@yaklabs-ai/plugin-sdk 0.49.0 → 0.50.0

package/README.md

@@ -13,7 +13,7 @@ it under the name your plugin code actually imports:
 ```json
 {
   "dependencies": {
-    "@bonsai/plugin-sdk": "npm:@yaklabs-ai/plugin-sdk@^0.49.0"
+    "@bonsai/plugin-sdk": "npm:@yaklabs-ai/plugin-sdk@^0.50.0"
   }
 }
 ```
@@ -62,7 +62,7 @@ Every tool the entrypoint registers is declared in the manifest too:
   "description": "Greets people by name.",
   "version": "0.1.0",
   "namespace": "widgets",
-  "compatibility": { "sdk": "^0.49.0" },
+  "compatibility": { "sdk": "^0.50.0" },
   "targets": {
     "kay": {
       "agent": {
@@ -139,6 +139,7 @@ naming both versions, instead of loading it and finding no `activate`.
 | `@bonsai/plugin-sdk/kay-agent`          | Tools, URI modules, search providers, auth — the per-session agent surface               |
 | `@bonsai/plugin-sdk/kay-app`            | App-lifetime surface: storage, endpoints, app-scoped URI modules                         |
 | `@bonsai/plugin-sdk/uri`                | Sessionless resource caller types, revision digest and unavailable fallback, from 0.49.0 |
+| `@bonsai/plugin-sdk/endpoints`          | Sessionless cross-plugin endpoint caller and outcome types, from 0.50.0                  |
 | `@bonsai/plugin-sdk/kay-agent/testing`  | `invokeToolForTest`, `fauxAuthContext` — for your own `node --test` runs                 |
 | `@bonsai/plugin-sdk/disclosure`         | The conformance audit Bonsai gates your plugin with — run it before you ship             |
 | `@bonsai/plugin-sdk/time`               | `Temporal` (Bonsai's own instance) and the time-zone helpers, from 0.13.6                |
@@ -150,7 +151,7 @@ naming both versions, instead of loading it and finding no `activate`.
 | `@bonsai/plugin-sdk/system-one`         | The types and error class for `api.systemOne` / `app.systemOne`, from 0.13.8             |
 | `@bonsai/plugin-sdk/zod`                | `z` (the host's in the daemon), on an entry with no other import, from 0.13.9            |
 
-A plugin that imports these subpaths declares the current supported SDK range (`^0.49.0`).
+A plugin that imports these subpaths declares the current supported SDK range (`^0.50.0`).
 The rows record when each subpath appeared, not retained runtime compatibility. `vendored-mcp` builds the plugin's URI module (its link cards and help); hosting the
 vendor's MCP server itself is a separate host decision: Bonsai hosts it once a person approves
 the plugin's `mcp.host-server` grant for that server's name and URL. A server that needs an OAuth
@@ -158,7 +159,7 @@ sign-in names one of the plugin's auth services in `authService`; that service m
 one `delegated` scheme, which Bonsai uses to sign the person in to the server. Bonsai declares that
 scheme at runtime; the plugin's code must not declare it again. From 0.16.2 a plugin's code can also
 call the server's tools through `api.vendoredMcp.port(<server>)`, typed by this subpath's
-`VendoredMcpPort` and `VendoredMcpOutcome` (declare `^0.49.0`).
+`VendoredMcpPort` and `VendoredMcpOutcome` (declare `^0.50.0`).
 
 From 0.13.10 the manifest schema carries two facts Bonsai reads for its own plugins only; another
 plugin's are ignored, with a load diagnostic. An `external-cli` auth scheme's `cli` says how Bonsai
@@ -228,18 +229,19 @@ A newer floor always has a release: every change to the rule set publishes a
 version of this package as it lands, so "update and re-run" is never blocked on
 someone remembering to cut one. If the numbers differ, a newer version exists.
 
