@databricks/appkit-ui 0.73.0 → 0.74.1

package/CLAUDE.md

@@ -99,9 +99,11 @@ npx @databricks/appkit docs <query>
 - [Function: createWorkspaceClient()](./docs/api/appkit/Function.createWorkspaceClient.md): Construct an AppKit workspace client.
 - [Function: database()](./docs/api/appkit/Function.database.md): Create a typed database plugin registration for a finalized schema.
 - [Function: defineEval()](./docs/api/appkit/Function.defineEval.md): Define an agent eval. Default-export the result from a
+- [Function: defineEvalConfig()](./docs/api/appkit/Function.defineEvalConfig.md): Define per-directory eval config. Default-export from evals.config.ts.
 - [Function: defineManifest()](./docs/api/appkit/Function.defineManifest.md): Validates a raw manifest (typically a manifest.json import) against the
 - [Function: defineSchema()](./docs/api/appkit/Function.defineSchema.md): Compile one declared schema. The returned type keeps the table names the
 - [Function: defineTool()](./docs/api/appkit/Function.defineTool.md): Defines a single tool entry for a plugin's internal registry.
+- [Function: discoverEvalConfigs()](./docs/api/appkit/Function.discoverEvalConfigs.md): Discover the per-agent evals.config.ts (from defineEvalConfig) at
 - [Function: discoverEvalFiles()](./docs/api/appkit/Function.discoverEvalFiles.md): Discover evals under /server/agents//evals/ — co-located
 - [Function: enumColumn()](./docs/api/appkit/Function.enumColumn.md): Parameters
 - [Function: equals()](./docs/api/appkit/Function.equals.md): Passes when the value equals expected exactly.
@@ -113,6 +115,8 @@ npx @databricks/appkit docs <query>
 - [Function: formatEvalDetail()](./docs/api/appkit/Function.formatEvalDetail.md): Indented detail lines for a failing eval (error + failing assertions).
 - [Function: formatEvalHeadline()](./docs/api/appkit/Function.formatEvalHeadline.md): The one-line header for a single eval result (no failure detail).
 - [Function: formatEvalResults()](./docs/api/appkit/Function.formatEvalResults.md): Render all results as a human-readable console report (non-streaming).
+- [Function: formatResultsJson()](./docs/api/appkit/Function.formatResultsJson.md): Render results as a machine-readable JSON report (2-space indented):
+- [Function: formatResultsJUnit()](./docs/api/appkit/Function.formatResultsJUnit.md): Render results as JUnit XML for standard CI test reporters: a single
 - [Function: formatSummaryLine()](./docs/api/appkit/Function.formatSummaryLine.md): The final PASS/FAIL summary line.
 - [Function: fromSupervisorApi()](./docs/api/appkit/Function.fromSupervisorApi.md): Creates an AgentAdapter backed by the Databricks AI Gateway
 - [Function: functionToolToDefinition()](./docs/api/appkit/Function.functionToolToDefinition.md): Parameters
@@ -148,11 +152,13 @@ npx @databricks/appkit docs <query>
 - [Function: runAgent()](./docs/api/appkit/Function.runAgent.md): Standalone agent execution without createApp. Resolves the adapter, binds
 - [Function: runEval()](./docs/api/appkit/Function.runEval.md): Run a single eval against a driver. Never throws for assertion or agent
 - [Function: runEvalsInDir()](./docs/api/appkit/Function.runEvalsInDir.md): Discover, load, and run every eval under each agent's evals/ dir, driving
+- [Function: runWithRetries()](./docs/api/appkit/Function.runWithRetries.md): Run attempt up to 1 + retries times, stopping as soon as it returns a
 - [Function: summarize()](./docs/api/appkit/Function.summarize.md): Parameters
 - [Function: text()](./docs/api/appkit/Function.text.md): Returns
 - [Function: timestamp()](./docs/api/appkit/Function.timestamp.md): Parameters
 - [Function: tool()](./docs/api/appkit/Function.tool.md): Factory for defining function tools with Zod schemas.
 - [Function: toolsFromRegistry()](./docs/api/appkit/Function.toolsFromRegistry.md): Produces the AgentToolDefinition[] a ToolProvider exposes to the LLM,
+- [Function: userTurns()](./docs/api/appkit/Function.userTurns.md): Extract every user-message content, in order, from an MLflow
 - [Function: uuid()](./docs/api/appkit/Function.uuid.md): Returns
 - [Function: varchar()](./docs/api/appkit/Function.varchar.md): Parameters
 - [Interface: AgentAdapter](./docs/api/appkit/Interface.AgentAdapter.md): Properties
@@ -174,6 +180,7 @@ npx @databricks/appkit docs <query>
 - [Interface: DatabricksAuth](./docs/api/appkit/Interface.DatabricksAuth.md): Resolved Databricks host + bearer token for the eval runner's REST calls.
 - [Interface: DatasetRow](./docs/api/appkit/Interface.DatasetRow.md): One row of a managed evaluation dataset. inputs are the kwargs passed to the
 - [Interface: DiscoveredEval](./docs/api/appkit/Interface.DiscoveredEval.md): An eval file found under server/agents//evals/.
+- [Interface: DiscoveredEvalConfig](./docs/api/appkit/Interface.DiscoveredEvalConfig.md): A per-agent evals.config.ts found under server/agents//evals/.
 - [Interface: DriveResult](./docs/api/appkit/Interface.DriveResult.md): What a driver returns for a single t.send.
 - [Interface: EndpointConfig](./docs/api/appkit/Interface.EndpointConfig.md): Properties
 - [Interface: EntityMutationHooks<TTable>](./docs/api/appkit/Interface.EntityMutationHooks.md): Mutation lifecycle for one entity. A before hook may return a replacement

package/dist/cli/commands/agent/eval.js

@@ -1,4 +1,5 @@
-import { Command } from "commander";
+import fs from "node:fs";
+import { Command, Option } from "commander";
 
 //#region src/cli/commands/agent/eval.ts
 /**
@@ -24,6 +25,22 @@ function parseHeaders(values) {
 	return headers;
 }
 /**
+* Parse `--min-pass-rate`: a finite number in `[0, 1]`, or `undefined` when
+* unset. Throws on blank, out-of-range, or non-numeric input so a bad gate
+* value fails fast instead of silently disabling or inverting the CI gate.
+*/
+function parsePassRate(raw) {
+	if (raw === void 0) return void 0;
+	const n = Number(raw);
+	if (raw.trim() === "" || !Number.isFinite(n) || n < 0 || n > 1) throw new Error(`Invalid --min-pass-rate "${raw}" — expected a number in [0, 1]`);
+	return n;
+}
+/** Parse a positive-integer CLI option; junk, zero, or negative → undefined. */
+function positiveInt(raw) {
+	const n = raw ? Number.parseInt(raw, 10) : NaN;
+	return n > 0 ? n : void 0;
+}
+/**
 * Native MLflow "Evaluation run" config — only when creds + an experiment are
 * all present (traces live in the app; the run + scores are driven from here).
 */
@@ -47,17 +64,22 @@ function resolveJudge(opts, auth) {
 		model
 	} : void 0;
 }
-/** Progress reporter: stream each eval as it runs instead of going silent. */
-function makeProgressReporter(runner, url) {
+/**
+* Progress reporter: stream each eval as it runs instead of going silent. In a
+* machine reporter (json/junit) the live per-eval streaming is suppressed and
+* banners go to stderr (via `info`), keeping stdout clean for the report.
+*/
+function makeProgressReporter(runner, url, machine, info) {
 	return (event) => {
 		switch (event.type) {
 			case "discovered":
-				console.log(`Running ${event.total} eval${event.total === 1 ? "" : "s"} against ${url}\n`);
+				info(`Running ${event.total} eval${event.total === 1 ? "" : "s"} against ${url}\n`);
 				break;
 			case "run-created":
-				console.log(`MLflow evaluation run: ${event.runId}\n`);
+				info(`MLflow evaluation run: ${event.runId}\n`);
 				break;
 			case "result":
+				if (machine) break;
 				console.log(`[${event.index + 1}/${event.total}] ${runner.formatEvalHeadline(event.result)}`);
 				for (const line of runner.formatEvalDetail(event.result)) console.log(line);
 				break;
@@ -67,33 +89,51 @@ function makeProgressReporter(runner, url) {
 function formatFailureLine(f) {
 	return `  ✗ trace ${f.traceId}: ${f.status ?? ""} ${f.error ?? ""}`.trim();
 }
-/** Print the MLflow assessment/finish outcome after a run that created one. */
-function printMlflowOutcome(mlflow) {
+/**
+* Print the MLflow assessment/finish outcome after a run that created one. The
+* summary line goes through `info` (stderr under a machine reporter); per-trace
+* failures and finish errors always go to stderr.
+*/
+function printMlflowOutcome(mlflow, info) {
 	const { report, finish } = mlflow;
-	console.log(`MLflow: ${report.written} assessment(s) written` + (report.skipped ? `, ${report.skipped} skipped` : "") + (report.failures.length ? `, ${report.failures.length} failed` : ""));
+	info(`MLflow: ${report.written} assessment(s) written` + (report.skipped ? `, ${report.skipped} skipped` : "") + (report.failures.length ? `, ${report.failures.length} failed` : ""));
 	for (const f of report.failures) console.error(formatFailureLine(f));
 	if (finish.metricsError) console.error(`  ⚠ metrics not logged: ${finish.metricsError}`);
 	if (!finish.finished) console.error(`  ✗ run left RUNNING — failed to finish: ${finish.finishError ?? "unknown"}`);
 }
 async function runAgentEval(filter, opts) {
 	const runner = await loadRunner();
-	const auth = await runner.resolveDatabricksAuth({
+	const credentials = {
 		profile: opts.profile ?? process.env.DATABRICKS_CONFIG_PROFILE,
 		host: opts.databricksHost ?? process.env.DATABRICKS_HOST,
 		token: opts.databricksToken ?? process.env.DATABRICKS_TOKEN
-	}) ?? {};
+	};
+	const auth = await runner.resolveDatabricksAuth(credentials) ?? {};
 	const warehouseId = opts.warehouseId ?? process.env.DATABRICKS_WAREHOUSE_ID;
-	const workspaceClient = runner.resolveWorkspaceClient({
-		profile: opts.profile ?? process.env.DATABRICKS_CONFIG_PROFILE,
-		host: opts.databricksHost ?? process.env.DATABRICKS_HOST,
-		token: opts.databricksToken ?? process.env.DATABRICKS_TOKEN
-	});
+	const workspaceClient = runner.resolveWorkspaceClient(credentials);
+	const timeoutMs = positiveInt(opts.timeout);
+	const retries = positiveInt(opts.retries);
+	let minPassRate;
+	try {
+		minPassRate = parsePassRate(opts.minPassRate);
+	} catch (err) {
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exitCode = 1;
+		return;
+	}
+	const reporter = opts.reporter ?? "text";
+	const machine = reporter !== "text";
+	const info = (msg) => {
