<z.ZodObject<{
+            kind: z.ZodEnum<{
+                read: "read";
+                mutate: "mutate";
+                destructive: "destructive";
+                execute: "execute";
+            }>;
+            ruleKey: z.ZodOptional<z.ZodString>;
+            scheme: z.ZodOptional<z.ZodString>;
+            resourcePrefix: z.ZodOptional<z.ZodString>;
+            resourceArgs: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            resourceTrim: z.ZodOptional<z.ZodLiteral<true>>;
+            defaultPermission: z.ZodOptional<z.ZodEnum<{
+                never: "never";
+                allow: "allow";
+                ask: "ask";
+            }>>;
+            classificationRules: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                when: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+                    arg: z.ZodString;
+                    equals: z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodNull]>;
+                }, z.core.$strict>, z.ZodObject<{
+                    arg: z.ZodString;
+                    present: z.ZodBoolean;
+                }, z.core.$strict>]>>;
+                kind: z.ZodEnum<{
+                    read: "read";
+                    mutate: "mutate";
+                    destructive: "destructive";
+                    execute: "execute";
+                }>;
+                ruleKey: z.ZodOptional<z.ZodString>;
+            }, z.core.$strict>>>;
+        }, z.core.$strict>>;
+        globalId: z.ZodString;
     }, z.core.$strict>>>;
     kayAppApprovalTypes: z.ZodOptional<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"message">;
@@ -11233,6 +11363,8 @@ declare interface UriResolveContext {
      * resolve a URI outside any verb call.
      */
     readonly sessionId?: string;
+    /** Host-stamped calling plugin; absent for session dispatch and resolver matching. */
+    readonly callerPluginId?: string;
     /**
      * WHO the dispatching session acts as, stamped by the host at the same dispatch site as
      * {@link UriResolveContext.sessionId} and just as un-influenceable by the caller - so a module

package/dist/kay-agent-testing.js

@@ -123,16 +123,31 @@ function createKayPluginLog(write, bound = {}) {
 }
 
 // packages/plugin-sdk/dist/kay-agent/declared-tool.js
-function permissionHint(permission) {
-  const { kind, ruleKey, resourceArgs, scheme, resourcePrefix } = permission;
+function declaredToolPermission(permission) {
+  const { kind, ruleKey, resourceArgs, scheme, resourcePrefix, resourceTrim, defaultPermission, classificationRules } = permission;
   return {
     kind,
     ...scheme === void 0 ? {} : { scheme },
     ...ruleKey === void 0 ? {} : { ruleKey },
+    ...defaultPermission === void 0 ? {} : { defaultPermission },
+    ...classificationRules === void 0 ? {} : {
+      deriveClassification: (input) => {
+        const rule = classificationRules.find((candidate) => candidate.when.every((condition) => {
+          const value = Object.hasOwn(input, condition.arg) ? input[condition.arg] : void 0;
+          return "equals" in condition ? value === condition.equals : value !== void 0 === condition.present;
+        }));
+        return rule === void 0 ? void 0 : {
+          kind: rule.kind,
+          ...rule.ruleKey === void 0 ? {} : { ruleKey: rule.ruleKey }
+        };
+      }
+    },
     ...resourceArgs === void 0 ? {} : {
       deriveResources: (input) => resourceArgs.flatMap((arg) => {
         const value = input[arg];
-        return typeof value === "string" ? [`${resourcePrefix ?? ""}${value}`] : [];
+        return typeof value === "string" ? [
+          `${resourcePrefix ?? ""}${resourceTrim === true ? value.trim() : value}`
+        ] : [];
       })
     }
   };
@@ -156,7 +171,7 @@ function declaredToolDefinition(tool, execute) {
         ...requiresAuth.schemeId === void 0 ? {} : { schemeId: requiresAuth.schemeId }
       }
     },
-    ...permission === void 0 ? {} : { permission: permissionHint(permission) },
+    ...permission === void 0 ? {} : { permission: declaredToolPermission(permission) },
     execute
   };
 }
@@ -262,6 +277,16 @@ var USER_FILE_METHODS = [
 ];
 function fauxKayAgentCapabilities() {
   return {
+    uri: {
+      read: unwired("uri.read"),
+      list: unwired("uri.list"),
+      search: unwired("uri.search"),
+      write: unwired("uri.write"),
+      edit: unwired("uri.edit"),
+      delete: unwired("uri.delete"),
+      registerModule: () => {
+      }
+    },
     network: { fetch: unwired("network.fetch") },
     webSession: {
       request: unwired("webSession.request"),

package/dist/kay-agent.d.ts

@@ -813,6 +813,8 @@ export declare function createUnavailableCompiler(message: string): KayAgentComp
  */
 export declare function createUnavailableEndpoints(message: string): KayAgentEndpoints;
 
