@databricks/appkit-ui 0.59.0 → 0.61.0

package/NOTICE.md

@@ -9,19 +9,19 @@ This Software contains code from the following open source projects:
 | [@ast-grep/napi](https://www.npmjs.com/package/@ast-grep/napi) | 0.37.0 | MIT | https://ast-grep.github.io |
 | [@clack/prompts](https://www.npmjs.com/package/@clack/prompts) | 1.0.1 | MIT | https://github.com/bombshell-dev/clack/tree/main/packages/prompts#readme |
 | [@opentelemetry/api](https://www.npmjs.com/package/@opentelemetry/api) | 1.9.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/api |
-| [@opentelemetry/api-logs](https://www.npmjs.com/package/@opentelemetry/api-logs) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/api-logs |
+| [@opentelemetry/api-logs](https://www.npmjs.com/package/@opentelemetry/api-logs) | 0.205.0, 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/api-logs |
 | [@opentelemetry/auto-instrumentations-node](https://www.npmjs.com/package/@opentelemetry/auto-instrumentations-node) | 0.77.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/auto-instrumentations-node#readme |
-| [@opentelemetry/exporter-logs-otlp-proto](https://www.npmjs.com/package/@opentelemetry/exporter-logs-otlp-proto) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-logs-otlp-proto |
-| [@opentelemetry/exporter-metrics-otlp-proto](https://www.npmjs.com/package/@opentelemetry/exporter-metrics-otlp-proto) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-exporter-metrics-otlp-proto |
-| [@opentelemetry/exporter-trace-otlp-proto](https://www.npmjs.com/package/@opentelemetry/exporter-trace-otlp-proto) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-trace-otlp-proto |
-| [@opentelemetry/instrumentation](https://www.npmjs.com/package/@opentelemetry/instrumentation) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation |
+| [@opentelemetry/exporter-logs-otlp-proto](https://www.npmjs.com/package/@opentelemetry/exporter-logs-otlp-proto) | 0.205.0, 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-logs-otlp-proto |
+| [@opentelemetry/exporter-metrics-otlp-proto](https://www.npmjs.com/package/@opentelemetry/exporter-metrics-otlp-proto) | 0.205.0, 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-exporter-metrics-otlp-proto |
+| [@opentelemetry/exporter-trace-otlp-proto](https://www.npmjs.com/package/@opentelemetry/exporter-trace-otlp-proto) | 0.205.0, 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/exporter-trace-otlp-proto |
+| [@opentelemetry/instrumentation](https://www.npmjs.com/package/@opentelemetry/instrumentation) | 0.205.0, 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation |
 | [@opentelemetry/instrumentation-express](https://www.npmjs.com/package/@opentelemetry/instrumentation-express) | 0.67.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js-contrib/tree/main/packages/instrumentation-express#readme |
 | [@opentelemetry/instrumentation-http](https://www.npmjs.com/package/@opentelemetry/instrumentation-http) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-instrumentation-http |
-| [@opentelemetry/resources](https://www.npmjs.com/package/@opentelemetry/resources) | 2.8.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-resources |
-| [@opentelemetry/sdk-logs](https://www.npmjs.com/package/@opentelemetry/sdk-logs) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/sdk-logs |
-| [@opentelemetry/sdk-metrics](https://www.npmjs.com/package/@opentelemetry/sdk-metrics) | 2.8.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/sdk-metrics |
-| [@opentelemetry/sdk-node](https://www.npmjs.com/package/@opentelemetry/sdk-node) | 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-sdk-node |
-| [@opentelemetry/sdk-trace-base](https://www.npmjs.com/package/@opentelemetry/sdk-trace-base) | 2.8.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-sdk-trace-base |
+| [@opentelemetry/resources](https://www.npmjs.com/package/@opentelemetry/resources) | 2.1.0, 2.8.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-resources |
+| [@opentelemetry/sdk-logs](https://www.npmjs.com/package/@opentelemetry/sdk-logs) | 0.205.0, 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/sdk-logs |
+| [@opentelemetry/sdk-metrics](https://www.npmjs.com/package/@opentelemetry/sdk-metrics) | 2.1.0, 2.8.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/sdk-metrics |
+| [@opentelemetry/sdk-node](https://www.npmjs.com/package/@opentelemetry/sdk-node) | 0.205.0, 0.219.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/experimental/packages/opentelemetry-sdk-node |
+| [@opentelemetry/sdk-trace-base](https://www.npmjs.com/package/@opentelemetry/sdk-trace-base) | 2.1.0, 2.8.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/packages/opentelemetry-sdk-trace-base |
 | [@opentelemetry/semantic-conventions](https://www.npmjs.com/package/@opentelemetry/semantic-conventions) | 1.38.0 | Apache-2.0 | https://github.com/open-telemetry/opentelemetry-js/tree/main/semantic-conventions |
 | [@radix-ui/react-accordion](https://www.npmjs.com/package/@radix-ui/react-accordion) | 1.2.12 | MIT | https://radix-ui.com/primitives |
 | [@radix-ui/react-alert-dialog](https://www.npmjs.com/package/@radix-ui/react-alert-dialog) | 1.1.15 | MIT | https://radix-ui.com/primitives |
@@ -70,6 +70,7 @@ This Software contains code from the following open source projects:
 | [lucide-react](https://www.npmjs.com/package/lucide-react) | 0.554.0 | ISC | https://lucide.dev |
 | [magic-string](https://www.npmjs.com/package/magic-string) | 0.30.21 | MIT | https://github.com/Rich-Harris/magic-string#readme |
 | [marked](https://www.npmjs.com/package/marked) | 16.4.2, 17.0.3 | MIT | https://marked.js.org |
+| [mlflow-tracing](https://www.npmjs.com/package/mlflow-tracing) | 0.1.3 | Apache-2.0 | https://mlflow.org/ |
 | [next-themes](https://www.npmjs.com/package/next-themes) | 0.4.6 | MIT | https://github.com/pacocoursey/next-themes#readme |
 | [obug](https://www.npmjs.com/package/obug) | 2.1.1 | MIT | https://github.com/sxzz/obug#readme |
 | [pg](https://www.npmjs.com/package/pg) | 8.18.0 | MIT | https://github.com/brianc/node-postgres |

package/dist/cli/commands/doctor/bundle.js

@@ -1,3 +1,4 @@
+import { APP_YAML_FILE, DATABRICKS_YML_FILE, bindingTypeOf } from "../../deploy-config.js";
 import { errorMessage } from "./utils.js";
 import fs from "node:fs";
 import path from "node:path";
@@ -16,22 +17,13 @@ import yaml from "js-yaml";
 *
 * SDK-free; pure YAML parsing. Absent files degrade to empty results.
 */
-const DEFAULT_BUNDLE_FILE = "databricks.yml";
-const DEFAULT_APP_YAML_FILE = "app.yaml";
 /** A `${resources.<type>.<key>.<field>}` reference — a bundle-created resource. */
 const RESOURCES_REF = /\$\{resources\.([^.]+)\.([^.}]+)\.[^}]+\}/;
-/** The typed sub-key of a binding is its single non-`name` object property. */
-function bindingType(block) {
-	for (const [k, v] of Object.entries(block)) {
-		if (k === "name") continue;
-		if (v && typeof v === "object") return k;
-	}
-}
 /** Classifies a binding by its typed sub-key and origin: scanning its field
 * values for a `${resources.*}` reference (bundle-managed) vs anything else
 * (external). */
 function classifyBinding(block) {
-	const type = bindingType(block);
+	const type = bindingTypeOf(block);
 	const typed = type ? block[type] : void 0;
 	if (typed && typeof typed === "object") for (const value of Object.values(typed)) {
 		if (typeof value !== "string") continue;
@@ -74,7 +66,7 @@ function readYaml(filePath) {
 * empty-but-`present:false` result when no bundle is found, so callers can treat
 * "no bundle" as "everything external" without special-casing.