+		if (machine) console.error(msg);
+		else console.log(msg);
+	};
 	let summary;
 	try {
 		summary = await runner.runEvalsInDir({
 			rootDir: opts.root,
 			baseUrl: opts.url,
 			filter,
+			tags: opts.tag,
 			strict: opts.strict,
 			headers: opts.header ? parseHeaders(opts.header) : void 0,
 			concurrency: opts.concurrency,
@@ -101,19 +141,43 @@ async function runAgentEval(filter, opts) {
 			judge: resolveJudge(opts, auth),
 			workspaceClient,
 			warehouseId,
-			onEvent: makeProgressReporter(runner, opts.url)
+			timeoutMs,
+			retries,
+			onEvent: makeProgressReporter(runner, opts.url, machine, info)
 		});
 	} catch (err) {
 		console.error(`\nEval run failed: ${err instanceof Error ? err.message : String(err)}`);
 		process.exitCode = 1;
 		return;
 	}
-	console.log(`\n${runner.formatSummaryLine(summary.results)}`);
-	if (summary.mlflow) printMlflowOutcome(summary.mlflow);
-	else console.log("\nMLflow evaluation run skipped — pass --experiment (or set MLFLOW_EXPERIMENT_ID) plus --profile/--databricks-host to create one.");
-	if (!runner.summarize(summary.results).allPassed) process.exitCode = 1;
+	info(`\n${runner.formatSummaryLine(summary.results)}`);
+	if (summary.mlflow) printMlflowOutcome(summary.mlflow, info);
+	else info("\nMLflow evaluation run skipped — pass --experiment (or set MLFLOW_EXPERIMENT_ID) plus --profile/--databricks-host to create one.");
+	if (machine) {
+		const report = reporter === "json" ? runner.formatResultsJson(summary.results) : runner.formatResultsJUnit(summary.results);
+		if (opts.output) {
+			try {
+				fs.writeFileSync(opts.output, `${report}\n`);
+			} catch (err) {
+				console.error(`Failed to write ${reporter} report to ${opts.output}: ${err instanceof Error ? err.message : String(err)}`);
+				process.exitCode = 1;
+				return;
+			}
+			info(`Wrote ${reporter} report to ${opts.output}`);
+		} else process.stdout.write(`${report}\n`);
+	}
+	const stats = runner.summarize(summary.results);
+	if (minPassRate !== void 0) {
+		const ok = stats.passRate >= minPassRate;
+		info(`Pass rate ${(stats.passRate * 100).toFixed(0)}% (threshold ${(minPassRate * 100).toFixed(0)}%) — ${ok ? "OK" : "below threshold"}`);
+		if (!ok) process.exitCode = 1;
+	} else if (!stats.allPassed) process.exitCode = 1;
 }
-const agentEvalCommand = new Command("eval").description("Run agent evals (server/agents/<id>/evals/*.eval.ts) against a running app").argument("[filter]", "Only run evals whose <agent>/<id> contains this substring (or an exact agent id)").option("--url <url>", "Base URL of the running app", "http://localhost:3000").option("--strict", "Fail on soft-assertion misses too", false).option("--concurrency <n>", "Max evals to run concurrently (default 4; keep at or below the app's max concurrent streams per user)", (v) => Number.parseInt(v, 10)).option("--root <dir>", "Project root containing server/agents/ (default: cwd)").option("--header <header...>", "Extra request header as 'Key: value' (repeatable)").option("--profile <name>", "Databricks CLI profile to authenticate with via OAuth (default: DATABRICKS_CONFIG_PROFILE)").option("--databricks-host <host>", "Databricks host for writing MLflow assessments (default: DATABRICKS_HOST)").option("--databricks-token <token>", "Databricks token for writing MLflow assessments (default: DATABRICKS_TOKEN)").option("--experiment <id>", "MLflow experiment id for the evaluation run (default: MLFLOW_EXPERIMENT_ID)").option("--warehouse-id <id>", "SQL warehouse id for reading managed eval datasets and writing assessments to UC-backed experiments (default: DATABRICKS_WAREHOUSE_ID, or MLFLOW_TRACING_SQL_WAREHOUSE_ID for assessments)").option("--judge-model <endpoint>", "Databricks serving endpoint to use as the LLM judge for t.judge.* (default: APPKIT_JUDGE_MODEL)").action(runAgentEval);
+const agentEvalCommand = new Command("eval").description("Run agent evals (server/agents/<id>/evals/*.eval.ts) against a running app").argument("[filter]", "Only run evals whose <agent>/<id> contains this substring (or an exact agent id)").option("--url <url>", "Base URL of the running app", "http://localhost:3000").option("--strict", "Fail on soft-assertion misses too", false).option("--concurrency <n>", "Max evals to run concurrently (default 4; keep at or below the app's max concurrent streams per user)", (v) => Number.parseInt(v, 10)).option("--root <dir>", "Project root containing server/agents/ (default: cwd)").option("--header <header...>", "Extra request header as 'Key: value' (repeatable)").option("--tag <tag...>", "Only run evals tagged with one of these tags (repeatable)").option("--profile <name>", "Databricks CLI profile to authenticate with via OAuth (default: DATABRICKS_CONFIG_PROFILE)").option("--databricks-host <host>", "Databricks host for writing MLflow assessments (default: DATABRICKS_HOST)").option("--databricks-token <token>", "Databricks token for writing MLflow assessments (default: DATABRICKS_TOKEN)").option("--experiment <id>", "MLflow experiment id for the evaluation run (default: MLFLOW_EXPERIMENT_ID)").option("--warehouse-id <id>", "SQL warehouse id for reading managed eval datasets and writing assessments to UC-backed experiments (default: DATABRICKS_WAREHOUSE_ID, or MLFLOW_TRACING_SQL_WAREHOUSE_ID for assessments)").option("--judge-model <endpoint>", "Databricks serving endpoint to use as the LLM judge for t.judge.* (default: APPKIT_JUDGE_MODEL)").option("--timeout <ms>", "Default per-eval timeout in ms (a per-eval timeoutMs overrides it)").option("--retries <n>", "Re-run an eval up to N times when it fails on an infra error (turn/timeout); assertion failures are not retried").option("--min-pass-rate <rate>", "Gate on aggregate pass rate (0..1) instead of requiring every eval to pass; exit 1 when below").addOption(new Option("--reporter <format>", "Report format: text (live console), json (dashboards), or junit (CI test reporters)").choices([
+	"text",
+	"json",
+	"junit"
+]).default("text")).option("--output <file>", "Write the json/junit report to this file instead of stdout (ignored for text)").action(runAgentEval);
 
 //#endregion
 export { agentEvalCommand };

package/dist/cli/commands/agent/eval.js.map

@@ -1 +1 @@
-{"version":3,"file":"eval.js","names":[],"sources":["../../../../src/cli/commands/agent/eval.ts"],"sourcesContent":["import { Command } from \"commander\";\n\ninterface EvalRunSummary {\n  results: unknown[];\n  mlflow?: {\n    runId: string;\n    report: {\n      written: number;\n      skipped: number;\n      failures: Array<{ traceId: string; status?: number; error?: string }>;\n    };\n    finish: { finished: boolean; metricsError?: string; finishError?: string };\n  };\n}\n\ntype EvalProgress =\n  | { type: \"discovered\"; total: number }\n  | { type: \"run-created\"; runId: string }\n  | { type: \"start\"; id: string; index: number; total: number }\n  | { type: \"result\"; result: unknown; index: number; total: number };\n\n/** Subset of `@databricks/appkit/beta`'s eval runner used by this command. */\ninterface EvalRunner {\n  runEvalsInDir(opts: {\n    rootDir?: string;\n    baseUrl: string;\n    filter?: string;\n    strict?: boolean;\n    headers?: Record<string, string>;\n    concurrency?: number;\n    mlflow?: {\n      host: string;\n      token: string;\n      experimentId: string;\n      sqlWarehouseId?: string;\n    };\n    judge?: { host: string; token: string; model: string };\n    workspaceClient?: unknown;\n    warehouseId?: string;\n    onEvent?: (event: EvalProgress) => void;\n  }): Promise<EvalRunSummary>;\n  resolveDatabricksAuth(opts: {\n    profile?: string;\n    host?: string;\n    token?: string;\n  }): Promise<{ host: string; token: string } | undefined>;\n  resolveWorkspaceClient(opts: {\n    profile?: string;\n    host?: string;\n    token?: string;\n  }): unknown;\n  formatEvalHeadline(result: unknown): string;\n  evalGlyph(result: unknown): string;\n  formatEvalDetail(result: unknown): string[];\n  formatSummaryLine(results: unknown[]): string;\n  summarize(results: unknown[]): { allPassed: boolean };\n}\n\n/**\n * Loaded at runtime from the consuming project so this command (which ships in\n * `@databricks/shared`) doesn't take a build-time dependency on appkit. The\n * specifier is a variable so the type checker treats it as `any`.\n */\nasync function loadRunner(): Promise<EvalRunner> {\n  const spec = \"@databricks/appkit/beta\";\n  try {\n    return (await import(spec)) as unknown as EvalRunner;\n  } catch (err) {\n    throw new Error(\n      \"Could not load @databricks/appkit. Run `appkit agent eval` from a \" +\n        \"project with @databricks/appkit installed. \" +\n        `Cause: ${err instanceof Error ? err.message : String(err)}`,\n    );\n  }\n}\n\nfunction parseHeaders(values: string[]): Record<string, string> {\n  const headers: Record<string, string> = {};\n  for (const v of values) {\n    const i = v.indexOf(\":\");\n    if (i === -1) continue;\n    headers[v.slice(0, i).trim()] = v.slice(i + 1).trim();\n  }\n  return headers;\n}\n\ninterface EvalOptions {\n  url: string;\n  strict?: boolean;\n  root?: string;\n  header?: string[];\n  profile?: string;\n  databricksHost?: string;\n  databricksToken?: string;\n  experiment?: string;\n  judgeModel?: string;\n  concurrency?: number;\n  warehouseId?: string;\n}\n\n/** Resolved Databricks host + bearer (either field may be absent). */\ntype Auth = { host?: string; token?: string };\n\n/**\n * Native MLflow \"Evaluation run\" config — only when creds + an experiment are\n * all present (traces live in the app; the run + scores are driven from here).\n */\nfunction resolveMlflow(opts: EvalOptions, auth: Auth) {\n  const experimentId = opts.experiment ?? process.env.MLFLOW_EXPERIMENT_ID;\n  if (!(auth.host && auth.token && experimentId)) return undefined;\n  // UC-backed experiments need a SQL warehouse to write assessments to their\n  // V4 traces. Mirror mlflow's env var, and accept the common DATABRICKS one.\n  const sqlWarehouseId =\n    opts.warehouseId ??\n    process.env.MLFLOW_TRACING_SQL_WAREHOUSE_ID ??