-## Sessionless calls (0.49.0)
+## Sessionless calls (resources from 0.49.0, endpoints from 0.50.0)
 
-Both backend targets expose `uri.read/list/search/write/edit/delete`. Calls return native
-resources, bytes and revisions. Exact `uri.call` grants name the canonical scheme and verb;
-declaring a dependency grants no authority. Declared cross-plugin endpoint calls are deferred
-to the next slice of #15758.
+Both backend targets expose `uri.read/list/search/write/edit/delete` and
+`endpoints.invokePlugin(providerPluginId, endpointLocalId, payload, { signal })`.
+URI calls return native resources, bytes and revisions. Endpoint calls return an unknown JSON
+value on success or a structured failure, including `denied` when the exact grant is absent.
+Provider schemas remain authoritative; declaring a dependency grants no authority.
 
 `app.memory` and its `KayAppMemory*` types are removed. Use complete `memory://` addresses
 through `app.uri`, parse returned Markdown in the consuming plugin, and retain the read's
 revision (or `contentDigest` from `/uri`) for edits. The old `memory.read` and `memory.write`
-grants do not authorize the replacement scheme-and-verb calls. Earlier SDK contracts are
-refused; migrate and declare `^0.49.0`.
+grants do not authorize the replacement scheme-and-verb calls. Contracts before 0.49.0 are
+refused; migrate and declare `^0.50.0`. The current host also serves the 0.49.0 resource contract.
 
 ## What this package is, and is not, at runtime
 

package/THIRD-PARTY-INVENTORY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "package": "@yaklabs-ai/plugin-sdk",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "target": "npm",
   "firstPartyLicense": "MIT",
   "bundled": [

package/dist/disclosure.d.ts

@@ -2453,8 +2453,11 @@ declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * types; callers use the resource surface instead. Previously admitted SDK contracts are no
  * longer served because they included app.memory on notebook hosts. No compatibility alias
  * restores it; callers migrate and declare ^0.49.0.
+ *
+ * 0.50.0 adds explicit cross-plugin endpoint calls on both backend targets. The URI-only 0.49.0
+ * contract remains served.
  */
-declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
+declare const KAY_PLUGIN_SDK_VERSION: "0.50.0";
 
 declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2467,46 +2470,9 @@ declare interface KayAgentCompiler {
     bundleBrowser(request: KayBrowserBundleRequest, sources: KayBrowserSources): Promise<KayBrowserBundle>;
 }
 
-/**
- * The plugin-facing `kay.agent` own-endpoint call: a plugin's agent part calls an endpoint its own
- * `kay.app` part registered. SDK 0.17.3; a plugin that calls it declares `compatibility.sdk`
- * `^0.19.0`.
- *
- * A plugin's two parts load as separate modules and share no memory, so this is how agent code
- * reaches state its app part keeps (a worker, a database). The manifest says which endpoints the
- * agent part may call: the `kay.app` target declares the endpoint with a `register` grant, and
- * `permissions.byTarget["kay.agent"].endpoints` lists it with `invoke`. No other plugin's endpoint
- * is nameable.
- *
- * An endpoint whose only `invoke` grant is the plugin's own `kay.agent` target is not reachable
- * from Bonsai's surfaces (its pages and runtime clients), so an action the agent takes after the
- * session's approval card cannot be taken around it.
- */
-/** Why an {@link KayAgentEndpoints.invoke} call produced no value. */
-declare type KayAgentEndpointFailureReason = 
-/** The manifest grants this plugin's `kay.agent` target no `invoke` on this endpoint. */
-"not-declared"
-/** The plugin's `kay.app` part is not running, or registered no handler for it. */
-| "unavailable"
-/** The handler did not answer within the host's fixed deadline (10 seconds). It may still finish. */
-| "timed-out"
-/** The caller's `signal` aborted. The handler may still finish. */
-| "cancelled"
-/** The handler threw; `message` is its error's message. */
-| "failed"
-/** The request or the handler's response does not match the endpoint's declared schema. */
-| "invalid";
-
-declare type KayAgentEndpointOutcome = {
-    readonly ok: true;
-    readonly value: unknown;
-} | {
-    readonly ok: false;
-    readonly reason: KayAgentEndpointFailureReason;
-    readonly message: string;
-};
+declare type KayAgentEndpointOutcome = PluginEndpointOutcome;
 
