@databricks/appkit-ui 0.15.0 → 0.17.0

package/docs/development/project-setup.md

@@ -61,7 +61,7 @@ The AppKit `server()` plugin automatically serves:
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^5.1.1",
-    "tsdown": "^0.15.7",
+    "tsdown": "^0.20.3",
     "tsx": "^4.19.0",
     "typescript": "~5.6.0",
     "vite": "^7.2.4"

package/docs/plugins/plugin-management.md

@@ -2,6 +2,8 @@
 
 AppKit includes a CLI for managing plugins. All commands are available under `npx @databricks/appkit plugin`.
 
+**Manifest convention:** `manifest.json` is the default and recommended format for CLI commands (`sync`, `list`, `validate`). For zero-trust safety, JS manifests (`manifest.js`/`manifest.cjs`) are ignored unless you pass `--allow-js-manifest`, which executes plugin code and should be used only with trusted sources. The **add-resource** command only edits `manifest.json` in place.
+
 ## Create a plugin[​](#create-a-plugin "Direct link to Create a plugin")
 
 Scaffold a new plugin interactively:
@@ -18,7 +20,7 @@ The wizard walks you through:
 * **Resources**: Which Databricks resources the plugin needs (SQL Warehouse, Secret, etc.) and whether each is required or optional
 * **Optional fields**: Author, version, license
 
-The command generates a complete plugin scaffold with `manifest.json`, TypeScript class, and barrel exports — ready to register in your app.
+The command generates a complete plugin scaffold with `manifest.json` and a TypeScript plugin class that imports the manifest directly — ready to register in your app.
 
 ## Sync plugin manifests[​](#sync-plugin-manifests "Direct link to Sync plugin manifests")
 
@@ -31,6 +33,13 @@ npx @databricks/appkit plugin sync --write
 
 This discovers plugin manifests from installed packages and local imports, then writes a consolidated manifest used by deployment tooling. Plugins referenced in your `createApp({ plugins: [...] })` call are automatically marked as required.
 
+Trusted installed Databricks packages (for example `@databricks/appkit`) are allowed to load bundled JS manifests during `plugin sync`. For other sources, if you intentionally rely on JS manifests, opt in explicitly:
+
+```bash
+npx @databricks/appkit plugin sync --write --allow-js-manifest
+
+```
+
 Use the `--silent` flag in build hooks to suppress output:
 
 ```json
@@ -59,6 +68,8 @@ npx @databricks/appkit plugin validate plugins/my-plugin appkit.plugins.json
 
 The validator auto-detects whether a file is a plugin manifest or a template manifest (from `$schema`) and reports errors with humanized paths and expected values.
 
+To include JS manifests in validation, pass `--allow-js-manifest`.
+
 ## List plugins[​](#list-plugins "Direct link to List plugins")
 
 View registered plugins from `appkit.plugins.json` or scan a directory:
@@ -70,6 +81,9 @@ npx @databricks/appkit plugin list
 # Scan a directory for plugin folders
 npx @databricks/appkit plugin list --dir plugins/
 
+# Scan a directory and include JS manifests (trusted code only)
+npx @databricks/appkit plugin list --dir plugins/ --allow-js-manifest
+
 # JSON output for scripting
 npx @databricks/appkit plugin list --json
 
@@ -77,7 +91,7 @@ npx @databricks/appkit plugin list --json
 
 ## Add a resource to a plugin[​](#add-a-resource-to-a-plugin "Direct link to Add a resource to a plugin")
 
-Interactively add a new resource requirement to an existing plugin manifest:
+Interactively add a new resource requirement to an existing plugin manifest. **Requires `manifest.json`** in the plugin directory (the command edits it in place; it does not modify `manifest.js`):
 
 ```bash
 npx @databricks/appkit plugin add-resource

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@databricks/appkit-ui",
   "type": "module",
-  "version": "0.15.0",
+  "version": "0.17.0",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/databricks/appkit.git"
@@ -14,6 +15,7 @@
     "docs",
     "docs.md",
     "CLAUDE.md",
+    "LICENSE",
     "llms.txt",
     "README.md",
     "DCO",