\n    process.env.DATABRICKS_WAREHOUSE_ID;\n  return {\n    host: auth.host,\n    token: auth.token,\n    experimentId,\n    ...(sqlWarehouseId ? { sqlWarehouseId } : {}),\n  };\n}\n\n/** LLM-as-judge config — reuses the Databricks creds + a judge serving endpoint. */\nfunction resolveJudge(opts: EvalOptions, auth: Auth) {\n  const model = opts.judgeModel ?? process.env.APPKIT_JUDGE_MODEL;\n  return model && auth.host && auth.token\n    ? { host: auth.host, token: auth.token, model }\n    : undefined;\n}\n\n/** Progress reporter: stream each eval as it runs instead of going silent. */\nfunction makeProgressReporter(\n  runner: EvalRunner,\n  url: string,\n): (event: EvalProgress) => void {\n  return (event) => {\n    switch (event.type) {\n      case \"discovered\":\n        console.log(\n          `Running ${event.total} eval${event.total === 1 ? \"\" : \"s\"} against ${url}\\n`,\n        );\n        break;\n      case \"run-created\":\n        console.log(`MLflow evaluation run: ${event.runId}\\n`);\n        break;\n      case \"result\": {\n        // One full line per completion — evals run concurrently, so a split\n        // \"start … glyph\" prefix would interleave into garbage.\n        console.log(\n          `[${event.index + 1}/${event.total}] ${runner.formatEvalHeadline(event.result)}`,\n        );\n        for (const line of runner.formatEvalDetail(event.result)) {\n          console.log(line);\n        }\n        break;\n      }\n    }\n  };\n}\n\nfunction formatFailureLine(f: {\n  traceId: string;\n  status?: number;\n  error?: string;\n}): string {\n  return `  ✗ trace ${f.traceId}: ${f.status ?? \"\"} ${f.error ?? \"\"}`.trim();\n}\n\n/** Print the MLflow assessment/finish outcome after a run that created one. */\nfunction printMlflowOutcome(\n  mlflow: NonNullable<EvalRunSummary[\"mlflow\"]>,\n): void {\n  const { report, finish } = mlflow;\n  console.log(\n    `MLflow: ${report.written} assessment(s) written` +\n      (report.skipped ? `, ${report.skipped} skipped` : \"\") +\n      (report.failures.length ? `, ${report.failures.length} failed` : \"\"),\n  );\n  for (const f of report.failures) {\n    console.error(formatFailureLine(f));\n  }\n  if (finish.metricsError) {\n    console.error(`  ⚠ metrics not logged: ${finish.metricsError}`);\n  }\n  if (!finish.finished) {\n    console.error(\n      `  ✗ run left RUNNING — failed to finish: ${finish.finishError ?? \"unknown\"}`,\n    );\n  }\n}\n\nasync function runAgentEval(\n  filter: string | undefined,\n  opts: EvalOptions,\n): Promise<void> {\n  const runner = await loadRunner();\n\n  // Resolve Databricks host + bearer the AppKit-native way: an explicit\n  // host/token (or DATABRICKS_* env) wins; otherwise the SDK mints an OAuth\n  // token from the CLI profile — so no hand-set PAT is required.\n  const auth: Auth =\n    (await runner.resolveDatabricksAuth({\n      profile: opts.profile ?? process.env.DATABRICKS_CONFIG_PROFILE,\n      host: opts.databricksHost ?? process.env.DATABRICKS_HOST,\n      token: opts.databricksToken ?? process.env.DATABRICKS_TOKEN,\n    })) ?? {};\n\n  // Managed-dataset reads: a workspace client (same profile/host/token) + a SQL\n  // warehouse. Only needed by evals that declare `dataset`.\n  const warehouseId = opts.warehouseId ?? process.env.DATABRICKS_WAREHOUSE_ID;\n  const workspaceClient = runner.resolveWorkspaceClient({\n    profile: opts.profile ?? process.env.DATABRICKS_CONFIG_PROFILE,\n    host: opts.databricksHost ?? process.env.DATABRICKS_HOST,\n    token: opts.databricksToken ?? process.env.DATABRICKS_TOKEN,\n  });\n\n  let summary: EvalRunSummary;\n  try {\n    summary = await runner.runEvalsInDir({\n      rootDir: opts.root,\n      baseUrl: opts.url,\n      filter,\n      strict: opts.strict,\n      headers: opts.header ? parseHeaders(opts.header) : undefined,\n      concurrency: opts.concurrency,\n      mlflow: resolveMlflow(opts, auth),\n      judge: resolveJudge(opts, auth),\n      workspaceClient,\n      warehouseId,\n      onEvent: makeProgressReporter(runner, opts.url),\n    });\n  } catch (err) {\n    // Setup failures (e.g. a bad --experiment for the MLflow run) reject before\n    // any eval runs; surface a clean message + non-zero exit rather than an\n    // unhandled promise rejection with a raw stack.\n    console.error(\n      `\\nEval run failed: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    process.exitCode = 1;\n    return;\n  }\n  console.log(`\\n${runner.formatSummaryLine(summary.results)}`);\n\n  if (summary.mlflow) {\n    printMlflowOutcome(summary.mlflow);\n  } else {\n    console.log(\n      \"\\nMLflow evaluation run skipped — pass --experiment (or set\" +\n        \" MLFLOW_EXPERIMENT_ID) plus --profile/--databricks-host to create one.\",\n    );\n  }\n\n  if (!runner.summarize(summary.results).allPassed) {\n    process.exitCode = 1;\n  }\n}\n\nexport const agentEvalCommand = new Command(\"eval\")\n  .description(\n    \"Run agent evals (server/agents/<id>/evals/*.eval.ts) against a running app\",\n  )\n  .argument(\n    \"[filter]\",\n    \"Only run evals whose <agent>/<id> contains this substring (or an exact agent id)\",\n  )\n  .option(\"--url <url>\", \"Base URL of the running app\", \"http://localhost:3000\")\n  .option(\"--strict\", \"Fail on soft-assertion misses too\", false)\n  .option(\n    \"--concurrency <n>\",\n    \"Max evals to run concurrently (default 4; keep at or below the app's max concurrent streams per user)\",\n    (v) => Number.parseInt(v, 10),\n  )\n  .option(\n    \"--root <dir>\",\n    \"Project root containing server/agents/ (default: cwd)\",\n  )\n  .option(\n    \"--header <header...>\",\n    \"Extra request header as 'Key: value' (repeatable)\",\n  )\n  .option(\n    \"--profile <name>\",\n    \"Databricks CLI profile to authenticate with via OAuth (default: DATABRICKS_CONFIG_PROFILE)\",\n  )\n  .option(\n    \"--databricks-host <host>\",\n    \"Databricks host for writing MLflow assessments (default: DATABRICKS_HOST)\",\n  )\n  .option(\n    \"--databricks-token <token>\",\n    \"Databricks token for writing MLflow assessments (default: DATABRICKS_TOKEN)\",\n  )\n  .option(\n    \"--experiment <id>\",\n    \"MLflow experiment id for the evaluation run (default: MLFLOW_EXPERIMENT_ID)\",\n  )\n  .option(\n    \"--warehouse-id <id>\",\n    \"SQL warehouse id for reading managed eval datasets and writing assessments to UC-backed experiments (default: DATABRICKS_WAREHOUSE_ID, or MLFLOW_TRACING_SQL_WAREHOUSE_ID for assessments)\",\n  )\n  .option(\n    \"--judge-model <endpoint>\",\n    \"Databricks serving endpoint to use as the LLM judge for t.judge.* (default: APPKIT_JUDGE_MODEL)\",\n  )\n  .action(runAgentEval);\n"],"mappings":";;;;;;;;AA+DA,eAAe,aAAkC;CAC/C,MAAM,OAAO;AACb,KAAI;AACF,SAAQ,MAAM,OAAO;UACd,KAAK;AACZ,QAAM,IAAI,MACR,yHAEY,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAC7D;;;AAIL,SAAS,aAAa,QAA0C;CAC9D,MAAM,UAAkC,EAAE;AAC1C,MAAK,MAAM,KAAK,QAAQ;EACtB,MAAM,IAAI,EAAE,QAAQ,IAAI;AACxB,MAAI,MAAM,GAAI;AACd,UAAQ,EAAE,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,MAAM;;AAEvD,QAAO;;;;;;AAwBT,SAAS,cAAc,MAAmB,MAAY;CACpD,MAAM,eAAe,KAAK,cAAc,QAAQ,IAAI;AACpD,KAAI,EAAE,KAAK,QAAQ,KAAK,SAAS,cAAe,QAAO;CAGvD,MAAM,iBACJ,KAAK,eACL,QAAQ,IAAI,mCACZ,QAAQ,IAAI;AACd,QAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ;EACA,GAAI,iBAAiB,EAAE,gBAAgB,GAAG,EAAE;EAC7C;;;AAIH,SAAS,aAAa,MAAmB,MAAY;CACnD,MAAM,QAAQ,KAAK,cAAc,QAAQ,IAAI;AAC7C,QAAO,SAAS,KAAK,QAAQ,KAAK,QAC9B;EAAE,MAAM,KAAK;EAAM,OAAO,KAAK;EAAO;EAAO,GAC7C;;;AAIN,SAAS,qBACP,QACA,KAC+B;AAC/B,SAAQ,UAAU;AAChB,UAAQ,MAAM,MAAd;GACE,KAAK;AACH,YAAQ,IACN,WAAW,MAAM,MAAM,OAAO,MAAM,UAAU,IAAI,KAAK,IAAI,WAAW,IAAI,IAC3E;AACD;GACF,KAAK;AACH,YAAQ,IAAI,0BAA0B,MAAM,MAAM,IAAI;AACtD;GACF,KAAK;AAGH,YAAQ,IACN,IAAI,MAAM,QAAQ,EAAE,GAAG,MAAM,MAAM,IAAI,OAAO,mBAAmB,MAAM,OAAO,GAC/E;AACD,SAAK,MAAM,QAAQ,OAAO,iBAAiB,MAAM,OAAO,CACtD,SAAQ,IAAI,KAAK;AAEnB;;;;AAMR,SAAS,kBAAkB,GAIhB;AACT,QAAO,aAAa,EAAE,QAAQ,IAAI,EAAE,UAAU,GAAG,GAAG,EAAE,SAAS,KAAK,MAAM;;;AAI5E,SAAS,mBACP,QACM;CACN,MAAM,EAAE,QAAQ,WAAW;AAC3B,SAAQ,IACN,WAAW,OAAO,QAAQ,2BACvB,OAAO,UAAU,KAAK,OAAO,QAAQ,YAAY,OACjD,OAAO,SAAS,SAAS,KAAK,OAAO,SAAS,OAAO,WAAW,IACpE;AACD,MAAK,MAAM,KAAK,OAAO,SACrB,SAAQ,MAAM,kBAAkB,EAAE,CAAC;AAErC,KAAI,OAAO,aACT,SAAQ,MAAM,2BAA2B,OAAO,eAAe;AAEjE,KAAI,CAAC,OAAO,SACV,SAAQ,MACN,4CAA4C,OAAO,eAAe,YACnE;;AAIL,eAAe,aACb,QACA,MACe;CACf,MAAM,SAAS,MAAM,YAAY;CAKjC,MAAM,OACH,MAAM,OAAO,sBAAsB;EAClC,SAAS,KAAK,WAAW,QAAQ,IAAI;EACrC,MAAM,KAAK,kBAAkB,QAAQ,IAAI;EACzC,OAAO,KAAK,mBAAmB,QAAQ,IAAI;EAC5C,CAAC,IAAK,EAAE;CAIX,MAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;CACpD,MAAM,kBAAkB,OAAO,uBAAuB;EACpD,SAAS,KAAK,WAAW,QAAQ,IAAI;EACrC,MAAM,KAAK,kBAAkB,QAAQ,IAAI;EACzC,OAAO,KAAK,mBAAmB,QAAQ,IAAI;EAC5C,CAAC;CAEF,IAAI;AACJ,KAAI;AACF,YAAU,MAAM,OAAO,cAAc;GACnC,SAAS,KAAK;GACd,SAAS,KAAK;GACd;GACA,QAAQ,KAAK;GACb,SAAS,KAAK,SAAS,aAAa,KAAK,OAAO,GAAG;GACnD,aAAa,KAAK;GAClB,QAAQ,cAAc,MAAM,KAAK;GACjC,OAAO,aAAa,MAAM,KAAK;GAC/B;GACA;GACA,SAAS,qBAAqB,QAAQ,KAAK,IAAI;GAChD,CAAC;UACK,KAAK;AAIZ,UAAQ,MACN,sBAAsB,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACvE;AACD,UAAQ,WAAW;AACnB;;AAEF,SAAQ,IAAI,KAAK,OAAO,kBAAkB,QAAQ,QAAQ,GAAG;AAE7D,KAAI,QAAQ,OACV,oBAAmB,QAAQ,OAAO;KAElC,SAAQ,IACN,oIAED;AAGH,KAAI,CAAC,OAAO,UAAU,QAAQ,QAAQ,CAAC,UACrC,SAAQ,WAAW;;AAIvB,MAAa,mBAAmB,IAAI,QAAQ,OAAO,CAChD,YACC,6EACD,CACA,SACC,YACA,mFACD,CACA,OAAO,eAAe,+BAA+B,wBAAwB,CAC7E,OAAO,YAAY,qCAAqC,MAAM,CAC9D,OACC,qBACA,0GACC,MAAM,OAAO,SAAS,GAAG,GAAG,CAC9B,CACA,OACC,gBACA,wDACD,CACA,OACC,wBACA,oDACD,CACA,OACC,oBACA,6FACD,CACA,OACC,4BACA,4EACD,CACA,OACC,8BACA,8EACD,CACA,OACC,qBACA,8EACD,CACA,OACC,uBACA,6LACD,CACA,OACC,4BACA,kGACD,CACA,OAAO,aAAa"}