-declare interface KayAgentEndpoints {
+declare interface KayAgentEndpoints extends PluginEndpointCaller {
     /**
      * Call `endpoint`, the local id this plugin's manifest declares on its `kay.app` target. Never
      * rejects: every failure is an outcome. Nothing is queued: when the app part is not running the
@@ -2772,10 +2738,9 @@ declare interface KayAgentPluginApi {
      */
     readonly vendoredMcp: KayAgentVendoredMcp;
     /**
-     * Calls the endpoints this plugin's own `kay.app` part registered and the manifest grants this
-     * target `invoke` on, by local id. Never another plugin's. Every failure is an outcome, never a
-     * rejection; the host fixes a 10-second deadline. Always present; a host with no app part
-     * answers each call `unavailable`. See {@link KayAgentEndpoints} (SDK 0.17.3).
+     * `invoke` calls this plugin's own declared app endpoint by local id. `invokePlugin` names a
+     * provider plugin explicitly and checks this target's exact `endpoints.invoke` claim. Every
+     * failure is an outcome; unavailable providers are never queued.
      */
     readonly endpoints: KayAgentEndpoints;
     /**
@@ -4417,6 +4382,28 @@ declare interface PluginDelegatedServiceEntry {
 /** One rule id from {@link PLUGIN_DISCLOSURE_RULES}. */
 export declare type PluginDisclosureRule = (typeof PLUGIN_DISCLOSURE_RULES)[number];
 
+/** Sessionless JSON calls to another plugin's declared, publicly reachable endpoint. */
+declare interface PluginEndpointCaller {
+    /**
+     * Never rejects. Both payload and result are validated against the provider's declared schemas.
+     * Nothing is queued or retried. Cancellation and timeouts leave the operation's effect unknown.
+     */
+    invokePlugin(providerPluginId: string, endpointLocalId: string, payload: unknown, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<PluginEndpointOutcome>;
+}
+
+declare type PluginEndpointFailureReason = "not-declared" | "unavailable" | "timed-out" | "cancelled" | "failed" | "invalid" | "denied";
+
+declare type PluginEndpointOutcome = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: PluginEndpointFailureReason;
+    readonly message: string;
+};
+
 declare const PluginEventPublishInput: z.ZodObject<{
     uri: z.ZodString;
     related: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;

package/dist/disclosure.js

@@ -737,10 +737,18 @@ function createUnavailableUriCaller(message) {
   };
 }
 
+// packages/plugin-sdk/dist/endpoints.js
+function createUnavailablePluginEndpointCaller(message) {
+  return {
+    invokePlugin: async () => ({ ok: false, reason: "unavailable", message })
+  };
+}
+
 // packages/plugin-sdk/dist/kay-agent/endpoints.js
 function createUnavailableEndpoints(message) {
   return {
-    invoke: async () => ({ ok: false, reason: "unavailable", message })
+    invoke: async () => ({ ok: false, reason: "unavailable", message }),
+    ...createUnavailablePluginEndpointCaller(message)
   };
 }
 

package/dist/endpoints.d.ts

@@ -0,0 +1,25 @@
+export declare function createUnavailablePluginEndpointCaller(message: string): PluginEndpointCaller;
+
+/** Sessionless JSON calls to another plugin's declared, publicly reachable endpoint. */
+export declare interface PluginEndpointCaller {
+    /**
+     * Never rejects. Both payload and result are validated against the provider's declared schemas.
+     * Nothing is queued or retried. Cancellation and timeouts leave the operation's effect unknown.
+     */
+    invokePlugin(providerPluginId: string, endpointLocalId: string, payload: unknown, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<PluginEndpointOutcome>;
+}
+
+export declare type PluginEndpointFailureReason = "not-declared" | "unavailable" | "timed-out" | "cancelled" | "failed" | "invalid" | "denied";
+
+export declare type PluginEndpointOutcome = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: PluginEndpointFailureReason;
+    readonly message: string;
+};
+
+export { }