 */
-function readBundleInfo(cwd = process.cwd(), bundleFile = DEFAULT_BUNDLE_FILE, appYamlFile = DEFAULT_APP_YAML_FILE) {
+function readBundleInfo(cwd = process.cwd(), bundleFile = DATABRICKS_YML_FILE, appYamlFile = APP_YAML_FILE) {
 	const bindings = /* @__PURE__ */ new Map();
 	const envToBinding = /* @__PURE__ */ new Map();
 	const declaredResources = /* @__PURE__ */ new Set();

package/dist/cli/commands/doctor/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","names":[],"sources":["../../../../src/cli/commands/doctor/bundle.ts"],"sourcesContent":["/**\n * Reads `databricks.yml` + `app.yaml` for two things doctor can't get from\n * `appkit.plugins.json`:\n *\n *  1. **Provenance** — whether each binding references an existing resource\n *     (`${var.*}`/literal → `external`) or one this bundle creates\n *     (`${resources.<type>.<key>.*}` → `bundle-managed`).\n *  2. **Wiring** — the binding `name` joins the three files: `app.yaml`'s\n *     `valueFrom: <name>` must match a `databricks.yml` binding `name`.\n *\n * SDK-free; pure YAML parsing. Absent files degrade to empty results.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport yaml from \"js-yaml\";\nimport type { ResourceOrigin } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\nexport const DEFAULT_BUNDLE_FILE = \"databricks.yml\";\nexport const DEFAULT_APP_YAML_FILE = \"app.yaml\";\n\n/** A `${resources.<type>.<key>.<field>}` reference — a bundle-created resource. */\nconst RESOURCES_REF = /\\$\\{resources\\.([^.]+)\\.([^.}]+)\\.[^}]+\\}/;\n\n/** One app resource binding from `resources.apps.<app>.resources[]`. */\nexport interface BundleBinding {\n  /** The binding name — the join key with `app.yaml` `valueFrom`. */\n  name: string;\n  /** The typed sub-key that names the kind (`sql_warehouse`, `genie_space`, …). */\n  type?: string;\n  origin: ResourceOrigin;\n  /** For bundle-managed bindings: the `<type>.<key>` it references, if parseable. */\n  ref?: { type: string; key: string };\n}\n\nexport interface BundleInfo {\n  /** Bindings under every app, keyed by binding name. */\n  bindings: Map<string, BundleBinding>;\n  /** `app.yaml` env var name → binding name (from `valueFrom`). */\n  envToBinding: Map<string, string>;\n  /** Declared bundle resource keys, as `\"<type>.<key>\"`, for ref-integrity. */\n  declaredResources: Set<string>;\n  /** True when a `databricks.yml` was found and parsed. */\n  present: boolean;\n}\n\ninterface AppResourceBlock {\n  name?: string;\n  [k: string]: unknown;\n}\ninterface BundleAppBlock {\n  resources?: AppResourceBlock[];\n}\ninterface BundleDoc {\n  resources?: {\n    apps?: Record<string, BundleAppBlock>;\n    [otherType: string]: Record<string, unknown> | undefined;\n  };\n}\ninterface AppYamlDoc {\n  env?: Array<{ name?: string; valueFrom?: string }>;\n}\n\n/** The typed sub-key of a binding is its single non-`name` object property. */\nfunction bindingType(block: AppResourceBlock): string | undefined {\n  for (const [k, v] of Object.entries(block)) {\n    if (k === \"name\") continue;\n    if (v && typeof v === \"object\") return k;\n  }\n  return undefined;\n}\n\n/** Classifies a binding by its typed sub-key and origin: scanning its field\n * values for a `${resources.*}` reference (bundle-managed) vs anything else\n * (external). */\nfunction classifyBinding(block: AppResourceBlock): {\n  type?: string;\n  origin: ResourceOrigin;\n  ref?: { type: string; key: string };\n} {\n  const type = bindingType(block);\n  const typed = type ? block[type] : undefined;\n  if (typed && typeof typed === \"object\") {\n    for (const value of Object.values(typed as Record<string, unknown>)) {\n      if (typeof value !== \"string\") continue;\n      const m = value.match(RESOURCES_REF);\n      if (m) {\n        return {\n          type,\n          origin: \"bundle-managed\",\n          ref: { type: m[1], key: m[2] },\n        };\n      }\n    }\n  }\n  return { type, origin: \"external\" };\n}\n\n/**\n * Reads and parses a YAML file. Returns `null` when the file is absent (a\n * legitimate \"no bundle\" state); throws on invalid YAML, since silently\n * ignoring it would let doctor report a false all-clear.\n */\nfunction readYaml<T>(filePath: string): T | null {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(filePath, \"utf-8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  try {\n    return (yaml.load(raw) ?? {}) as T;\n  } catch (err) {\n    throw new Error(\n      `Failed to parse ${path.basename(filePath)}: ${errorMessage(err)}`,\n    );\n  }\n}\n\n/**\n * Parses `databricks.yml` (+ `app.yaml`) into {@link BundleInfo}. Returns an\n * empty-but-`present:false` result when no bundle is found, so callers can treat\n * \"no bundle\" as \"everything external\" without special-casing.\n */\nexport function readBundleInfo(\n  cwd: string = process.cwd(),\n  bundleFile: string = DEFAULT_BUNDLE_FILE,\n  appYamlFile: string = DEFAULT_APP_YAML_FILE,\n): BundleInfo {\n  const bindings = new Map<string, BundleBinding>();\n  const envToBinding = new Map<string, string>();\n  const declaredResources = new Set<string>();\n\n  const doc = readYaml<BundleDoc>(path.resolve(cwd, bundleFile));\n  if (!doc) {\n    return { bindings, envToBinding, declaredResources, present: false };\n  }\n\n  for (const [type, group] of Object.entries(doc.resources ?? {})) {\n    if (!group || typeof group !== \"object\") continue;\n    for (const key of Object.keys(group))\n      declaredResources.add(`${type}.${key}`);\n  }\n\n  for (const app of Object.values(doc.resources?.apps ?? {})) {\n    for (const block of app.resources ?? []) {\n      if (!block?.name) continue;\n      const { type, origin, ref } = classifyBinding(block);\n      bindings.set(block.name, {\n        name: block.name,\n        type,\n        origin,\n        ref,\n      });\n    }\n  }\n\n  const appYaml = readYaml<AppYamlDoc>(path.resolve(cwd, appYamlFile));\n  for (const entry of appYaml?.env ?? []) {\n    if (entry?.name && entry.valueFrom) {\n      envToBinding.set(entry.name, entry.valueFrom);\n    }\n  }\n\n  return { bindings, envToBinding, declaredResources, present: true };\n}\n\n/**\n * Resolves the origin for a target given its env vars, by walking\n * env var → binding name → binding origin. Returns undefined when the bundle\n * has nothing to say (so the target stays external by default).