+{"version":3,"file":"eval.js","names":[],"sources":["../../../../src/cli/commands/agent/eval.ts"],"sourcesContent":["import fs from \"node:fs\";\n\nimport { Command, Option } from \"commander\";\n\ninterface EvalRunSummary {\n  results: unknown[];\n  mlflow?: {\n    runId: string;\n    report: {\n      written: number;\n      skipped: number;\n      failures: Array<{ traceId: string; status?: number; error?: string }>;\n    };\n    finish: { finished: boolean; metricsError?: string; finishError?: string };\n  };\n}\n\ntype EvalProgress =\n  | { type: \"discovered\"; total: number }\n  | { type: \"run-created\"; runId: string }\n  | { type: \"start\"; id: string; index: number; total: number }\n  | { type: \"result\"; result: unknown; index: number; total: number };\n\n/** Subset of `@databricks/appkit/beta`'s eval runner used by this command. */\ninterface EvalRunner {\n  runEvalsInDir(opts: {\n    rootDir?: string;\n    baseUrl: string;\n    filter?: string;\n    tags?: string[];\n    strict?: boolean;\n    headers?: Record<string, string>;\n    concurrency?: number;\n    mlflow?: {\n      host: string;\n      token: string;\n      experimentId: string;\n      sqlWarehouseId?: string;\n    };\n    judge?: { host: string; token: string; model: string };\n    workspaceClient?: unknown;\n    warehouseId?: string;\n    timeoutMs?: number;\n    retries?: number;\n    onEvent?: (event: EvalProgress) => void;\n  }): Promise<EvalRunSummary>;\n  resolveDatabricksAuth(opts: {\n    profile?: string;\n    host?: string;\n    token?: string;\n  }): Promise<{ host: string; token: string } | undefined>;\n  resolveWorkspaceClient(opts: {\n    profile?: string;\n    host?: string;\n    token?: string;\n  }): unknown;\n  formatEvalHeadline(result: unknown): string;\n  evalGlyph(result: unknown): string;\n  formatEvalDetail(result: unknown): string[];\n  formatSummaryLine(results: unknown[]): string;\n  formatResultsJson(results: unknown[]): string;\n  formatResultsJUnit(results: unknown[]): string;\n  summarize(results: unknown[]): { allPassed: boolean; passRate: number };\n}\n\n/**\n * Loaded at runtime from the consuming project so this command (which ships in\n * `@databricks/shared`) doesn't take a build-time dependency on appkit. The\n * specifier is a variable so the type checker treats it as `any`.\n */\nasync function loadRunner(): Promise<EvalRunner> {\n  const spec = \"@databricks/appkit/beta\";\n  try {\n    return (await import(spec)) as unknown as EvalRunner;\n  } catch (err) {\n    throw new Error(\n      \"Could not load @databricks/appkit. Run `appkit agent eval` from a \" +\n        \"project with @databricks/appkit installed. \" +\n        `Cause: ${err instanceof Error ? err.message : String(err)}`,\n    );\n  }\n}\n\nfunction parseHeaders(values: string[]): Record<string, string> {\n  const headers: Record<string, string> = {};\n  for (const v of values) {\n    const i = v.indexOf(\":\");\n    if (i === -1) continue;\n    headers[v.slice(0, i).trim()] = v.slice(i + 1).trim();\n  }\n  return headers;\n}\n\n/**\n * Parse `--min-pass-rate`: a finite number in `[0, 1]`, or `undefined` when\n * unset. Throws on blank, out-of-range, or non-numeric input so a bad gate\n * value fails fast instead of silently disabling or inverting the CI gate.\n */\nexport function parsePassRate(raw: string | undefined): number | undefined {\n  if (raw === undefined) return undefined;\n  const n = Number(raw);\n  // Reject blank too: `Number(\"\")` is 0, which would silently disable the gate.\n  if (raw.trim() === \"\" || !Number.isFinite(n) || n < 0 || n > 1) {\n    throw new Error(\n      `Invalid --min-pass-rate \"${raw}\" — expected a number in [0, 1]`,\n    );\n  }\n  return n;\n}\n\n/** Parse a positive-integer CLI option; junk, zero, or negative → undefined. */\nfunction positiveInt(raw: string | undefined): number | undefined {\n  const n = raw ? Number.parseInt(raw, 10) : Number.NaN;\n  return n > 0 ? n : undefined;\n}\n\ninterface EvalOptions {\n  url: string;\n  strict?: boolean;\n  root?: string;\n  header?: string[];\n  tag?: string[];\n  profile?: string;\n  databricksHost?: string;\n  databricksToken?: string;\n  experiment?: string;\n  judgeModel?: string;\n  concurrency?: number;\n  warehouseId?: string;\n  timeout?: string;\n  retries?: string;\n  minPassRate?: string;\n  reporter?: \"text\" | \"json\" | \"junit\";\n  output?: string;\n}\n\n/** Resolved Databricks host + bearer (either field may be absent). */\ntype Auth = { host?: string; token?: string };\n\n/**\n * Native MLflow \"Evaluation run\" config — only when creds + an experiment are\n * all present (traces live in the app; the run + scores are driven from here).\n */\nfunction resolveMlflow(opts: EvalOptions, auth: Auth) {\n  const experimentId = opts.experiment ?? process.env.MLFLOW_EXPERIMENT_ID;\n  if (!(auth.host && auth.token && experimentId)) return undefined;\n  // UC-backed experiments need a SQL warehouse to write assessments to their\n  // V4 traces. Mirror mlflow's env var, and accept the common DATABRICKS one.\n  const sqlWarehouseId =\n    opts.warehouseId ??\n    process.env.MLFLOW_TRACING_SQL_WAREHOUSE_ID ??\n    process.env.DATABRICKS_WAREHOUSE_ID;\n  return {\n    host: auth.host,\n    token: auth.token,\n    experimentId,\n    ...(sqlWarehouseId ? { sqlWarehouseId } : {}),\n  };\n}\n\n/** LLM-as-judge config — reuses the Databricks creds + a judge serving endpoint. */\nfunction resolveJudge(opts: EvalOptions, auth: Auth) {\n  const model = opts.judgeModel ?? process.env.APPKIT_JUDGE_MODEL;\n  return model && auth.host && auth.token\n    ? { host: auth.host, token: auth.token, model }\n    : undefined;\n}\n\n/**\n * Progress reporter: stream each eval as it runs instead of going silent. In a\n * machine reporter (json/junit) the live per-eval streaming is suppressed and\n * banners go to stderr (via `info`), keeping stdout clean for the report.\n */\nfunction makeProgressReporter(\n  runner: EvalRunner,\n  url: string,\n  machine: boolean,\n  info: (msg: string) => void,\n): (event: EvalProgress) => void {\n  return (event) => {\n    switch (event.type) {\n      case \"discovered\":\n        info(\n          `Running ${event.total} eval${event.total === 1 ? \"\" : \"s\"} against ${url}\\n`,\n        );\n        break;\n      case \"run-created\":\n        info(`MLflow evaluation run: ${event.runId}\\n`);\n        break;\n      case \"result\": {\n        if (machine) break;\n        // One full line per completion — evals run concurrently, so a split\n        // \"start … glyph\" prefix would interleave into garbage.\n        console.log(\n          `[${event.index + 1}/${event.total}] ${runner.formatEvalHeadline(event.result)}`,\n        );\n        for (const line of runner.formatEvalDetail(event.result)) {\n          console.log(line);\n        }\n        break;\n      }\n    }\n  };\n}\n\nfunction formatFailureLine(f: {\n  traceId: string;\n  status?: number;\n  error?: string;\n}): string {\n  return `  ✗ trace ${f.traceId}: ${f.status ?? \"\"} ${f.error ?? \"\"}`.trim();\n}\n\n/**\n * Print the MLflow assessment/finish outcome after a run that created one. The\n * summary line goes through `info` (stderr under a machine reporter); per-trace\n * failures and finish errors always go to stderr.\n */\nfunction printMlflowOutcome(\n  mlflow: NonNullable<EvalRunSummary[\"mlflow\"]>,\n  info: (msg: string) => void,\n): void {\n  const { report, finish } = mlflow;\n  info(\n    `MLflow: ${report.written} assessment(s) written` +\n      (report.skipped ? `, ${report.skipped} skipped` : \"\") +\n      (report.failures.length ? `, ${report.failures.length} failed` : \"\"),\n  );\n  for (const f of report.failures) {\n    console.error(formatFailureLine(f));\n  }\n  if (finish.metricsError) {\n    console.error(`  ⚠ metrics not logged: ${finish.metricsError}`);\n  }\n  if (!finish.finished) {\n    console.error(\n      `  ✗ run left RUNNING — failed to finish: ${finish.finishError ?? \"unknown\"}`,\n    );\n  }\n}\n\nasync function runAgentEval(\n  filter: string | undefined,\n  opts: EvalOptions,\n): Promise<void> {\n  const runner = await loadRunner();\n\n  // Databricks credentials shared by auth resolution and the workspace client:\n  // an explicit flag/DATABRICKS_* env wins, else the SDK resolves from the CLI\n  // profile.\n  const credentials = {\n    profile: opts.profile ?? process.env.DATABRICKS_CONFIG_PROFILE,\n    host: opts.databricksHost ?? process.env.DATABRICKS_HOST,\n    token: opts.databricksToken ?? process.env.DATABRICKS_TOKEN,\n  };\n\n  // Resolve Databricks host + bearer the AppKit-native way: an explicit\n  // host/token wins; otherwise the SDK mints an OAuth token from the CLI\n  // profile — so no hand-set PAT is required.\n  const auth: Auth = (await runner.resolveDatabricksAuth(credentials)) ?? {};\n\n  // Managed-dataset reads: a workspace client (same profile/host/token) + a SQL\n  // warehouse. Only needed by evals that declare `dataset`.\n  const warehouseId = opts.warehouseId ?? process.env.DATABRICKS_WAREHOUSE_ID;\n  const workspaceClient = runner.resolveWorkspaceClient(credentials);\n\n  // Runner-level default per-eval timeout (ms). A per-eval `timeoutMs` wins.\n  const timeoutMs = positiveInt(opts.timeout);\n\n  // Extra attempts for evals that fail on an infra error (turn/timeout). Junk\n  // or negative input falls back to no retries.\n  const retries = positiveInt(opts.retries);\n\n  // Validate up front so a bad gate value fails before the run, not after.\n  let minPassRate: number | undefined;\n  try {\n    minPassRate = parsePassRate(opts.minPassRate);\n  } catch (err) {\n    console.error(err instanceof Error ? err.message : String(err));\n    process.exitCode = 1;\n    return;\n  }\n\n  // In a machine reporter (json/junit), stdout is reserved for the report (it\n  // may be piped), so human-facing lines go to stderr and the per-eval live\n  // streaming is suppressed. Text mode keeps its current stdout behavior.\n  const reporter = opts.reporter ?? \"text\";\n  const machine = reporter !