package/dist/endpoints.js

@@ -0,0 +1,9 @@
+// packages/plugin-sdk/dist/endpoints.js
+function createUnavailablePluginEndpointCaller(message) {
+  return {
+    invokePlugin: async () => ({ ok: false, reason: "unavailable", message })
+  };
+}
+export {
+  createUnavailablePluginEndpointCaller
+};

package/dist/kay-agent-testing.d.ts

@@ -2507,8 +2507,11 @@ declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * types; callers use the resource surface instead. Previously admitted SDK contracts are no
  * longer served because they included app.memory on notebook hosts. No compatibility alias
  * restores it; callers migrate and declare ^0.49.0.
+ *
+ * 0.50.0 adds explicit cross-plugin endpoint calls on both backend targets. The URI-only 0.49.0
+ * contract remains served.
  */
-declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
+declare const KAY_PLUGIN_SDK_VERSION: "0.50.0";
 
 declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2518,46 +2521,9 @@ declare interface KayAgentCompiler {
     bundleBrowser(request: KayBrowserBundleRequest, sources: KayBrowserSources): Promise<KayBrowserBundle>;
 }
 
-/**
- * The plugin-facing `kay.agent` own-endpoint call: a plugin's agent part calls an endpoint its own
- * `kay.app` part registered. SDK 0.17.3; a plugin that calls it declares `compatibility.sdk`
- * `^0.19.0`.
- *
- * A plugin's two parts load as separate modules and share no memory, so this is how agent code
- * reaches state its app part keeps (a worker, a database). The manifest says which endpoints the
- * agent part may call: the `kay.app` target declares the endpoint with a `register` grant, and
- * `permissions.byTarget["kay.agent"].endpoints` lists it with `invoke`. No other plugin's endpoint
- * is nameable.
- *
- * An endpoint whose only `invoke` grant is the plugin's own `kay.agent` target is not reachable
- * from Bonsai's surfaces (its pages and runtime clients), so an action the agent takes after the
- * session's approval card cannot be taken around it.
- */
-/** Why an {@link KayAgentEndpoints.invoke} call produced no value. */
-declare type KayAgentEndpointFailureReason = 
-/** The manifest grants this plugin's `kay.agent` target no `invoke` on this endpoint. */
-"not-declared"
-/** The plugin's `kay.app` part is not running, or registered no handler for it. */
-| "unavailable"
-/** The handler did not answer within the host's fixed deadline (10 seconds). It may still finish. */
-| "timed-out"
-/** The caller's `signal` aborted. The handler may still finish. */
-| "cancelled"
-/** The handler threw; `message` is its error's message. */
-| "failed"
-/** The request or the handler's response does not match the endpoint's declared schema. */
-| "invalid";
-
-declare type KayAgentEndpointOutcome = {
-    readonly ok: true;
-    readonly value: unknown;
-} | {
-    readonly ok: false;
-    readonly reason: KayAgentEndpointFailureReason;
-    readonly message: string;
-};
+declare type KayAgentEndpointOutcome = PluginEndpointOutcome;
 