\n */\nexport function originForEnvVars(\n  envVars: string[],\n  info: BundleInfo,\n): ResourceOrigin | undefined {\n  if (!info.present) return undefined;\n  for (const env of envVars) {\n    const bindingName = info.envToBinding.get(env);\n    if (!bindingName) continue;\n    const binding = info.bindings.get(bindingName);\n    if (binding) return binding.origin;\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,MAAa,sBAAsB;AACnC,MAAa,wBAAwB;;AAGrC,MAAM,gBAAgB;;AA0CtB,SAAS,YAAY,OAA6C;AAChE,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,MAAI,MAAM,OAAQ;AAClB,MAAI,KAAK,OAAO,MAAM,SAAU,QAAO;;;;;;AAQ3C,SAAS,gBAAgB,OAIvB;CACA,MAAM,OAAO,YAAY,MAAM;CAC/B,MAAM,QAAQ,OAAO,MAAM,QAAQ;AACnC,KAAI,SAAS,OAAO,UAAU,SAC5B,MAAK,MAAM,SAAS,OAAO,OAAO,MAAiC,EAAE;AACnE,MAAI,OAAO,UAAU,SAAU;EAC/B,MAAM,IAAI,MAAM,MAAM,cAAc;AACpC,MAAI,EACF,QAAO;GACL;GACA,QAAQ;GACR,KAAK;IAAE,MAAM,EAAE;IAAI,KAAK,EAAE;IAAI;GAC/B;;AAIP,QAAO;EAAE;EAAM,QAAQ;EAAY;;;;;;;AAQrC,SAAS,SAAY,UAA4B;CAC/C,IAAI;AACJ,KAAI;AACF,QAAM,GAAG,aAAa,UAAU,QAAQ;UACjC,KAAK;AACZ,MAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,QAAM;;AAER,KAAI;AACF,SAAQ,KAAK,KAAK,IAAI,IAAI,EAAE;UACrB,KAAK;AACZ,QAAM,IAAI,MACR,mBAAmB,KAAK,SAAS,SAAS,CAAC,IAAI,aAAa,IAAI,GACjE;;;;;;;;AASL,SAAgB,eACd,MAAc,QAAQ,KAAK,EAC3B,aAAqB,qBACrB,cAAsB,uBACV;CACZ,MAAM,2BAAW,IAAI,KAA4B;CACjD,MAAM,+BAAe,IAAI,KAAqB;CAC9C,MAAM,oCAAoB,IAAI,KAAa;CAE3C,MAAM,MAAM,SAAoB,KAAK,QAAQ,KAAK,WAAW,CAAC;AAC9D,KAAI,CAAC,IACH,QAAO;EAAE;EAAU;EAAc;EAAmB,SAAS;EAAO;AAGtE,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,IAAI,aAAa,EAAE,CAAC,EAAE;AAC/D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,OAAK,MAAM,OAAO,OAAO,KAAK,MAAM,CAClC,mBAAkB,IAAI,GAAG,KAAK,GAAG,MAAM;;AAG3C,MAAK,MAAM,OAAO,OAAO,OAAO,IAAI,WAAW,QAAQ,EAAE,CAAC,CACxD,MAAK,MAAM,SAAS,IAAI,aAAa,EAAE,EAAE;AACvC,MAAI,CAAC,OAAO,KAAM;EAClB,MAAM,EAAE,MAAM,QAAQ,QAAQ,gBAAgB,MAAM;AACpD,WAAS,IAAI,MAAM,MAAM;GACvB,MAAM,MAAM;GACZ;GACA;GACA;GACD,CAAC;;CAIN,MAAM,UAAU,SAAqB,KAAK,QAAQ,KAAK,YAAY,CAAC;AACpE,MAAK,MAAM,SAAS,SAAS,OAAO,EAAE,CACpC,KAAI,OAAO,QAAQ,MAAM,UACvB,cAAa,IAAI,MAAM,MAAM,MAAM,UAAU;AAIjD,QAAO;EAAE;EAAU;EAAc;EAAmB,SAAS;EAAM;;;;;;;AAQrE,SAAgB,iBACd,SACA,MAC4B;AAC5B,KAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,MAAK,MAAM,OAAO,SAAS;EACzB,MAAM,cAAc,KAAK,aAAa,IAAI,IAAI;AAC9C,MAAI,CAAC,YAAa;EAClB,MAAM,UAAU,KAAK,SAAS,IAAI,YAAY;AAC9C,MAAI,QAAS,QAAO,QAAQ"}
+{"version":3,"file":"bundle.js","names":[],"sources":["../../../../src/cli/commands/doctor/bundle.ts"],"sourcesContent":["/**\n * Reads `databricks.yml` + `app.yaml` for two things doctor can't get from\n * `appkit.plugins.json`:\n *\n *  1. **Provenance** — whether each binding references an existing resource\n *     (`${var.*}`/literal → `external`) or one this bundle creates\n *     (`${resources.<type>.<key>.*}` → `bundle-managed`).\n *  2. **Wiring** — the binding `name` joins the three files: `app.yaml`'s\n *     `valueFrom: <name>` must match a `databricks.yml` binding `name`.\n *\n * SDK-free; pure YAML parsing. Absent files degrade to empty results.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport yaml from \"js-yaml\";\nimport {\n  APP_YAML_FILE,\n  bindingTypeOf,\n  DATABRICKS_YML_FILE,\n} from \"../../deploy-config\";\nimport type { ResourceOrigin } from \"./types\";\nimport { errorMessage } from \"./utils\";\n\n/** A `${resources.<type>.<key>.<field>}` reference — a bundle-created resource. */\nconst RESOURCES_REF = /\\$\\{resources\\.([^.]+)\\.([^.}]+)\\.[^}]+\\}/;\n\n/** One app resource binding from `resources.apps.<app>.resources[]`. */\nexport interface BundleBinding {\n  /** The binding name — the join key with `app.yaml` `valueFrom`. */\n  name: string;\n  /** The typed sub-key that names the kind (`sql_warehouse`, `genie_space`, …). */\n  type?: string;\n  origin: ResourceOrigin;\n  /** For bundle-managed bindings: the `<type>.<key>` it references, if parseable. */\n  ref?: { type: string; key: string };\n}\n\nexport interface BundleInfo {\n  /** Bindings under every app, keyed by binding name. */\n  bindings: Map<string, BundleBinding>;\n  /** `app.yaml` env var name → binding name (from `valueFrom`). */\n  envToBinding: Map<string, string>;\n  /** Declared bundle resource keys, as `\"<type>.<key>\"`, for ref-integrity. */\n  declaredResources: Set<string>;\n  /** True when a `databricks.yml` was found and parsed. */\n  present: boolean;\n}\n\ninterface AppResourceBlock {\n  name?: string;\n  [k: string]: unknown;\n}\ninterface BundleAppBlock {\n  resources?: AppResourceBlock[];\n}\ninterface BundleDoc {\n  resources?: {\n    apps?: Record<string, BundleAppBlock>;\n    [otherType: string]: Record<string, unknown> | undefined;\n  };\n}\ninterface AppYamlDoc {\n  env?: Array<{ name?: string; valueFrom?: string }>;\n}\n\n/** Classifies a binding by its typed sub-key and origin: scanning its field\n * values for a `${resources.*}` reference (bundle-managed) vs anything else\n * (external). */\nfunction classifyBinding(block: AppResourceBlock): {\n  type?: string;\n  origin: ResourceOrigin;\n  ref?: { type: string; key: string };\n} {\n  const type = bindingTypeOf(block);\n  const typed = type ? block[type] : undefined;\n  if (typed && typeof typed === \"object\") {\n    for (const value of Object.values(typed as Record<string, unknown>)) {\n      if (typeof value !== \"string\") continue;\n      const m = value.match(RESOURCES_REF);\n      if (m) {\n        return {\n          type,\n          origin: \"bundle-managed\",\n          ref: { type: m[1], key: m[2] },\n        };\n      }\n    }\n  }\n  return { type, origin: \"external\" };\n}\n\n/**\n * Reads and parses a YAML file. Returns `null` when the file is absent (a\n * legitimate \"no bundle\" state); throws on invalid YAML, since silently\n * ignoring it would let doctor report a false all-clear.\n */\nfunction readYaml<T>(filePath: string): T | null {\n  let raw: string;\n  try {\n    raw = fs.readFileSync(filePath, \"utf-8\");\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return null;\n    throw err;\n  }\n  try {\n    return (yaml.load(raw) ?? {}) as T;\n  } catch (err) {\n    throw new Error(\n      `Failed to parse ${path.basename(filePath)}: ${errorMessage(err)}`,\n    );\n  }\n}\n\n/**\n * Parses `databricks.yml` (+ `app.yaml`) into {@link BundleInfo}. Returns an\n * empty-but-`present:false` result when no bundle is found, so callers can treat\n * \"no bundle\" as \"everything external\" without special-casing.\n */\nexport function readBundleInfo(\n  cwd: string = process.cwd(),\n  bundleFile: string = DATABRICKS_YML_FILE,\n  appYamlFile: string = APP_YAML_FILE,\n): BundleInfo {\n  const bindings = new Map<string, BundleBinding>();\n  const envToBinding = new Map<string, string>();\n  const declaredResources = new Set<string>();\n\n  const doc = readYaml<BundleDoc>(path.resolve(cwd, bundleFile));\n  if (!doc) {\n    return { bindings, envToBinding, declaredResources, present: false };\n  }\n\n  for (const [type, group] of Object.entries(doc.resources ?? {})) {\n    if (!group || typeof group !== \"object\") continue;\n    for (const key of Object.keys(group))\n      declaredResources.add(`${type}.