== \"text\";\n  const info = (msg: string): void => {\n    if (machine) console.error(msg);\n    else console.log(msg);\n  };\n\n  let summary: EvalRunSummary;\n  try {\n    summary = await runner.runEvalsInDir({\n      rootDir: opts.root,\n      baseUrl: opts.url,\n      filter,\n      tags: opts.tag,\n      strict: opts.strict,\n      headers: opts.header ? parseHeaders(opts.header) : undefined,\n      concurrency: opts.concurrency,\n      mlflow: resolveMlflow(opts, auth),\n      judge: resolveJudge(opts, auth),\n      workspaceClient,\n      warehouseId,\n      timeoutMs,\n      retries,\n      onEvent: makeProgressReporter(runner, opts.url, machine, info),\n    });\n  } catch (err) {\n    // Setup failures (e.g. a bad --experiment for the MLflow run) reject before\n    // any eval runs; surface a clean message + non-zero exit rather than an\n    // unhandled promise rejection with a raw stack.\n    console.error(\n      `\\nEval run failed: ${err instanceof Error ? err.message : String(err)}`,\n    );\n    process.exitCode = 1;\n    return;\n  }\n\n  // The final human summary always shows (stderr for machine reporters so it\n  // never pollutes the report on stdout/file).\n  info(`\\n${runner.formatSummaryLine(summary.results)}`);\n\n  if (summary.mlflow) {\n    printMlflowOutcome(summary.mlflow, info);\n  } else {\n    info(\n      \"\\nMLflow evaluation run skipped — pass --experiment (or set\" +\n        \" MLFLOW_EXPERIMENT_ID) plus --profile/--databricks-host to create one.\",\n    );\n  }\n\n  // Machine-readable report: build the string with a pure formatter, then emit\n  // it to --output <file> or stdout (kept clean of the human noise above).\n  if (machine) {\n    const report =\n      reporter === \"json\"\n        ? runner.formatResultsJson(summary.results)\n        : runner.formatResultsJUnit(summary.results);\n    if (opts.output) {\n      try {\n        fs.writeFileSync(opts.output, `${report}\\n`);\n      } catch (err) {\n        console.error(\n          `Failed to write ${reporter} report to ${opts.output}: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        );\n        process.exitCode = 1;\n        return;\n      }\n      info(`Wrote ${reporter} report to ${opts.output}`);\n    } else {\n      process.stdout.write(`${report}\\n`);\n    }\n  }\n\n  const stats = runner.summarize(summary.results);\n  if (minPassRate !== undefined) {\n    // Threshold mode: gate on the aggregate pass rate rather than requiring\n    // every eval to pass.\n    const ok = stats.passRate >= minPassRate;\n    info(\n      `Pass rate ${(stats.passRate * 100).toFixed(0)}% (threshold ${(\n        minPassRate * 100\n      ).toFixed(0)}%) — ${ok ? \"OK\" : \"below threshold\"}`,\n    );\n    if (!ok) process.exitCode = 1;\n  } else if (!stats.allPassed) {\n    process.exitCode = 1;\n  }\n}\n\nexport const agentEvalCommand = new Command(\"eval\")\n  .description(\n    \"Run agent evals (server/agents/<id>/evals/*.eval.ts) against a running app\",\n  )\n  .argument(\n    \"[filter]\",\n    \"Only run evals whose <agent>/<id> contains this substring (or an exact agent id)\",\n  )\n  .option(\"--url <url>\", \"Base URL of the running app\", \"http://localhost:3000\")\n  .option(\"--strict\", \"Fail on soft-assertion misses too\", false)\n  .option(\n    \"--concurrency <n>\",\n    \"Max evals to run concurrently (default 4; keep at or below the app's max concurrent streams per user)\",\n    (v) => Number.parseInt(v, 10),\n  )\n  .option(\n    \"--root <dir>\",\n    \"Project root containing server/agents/ (default: cwd)\",\n  )\n  .option(\n    \"--header <header...>\",\n    \"Extra request header as 'Key: value' (repeatable)\",\n  )\n  .option(\n    \"--tag <tag...>\",\n    \"Only run evals tagged with one of these tags (repeatable)\",\n  )\n  .option(\n    \"--profile <name>\",\n    \"Databricks CLI profile to authenticate with via OAuth (default: DATABRICKS_CONFIG_PROFILE)\",\n  )\n  .option(\n    \"--databricks-host <host>\",\n    \"Databricks host for writing MLflow assessments (default: DATABRICKS_HOST)\",\n  )\n  .option(\n    \"--databricks-token <token>\",\n    \"Databricks token for writing MLflow assessments (default: DATABRICKS_TOKEN)\",\n  )\n  .option(\n    \"--experiment <id>\",\n    \"MLflow experiment id for the evaluation run (default: MLFLOW_EXPERIMENT_ID)\",\n  )\n  .option(\n    \"--warehouse-id <id>\",\n    \"SQL warehouse id for reading managed eval datasets and writing assessments to UC-backed experiments (default: DATABRICKS_WAREHOUSE_ID, or MLFLOW_TRACING_SQL_WAREHOUSE_ID for assessments)\",\n  )\n  .option(\n    \"--judge-model <endpoint>\",\n    \"Databricks serving endpoint to use as the LLM judge for t.judge.* (default: APPKIT_JUDGE_MODEL)\",\n  )\n  .option(\n    \"--timeout <ms>\",\n    \"Default per-eval timeout in ms (a per-eval timeoutMs overrides it)\",\n  )\n  .option(\n    \"--retries <n>\",\n    \"Re-run an eval up to N times when it fails on an infra error (turn/timeout); assertion failures are not retried\",\n  )\n  .option(\n    \"--min-pass-rate <rate>\",\n    \"Gate on aggregate pass rate (0..1) instead of requiring every eval to pass; exit 1 when below\",\n  )\n  .addOption(\n    new Option(\n      \"--reporter <format>\",\n      \"Report format: text (live console), json (dashboards), or junit (CI test reporters)\",\n    )\n      .choices([\"text\", \"json\", \"junit\"])\n      .default(\"text\"),\n  )\n  .option(\n    \"--output <file>\",\n    \"Write the json/junit report to this file instead of stdout (ignored for text)\",\n  )\n  .action(runAgentEval);\n"],"mappings":";;;;;;;;;AAsEA,eAAe,aAAkC;CAC/C,MAAM,OAAO;AACb,KAAI;AACF,SAAQ,MAAM,OAAO;UACd,KAAK;AACZ,QAAM,IAAI,MACR,yHAEY,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAC7D;;;AAIL,SAAS,aAAa,QAA0C;CAC9D,MAAM,UAAkC,EAAE;AAC1C,MAAK,MAAM,KAAK,QAAQ;EACtB,MAAM,IAAI,EAAE,QAAQ,IAAI;AACxB,MAAI,MAAM,GAAI;AACd,UAAQ,EAAE,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,EAAE,MAAM,IAAI,EAAE,CAAC,MAAM;;AAEvD,QAAO;;;;;;;AAQT,SAAgB,cAAc,KAA6C;AACzE,KAAI,QAAQ,OAAW,QAAO;CAC9B,MAAM,IAAI,OAAO,IAAI;AAErB,KAAI,IAAI,MAAM,KAAK,MAAM,CAAC,OAAO,SAAS,EAAE,IAAI,IAAI,KAAK,IAAI,EAC3D,OAAM,IAAI,MACR,4BAA4B,IAAI,iCACjC;AAEH,QAAO;;;AAIT,SAAS,YAAY,KAA6C;CAChE,MAAM,IAAI,MAAM,OAAO,SAAS,KAAK,GAAG,GAAG;AAC3C,QAAO,IAAI,IAAI,IAAI;;;;;;AA8BrB,SAAS,cAAc,MAAmB,MAAY;CACpD,MAAM,eAAe,KAAK,cAAc,QAAQ,IAAI;AACpD,KAAI,EAAE,KAAK,QAAQ,KAAK,SAAS,cAAe,QAAO;CAGvD,MAAM,iBACJ,KAAK,eACL,QAAQ,IAAI,mCACZ,QAAQ,IAAI;AACd,QAAO;EACL,MAAM,KAAK;EACX,OAAO,KAAK;EACZ;EACA,GAAI,iBAAiB,EAAE,gBAAgB,GAAG,EAAE;EAC7C;;;AAIH,SAAS,aAAa,MAAmB,MAAY;CACnD,MAAM,QAAQ,KAAK,cAAc,QAAQ,IAAI;AAC7C,QAAO,SAAS,KAAK,QAAQ,KAAK,QAC9B;EAAE,MAAM,KAAK;EAAM,OAAO,KAAK;EAAO;EAAO,GAC7C;;;;;;;AAQN,SAAS,qBACP,QACA,KACA,SACA,MAC+B;AAC/B,SAAQ,UAAU;AAChB,UAAQ,MAAM,MAAd;GACE,KAAK;AACH,SACE,WAAW,MAAM,MAAM,OAAO,MAAM,UAAU,IAAI,KAAK,IAAI,WAAW,IAAI,IAC3E;AACD;GACF,KAAK;AACH,SAAK,0BAA0B,MAAM,MAAM,IAAI;AAC/C;GACF,KAAK;AACH,QAAI,QAAS;AAGb,YAAQ,IACN,IAAI,MAAM,QAAQ,EAAE,GAAG,MAAM,MAAM,IAAI,OAAO,mBAAmB,MAAM,OAAO,GAC/E;AACD,SAAK,MAAM,QAAQ,OAAO,iBAAiB,MAAM,OAAO,CACtD,SAAQ,IAAI,KAAK;AAEnB;;;;AAMR,SAAS,kBAAkB,GAIhB;AACT,QAAO,aAAa,EAAE,QAAQ,IAAI,EAAE,UAAU,GAAG,GAAG,EAAE,SAAS,KAAK,MAAM;;;;;;;AAQ5E,SAAS,mBACP,QACA,MACM;CACN,MAAM,EAAE,QAAQ,WAAW;AAC3B,MACE,WAAW,OAAO,QAAQ,2BACvB,OAAO,UAAU,KAAK,OAAO,QAAQ,YAAY,OACjD,OAAO,SAAS,SAAS,KAAK,OAAO,SAAS,OAAO,WAAW,IACpE;AACD,MAAK,MAAM,KAAK,OAAO,SACrB,SAAQ,MAAM,kBAAkB,EAAE,CAAC;AAErC,KAAI,OAAO,aACT,SAAQ,MAAM,2BAA2B,OAAO,eAAe;AAEjE,KAAI,CAAC,OAAO,SACV,SAAQ,MACN,4CAA4C,OAAO,eAAe,YACnE;;AAIL,eAAe,aACb,QACA,MACe;CACf,MAAM,SAAS,MAAM,YAAY;CAKjC,MAAM,cAAc;EAClB,SAAS,KAAK,WAAW,QAAQ,IAAI;EACrC,MAAM,KAAK,kBAAkB,QAAQ,IAAI;EACzC,OAAO,KAAK,mBAAmB,QAAQ,IAAI;EAC5C;CAKD,MAAM,OAAc,MAAM,OAAO,sBAAsB,YAAY,IAAK,EAAE;CAI1E,MAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;CACpD,MAAM,kBAAkB,OAAO,uBAAuB,YAAY;CAGlE,MAAM,YAAY,YAAY,KAAK,QAAQ;CAI3C,MAAM,UAAU,YAAY,KAAK,QAAQ;CAGzC,IAAI;AACJ,KAAI;AACF,gBAAc,cAAc,KAAK,YAAY;UACtC,KAAK;AACZ,UAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,CAAC;AAC/D,UAAQ,WAAW;AACnB;;CAMF,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,UAAU,aAAa;CAC7B,MAAM,QAAQ,QAAsB;AAClC,MAAI,QAAS,SAAQ,MAAM,IAAI;MAC1B,SAAQ,IAAI,IAAI;;CAGvB,IAAI;AACJ,KAAI;AACF,YAAU,MAAM,OAAO,cAAc;GACnC,SAAS,KAAK;GACd,SAAS,KAAK;GACd;GACA,MAAM,KAAK;GACX,QAAQ,KAAK;GACb,SAAS,KAAK,SAAS,aAAa,KAAK,OAAO,GAAG;GACnD,aAAa,KAAK;GAClB,QAAQ,cAAc,MAAM,KAAK;GACjC,OAAO,aAAa,MAAM,KAAK;GAC/B;GACA;GACA;GACA;GACA,SAAS,qBAAqB,QAAQ,KAAK,KAAK,SAAS,KAAK;GAC/D,CAAC;UACK,KAAK;AAIZ,UAAQ,MACN,sBAAsB,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GACvE;AACD,UAAQ,WAAW;AACnB;;AAKF,MAAK,KAAK,OAAO,kBAAkB,QAAQ,QAAQ,GAAG;AAEtD,KAAI,QAAQ,OACV,oBAAmB,QAAQ,QAAQ,KAAK;KAExC,MACE,oIAED;AAKH,KAAI,SAAS;EACX,MAAM,SACJ,aAAa,SACT,OAAO,kBAAkB,QAAQ,QAAQ,GACzC,OAAO,mBAAmB,QAAQ,QAAQ;AAChD,MAAI,KAAK,QAAQ;AACf,OAAI;AACF,OAAG,cAAc,KAAK,QAAQ,GAAG,OAAO,IAAI;YACrC,KAAK;AACZ,YAAQ,MACN,mBAAmB,SAAS,aAAa,KAAK,OAAO,IACnD,eAAe,QAAQ,IAAI,UAAU,OAAO,IAAI,GAEnD;AACD,YAAQ,WAAW;AACnB;;AAEF,QAAK,SAAS,SAAS,aAAa,KAAK,SAAS;QAElD,SAAQ,OAAO,MAAM,GAAG,OAAO,IAAI;;CAIvC,MAAM,QAAQ,OAAO,UAAU,QAAQ,QAAQ;AAC/C,KAAI,gBAAgB,QAAW;EAG7B,MAAM,KAAK,MAAM,YAAY;AAC7B,OACE,cAAc,MAAM,WAAW,KAAK,QAAQ,EAAE,CAAC,gBAC7C,cAAc,KACd,QAAQ,EAAE,CAAC,OAAO,KAAK,OAAO,oBACjC;AACD,MAAI,CAAC,GAAI,SAAQ,WAAW;YACnB,CAAC,MAAM,UAChB,SAAQ,WAAW;;AAIvB,MAAa,mBAAmB,IAAI,QAAQ,OAAO,CAChD,YACC,6EACD,CACA,SACC,YACA,mFACD,CACA,OAAO,eAAe,+BAA+B,wBAAwB,CAC7E,OAAO,YAAY,qCAAqC,MAAM,CAC9D,OACC,qBACA,0GACC,MAAM,OAAO,SAAS,GAAG,GAAG,CAC9B,CACA,OACC,gBACA,wDACD,CACA,OACC,wBACA,oDACD,CACA,OACC,kBACA,4DACD,CACA,OACC,oBACA,6FACD,CACA,OACC,4BACA,4EACD,CACA,OACC,8BACA,8EACD,CACA,OACC,qBACA,8EACD,CACA,OACC,uBACA,6LACD,CACA,OACC,4BACA,kGACD,CACA,OACC,kBACA,qEACD,CACA,OACC,iBACA,kHACD,CACA,OACC,0BACA,gGACD,CACA,UACC,IAAI,OACF,uBACA,sFACD,CACE,QAAQ;CAAC;CAAQ;CAAQ;CAAQ,CAAC,CAClC,QAAQ,OAAO,CACnB,CACA,OACC,mBACA,gFACD,CACA,OAAO,aAAa"}

package/dist/cli/commands/registry/add.js

@@ -129,27 +129,98 @@ function partitionDeps(deps) {
 		rejected
 	};
 }
-function installDependencies(deps, cwd) {
+/** Splits an npm spec into `name` and optional version `range`, handling the
+* leading `@` of scoped names (`@databricks/appkit-ui@^0.41.0` → name
+* `@databricks/appkit-ui`, range `^0.41.0`; `lodash` → no range). */
+function parseDepSpec(spec) {
+	const at = spec.lastIndexOf("@");
+	if (at <= 0) return { name: spec };
+	return {
+		name: spec.slice(0, at),
+		range: spec.slice(at + 1)
+	};
+}
+/**
+* Registry `dependencies` are floors ("needs at least this version"), not pins.