-declare interface KayAgentEndpoints {
+declare interface KayAgentEndpoints extends PluginEndpointCaller {
     /**
      * Call `endpoint`, the local id this plugin's manifest declares on its `kay.app` target. Never
      * rejects: every failure is an outcome. Nothing is queued: when the app part is not running the
@@ -2823,10 +2789,9 @@ declare interface KayAgentPluginApi {
      */
     readonly vendoredMcp: KayAgentVendoredMcp;
     /**
-     * Calls the endpoints this plugin's own `kay.app` part registered and the manifest grants this
-     * target `invoke` on, by local id. Never another plugin's. Every failure is an outcome, never a
-     * rejection; the host fixes a 10-second deadline. Always present; a host with no app part
-     * answers each call `unavailable`. See {@link KayAgentEndpoints} (SDK 0.17.3).
+     * `invoke` calls this plugin's own declared app endpoint by local id. `invokePlugin` names a
+     * provider plugin explicitly and checks this target's exact `endpoints.invoke` claim. Every
+     * failure is an outcome; unavailable providers are never queued.
      */
     readonly endpoints: KayAgentEndpoints;
     /**
@@ -4432,6 +4397,28 @@ declare interface PluginDelegatedServiceEntry {
     readonly scheme: PluginDelegatedScheme;
 }
 
+/** Sessionless JSON calls to another plugin's declared, publicly reachable endpoint. */
+declare interface PluginEndpointCaller {
+    /**
+     * Never rejects. Both payload and result are validated against the provider's declared schemas.
+     * Nothing is queued or retried. Cancellation and timeouts leave the operation's effect unknown.
+     */
+    invokePlugin(providerPluginId: string, endpointLocalId: string, payload: unknown, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<PluginEndpointOutcome>;
+}
+
+declare type PluginEndpointFailureReason = "not-declared" | "unavailable" | "timed-out" | "cancelled" | "failed" | "invalid" | "denied";
+
+declare type PluginEndpointOutcome = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: PluginEndpointFailureReason;
+    readonly message: string;
+};
+
 declare const PluginEventPublishInput: z.ZodObject<{
     uri: z.ZodString;
     related: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>>>;

package/dist/kay-agent-testing.js

@@ -358,15 +358,8 @@ function fauxKayAgentCapabilities() {
         })
       })
     },
-    // Answers `unavailable` naming itself, keeping the real call's promise never to reject. A test
-    // that exercises its plugin's own endpoints passes its own handle.
-    endpoints: {
-      invoke: async (endpoint) => ({
-        ok: false,
-        reason: "unavailable",
-        message: `endpoints.invoke("${endpoint}") is not wired in this test double`
-      })
-    }
+    // Uncomposed own and foreign calls keep their outcome contract instead of rejecting.
+    endpoints: { invokePlugin: NOT_WIRED, invoke: NOT_WIRED }
   };
 }
 function createTestClock(startMs, options = {}) {

package/dist/kay-agent.d.ts

@@ -813,6 +813,8 @@ export declare function createUnavailableCompiler(message: string): KayAgentComp
  */
 export declare function createUnavailableEndpoints(message: string): KayAgentEndpoints;
 
+export declare function createUnavailablePluginEndpointCaller(message: string): PluginEndpointCaller;
+
 export declare function createUnavailableUriCaller(message: string): PluginUriCaller;
 
 /** What the module holds at mutation time: a provider revision, the current content, or both. */
@@ -2784,8 +2786,11 @@ declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * types; callers use the resource surface instead. Previously admitted SDK contracts are no
  * longer served because they included app.memory on notebook hosts. No compatibility alias
  * restores it; callers migrate and declare ^0.49.0.
+ *
+ * 0.50.0 adds explicit cross-plugin endpoint calls on both backend targets. The URI-only 0.49.0
+ * contract remains served.
  */
-declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
+declare const KAY_PLUGIN_SDK_VERSION: "0.50.0";
 
 declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -2819,46 +2824,11 @@ export declare interface KayAgentCompiler {
     bundleBrowser(request: KayBrowserBundleRequest, sources: KayBrowserSources): Promise<KayBrowserBundle>;
 }
 