${key}`);\n  }\n\n  for (const app of Object.values(doc.resources?.apps ?? {})) {\n    for (const block of app.resources ?? []) {\n      if (!block?.name) continue;\n      const { type, origin, ref } = classifyBinding(block);\n      bindings.set(block.name, {\n        name: block.name,\n        type,\n        origin,\n        ref,\n      });\n    }\n  }\n\n  const appYaml = readYaml<AppYamlDoc>(path.resolve(cwd, appYamlFile));\n  for (const entry of appYaml?.env ?? []) {\n    if (entry?.name && entry.valueFrom) {\n      envToBinding.set(entry.name, entry.valueFrom);\n    }\n  }\n\n  return { bindings, envToBinding, declaredResources, present: true };\n}\n\n/**\n * Resolves the origin for a target given its env vars, by walking\n * env var → binding name → binding origin. Returns undefined when the bundle\n * has nothing to say (so the target stays external by default).\n */\nexport function originForEnvVars(\n  envVars: string[],\n  info: BundleInfo,\n): ResourceOrigin | undefined {\n  if (!info.present) return undefined;\n  for (const env of envVars) {\n    const bindingName = info.envToBinding.get(env);\n    if (!bindingName) continue;\n    const binding = info.bindings.get(bindingName);\n    if (binding) return binding.origin;\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAyBA,MAAM,gBAAgB;;;;AA4CtB,SAAS,gBAAgB,OAIvB;CACA,MAAM,OAAO,cAAc,MAAM;CACjC,MAAM,QAAQ,OAAO,MAAM,QAAQ;AACnC,KAAI,SAAS,OAAO,UAAU,SAC5B,MAAK,MAAM,SAAS,OAAO,OAAO,MAAiC,EAAE;AACnE,MAAI,OAAO,UAAU,SAAU;EAC/B,MAAM,IAAI,MAAM,MAAM,cAAc;AACpC,MAAI,EACF,QAAO;GACL;GACA,QAAQ;GACR,KAAK;IAAE,MAAM,EAAE;IAAI,KAAK,EAAE;IAAI;GAC/B;;AAIP,QAAO;EAAE;EAAM,QAAQ;EAAY;;;;;;;AAQrC,SAAS,SAAY,UAA4B;CAC/C,IAAI;AACJ,KAAI;AACF,QAAM,GAAG,aAAa,UAAU,QAAQ;UACjC,KAAK;AACZ,MAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,QAAM;;AAER,KAAI;AACF,SAAQ,KAAK,KAAK,IAAI,IAAI,EAAE;UACrB,KAAK;AACZ,QAAM,IAAI,MACR,mBAAmB,KAAK,SAAS,SAAS,CAAC,IAAI,aAAa,IAAI,GACjE;;;;;;;;AASL,SAAgB,eACd,MAAc,QAAQ,KAAK,EAC3B,aAAqB,qBACrB,cAAsB,eACV;CACZ,MAAM,2BAAW,IAAI,KAA4B;CACjD,MAAM,+BAAe,IAAI,KAAqB;CAC9C,MAAM,oCAAoB,IAAI,KAAa;CAE3C,MAAM,MAAM,SAAoB,KAAK,QAAQ,KAAK,WAAW,CAAC;AAC9D,KAAI,CAAC,IACH,QAAO;EAAE;EAAU;EAAc;EAAmB,SAAS;EAAO;AAGtE,MAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,IAAI,aAAa,EAAE,CAAC,EAAE;AAC/D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU;AACzC,OAAK,MAAM,OAAO,OAAO,KAAK,MAAM,CAClC,mBAAkB,IAAI,GAAG,KAAK,GAAG,MAAM;;AAG3C,MAAK,MAAM,OAAO,OAAO,OAAO,IAAI,WAAW,QAAQ,EAAE,CAAC,CACxD,MAAK,MAAM,SAAS,IAAI,aAAa,EAAE,EAAE;AACvC,MAAI,CAAC,OAAO,KAAM;EAClB,MAAM,EAAE,MAAM,QAAQ,QAAQ,gBAAgB,MAAM;AACpD,WAAS,IAAI,MAAM,MAAM;GACvB,MAAM,MAAM;GACZ;GACA;GACA;GACD,CAAC;;CAIN,MAAM,UAAU,SAAqB,KAAK,QAAQ,KAAK,YAAY,CAAC;AACpE,MAAK,MAAM,SAAS,SAAS,OAAO,EAAE,CACpC,KAAI,OAAO,QAAQ,MAAM,UACvB,cAAa,IAAI,MAAM,MAAM,MAAM,UAAU;AAIjD,QAAO;EAAE;EAAU;EAAc;EAAmB,SAAS;EAAM;;;;;;;AAQrE,SAAgB,iBACd,SACA,MAC4B;AAC5B,KAAI,CAAC,KAAK,QAAS,QAAO;AAC1B,MAAK,MAAM,OAAO,SAAS;EACzB,MAAM,cAAc,KAAK,aAAa,IAAI,IAAI;AAC9C,MAAI,CAAC,YAAa;EAClB,MAAM,UAAU,KAAK,SAAS,IAAI,YAAY;AAC9C,MAAI,QAAS,QAAO,QAAQ"}

package/dist/cli/commands/doctor/databricks-client.js

@@ -1,38 +1,34 @@
+import { loadConfigFile } from "../../../workspace-client/legacy.js";
+import { createWorkspaceClient } from "../../../workspace-client/factory.js";
+
 //#region src/cli/commands/doctor/databricks-client.ts
 /**
-* The single seam where `appkit doctor` crosses into the Databricks SDK. The
-* SDK-free `shared` package reaches it via a runtime `import(...)`, degrading
-* gracefully when it's absent.
-*
-* `noRestrictedImports` normally routes SDK access through
-* `packages/appkit/src/workspace-client`, but that isn't available here: `appkit`
-* depends on `shared`, so importing it back would be a dependency cycle. `shared`
-* also can't depend on the SDK directly — hence the dynamic `import(...)` and the
-* per-call suppressions below. This file *is* the wrapper for this package, and
-* every SDK reference in the doctor command is confined to it.
+* The seam where `appkit doctor` crosses into the Databricks SDK. It reaches
+* the SDK through the shared `workspace-client` facade — the one sanctioned SDK
+* import site — so no dynamic import or `noRestrictedImports` suppression is
+* needed. (The Lakebase probe still dynamically imports `@databricks/appkit`
+* below, since that's an optional peer `shared` deliberately doesn't depend on.)
+*/
+/**
+* Retained for backward compatibility. Since `shared` now depends on the SDK
+* (reached via the workspace-client facade), the SDK is always resolvable at
+* runtime and this is no longer thrown; kept exported so existing callers and
+* the `SDK_NOT_INSTALLED` diagnostic branch keep compiling.
 */
-/** Raised when `@databricks/sdk-experimental` is not resolvable at runtime. */
 var SdkNotInstalledError = class extends Error {
 	constructor() {
-		super("The 'doctor' command requires the Databricks SDK (a dependency of @databricks/appkit). Please install @databricks/appkit to run connection checks.");
+		super("The 'doctor' command requires the Databricks SDK (a dependency of @databricks/appkit).");
 		this.name = "SdkNotInstalledError";
 	}
 };
 function isModuleNotFound(err) {
 	return err instanceof Error && (err.message.includes("Cannot find module") || err.message.includes("Cannot find package") || err.code === "ERR_MODULE_NOT_FOUND");
 }
-/** Constructs a `WorkspaceClient` via the SDK's unified-auth chain. An explicit
+/** Constructs a workspace client via the SDK's unified-auth chain. An explicit
 * `profile` is passed through `Config.profile` rather than mutating
 * `process.env`, so it doesn't leak beyond this call. */
 async function getServiceClient(profile) {
-	let sdk;
-	try {
-		sdk = await import("@databricks/sdk-experimental");
-	} catch (err) {
-		if (isModuleNotFound(err)) throw new SdkNotInstalledError();
-		throw err;
-	}
-	return { client: new sdk.WorkspaceClient(profile ? { profile } : {}) };
+	return { client: createWorkspaceClient(profile ? { profile } : {}).toLegacyWorkspaceClient() };
 }
 /**
 * The host a named profile declares in `~/.databrickscfg`, read offline. Doctor
@@ -43,7 +39,7 @@ async function getServiceClient(profile) {
 */
 async function getProfileHost(profile) {
 	try {
-		const { iniFile } = await (await import("@databricks/sdk-experimental")).loadConfigFile(process.env.DATABRICKS_CONFIG_FILE);
+		const { iniFile } = await loadConfigFile(process.env.DATABRICKS_CONFIG_FILE);
 		const host = iniFile?.[profile]?.host;
 		return typeof host === "string" && host.length > 0 ? host : void 0;
 	} catch {