+* Against the versions already in the target `package.json`, returns which specs
+* to install: missing packages (as declared) and genuine upgrades (installed
+* floor below the requested floor). A package already at a same-or-newer version
+* is skipped so the package manager never downgrades it; ranges that can't be
+* compared (workspace:*, catalog:, git) are skipped for the same reason.
+*
+* `semver` is injected so the caller can lazy-load it (see `installDependencies`).
+*/
+function reconcileDeps(specs, installed, { gte, minVersion }) {
+	const floor = (range) => {
+		try {
+			return minVersion(range)?.version ?? null;
+		} catch {
+			return null;
+		}
+	};
+	const install = [];
+	const skipped = [];
+	for (const spec of specs) {
+		const { name, range } = parseDepSpec(spec);
+		const have = installed[name];
+		if (!have) {
+			install.push(spec);
+			continue;
+		}
+		if (!range) {
+			skipped.push(spec);
+			continue;
+		}
+		const reqFloor = floor(range);
+		const haveFloor = floor(have);
+		if (!reqFloor || !haveFloor) skipped.push(spec);
+		else if (gte(haveFloor, reqFloor)) skipped.push(spec);
+		else install.push(spec);
+	}
+	return {
+		install,
+		skipped
+	};
+}
+/** Merged dependencies + devDependencies (name → declared range) of a
+* package.json, tolerating a missing/unreadable file (returns {}). */
+function readInstalledRanges(pkgPath) {
+	try {
+		const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+		return {
+			...pkg.dependencies,
+			...pkg.devDependencies
+		};
+	} catch {
+		return {};
+	}
+}
+async function installDependencies(deps, cwd) {
 	if (deps.length === 0) return;
 	const { safe, rejected } = partitionDeps(deps);
 	if (rejected.length > 0) console.warn(pc.yellow(`Skipping suspicious dependenc${rejected.length === 1 ? "y" : "ies"} from the registry (not a plain name@version): ${rejected.join(", ")}. Install manually if you trust them.`));
 	if (safe.length === 0) return;
-	if (!fs.existsSync(path.join(cwd, "package.json"))) {
+	const pkgPath = path.join(cwd, "package.json");
+	if (!fs.existsSync(pkgPath)) {
 		console.warn(pc.yellow(`No package.json found — install these manually: ${safe.join(" ")}`));
 		return;
 	}
+	const semver = await import("semver");
+	const { install, skipped } = reconcileDeps(safe, readInstalledRanges(pkgPath), semver);
+	if (skipped.length > 0) console.log(pc.dim(`Keeping already-installed (registry asked for an older/equal range): ${skipped.join(", ")}`));
+	if (install.length === 0) return;
 	const pm = detectPackageManager(cwd);
 	const subcommand = pm === "npm" ? "install" : "add";
-	console.log(`\nInstalling dependencies with ${pm}: ${safe.join(" ")}`);
+	console.log(`\nInstalling dependencies with ${pm}: ${install.join(" ")}`);
 	const result = spawnSync(pm, [
 		subcommand,
 		"--",
-		...safe
+		...install
 	], {
 		stdio: "inherit",
 		cwd
 	});
-	if (result.status !== 0) console.warn(pc.yellow(`Dependency install exited with code ${result.status ?? "unknown"} — install manually if needed: ${safe.join(" ")}`));
+	if (result.status !== 0) console.warn(pc.yellow(`Dependency install exited with code ${result.status ?? "unknown"} — install manually if needed: ${install.join(" ")}`));
 }
 /** Runs `appkit plugin sync --write` via this same CLI binary. */
 function runPluginSync(cwd) {
@@ -281,7 +352,7 @@ async function runAdd(refs, opts) {
 			wroteUi = true;
 		}
 	}
-	installDependencies([...deps], findNearestPackageJson(cwd));
+	await installDependencies([...deps], findNearestPackageJson(cwd));
 	if (hasPlugin) {
 		console.log(pc.dim("\nRegistering plugins (appkit plugin sync)..."));
 		runPluginSync(cwd);

package/dist/cli/commands/registry/add.js.map

@@ -1 +1 @@
-{"version":3,"file":"add.js","names":[],"sources":["../../../../src/cli/commands/registry/add.ts"],"sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\n\nimport { Command } from \"commander\";\nimport pc from \"picocolors\";\n\nimport {\n  fetchRegistryItem,\n  fetchVerifiedNames,\n  isValidItemName,\n  type RegistryItem,\n  type RegistryItemFile,\n  stripNamespace,\n} from \"./client\";\nimport {\n  buildConfigPlan,\n  collectBindingValueNeeds,\n  planHasContent,\n} from \"./config-plan\";\nimport {\n  reportConfigWrite,\n  validateBundle,\n  writeConfig,\n} from \"./config-writer\";\nimport {\n  JS_IDENTIFIER,\n  REGISTRY_REPO,\n  type RegistryToken,\n  resolveToken,\n} from \"./constants\";\nimport { parseEnv } from \"./env-reconcile\";\nimport {\n  extractRequirements,\n  type ResourceRequirementRow,\n  renderRequirements,\n} from \"./requirements\";\n\n/** Subdirectories that commonly hold the frontend / server in an AppKit app. */\nconst FRONTEND_SUBDIRS = [\"client\", \"frontend\", \"web\", \"app\"];\nconst SERVER_SUBDIRS = [\"server\", \"api\", \"backend\"];\n\nfunction isDir(p: string): boolean {\n  return fs.existsSync(p) && fs.statSync(p).isDirectory();\n}\n\n/** A registry item is a server plugin if it ships a manifest.json. */\nfunction isPluginItem(item: RegistryItem): boolean {\n  return (item.files ?? []).some(\n    (f) => path.basename(f.target ?? f.path) === \"manifest.json\",\n  );\n}\n\n/**\n * Locates the frontend root for UI components. AppKit apps put the client in a\n * client/ subdir (with its own components.json + src/); the CLI is typically\n * run from the repo root. Prefer the dir with components.json, then a src/.\n */\nfunction findFrontendRoot(cwd: string): string {\n  if (fs.existsSync(path.join(cwd, \"components.json\"))) return cwd;\n  for (const sub of FRONTEND_SUBDIRS) {\n    if (fs.existsSync(path.join(cwd, sub, \"components.json\"))) {\n      return path.join(cwd, sub);\n    }\n  }\n  if (isDir(path.join(cwd, \"src\"))) return cwd;\n  for (const sub of FRONTEND_SUBDIRS) {\n    if (isDir(path.join(cwd, sub, \"src\"))) return path.join(cwd, sub);\n  }\n  return cwd;\n}\n\n/** Locates the server root for plugins (the server/ subdir, else cwd). */\nfunction findServerRoot(cwd: string): string {\n  for (const sub of SERVER_SUBDIRS) {\n    if (isDir(path.join(cwd, sub))) return path.join(cwd, sub);\n  }\n  return cwd;\n}\n\n/** Nearest dir with a package.json, walking up from start (for dep install). */\nfunction findNearestPackageJson(start: string): string {\n  let dir = start;\n  for (;;) {\n    if (fs.existsSync(path.join(dir, \"package.json\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) return start;\n    dir = parent;\n  }\n}\n\n/**\n * The Databricks profile the app is configured with, read from\n * `DATABRICKS_CONFIG_PROFILE` in `cwd/.env` via the same dotenv parser the app\n * loads its env with. The CLI's top-level `dotenv/config` only loads the launch\n * dir's `.env` into `process.env`; when `--cwd` points at a different app dir,\n * that file isn't loaded, so the workspace picker and bundle validate would\n * miss the app's profile — this reads it directly. Undefined if the file or key\n * is absent, so the SDK's own default resolution still applies.\n */\nexport function profileFromEnv(cwd: string): string | undefined {\n  try {\n    const content = fs.readFileSync(path.join(cwd, \".env\"), \"utf-8\");\n    return parseEnv(content).DATABRICKS_CONFIG_PROFILE || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Resolves a registry item's `target` under `base`, enforcing that the result\n * stays inside `base`. Registry items are untrusted remote data; a `target`\n * like `../../../.zshrc` or an absolute path could otherwise write files\n * anywhere on disk (arbitrary-write → RCE). Throws on any escape.\n */\nexport function resolveWithinBase(base: string, target: string): string {\n  if (path.isAbsolute(target)) {\n    throw new Error(`Refusing absolute file target from registry: ${target}`);\n  }\n  const baseResolved = path.resolve(base);\n  const resolved = path.resolve(baseResolved, target);\n  if (\n    resolved !== baseResolved &&\n    !resolved.startsWith(baseResolved + path.sep)\n  ) {\n    throw new Error(\n      `Refusing file target that escapes the destination directory: ${target}`,\n    );\n  }\n  return resolved;\n}\n\n/** UI file destination (relative to the frontend root): placed in src/ if present. */\nfunction uiTargetPath(base: string, file: RegistryItemFile): string {\n  let target = file.target ?? path.join(\"components\", path.basename(file.path));\n  if (!target.startsWith(\"src/\") && isDir(path.join(base, \"src\"))) {\n    target = path.join(\"src\", target);\n  }\n  return target;\n}\n\n/** Best-effort: the `toPlugin` export name from the item's index.ts. Returns\n * null (caller falls back to printed instructions) unless the name is a plain\n * JS identifier — the item is untrusted remote content and the value is\n * interpolated into the user's server.ts. */\nexport function pluginExportName(item: RegistryItem): string | null {\n  const index = (item.files ?? []).find(\n    (f) => path.basename(f.target ?? f.path) === \"index.ts\",\n  );\n  const match = index?.content.match(/export\\s*\\{([^}]*)\\}/);\n  if (!match) return null;\n  const names = match[1].split(\",\").map((s) => s.trim());\n  // Prefer the camelCase toPlugin instance over the PascalCase class.\n  const chosen = names.find((n) => /^[a-z]/.test(n)) ?? names[0];\n  return chosen && JS_IDENTIFIER.test(chosen) ? chosen : null;\n}\n\nfunction detectPackageManager(cwd: string): \"pnpm\" | \"yarn\" | \"bun\" | \"npm\" {\n  if (fs.existsSync(path.join(cwd, \"pnpm-lock.yaml\"))) return \"pnpm\";\n  if (fs.existsSync(path.join(cwd, \"yarn.lock\"))) return \"yarn\";\n  if (fs.existsSync(path.join(cwd, \"bun.lockb\"))) return \"bun\";\n  return \"npm\";\n}\n\n/**\n * A safe npm dependency spec: `[@scope/]name` with an optional `@version`\n * range. Registry `dependencies` are untrusted remote data passed to the\n * package manager, so we reject anything that isn't a plain name+range —\n * blocks tarball/git URL specs (install-script RCE) and `-`-prefixed entries\n * that the PM would parse as flags (argument injection).\n */\nconst SAFE_DEP_SPEC =\n  /^(@[a-z0-9][\\w.-]*\\/)?[a-z0-9][\\w.-]*(@[\\w.\\-+~^><=|* ]+)?$/i;\n\n/** Splits deps into safe (installable) and rejected (surfaced to the user). */\nexport function partitionDeps(deps: string[]): {\n  safe: string[];\n  rejected: string[];\n} {\n  const safe: string[] = [];\n  const rejected: string[] = [];\n  for (const dep of deps) {\n    if (dep.startsWith(\"-\") || !SAFE_DEP_SPEC.test(dep)) rejected.push(dep);\n    else safe.push(dep);\n  }\n  return { safe, rejected };\n}\n\nfunction installDependencies(deps: string[], cwd: string): void {\n  if (deps.length === 0) return;\n\n  const { safe, rejected } = partitionDeps(deps);\n  if (rejected.length > 0) {\n    console.warn(\n      pc.yellow(\n        `Skipping suspicious dependenc${rejected.length === 1 ? \"y\" : \"ies\"} from the registry (not a plain name@version): ${rejected.join(\", \")}. Install manually if you trust them.