-/**
- * The plugin-facing `kay.agent` own-endpoint call: a plugin's agent part calls an endpoint its own
- * `kay.app` part registered. SDK 0.17.3; a plugin that calls it declares `compatibility.sdk`
- * `^0.19.0`.
- *
- * A plugin's two parts load as separate modules and share no memory, so this is how agent code
- * reaches state its app part keeps (a worker, a database). The manifest says which endpoints the
- * agent part may call: the `kay.app` target declares the endpoint with a `register` grant, and
- * `permissions.byTarget["kay.agent"].endpoints` lists it with `invoke`. No other plugin's endpoint
- * is nameable.
- *
- * An endpoint whose only `invoke` grant is the plugin's own `kay.agent` target is not reachable
- * from Bonsai's surfaces (its pages and runtime clients), so an action the agent takes after the
- * session's approval card cannot be taken around it.
- */
-/** Why an {@link KayAgentEndpoints.invoke} call produced no value. */
-export declare type KayAgentEndpointFailureReason = 
-/** The manifest grants this plugin's `kay.agent` target no `invoke` on this endpoint. */
-"not-declared"
-/** The plugin's `kay.app` part is not running, or registered no handler for it. */
-| "unavailable"
-/** The handler did not answer within the host's fixed deadline (10 seconds). It may still finish. */
-| "timed-out"
-/** The caller's `signal` aborted. The handler may still finish. */
-| "cancelled"
-/** The handler threw; `message` is its error's message. */
-| "failed"
-/** The request or the handler's response does not match the endpoint's declared schema. */
-| "invalid";
-
-export declare type KayAgentEndpointOutcome = {
-    readonly ok: true;
-    readonly value: unknown;
-} | {
-    readonly ok: false;
-    readonly reason: KayAgentEndpointFailureReason;
-    readonly message: string;
-};
+export declare type KayAgentEndpointFailureReason = PluginEndpointFailureReason;
+
+export declare type KayAgentEndpointOutcome = PluginEndpointOutcome;
 
-export declare interface KayAgentEndpoints {
+export declare interface KayAgentEndpoints extends PluginEndpointCaller {
     /**
      * Call `endpoint`, the local id this plugin's manifest declares on its `kay.app` target. Never
      * rejects: every failure is an outcome. Nothing is queued: when the app part is not running the
@@ -3132,10 +3102,9 @@ export declare interface KayAgentPluginApi {
      */
     readonly vendoredMcp: KayAgentVendoredMcp;
     /**
-     * Calls the endpoints this plugin's own `kay.app` part registered and the manifest grants this
-     * target `invoke` on, by local id. Never another plugin's. Every failure is an outcome, never a
-     * rejection; the host fixes a 10-second deadline. Always present; a host with no app part
-     * answers each call `unavailable`. See {@link KayAgentEndpoints} (SDK 0.17.3).
+     * `invoke` calls this plugin's own declared app endpoint by local id. `invokePlugin` names a
+     * provider plugin explicitly and checks this target's exact `endpoints.invoke` claim. Every
+     * failure is an outcome; unavailable providers are never queued.
      */
     readonly endpoints: KayAgentEndpoints;
     /**
@@ -5128,6 +5097,16 @@ declare const PluginCapabilityRefusalV1: z.ZodObject<{
                 delete: "delete";
             }>;
         }, z.core.$strict>;
+    }, z.core.$strict>, z.ZodObject<{
+        target: z.ZodEnum<{
+            "kay.agent": "kay.agent";
+            "kay.app": "kay.app";
+        }>;
+        slug: z.ZodLiteral<"endpoints.invoke">;
+        envelope: z.ZodObject<{
+            pluginId: z.ZodString;
+            endpointId: z.ZodString;
+        }, z.core.$strict>;
     }, z.core.$strict>, z.ZodObject<{
         target: z.ZodLiteral<"kay.app">;
         slug: z.ZodLiteral<"skills.read">;
@@ -5456,6 +5435,28 @@ export declare interface PluginDelegatedServiceEntry {
     readonly scheme: PluginDelegatedScheme;
 }
 