package/dist/cli/commands/doctor/databricks-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"databricks-client.js","names":[],"sources":["../../../../src/cli/commands/doctor/databricks-client.ts"],"sourcesContent":["/**\n * The single seam where `appkit doctor` crosses into the Databricks SDK. The\n * SDK-free `shared` package reaches it via a runtime `import(...)`, degrading\n * gracefully when it's absent.\n *\n * `noRestrictedImports` normally routes SDK access through\n * `packages/appkit/src/workspace-client`, but that isn't available here: `appkit`\n * depends on `shared`, so importing it back would be a dependency cycle. `shared`\n * also can't depend on the SDK directly — hence the dynamic `import(...)` and the\n * per-call suppressions below. This file *is* the wrapper for this package, and\n * every SDK reference in the doctor command is confined to it.\n */\n\n/** Raised when `@databricks/sdk-experimental` is not resolvable at runtime. */\nexport class SdkNotInstalledError extends Error {\n  constructor() {\n    super(\n      \"The 'doctor' command requires the Databricks SDK (a dependency of @databricks/appkit). Please install @databricks/appkit to run connection checks.\",\n    );\n    this.name = \"SdkNotInstalledError\";\n  }\n}\n\ninterface ServiceClientHandle {\n  /** WorkspaceClient, typed as unknown to keep `shared` SDK-free. */\n  client: unknown;\n}\n\nfunction isModuleNotFound(err: unknown): boolean {\n  return (\n    err instanceof Error &&\n    (err.message.includes(\"Cannot find module\") ||\n      err.message.includes(\"Cannot find package\") ||\n      (err as NodeJS.ErrnoException).code === \"ERR_MODULE_NOT_FOUND\")\n  );\n}\n\n/** Constructs a `WorkspaceClient` via the SDK's unified-auth chain. An explicit\n * `profile` is passed through `Config.profile` rather than mutating\n * `process.env`, so it doesn't leak beyond this call. */\nexport async function getServiceClient(\n  profile?: string,\n): Promise<ServiceClientHandle> {\n  let sdk: { WorkspaceClient: new (opts: Record<string, unknown>) => unknown };\n  try {\n    // biome-ignore lint/style/noRestrictedImports: shared can't reach appkit's workspace-client wrapper (appkit depends on shared); this file is the SDK seam\n    sdk = (await import(\"@databricks/sdk-experimental\")) as typeof sdk;\n  } catch (err) {\n    if (isModuleNotFound(err)) {\n      throw new SdkNotInstalledError();\n    }\n    throw err;\n  }\n\n  const client = new sdk.WorkspaceClient(profile ? { profile } : {});\n  return { client };\n}\n\n/**\n * The host a named profile declares in `~/.databrickscfg`, read offline. Doctor\n * uses it to detect a profile/host conflict, so it must not depend on the\n * resolved config (where `DATABRICKS_HOST` has already won). Returns undefined\n * for any unreadable file, missing profile, or hostless profile — a conflict we\n * can't prove isn't worth reporting.\n */\nexport async function getProfileHost(\n  profile: string,\n): Promise<string | undefined> {\n  try {\n    // biome-ignore lint/style/noRestrictedImports: see the note at the top of this file — shared can't import appkit's wrapper\n    const sdk = (await import(\"@databricks/sdk-experimental\")) as {\n      loadConfigFile: (\n        file?: string,\n      ) => Promise<{ iniFile: Record<string, { host?: string }> }>;\n    };\n    const { iniFile } = await sdk.loadConfigFile(\n      process.env.DATABRICKS_CONFIG_FILE,\n    );\n    const host = iniFile?.[profile]?.host;\n    return typeof host === \"string\" && host.length > 0 ? host : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Raised when `@databricks/appkit` (needed for the Lakebase probe) is absent. */\nexport class AppkitNotInstalledError extends Error {\n  constructor() {\n    super(\n      \"The Lakebase connection check requires @databricks/appkit. Please install it to run this check.\",\n    );\n    this.name = \"AppkitNotInstalledError\";\n  }\n}\n\n/** Minimal `pg.Pool`-shaped handle. The caller owns it and must call `end()`. */\nexport interface LakebasePoolHandle {\n  query: (sql: string) => Promise<unknown>;\n  end: () => Promise<void>;\n}\n\n/** Builds a Lakebase pool via `createLakebasePool`. Connection settings\n * (`PGHOST`, `LAKEBASE_ENDPOINT`, …) come from the environment; we inject only\n * the resolved workspace client for OAuth token minting. */\nexport async function getLakebasePool(\n  client: unknown,\n): Promise<LakebasePoolHandle> {\n  // A variable specifier stops TS from statically resolving `@databricks/appkit`,\n  // an optional peer that `shared` has no dependency on.\n  const appkitPkg = \"@databricks/appkit\";\n  let appkit: {\n    createLakebasePool: (cfg: Record<string, unknown>) => unknown;\n  };\n  try {\n    appkit = await import(appkitPkg);\n  } catch (err) {\n    if (isModuleNotFound(err)) {\n      throw new AppkitNotInstalledError();\n    }\n    throw err;\n  }\n\n  // Silence Lakebase's own logger. It defaults to an error-only console logger\n  // that dumps the raw SDK ApiError (stack + full response blob) to stderr on a\n  // failed token fetch. doctor classifies and prints that failure itself, so the\n  // library's dump is just noise on top of our clean one-line report.\n  const pool = appkit.createLakebasePool({\n    workspaceClient: client,\n    logger: { error: false },\n  });\n  return pool as unknown as LakebasePoolHandle;\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,cAAc;AACZ,QACE,qJACD;AACD,OAAK,OAAO;;;AAShB,SAAS,iBAAiB,KAAuB;AAC/C,QACE,eAAe,UACd,IAAI,QAAQ,SAAS,qBAAqB,IACzC,IAAI,QAAQ,SAAS,sBAAsB,IAC1C,IAA8B,SAAS;;;;;AAO9C,eAAsB,iBACpB,SAC8B;CAC9B,IAAI;AACJ,KAAI;AAEF,QAAO,MAAM,OAAO;UACb,KAAK;AACZ,MAAI,iBAAiB,IAAI,CACvB,OAAM,IAAI,sBAAsB;AAElC,QAAM;;AAIR,QAAO,EAAE,QADM,IAAI,IAAI,gBAAgB,UAAU,EAAE,SAAS,GAAG,EAAE,CAAC,EACjD;;;;;;;;;AAUnB,eAAsB,eACpB,SAC6B;AAC7B,KAAI;EAOF,MAAM,EAAE,YAAY,OALP,MAAM,OAAO,iCAKI,eAC5B,QAAQ,IAAI,uBACb;EACD,MAAM,OAAO,UAAU,UAAU;AACjC,SAAO,OAAO,SAAS,YAAY,KAAK,SAAS,IAAI,OAAO;SACtD;AACN;;;;AAKJ,IAAa,0BAAb,cAA6C,MAAM;CACjD,cAAc;AACZ,QACE,kGACD;AACD,OAAK,OAAO;;;;;;AAahB,eAAsB,gBACpB,QAC6B;CAG7B,MAAM,YAAY;CAClB,IAAI;AAGJ,KAAI;AACF,WAAS,MAAM,OAAO;UACf,KAAK;AACZ,MAAI,iBAAiB,IAAI,CACvB,OAAM,IAAI,yBAAyB;AAErC,QAAM;;AAWR,QAJa,OAAO,mBAAmB;EACrC,iBAAiB;EACjB,QAAQ,EAAE,OAAO,OAAO;EACzB,CAAC"}
+{"version":3,"file":"databricks-client.js","names":[],"sources":["../../../../src/cli/commands/doctor/databricks-client.ts"],"sourcesContent":["/**\n * The seam where `appkit doctor` crosses into the Databricks SDK. It reaches\n * the SDK through the shared `workspace-client` facade — the one sanctioned SDK\n * import site — so no dynamic import or `noRestrictedImports` suppression is\n * needed. (The Lakebase probe still dynamically imports `@databricks/appkit`\n * below, since that's an optional peer `shared` deliberately doesn't depend on.)\n */\n\nimport {\n  createWorkspaceClient,\n  loadConfigFile,\n} from \"../../../workspace-client\";\n\n/**\n * Retained for backward compatibility. Since `shared` now depends on the SDK\n * (reached via the workspace-client facade), the SDK is always resolvable at\n * runtime and this is no longer thrown; kept exported so existing callers and\n * the `SDK_NOT_INSTALLED` diagnostic branch keep compiling.\n */\nexport class SdkNotInstalledError extends Error {\n  constructor() {\n    super(\n      \"The 'doctor' command requires the Databricks SDK (a dependency of @databricks/appkit).