`,\n      ),\n    );\n  }\n  if (safe.length === 0) return;\n\n  if (!fs.existsSync(path.join(cwd, \"package.json\"))) {\n    console.warn(\n      pc.yellow(\n        `No package.json found — install these manually: ${safe.join(\" \")}`,\n      ),\n    );\n    return;\n  }\n  const pm = detectPackageManager(cwd);\n  const subcommand = pm === \"npm\" ? \"install\" : \"add\";\n  console.log(`\\nInstalling dependencies with ${pm}: ${safe.join(\" \")}`);\n  // `--` stops the PM from parsing any dep as a flag (defense in depth).\n  const result = spawnSync(pm, [subcommand, \"--\", ...safe], {\n    stdio: \"inherit\",\n    cwd,\n  });\n  if (result.status !== 0) {\n    console.warn(\n      pc.yellow(\n        `Dependency install exited with code ${result.status ?? \"unknown\"} — install manually if needed: ${safe.join(\" \")}`,\n      ),\n    );\n  }\n}\n\n/** Runs `appkit plugin sync --write` via this same CLI binary. */\nfunction runPluginSync(cwd: string): void {\n  const result = spawnSync(\n    process.execPath,\n    [process.argv[1], \"plugin\", \"sync\", \"--write\"],\n    { stdio: \"inherit\", cwd },\n  );\n  if (result.status !== 0) {\n    console.warn(\n      pc.yellow(\n        \"  Plugin sync did not complete cleanly — run `appkit plugin sync --write` manually.\",\n      ),\n    );\n  }\n}\n\nfunction writeItemFile(\n  base: string,\n  target: string,\n  content: string,\n  force: boolean,\n  cwd: string,\n): void {\n  const dest = resolveWithinBase(base, target);\n  const existed = fs.existsSync(dest);\n  if (existed && !force) {\n    console.error(\n      pc.red(\n        `Refusing to overwrite ${path.relative(cwd, dest)} — pass --force to replace it.`,\n      ),\n    );\n    process.exit(1);\n  }\n  fs.mkdirSync(path.dirname(dest), { recursive: true });\n  fs.writeFileSync(dest, content);\n  const label = existed ? pc.yellow(\"Updated\") : pc.green(\"Created\");\n  console.log(`${label} ${path.relative(cwd, dest)}`);\n}\n\ninterface PluginSummary {\n  importPath: string;\n  exportName: string | null;\n}\n\n/**\n * Fetches the requested items plus their transitive registryDependencies.\n * Dependencies are resolved breadth-first and de-duplicated by name, so a\n * plugin that depends on another registry item pulls the whole graph in one\n * `add`. Explicitly-requested items keep their request order and come first.\n */\nexport async function resolveItems(\n  names: string[],\n  token: RegistryToken | null,\n  fetchItem: (\n    name: string,\n    token: RegistryToken | null,\n  ) => Promise<RegistryItem> = fetchRegistryItem,\n): Promise<RegistryItem[]> {\n  const seen = new Set<string>();\n  const ordered: RegistryItem[] = [];\n  // A name is both the fetch path and the on-disk `plugins/<name>` dir, so\n  // reject non-slug refs (`/`, `..`, control chars) before they reach either.\n  const enqueue = (ref: string): string => {\n    const name = stripNamespace(ref);\n    if (!isValidItemName(name)) {\n      throw new Error(`Invalid registry item name: ${JSON.stringify(ref)}`);\n    }\n    return name;\n  };\n  // Breadth-first over the dependency graph, one level per iteration. Items in\n  // a level are fetched concurrently (fetch latency is additive otherwise), but\n  // levels stay ordered and dedup/cycle handling is unchanged: a name is marked\n  // seen before its level is fetched, so it's never fetched or queued twice.\n  let level = names.map(enqueue).filter((name) => {\n    if (seen.has(name)) return false;\n    seen.add(name);\n    return true;\n  });\n\n  while (level.length > 0) {\n    const items = await Promise.all(\n      level.map(async (key) => {\n        const item = await fetchItem(key, token);\n        // Pin to the fetch key: the body's self-reported `name` is untrusted\n        // and could claim a verified name to slip past the gate. The key is the\n        // trustworthy identity the index keys `verified` on.\n        item.name = key;\n        return item;\n      }),\n    );\n    ordered.push(...items);\n    const next: string[] = [];\n    for (const item of items) {\n      for (const dep of item.registryDependencies ?? []) {\n        const depName = enqueue(dep);\n        if (seen.has(depName)) continue;\n        seen.add(depName);\n        next.push(depName);\n      }\n    }\n    level = next;\n  }\n\n  return ordered;\n}\n\ninterface AddOptions {\n  force?: boolean;\n  cwd?: string;\n  register?: boolean;\n  /** false = don't reconcile resource env vars into .env. */\n  resources?: boolean;\n  /** true = never prompt; use --env flags or leave unset (agent/CI). */\n  yes?: boolean;\n  /** Pre-supplied env values from repeated --env KEY=VALUE flags. */\n  env?: Record<string, string>;\n  /** Databricks profile passed to `bundle validate` after writing config. */\n  profile?: string;\n  /** true = install items the registry index doesn't mark verified. */\n  allowUnverified?: boolean;\n}\n\n/**\n * Splits requested names into verified and unverified against the index's\n * verified set. When `verified` is null the index couldn't be read — we can't\n * prove anything is verified, so every name is treated as unverified (the gate\n * then decides whether to warn-and-continue or block). Names are compared with\n * the namespace stripped, matching how items are fetched.\n */\nexport function partitionVerified(\n  refs: string[],\n  verified: Set<string> | null,\n): { verified: string[]; unverified: string[] } {\n  const ok: string[] = [];\n  const bad: string[] = [];\n  for (const ref of refs) {\n    const name = stripNamespace(ref);\n    if (verified?.has(name)) ok.push(name);\n    else bad.push(name);\n  }\n  return { verified: ok, unverified: bad };\n}\n\nasync function runAdd(refs: string[], opts: AddOptions): Promise<void> {\n  const cwd = opts.cwd ? path.resolve(opts.cwd) : process.cwd();\n  const token = resolveToken();\n  if (token) {\n    console.log(\n      `Using ${token.envName} to fetch from ${REGISTRY_REPO} (private).`,\n    );\n  }\n\n  // Resolve the full graph and fetch the verified index concurrently (two\n  // independent round-trips). Item resolution is read-only — nothing is written\n  // or installed until after the gate below.\n  const verifiedP = opts.allowUnverified\n    ? Promise.resolve(null)\n    : fetchVerifiedNames(token);\n  const items = await resolveItems(refs, token);\n\n  // Integrity gate over the *entire resolved set* (not just requested names, so\n  // an unverified transitive dep can't ride in on a verified item). Fails closed:\n  // a null verified set (unreadable index) makes every item count as unverified.\n  if (!opts.allowUnverified) {\n    const verified = await verifiedP;\n    const { unverified } = partitionVerified(\n      items.map((i) => i.name),\n      verified,\n    );\n    if (unverified.length > 0) {\n      const reason =\n        verified === null\n          ? \"could not read the registry index to verify these items\"\n          : `not marked verified in ${REGISTRY_REPO}`;\n      console.error(\n        pc.red(\n          `Refusing to add unverified item(s) (${reason}): ${unverified.join(\", \")}.`,\n        ),\n      );\n      console.error(\n        pc.dim(\n          \"  Re-run with --allow-unverified if you trust the source; unverified items run code in your app.\",\n        ),\n      );\n      process.exit(1);\n    }\n  }\n\n  const hasUi = items.some((i) => !isPluginItem(i));\n  const hasPlugin = items.some(isPluginItem);\n  const frontendRoot = hasUi ? findFrontendRoot(cwd) : cwd;\n  const serverRoot = hasPlugin ? findServerRoot(cwd) : cwd;\n  if (hasUi && frontendRoot !== cwd) {\n    console.log(pc.dim(`UI components → ${path.relative(cwd, frontendRoot)}/`));\n  }\n  if (hasPlugin && serverRoot !== cwd) {\n    console.log(pc.dim(`Plugins → ${path.relative(cwd, serverRoot)}/`));\n  }\n\n  const deps = new Set<string>();\n  let wroteUi = false;\n  const pluginSummaries: PluginSummary[] = [];\n  const allRequirements: ResourceRequirementRow[] = [];\n\n  for (const item of items) {\n    for (const dep of item.dependencies ?? []) deps.add(dep);\n\n    if (isPluginItem(item)) {\n      let pluginRel = path.join(\"plugins\", item.name);\n      for (const file of item.files ?? []) {\n        const target =\n          file.target ??\n          path.join(\"plugins\", item.name, path.basename(file.path));\n        writeItemFile(\n          serverRoot,\n          target,\n          file.content,\n          Boolean(opts.force),\n          cwd,\n        );\n        if (path.basename(target) === \"manifest.json\") {\n          pluginRel = path.dirname(target);\n        }\n      }\n      const requirements = extractRequirements(item);\n      if (requirements.length > 0) {\n        console.log(`\\n${renderRequirements(item, requirements)}`);\n        allRequirements.push(...requirements);\n      }\n      pluginSummaries.push({\n        importPath: `./${pluginRel}`,\n        exportName: pluginExportName(item),\n      });\n    } else {\n      for (const file of item.files ?? []) {\n        writeItemFile(\n          frontendRoot,\n          uiTargetPath(frontendRoot, file),\n          file.content,\n          Boolean(opts.force),\n          cwd,\n        );\n        wroteUi = true;\n      }\n    }\n  }\n\n  installDependencies([...deps], findNearestPackageJson(cwd));\n\n  if (hasPlugin) {\n    console.log(pc.dim(\"\\nRegistering plugins (appkit plugin sync)...\"));\n    runPluginSync(cwd);\n  }\n\n  if (wroteUi) {\n    console.log(\n      pc.dim(\n        '\\nReminder: import \"@databricks/appkit-ui/styles.css\" once at your app root so components are themed.',\n      ),\n    );\n  }\n  // Lazy import: server-register pulls in @ast-grep/napi (a native addon), and\n  // this CLI is imported eagerly by index.ts, so a static import would make\n  // every unrelated command pay that cost.\n  const registerPluginInServer =\n    opts.register !== false && pluginSummaries.some((s) => s.exportName)\n      ? (await import(\"./server-register.js\")).registerPluginInServer\n      : null;\n  for (const s of pluginSummaries) {\n    // Try to wire the plugin into the server's createApp call automatically;\n    // fall back to printing the snippet when the shape isn't the standard one.\n    let wired = false;\n    // Why auto-registration was skipped, so the fallback can say so (an empty\n    // reason means the user opted out via --no-register — no nag then).\n    let skipReason: string | undefined;\n    if (opts.register === false) {\n      // opted out — print the snippet without a \"couldn't\" message\n    } else if (!s.exportName) {\n      skipReason =\n        \"couldn't read a plugin export name from the item's index.ts\";\n    } else if (registerPluginInServer) {\n      const result = registerPluginInServer(\n        serverRoot,\n        s.importPath,\n        s.exportName,\n      );\n      // result.file is relative to serverRoot; show it from cwd for the user.