+/** Sessionless JSON calls to another plugin's declared, publicly reachable endpoint. */
+export declare interface PluginEndpointCaller {
+    /**
+     * Never rejects. Both payload and result are validated against the provider's declared schemas.
+     * Nothing is queued or retried. Cancellation and timeouts leave the operation's effect unknown.
+     */
+    invokePlugin(providerPluginId: string, endpointLocalId: string, payload: unknown, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<PluginEndpointOutcome>;
+}
+
+export declare type PluginEndpointFailureReason = "not-declared" | "unavailable" | "timed-out" | "cancelled" | "failed" | "invalid" | "denied";
+
+export declare type PluginEndpointOutcome = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: PluginEndpointFailureReason;
+    readonly message: string;
+};
+
 export declare const PluginEventEnvelope: z.ZodObject<{
     id: z.ZodString;
     localId: z.ZodString;

package/dist/kay-agent.js

@@ -997,6 +997,13 @@ function createUnavailableUriCaller(message) {
   };
 }
 
+// packages/plugin-sdk/dist/endpoints.js
+function createUnavailablePluginEndpointCaller(message) {
+  return {
+    invokePlugin: async () => ({ ok: false, reason: "unavailable", message })
+  };
+}
+
 // packages/herd-uri-extensions/dist/limits.js
 var MAX_BYTES = 50 * 1024 * 1024;
 var MAX_OUTPUT_CHARS = 5e5;
@@ -1492,7 +1499,8 @@ function createUnavailableCompiler(message) {
 // packages/plugin-sdk/dist/kay-agent/endpoints.js
 function createUnavailableEndpoints(message) {
   return {
-    invoke: async () => ({ ok: false, reason: "unavailable", message })
+    invoke: async () => ({ ok: false, reason: "unavailable", message }),
+    ...createUnavailablePluginEndpointCaller(message)
   };
 }
 
@@ -1731,6 +1739,7 @@ export {
   createOsascriptRunner,
   createUnavailableCompiler,
   createUnavailableEndpoints,
+  createUnavailablePluginEndpointCaller,
   createUnavailableUriCaller,
   declareProducedResources,
   defineAuthedTool,

package/dist/kay-app.d.ts

@@ -952,6 +952,8 @@ export declare function createFallbackOnlySignals(): KayAppSignals;
  */
 export declare function createKayPluginLog(write: (line: KayPluginLogLine) => void, bound?: KayPluginLogAttributes): KayPluginLog;
 
+export declare function createUnavailablePluginEndpointCaller(message: string): PluginEndpointCaller;
+
 /**
  * A `KayAppSealing` that answers `unavailable` to every call: what a host with no vault binds, so
  * `app.sealing` stays present on every host.
@@ -2900,8 +2902,11 @@ declare const KAY_PLUGIN_PROTOCOL_VERSION: "kay.plugin.v1";
  * types; callers use the resource surface instead. Previously admitted SDK contracts are no
  * longer served because they included app.memory on notebook hosts. No compatibility alias
  * restores it; callers migrate and declare ^0.49.0.
+ *
+ * 0.50.0 adds explicit cross-plugin endpoint calls on both backend targets. The URI-only 0.49.0
+ * contract remains served.
  */
-declare const KAY_PLUGIN_SDK_VERSION: "0.49.0";
+declare const KAY_PLUGIN_SDK_VERSION: "0.50.0";
 
 declare const KAY_PLUGIN_TARGET_NAMES: readonly ["kay.agent", "kay.app", "kay.ui"];
 
@@ -4572,12 +4577,14 @@ export declare interface KayAppDynamicContextSearchOptions {
 export declare interface KayAppEndpointContext {
     readonly credentials: readonly KayAppResolvedCredential[];
     readonly signal: AbortSignal;
+    /** Host-stamped origin of a sessionless cross-plugin call; absent for other callers. */
+    readonly callerPluginId?: string;
     /** Record only a scheme from this call's credentials after its provider operation succeeds. */
     reportWorked(schemeId: string): void;
 }
 