\",\n    );\n    this.name = \"SdkNotInstalledError\";\n  }\n}\n\ninterface ServiceClientHandle {\n  /** WorkspaceClient, typed as unknown to keep doctor's call sites SDK-agnostic. */\n  client: unknown;\n}\n\nfunction isModuleNotFound(err: unknown): boolean {\n  return (\n    err instanceof Error &&\n    (err.message.includes(\"Cannot find module\") ||\n      err.message.includes(\"Cannot find package\") ||\n      (err as NodeJS.ErrnoException).code === \"ERR_MODULE_NOT_FOUND\")\n  );\n}\n\n/** Constructs a workspace client via the SDK's unified-auth chain. An explicit\n * `profile` is passed through `Config.profile` rather than mutating\n * `process.env`, so it doesn't leak beyond this call. */\nexport async function getServiceClient(\n  profile?: string,\n): Promise<ServiceClientHandle> {\n  const client = createWorkspaceClient(\n    profile ? { profile } : {},\n  ).toLegacyWorkspaceClient();\n  return { client };\n}\n\n/**\n * The host a named profile declares in `~/.databrickscfg`, read offline. Doctor\n * uses it to detect a profile/host conflict, so it must not depend on the\n * resolved config (where `DATABRICKS_HOST` has already won). Returns undefined\n * for any unreadable file, missing profile, or hostless profile — a conflict we\n * can't prove isn't worth reporting.\n */\nexport async function getProfileHost(\n  profile: string,\n): Promise<string | undefined> {\n  try {\n    const { iniFile } = await loadConfigFile(\n      process.env.DATABRICKS_CONFIG_FILE,\n    );\n    const host = iniFile?.[profile]?.host;\n    return typeof host === \"string\" && host.length > 0 ? host : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** Raised when `@databricks/appkit` (needed for the Lakebase probe) is absent. */\nexport class AppkitNotInstalledError extends Error {\n  constructor() {\n    super(\n      \"The Lakebase connection check requires @databricks/appkit. Please install it to run this check.\",\n    );\n    this.name = \"AppkitNotInstalledError\";\n  }\n}\n\n/** Minimal `pg.Pool`-shaped handle. The caller owns it and must call `end()`. */\nexport interface LakebasePoolHandle {\n  query: (sql: string) => Promise<unknown>;\n  end: () => Promise<void>;\n}\n\n/** Builds a Lakebase pool via `createLakebasePool`. Connection settings\n * (`PGHOST`, `LAKEBASE_ENDPOINT`, …) come from the environment; we inject only\n * the resolved workspace client for OAuth token minting. */\nexport async function getLakebasePool(\n  client: unknown,\n): Promise<LakebasePoolHandle> {\n  // A variable specifier stops TS from statically resolving `@databricks/appkit`,\n  // an optional peer that `shared` has no dependency on.\n  const appkitPkg = \"@databricks/appkit\";\n  let appkit: {\n    createLakebasePool: (cfg: Record<string, unknown>) => unknown;\n  };\n  try {\n    appkit = await import(appkitPkg);\n  } catch (err) {\n    if (isModuleNotFound(err)) {\n      throw new AppkitNotInstalledError();\n    }\n    throw err;\n  }\n\n  // Silence Lakebase's own logger. It defaults to an error-only console logger\n  // that dumps the raw SDK ApiError (stack + full response blob) to stderr on a\n  // failed token fetch. doctor classifies and prints that failure itself, so the\n  // library's dump is just noise on top of our clean one-line report.\n  const pool = appkit.createLakebasePool({\n    workspaceClient: client,\n    logger: { error: false },\n  });\n  return pool as unknown as LakebasePoolHandle;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAmBA,IAAa,uBAAb,cAA0C,MAAM;CAC9C,cAAc;AACZ,QACE,yFACD;AACD,OAAK,OAAO;;;AAShB,SAAS,iBAAiB,KAAuB;AAC/C,QACE,eAAe,UACd,IAAI,QAAQ,SAAS,qBAAqB,IACzC,IAAI,QAAQ,SAAS,sBAAsB,IAC1C,IAA8B,SAAS;;;;;AAO9C,eAAsB,iBACpB,SAC8B;AAI9B,QAAO,EAAE,QAHM,sBACb,UAAU,EAAE,SAAS,GAAG,EAAE,CAC3B,CAAC,yBAAyB,EACV;;;;;;;;;AAUnB,eAAsB,eACpB,SAC6B;AAC7B,KAAI;EACF,MAAM,EAAE,YAAY,MAAM,eACxB,QAAQ,IAAI,uBACb;EACD,MAAM,OAAO,UAAU,UAAU;AACjC,SAAO,OAAO,SAAS,YAAY,KAAK,SAAS,IAAI,OAAO;SACtD;AACN;;;;AAKJ,IAAa,0BAAb,cAA6C,MAAM;CACjD,cAAc;AACZ,QACE,kGACD;AACD,OAAK,OAAO;;;;;;AAahB,eAAsB,gBACpB,QAC6B;CAG7B,MAAM,YAAY;CAClB,IAAI;AAGJ,KAAI;AACF,WAAS,MAAM,OAAO;UACf,KAAK;AACZ,MAAI,iBAAiB,IAAI,CACvB,OAAM,IAAI,yBAAyB;AAErC,QAAM;;AAWR,QAJa,OAAO,mBAAmB;EACrC,iBAAiB;EACjB,QAAQ,EAAE,OAAO,OAAO;EACzB,CAAC"}

package/dist/cli/commands/registry/add.js

@@ -0,0 +1,410 @@
+import { JS_IDENTIFIER, REGISTRY_REPO, resolveToken } from "./constants.js";
+import { fetchRegistryItem, fetchVerifiedNames, isValidItemName, stripNamespace } from "./client.js";
+import { extractRequirements, renderRequirements } from "./requirements.js";
+import { buildConfigPlan, collectBindingValueNeeds, planHasContent } from "./config-plan.js";
+import { reportConfigWrite, validateBundle, writeConfig } from "./config-writer.js";
+import { parseEnv } from "./env-reconcile.js";
+import fs from "node:fs";
+import path from "node:path";
+import { Command } from "commander";
+import process from "node:process";
+import pc from "picocolors";
+import { spawnSync } from "node:child_process";
+
+//#region src/cli/commands/registry/add.ts
+/** Subdirectories that commonly hold the frontend / server in an AppKit app. */
+const FRONTEND_SUBDIRS = [
+	"client",
+	"frontend",
+	"web",
+	"app"
+];
+const SERVER_SUBDIRS = [
+	"server",
+	"api",
+	"backend"
+];
+function isDir(p) {
+	return fs.existsSync(p) && fs.statSync(p).isDirectory();
+}
+/** A registry item is a server plugin if it ships a manifest.json. */
+function isPluginItem(item) {
+	return (item.files ?? []).some((f) => path.basename(f.target ?? f.path) === "manifest.json");
+}
+/**
+* Locates the frontend root for UI components. AppKit apps put the client in a
+* client/ subdir (with its own components.json + src/); the CLI is typically
+* run from the repo root. Prefer the dir with components.json, then a src/.
+*/
+function findFrontendRoot(cwd) {
+	if (fs.existsSync(path.join(cwd, "components.json"))) return cwd;
+	for (const sub of FRONTEND_SUBDIRS) if (fs.existsSync(path.join(cwd, sub, "components.json"))) return path.join(cwd, sub);
+	if (isDir(path.join(cwd, "src"))) return cwd;
+	for (const sub of FRONTEND_SUBDIRS) if (isDir(path.join(cwd, sub, "src"))) return path.join(cwd, sub);
+	return cwd;
+}
+/** Locates the server root for plugins (the server/ subdir, else cwd). */
+function findServerRoot(cwd) {
+	for (const sub of SERVER_SUBDIRS) if (isDir(path.join(cwd, sub))) return path.join(cwd, sub);
+	return cwd;
+}
+/** Nearest dir with a package.json, walking up from start (for dep install). */
+function findNearestPackageJson(start) {
+	let dir = start;
+	for (;;) {
+		if (fs.existsSync(path.join(dir, "package.json"))) return dir;
+		const parent = path.dirname(dir);
+		if (parent === dir) return start;
+		dir = parent;
+	}
+}
+/**
+* The Databricks profile the app is configured with, read from
+* `DATABRICKS_CONFIG_PROFILE` in `cwd/.env` via the same dotenv parser the app
+* loads its env with. The CLI's top-level `dotenv/config` only loads the launch
+* dir's `.env` into `process.env`; when `--cwd` points at a different app dir,
+* that file isn't loaded, so the workspace picker and bundle validate would
+* miss the app's profile — this reads it directly. Undefined if the file or key
+* is absent, so the SDK's own default resolution still applies.