+export declare function createUnavailableUriCaller(message: string): PluginUriCaller;
+
 /** What the module holds at mutation time: a provider revision, the current content, or both. */
 export declare interface CurrentResourceState {
     readonly revision?: string;
@@ -2775,8 +2777,15 @@ declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * 0.47.0 adds card layouts and builders; successful card submits now require a summary.
  *
  * 0.48.0 adds the models.complete UI capability.
+ *
+ * 0.48.1 adds app-tool metadata, conditional tool permissions and screen-action declarations.
+ *
+ * 0.49.0 adds sessionless URI calls on both backend targets. It removes app.memory and its note
+ * types; callers use the resource surface instead. Previously admitted SDK contracts are no
+ * longer served because they included app.memory on notebook hosts. No compatibility alias
+ * restores it; callers migrate and declare ^0.49.0.
  */
-declare const KAY_PLUGIN_SDK_VERSION: "0.48.0";
+declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
 
 declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -3030,7 +3039,7 @@ export declare interface KayAgentNetwork {
  * here; the plugin never touches an `ExtensionApi`, `child_process`, credentials, or Electron.
  */
 export declare interface KayAgentPluginApi {
-    readonly uri: {
+    readonly uri: PluginUriCaller & {
         /** Register a whole URI module (a scheme handler that owns its address space, e.g. `drive://`). */
         registerModule(module: UriExtensionModule): void;
     };
@@ -5103,13 +5112,22 @@ declare const PluginCapabilityRefusalV1: z.ZodObject<{
         slug: z.ZodLiteral<"signals.read">;
         envelope: z.ZodObject<{}, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
-        target: z.ZodLiteral<"kay.app">;
-        slug: z.ZodLiteral<"memory.read">;
-        envelope: z.ZodObject<{}, z.core.$strict>;
-    }, z.core.$strict>, z.ZodObject<{
-        target: z.ZodLiteral<"kay.app">;
-        slug: z.ZodLiteral<"memory.write">;
-        envelope: z.ZodObject<{}, z.core.$strict>;
+        target: z.ZodEnum<{
+            "kay.agent": "kay.agent";
+            "kay.app": "kay.app";
+        }>;
+        slug: z.ZodLiteral<"uri.call">;
+        envelope: z.ZodObject<{
+            scheme: z.ZodString;
+            verb: z.ZodEnum<{
+                search: "search";
+                list: "list";
+                read: "read";
+                write: "write";
+                edit: "edit";
+                delete: "delete";
+            }>;
+        }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"skills.read">;
@@ -5564,6 +5582,38 @@ declare const PluginToolName: z.ZodString;
 
 declare type PluginToolName = z.infer<typeof PluginToolName>;
 
+/**
+ * Sessionless resource calls. Each call checks the calling target's exact scheme and verb grant.
+ * Results retain provider bytes, metadata and revisions; provider failures retain their URI tags.
+ * A cancellation or lost response does not prove a mutation was not applied.
+ */
+export declare interface PluginUriCaller {
+    read(input: string, options?: PluginUriReadOptions): Promise<RawResource>;
+    list(input: string, params?: UriListParams, options?: PluginUriCallOptions): Promise<UriListResult>;
+    search(input: string, params: UriSearchParams, options?: PluginUriCallOptions): Promise<UriSearchResult>;
+    write(input: string, content?: UriPayload | Uint8Array, options?: PluginUriWriteOptions): Promise<UriMutationResult | void>;
+    edit(input: string, payload: UriPayload, options?: PluginUriMutationOptions): Promise<UriMutationResult>;
+    delete(input: string, options?: PluginUriMutationOptions): Promise<UriMutationResult>;
+}
+
+export declare interface PluginUriCallOptions {
+    readonly cwd?: string;
+    readonly signal?: AbortSignal;
+}
+
+export declare interface PluginUriMutationOptions extends PluginUriCallOptions {
+    readonly expectedRevision?: string;
+}
+
+export declare interface PluginUriReadOptions extends PluginUriCallOptions {
+    readonly knownRevision?: string;
+}
+
+export declare interface PluginUriWriteOptions extends PluginUriMutationOptions {
+    readonly sources?: readonly UriWriteSource[];
+    readonly writeSource?: UriSourceDescriptor;
+}
+
 /**
  * What a run did to a URI. The words match the automation run wire's artifact actions. When one
  * run both creates and updates a URI, the reader reports `created`.
@@ -11452,6 +11502,8 @@ export declare interface UriResolveContext {
      * resolve a URI outside any verb call.
      */
     readonly sessionId?: string;
+    /** Host-stamped calling plugin; absent for session dispatch and resolver matching. */
+    readonly callerPluginId?: string;
     /**
      * WHO the dispatching session acts as, stamped by the host at the same dispatch site as
      * {@link UriResolveContext.sessionId} and just as un-influenceable by the caller - so a module

package/dist/kay-agent.js

@@ -982,6 +982,21 @@ function capability(spec) {
   return { ...spec };
 }
 
+// packages/plugin-sdk/dist/uri.js
+function createUnavailableUriCaller(message) {
+  const unavailable = async () => {
+    throw new Error(message);
+  };
+  return {
+    read: unavailable,
+    list: unavailable,
+    search: unavailable,
+    write: unavailable,
+    edit: unavailable,
+    delete: unavailable
+  };
+}
+
 // packages/herd-uri-extensions/dist/limits.js
 var MAX_BYTES = 50 * 1024 * 1024;
 var MAX_OUTPUT_CHARS = 5e5;
@@ -1716,6 +1731,7 @@ export {
   createOsascriptRunner,
   createUnavailableCompiler,
   createUnavailableEndpoints,
+  createUnavailableUriCaller,
   declareProducedResources,
   defineAuthedTool,
   defineTool,