 /** The app-wide endpoint bus; payloads and returned values must be JSON. */
-export declare interface KayAppEndpoints {
+export declare interface KayAppEndpoints extends PluginEndpointCaller {
     register(name: string, handler: (payload: unknown, context: KayAppEndpointContext) => unknown | Promise<unknown>): void;
 }
 
@@ -5497,9 +5504,9 @@ export declare interface KayAppPluginApi {
      */
     readonly sealing: KayAppSealing;
     /**
-     * The app-wide endpoint bus (register handlers a consuming surface invokes). An endpoint whose
-     * only `invoke` grant is this plugin's own `kay.agent` target is reachable only from that target
-     * (`api.endpoints.invoke`), never from a surface.
+     * Register this plugin's app handlers or call another plugin's declared endpoint with
+     * `invokePlugin`. Foreign calls require this target's exact `endpoints.invoke` claim and
+     * cannot reach an endpoint restricted to its owner's agent target.
      */
     readonly endpoints: KayAppEndpoints;
     /** Publish one event declared by this plugin's `kay.app` manifest target. */
@@ -9974,6 +9981,28 @@ declare type PluginCardSubmitResult<T> = {
     readonly ok: false;
 }>;
 
+/** Sessionless JSON calls to another plugin's declared, publicly reachable endpoint. */
+export declare interface PluginEndpointCaller {
+    /**
+     * Never rejects. Both payload and result are validated against the provider's declared schemas.
+     * Nothing is queued or retried. Cancellation and timeouts leave the operation's effect unknown.
+     */
+    invokePlugin(providerPluginId: string, endpointLocalId: string, payload: unknown, options?: {
+        readonly signal?: AbortSignal;
+    }): Promise<PluginEndpointOutcome>;
+}
+
+export declare type PluginEndpointFailureReason = "not-declared" | "unavailable" | "timed-out" | "cancelled" | "failed" | "invalid" | "denied";
+
+export declare type PluginEndpointOutcome = {
+    readonly ok: true;
+    readonly value: unknown;
+} | {
+    readonly ok: false;
+    readonly reason: PluginEndpointFailureReason;
+    readonly message: string;
+};
+
 export declare const PluginEventEnvelope: z.ZodObject<{
     id: z.ZodString;
     localId: z.ZodString;

package/dist/kay-app.js

@@ -308,6 +308,13 @@ function createUnavailableUriCaller(message) {
   };
 }
 
+// packages/plugin-sdk/dist/endpoints.js
+function createUnavailablePluginEndpointCaller(message) {
+  return {
+    invokePlugin: async () => ({ ok: false, reason: "unavailable", message })
+  };
+}
+
 // packages/plugin-protocol/dist/plugin-signal-limits.js
 var PLUGIN_EVENT_REFUSED_ERROR_NAME = "PluginEventRefusedError";
 var PLUGIN_SIGNAL_KINDS = [
@@ -1106,6 +1113,7 @@ export {
   createConsoleKayPluginLog,
   createFallbackOnlySignals,
   createKayPluginLog,
+  createUnavailablePluginEndpointCaller,
   createUnavailableSealing,
   createUnavailableSkills,
   createUnavailableTools,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yaklabs-ai/plugin-sdk",
-  "version": "0.49.0",
+  "version": "0.50.0",
   "description": "The Kay plugin SDK — types and helpers for authoring a Kay directory plugin.",
   "author": "YakLabs",
   "type": "module",
@@ -21,6 +21,10 @@
       "types": "./dist/uri.d.ts",
       "default": "./dist/uri.js"
     },
+    "./endpoints": {
+      "types": "./dist/endpoints.d.ts",
+      "default": "./dist/endpoints.js"
+    },
     "./kay-app/session-summary": {
       "types": "./dist/kay-app-session-summary.d.ts",
       "default": "./dist/kay-app-session-summary.js"