+*/
+function profileFromEnv(cwd) {
+	try {
+		return parseEnv(fs.readFileSync(path.join(cwd, ".env"), "utf-8")).DATABRICKS_CONFIG_PROFILE || void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Resolves a registry item's `target` under `base`, enforcing that the result
+* stays inside `base`. Registry items are untrusted remote data; a `target`
+* like `../../../.zshrc` or an absolute path could otherwise write files
+* anywhere on disk (arbitrary-write → RCE). Throws on any escape.
+*/
+function resolveWithinBase(base, target) {
+	if (path.isAbsolute(target)) throw new Error(`Refusing absolute file target from registry: ${target}`);
+	const baseResolved = path.resolve(base);
+	const resolved = path.resolve(baseResolved, target);
+	if (resolved !== baseResolved && !resolved.startsWith(baseResolved + path.sep)) throw new Error(`Refusing file target that escapes the destination directory: ${target}`);
+	return resolved;
+}
+/** UI file destination (relative to the frontend root): placed in src/ if present. */
+function uiTargetPath(base, file) {
+	let target = file.target ?? path.join("components", path.basename(file.path));
+	if (!target.startsWith("src/") && isDir(path.join(base, "src"))) target = path.join("src", target);
+	return target;
+}
+/** Best-effort: the `toPlugin` export name from the item's index.ts. Returns
+* null (caller falls back to printed instructions) unless the name is a plain
+* JS identifier — the item is untrusted remote content and the value is
+* interpolated into the user's server.ts. */
+function pluginExportName(item) {
+	const match = (item.files ?? []).find((f) => path.basename(f.target ?? f.path) === "index.ts")?.content.match(/export\s*\{([^}]*)\}/);
+	if (!match) return null;
+	const names = match[1].split(",").map((s) => s.trim());
+	const chosen = names.find((n) => /^[a-z]/.test(n)) ?? names[0];
+	return chosen && JS_IDENTIFIER.test(chosen) ? chosen : null;
+}
+function detectPackageManager(cwd) {
+	if (fs.existsSync(path.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+	if (fs.existsSync(path.join(cwd, "yarn.lock"))) return "yarn";
+	if (fs.existsSync(path.join(cwd, "bun.lockb"))) return "bun";
+	return "npm";
+}
+/**
+* A safe npm dependency spec: `[@scope/]name` with an optional `@version`
+* range. Registry `dependencies` are untrusted remote data passed to the
+* package manager, so we reject anything that isn't a plain name+range —
+* blocks tarball/git URL specs (install-script RCE) and `-`-prefixed entries
+* that the PM would parse as flags (argument injection).
+*/
+const SAFE_DEP_SPEC = /^(@[a-z0-9][\w.-]*\/)?[a-z0-9][\w.-]*(@[\w.\-+~^><=|* ]+)?$/i;
+/** Splits deps into safe (installable) and rejected (surfaced to the user). */
+function partitionDeps(deps) {
+	const safe = [];
+	const rejected = [];
+	for (const dep of deps) if (dep.startsWith("-") || !SAFE_DEP_SPEC.test(dep)) rejected.push(dep);
+	else safe.push(dep);
+	return {
+		safe,
+		rejected
+	};
+}
+function installDependencies(deps, cwd) {
+	if (deps.length === 0) return;
+	const { safe, rejected } = partitionDeps(deps);
+	if (rejected.length > 0) console.warn(pc.yellow(`Skipping suspicious dependenc${rejected.length === 1 ? "y" : "ies"} from the registry (not a plain name@version): ${rejected.join(", ")}. Install manually if you trust them.`));
+	if (safe.length === 0) return;
+	if (!fs.existsSync(path.join(cwd, "package.json"))) {
+		console.warn(pc.yellow(`No package.json found — install these manually: ${safe.join(" ")}`));
+		return;
+	}
+	const pm = detectPackageManager(cwd);
+	const subcommand = pm === "npm" ? "install" : "add";
+	console.log(`\nInstalling dependencies with ${pm}: ${safe.join(" ")}`);
+	const result = spawnSync(pm, [
+		subcommand,
+		"--",
+		...safe
+	], {
+		stdio: "inherit",
+		cwd
+	});
+	if (result.status !== 0) console.warn(pc.yellow(`Dependency install exited with code ${result.status ?? "unknown"} — install manually if needed: ${safe.join(" ")}`));
+}
+/** Runs `appkit plugin sync --write` via this same CLI binary. */
+function runPluginSync(cwd) {
+	if (spawnSync(process.execPath, [
+		process.argv[1],
+		"plugin",
+		"sync",
+		"--write"
+	], {
+		stdio: "inherit",
+		cwd
+	}).status !== 0) console.warn(pc.yellow("  Plugin sync did not complete cleanly — run `appkit plugin sync --write` manually."));
+}
+function writeItemFile(base, target, content, force, cwd) {
+	const dest = resolveWithinBase(base, target);
+	const existed = fs.existsSync(dest);
+	if (existed && !force) {
+		console.error(pc.red(`Refusing to overwrite ${path.relative(cwd, dest)} — pass --force to replace it.`));
+		process.exit(1);
+	}
+	fs.mkdirSync(path.dirname(dest), { recursive: true });
+	fs.writeFileSync(dest, content);
+	const label = existed ? pc.yellow("Updated") : pc.green("Created");
+	console.log(`${label} ${path.relative(cwd, dest)}`);
+}
+/**
+* Fetches the requested items plus their transitive registryDependencies.
+* Dependencies are resolved breadth-first and de-duplicated by name, so a
+* plugin that depends on another registry item pulls the whole graph in one
+* `add`. Explicitly-requested items keep their request order and come first.
+*/
+async function resolveItems(names, token, fetchItem = fetchRegistryItem) {
+	const seen = /* @__PURE__ */ new Set();
+	const ordered = [];
+	const enqueue = (ref) => {
+		const name = stripNamespace(ref);
+		if (!isValidItemName(name)) throw new Error(`Invalid registry item name: ${JSON.stringify(ref)}`);
+		return name;
+	};
+	let level = names.map(enqueue).filter((name) => {
+		if (seen.has(name)) return false;
+		seen.add(name);
+		return true;
+	});
+	while (level.length > 0) {
+		const items = await Promise.all(level.map(async (key) => {
+			const item = await fetchItem(key, token);
+			item.name = key;
+			return item;
+		}));
+		ordered.push(...items);
+		const next = [];
+		for (const item of items) for (const dep of item.registryDependencies ?? []) {
+			const depName = enqueue(dep);
+			if (seen.has(depName)) continue;
+			seen.add(depName);
+			next.push(depName);
+		}
+		level = next;
+	}
+	return ordered;
+}
+/**
+* Splits requested names into verified and unverified against the index's
+* verified set. When `verified` is null the index couldn't be read — we can't
+* prove anything is verified, so every name is treated as unverified (the gate
+* then decides whether to warn-and-continue or block). Names are compared with
+* the namespace stripped, matching how items are fetched.
+*/
+function partitionVerified(refs, verified) {
+	const ok = [];
+	const bad = [];
+	for (const ref of refs) {
+		const name = stripNamespace(ref);
+		if (verified?.has(name)) ok.push(name);
+		else bad.push(name);
+	}
+	return {
+		verified: ok,
+		unverified: bad
+	};
+}
+async function runAdd(refs, opts) {
+	const cwd = opts.cwd ? path.resolve(opts.cwd) : process.cwd();
+	const token = resolveToken();
+	if (token) console.log(`Using ${token.envName} to fetch from ${REGISTRY_REPO} (private).`);
+	const verifiedP = opts.allowUnverified ? Promise.resolve(null) : fetchVerifiedNames(token);
+	const items = await resolveItems(refs, token);
+	if (!opts.allowUnverified) {
+		const verified = await verifiedP;
+		const { unverified } = partitionVerified(items.map((i) => i.name), verified);
+		if (unverified.length > 0) {
+			const reason = verified === null ? "could not read the registry index to verify these items" : `not marked verified in ${REGISTRY_REPO}`;
+			console.error(pc.red(`Refusing to add unverified item(s) (${reason}): ${unverified.join(", ")}.`));
+			console.error(pc.dim("  Re-run with --allow-unverified if you trust the source; unverified items run code in your app."));
+			process.exit(1);
+		}
+	}
+	const hasUi = items.some((i) => !isPluginItem(i));
+	const hasPlugin = items.some(isPluginItem);
+	const frontendRoot = hasUi ? findFrontendRoot(cwd) : cwd;
+	const serverRoot = hasPlugin ? findServerRoot(cwd) : cwd;
+	if (hasUi && frontendRoot !== cwd) console.log(pc.dim(`UI components → ${path.relative(cwd, frontendRoot)}/`));
+	if (hasPlugin && serverRoot !== cwd) console.log(pc.dim(`Plugins → ${path.relative(cwd, serverRoot)}/`));
+	const deps = /* @__PURE__ */ new Set();
+	let wroteUi = false;
+	const pluginSummaries = [];
+	const allRequirements = [];
+	for (const item of items) {
+		for (const dep of item.dependencies ?? []) deps.add(dep);
+		if (isPluginItem(item)) {
+			let pluginRel = path.join("plugins", item.name);
+			for (const file of item.files ?? []) {
+				const target = file.target ?? path.join("plugins", item.name, path.basename(file.path));
+				writeItemFile(serverRoot, target, file.content, Boolean(opts.force), cwd);
+				if (path.basename(target) === "manifest.json") pluginRel = path.dirname(target);
+			}
+			const requirements = extractRequirements(item);
+			if (requirements.length > 0) {
+				console.log(`\n${renderRequirements(item, requirements)}`);
+				allRequirements.push(...requirements);
+			}
+			pluginSummaries.push({
+				importPath: `./${pluginRel}`,
+				exportName: pluginExportName(item)
+			});
+		} else for (const file of item.files ?? []) {
+			writeItemFile(frontendRoot, uiTargetPath(frontendRoot, file), file.content, Boolean(opts.force), cwd);
+			wroteUi = true;
+		}
+	}
+	installDependencies([...deps], findNearestPackageJson(cwd));
+	if (hasPlugin) {
+		console.log(pc.dim("\nRegistering plugins (appkit plugin sync)..."));
+		runPluginSync(cwd);
+	}
+	if (wroteUi) console.log(pc.dim("\nReminder: import \"@databricks/appkit-ui/styles.css\" once at your app root so components are themed."));
+	const registerPluginInServer = opts.register !== false && pluginSummaries.some((s) => s.exportName) ? (await import("./server-register.js")).registerPluginInServer : null;
+	for (const s of pluginSummaries) {
+		let wired = false;
+		let skipReason;
+		if (opts.register === false) {} else if (!s.exportName) skipReason = "couldn't read a plugin export name from the item's index.ts";
+		else if (registerPluginInServer) {
+			const result = registerPluginInServer(serverRoot, s.importPath, s.exportName);
+			const shown = result.file && path.relative(cwd, path.join(serverRoot, result.file));
+			if (result.status === "wired") {
+				console.log(`\n${pc.green("Registered")} ${s.exportName} in ${shown}`);
+				wired = true;
+			} else if (result.status === "already") {
+				console.log(pc.dim(`\n${s.exportName} is already registered in ${shown}`));
+				wired = true;
+			} else skipReason = result.reason;
+		}
+		if (!wired) {
+			const imp = s.exportName ?? "<plugin>";
+			if (skipReason) console.log(pc.yellow(`\nCouldn't auto-register ${imp} — ${skipReason}.`));
+			console.log(`${pc.bold("Add this to your server's createApp call:")}\n` + pc.dim(`  import { ${imp} } from "${s.importPath}";\n  const app = await createApp({ plugins: [${imp}(), /* ... */] });`));
+		}
+	}
+	if (opts.resources !== false && allRequirements.length > 0) {
+		const { collectBindingValues, reportEnvResolutions, syncEnv } = await import("./env-writer.js");
+		const profile = opts.profile ?? profileFromEnv(cwd);
+		console.log(pc.dim("\nReconciling resource env vars into .env..."));
+		const resolutions = await syncEnv(allRequirements, {
+			cwd,
+			nonInteractive: Boolean(opts.yes),
+			values: opts.env,
+			profile
+		});
+		reportEnvResolutions(resolutions);
+		const values = { ...opts.env ?? {} };
+		for (const r of resolutions) if (r.value !== void 0) values[r.env] = r.value;
+		const bindingNeeds = collectBindingValueNeeds(allRequirements);
+		if (bindingNeeds.length > 0) {
+			const bindingValues = await collectBindingValues(bindingNeeds, {
+				cwd,
+				nonInteractive: Boolean(opts.yes),
+				values: opts.env,
+				profile
+			});
+			Object.assign(values, bindingValues);
+		}
+		const plan = buildConfigPlan(allRequirements, values);
+		if (planHasContent(plan)) {
+			const result = writeConfig(cwd, plan);
+			reportConfigWrite(result);
+			if (result.databricksYmlChanged) validateBundle(cwd, profile);
+		}
+		warnScopeNeeding(allRequirements);
+	}
+}
+/**
+* v1 does not write `user_api_scopes` (deferred to the manifest scope
+* extension). Warn when an added plugin's resource type is known to need one,
+* so the user adds it before deploy.
+*/
+/** Resource types known to require a user_api_scope, and the scope each needs. */
+const SCOPE_BY_RESOURCE_TYPE = {
+	genie_space: "dashboards.genie",
+	serving_endpoint: "serving.serving-endpoints",
+	volume: "files.files"
+};
+/** Returns the user_api_scopes implied by a set of resource rows (deduped). */
+function scopesForResources(rows) {
+	const needed = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		const scope = SCOPE_BY_RESOURCE_TYPE[row.type];
+		if (scope) needed.set(row.type, scope);
+	}
+	return needed;
+}
+function warnScopeNeeding(rows) {
+	const needed = scopesForResources(rows);
+	if (needed.size === 0) return;
+	const list = [...needed.entries()].map(([type, scope]) => `${type} → ${scope}`).join(", ");
+	console.warn(pc.yellow(`\n  Note: these resources may need a user_api_scope before deploy: ${list}.\n  Add it under resources.apps.app.user_api_scopes in databricks.yml.`));
+}
+/** Commander reducer for repeatable `--env KEY=VALUE` flags. */
+function collectEnvFlag(raw, acc) {
+	const eq = raw.indexOf("=");
+	if (eq === -1) {
+		console.error(`Ignoring --env "${raw}" (expected KEY=VALUE).`);
+		return acc;
+	}
+	const key = raw.slice(0, eq).trim();
+	const value = raw.slice(eq + 1);
+	if (key) acc[key] = value;
+	return acc;
+}
+const addCommand = new Command("add").description("Add a UI component or server plugin from the AppKit registry").argument("<item...>", "Registry item name(s), e.g. metric-card or hello").option("-f, --force", "Overwrite existing files").option("-C, --cwd <dir>", "Run as if started in <dir>").option("--no-register", "Don't edit the server entry to register plugins").option("--no-resources", "Don't reconcile resource env vars into .env").option("-y, --yes", "Don't prompt; use --env values or leave vars unset").option("--env <KEY=VALUE>", "Pre-set a resource env var (repeatable)", collectEnvFlag, {}).option("-p, --profile <name>", "Databricks profile for the resource picker and bundle validate (defaults to the app's DATABRICKS_CONFIG_PROFILE)").option("--allow-unverified", "Add items the registry doesn't mark verified (runs untrusted code)").addHelpText("after", `
+No components.json is required. Item type is detected automatically:
+  • UI components → <frontend>/src/components/appkit/  (client/ detected)
+  • Server plugins → <server>/plugins/<name>/, runs plugin sync, and registers
+    them in your createApp call (use --no-register to skip the server edit)
+
+Server plugins declare Databricks resources. On add, their env vars are
+reconciled into .env (and names into .env.example), and the deploy config
+(app.yaml + databricks.yml resource bindings) is patched to match — existing
+entries are never clobbered. Interactive by default; pass --yes for agents/CI
+(uses --env values, leaves the rest unset) and --env KEY=VALUE to supply
+values non-interactively. Pass --profile to validate the bundle after writing.
+
+The frontend/server roots are detected from common layouts, so you can run
+this from the repo root. While the registry repo is private, a read token is
+resolved from \`gh auth token\` or APPKIT_REGISTRY_TOKEN / GITHUB_TOKEN / GH_TOKEN.
+
+Examples:
+  $ appkit add metric-card           # UI component
+  $ appkit add hello                 # server plugin
+  $ appkit add metric-card hello     # mix in one call
+  $ appkit add analytics --yes --env DATABRICKS_WAREHOUSE_ID=abc123`).action((items, opts) => runAdd(items, opts).catch((err) => {
+	console.error(err);
+	process.exit(1);
+}));
+
+//#endregion
+export { addCommand };
+//# sourceMappingURL=add.js.map