\n      const shown =\n        result.file && path.relative(cwd, path.join(serverRoot, result.file));\n      if (result.status === \"wired\") {\n        console.log(`\\n${pc.green(\"Registered\")} ${s.exportName} in ${shown}`);\n        wired = true;\n      } else if (result.status === \"already\") {\n        console.log(\n          pc.dim(`\\n${s.exportName} is already registered in ${shown}`),\n        );\n        wired = true;\n      } else {\n        skipReason = result.reason;\n      }\n    }\n    if (!wired) {\n      const imp = s.exportName ?? \"<plugin>\";\n      if (skipReason) {\n        console.log(\n          pc.yellow(`\\nCouldn't auto-register ${imp} — ${skipReason}.`),\n        );\n      }\n      console.log(\n        `${pc.bold(\"Add this to your server's createApp call:\")}\\n` +\n          pc.dim(\n            `  import { ${imp} } from \"${s.importPath}\";\\n` +\n              `  const app = await createApp({ plugins: [${imp}(), /* ... */] });`,\n          ),\n      );\n    }\n  }\n\n  if (opts.resources !== false && allRequirements.length > 0) {\n    // Lazy import (same reason as server-register above): env-writer pulls in\n    // the workspace picker and, through it, the Databricks SDK.\n    const { collectBindingValues, reportEnvResolutions, syncEnv } =\n      await import(\"./env-writer.js\");\n    // Without --profile, fall back to the app's configured profile so the\n    // picker and bundle validate reach the workspace the app runs against.\n    const profile = opts.profile ?? profileFromEnv(cwd);\n    console.log(pc.dim(\"\\nReconciling resource env vars into .env...\"));\n    const resolutions = await syncEnv(allRequirements, {\n      cwd,\n      nonInteractive: Boolean(opts.yes),\n      values: opts.env,\n      profile,\n    });\n    reportEnvResolutions(resolutions);\n\n    // Deploy config (app.yaml + databricks.yml). Values come from what the\n    // user supplied for env fields (flags or prompts); other fields fall back\n    // to their manifest defaults inside buildConfigPlan.\n    const values: Record<string, string> = { ...(opts.env ?? {}) };\n    for (const r of resolutions) {\n      if (r.value !== undefined) values[r.env] = r.value;\n    }\n    // Binding fields with no env name (e.g. postgres project/branch/database)\n    // never flow through .env, so collect them separately — else their\n    // databricks.yml bundle variables stay unassigned and bundle validate fails.\n    const bindingNeeds = collectBindingValueNeeds(allRequirements);\n    if (bindingNeeds.length > 0) {\n      const bindingValues = await collectBindingValues(bindingNeeds, {\n        cwd,\n        nonInteractive: Boolean(opts.yes),\n        values: opts.env,\n        profile,\n      });\n      Object.assign(values, bindingValues);\n    }\n    const plan = buildConfigPlan(allRequirements, values);\n    if (planHasContent(plan)) {\n      const result = writeConfig(cwd, plan);\n      reportConfigWrite(result);\n      if (result.databricksYmlChanged) validateBundle(cwd, profile);\n    }\n    warnScopeNeeding(allRequirements);\n  }\n}\n\n/**\n * v1 does not write `user_api_scopes` (deferred to the manifest scope\n * extension). Warn when an added plugin's resource type is known to need one,\n * so the user adds it before deploy.\n */\n/** Resource types known to require a user_api_scope, and the scope each needs. */\nexport const SCOPE_BY_RESOURCE_TYPE: Record<string, string> = {\n  genie_space: \"dashboards.genie\",\n  serving_endpoint: \"serving.serving-endpoints\",\n  // volumes/files-backed access uses files.files\n  volume: \"files.files\",\n};\n\n/** Returns the user_api_scopes implied by a set of resource rows (deduped). */\nexport function scopesForResources(\n  rows: ResourceRequirementRow[],\n): Map<string, string> {\n  const needed = new Map<string, string>();\n  for (const row of rows) {\n    const scope = SCOPE_BY_RESOURCE_TYPE[row.type];\n    if (scope) needed.set(row.type, scope);\n  }\n  return needed;\n}\n\nfunction warnScopeNeeding(rows: ResourceRequirementRow[]): void {\n  const needed = scopesForResources(rows);\n  if (needed.size === 0) return;\n  const list = [...needed.entries()]\n    .map(([type, scope]) => `${type} → ${scope}`)\n    .join(\", \");\n  console.warn(\n    pc.yellow(\n      `\\n  Note: these resources may need a user_api_scope before deploy: ${list}.\\n` +\n        \"  Add it under resources.apps.app.user_api_scopes in databricks.yml.\",\n    ),\n  );\n}\n\n/** Commander reducer for repeatable `--env KEY=VALUE` flags. */\nfunction collectEnvFlag(\n  raw: string,\n  acc: Record<string, string>,\n): Record<string, string> {\n  const eq = raw.indexOf(\"=\");\n  if (eq === -1) {\n    console.error(`Ignoring --env \"${raw}\" (expected KEY=VALUE).`);\n    return acc;\n  }\n  const key = raw.slice(0, eq).trim();\n  const value = raw.slice(eq + 1);\n  if (key) acc[key] = value;\n  return acc;\n}\n\nexport const addCommand = new Command(\"add\")\n  .description(\"Add a UI component or server plugin from the AppKit registry\")\n  .argument(\"<item...>\", \"Registry item name(s), e.g. metric-card or hello\")\n  .option(\"-f, --force\", \"Overwrite existing files\")\n  .option(\"-C, --cwd <dir>\", \"Run as if started in <dir>\")\n  .option(\"--no-register\", \"Don't edit the server entry to register plugins\")\n  .option(\"--no-resources\", \"Don't reconcile resource env vars into .env\")\n  .option(\"-y, --yes\", \"Don't prompt; use --env values or leave vars unset\")\n  .option(\n    \"--env <KEY=VALUE>\",\n    \"Pre-set a resource env var (repeatable)\",\n    collectEnvFlag,\n    {},\n  )\n  .option(\n    \"-p, --profile <name>\",\n    \"Databricks profile for the resource picker and bundle validate (defaults to the app's DATABRICKS_CONFIG_PROFILE)\",\n  )\n  .option(\n    \"--allow-unverified\",\n    \"Add items the registry doesn't mark verified (runs untrusted code)\",\n  )\n  .addHelpText(\n    \"after\",\n    `\nNo components.json is required. Item type is detected automatically:\n  • UI components → <frontend>/src/components/appkit/  (client/ detected)\n  • Server plugins → <server>/plugins/<name>/, runs plugin sync, and registers\n    them in your createApp call (use --no-register to skip the server edit)\n\nServer plugins declare Databricks resources. On add, their env vars are\nreconciled into .env (and names into .env.example), and the deploy config\n(app.yaml + databricks.yml resource bindings) is patched to match — existing\nentries are never clobbered. Interactive by default; pass --yes for agents/CI\n(uses --env values, leaves the rest unset) and --env KEY=VALUE to supply\nvalues non-interactively. Pass --profile to validate the bundle after writing.\n\nThe frontend/server roots are detected from common layouts, so you can run\nthis from the repo root. While the registry repo is private, a read token is\nresolved from \\`gh auth token\\` or APPKIT_REGISTRY_TOKEN / GITHUB_TOKEN / GH_TOKEN.\n\nExamples:\n  $ appkit add metric-card           # UI component\n  $ appkit add hello                 # server plugin\n  $ appkit add metric-card hello     # mix in one call\n  $ appkit add analytics --yes --env DATABRICKS_WAREHOUSE_ID=abc123`,\n  )\n  .action((items: string[], opts: AddOptions) =>\n    runAdd(items, opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;AAwCA,MAAM,mBAAmB;CAAC;CAAU;CAAY;CAAO;CAAM;AAC7D,MAAM,iBAAiB;CAAC;CAAU;CAAO;CAAU;AAEnD,SAAS,MAAM,GAAoB;AACjC,QAAO,GAAG,WAAW,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,aAAa;;;AAIzD,SAAS,aAAa,MAA6B;AACjD,SAAQ,KAAK,SAAS,EAAE,EAAE,MACvB,MAAM,KAAK,SAAS,EAAE,UAAU,EAAE,KAAK,KAAK,gBAC9C;;;;;;;AAQH,SAAS,iBAAiB,KAAqB;AAC7C,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,kBAAkB,CAAC,CAAE,QAAO;AAC7D,MAAK,MAAM,OAAO,iBAChB,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,KAAK,kBAAkB,CAAC,CACvD,QAAO,KAAK,KAAK,KAAK,IAAI;AAG9B,KAAI,MAAM,KAAK,KAAK,KAAK,MAAM,CAAC,CAAE,QAAO;AACzC,MAAK,MAAM,OAAO,iBAChB,KAAI,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,CAAC,CAAE,QAAO,KAAK,KAAK,KAAK,IAAI;AAEnE,QAAO;;;AAIT,SAAS,eAAe,KAAqB;AAC3C,MAAK,MAAM,OAAO,eAChB,KAAI,MAAM,KAAK,KAAK,KAAK,IAAI,CAAC,CAAE,QAAO,KAAK,KAAK,KAAK,IAAI;AAE5D,QAAO;;;AAIT,SAAS,uBAAuB,OAAuB;CACrD,IAAI,MAAM;AACV,UAAS;AACP,MAAI,GAAG,WAAW,KAAK,KAAK,KAAK,eAAe,CAAC,CAAE,QAAO;EAC1D,MAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,MAAI,WAAW,IAAK,QAAO;AAC3B,QAAM;;;;;;;;;;;;AAaV,SAAgB,eAAe,KAAiC;AAC9D,KAAI;AAEF,SAAO,SADS,GAAG,aAAa,KAAK,KAAK,KAAK,OAAO,EAAE,QAAQ,CACxC,CAAC,6BAA6B;SAChD;AACN;;;;;;;;;AAUJ,SAAgB,kBAAkB,MAAc,QAAwB;AACtE,KAAI,KAAK,WAAW,OAAO,CACzB,OAAM,IAAI,MAAM,gDAAgD,SAAS;CAE3E,MAAM,eAAe,KAAK,QAAQ,KAAK;CACvC,MAAM,WAAW,KAAK,QAAQ,cAAc,OAAO;AACnD,KACE,aAAa,gBACb,CAAC,SAAS,WAAW,eAAe,KAAK,IAAI,CAE7C,OAAM,IAAI,MACR,gEAAgE,SACjE;AAEH,QAAO;;;AAIT,SAAS,aAAa,MAAc,MAAgC;CAClE,IAAI,SAAS,KAAK,UAAU,KAAK,KAAK,cAAc,KAAK,SAAS,KAAK,KAAK,CAAC;AAC7E,KAAI,CAAC,OAAO,WAAW,OAAO,IAAI,MAAM,KAAK,KAAK,MAAM,MAAM,CAAC,CAC7D,UAAS,KAAK,KAAK,OAAO,OAAO;AAEnC,QAAO;;;;;;AAOT,SAAgB,iBAAiB,MAAmC;CAIlE,MAAM,SAHS,KAAK,SAAS,EAAE,EAAE,MAC9B,MAAM,KAAK,SAAS,EAAE,UAAU,EAAE,KAAK,KAAK,WAC9C,EACoB,QAAQ,MAAM,uBAAuB;AAC1D,KAAI,CAAC,MAAO,QAAO;CACnB,MAAM,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,MAAM,EAAE,MAAM,CAAC;CAEtD,MAAM,SAAS,MAAM,MAAM,MAAM,SAAS,KAAK,EAAE,CAAC,IAAI,MAAM;AAC5D,QAAO,UAAU,cAAc,KAAK,OAAO,GAAG,SAAS;;AAGzD,SAAS,qBAAqB,KAA8C;AAC1E,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,iBAAiB,CAAC,CAAE,QAAO;AAC5D,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACvD,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACvD,QAAO;;;;;;;;;AAUT,MAAM,gBACJ;;AAGF,SAAgB,cAAc,MAG5B;CACA,MAAM,OAAiB,EAAE;CACzB,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,OAAO,KAChB,KAAI,IAAI,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,CAAE,UAAS,KAAK,IAAI;KAClE,MAAK,KAAK,IAAI;AAErB,QAAO;EAAE;EAAM;EAAU;;AAG3B,SAAS,oBAAoB,MAAgB,KAAmB;AAC9D,KAAI,KAAK,WAAW,EAAG;CAEvB,MAAM,EAAE,MAAM,aAAa,cAAc,KAAK;AAC9C,KAAI,SAAS,SAAS,EACpB,SAAQ,KACN,GAAG,OACD,gCAAgC,SAAS,WAAW,IAAI,MAAM,MAAM,iDAAiD,SAAS,KAAK,KAAK,CAAC,uCAC1I,CACF;AAEH,KAAI,KAAK,WAAW,EAAG;AAEvB,KAAI,CAAC,GAAG,WAAW,KAAK,KAAK,KAAK,eAAe,CAAC,EAAE;AAClD,UAAQ,KACN,GAAG,OACD,mDAAmD,KAAK,KAAK,IAAI,GAClE,CACF;AACD;;CAEF,MAAM,KAAK,qBAAqB,IAAI;CACpC,MAAM,aAAa,OAAO,QAAQ,YAAY;AAC9C,SAAQ,IAAI,kCAAkC,GAAG,IAAI,KAAK,KAAK,IAAI,GAAG;CAEtE,MAAM,SAAS,UAAU,IAAI;EAAC;EAAY;EAAM,GAAG;EAAK,EAAE;EACxD,OAAO;EACP;EACD,CAAC;AACF,KAAI,OAAO,WAAW,EACpB,SAAQ,KACN,GAAG,OACD,uCAAuC,OAAO,UAAU,UAAU,iCAAiC,KAAK,KAAK,IAAI,GAClH,CACF;;;AAKL,SAAS,cAAc,KAAmB;AAMxC,KALe,UACb,QAAQ,UACR;EAAC,QAAQ,KAAK;EAAI;EAAU;EAAQ;EAAU,EAC9C;EAAE,OAAO;EAAW;EAAK,CAC1B,CACU,WAAW,EACpB,SAAQ,KACN,GAAG,OACD,sFACD,CACF;;AAIL,SAAS,cACP,MACA,QACA,SACA,OACA,KACM;CACN,MAAM,OAAO,kBAAkB,MAAM,OAAO;CAC5C,MAAM,UAAU,GAAG,WAAW,KAAK;AACnC,KAAI,WAAW,CAAC,OAAO;AACrB,UAAQ,MACN,GAAG,IACD,yBAAyB,KAAK,SAAS,KAAK,KAAK,CAAC,gCACnD,CACF;AACD,UAAQ,KAAK,EAAE;;AAEjB,IAAG,UAAU,KAAK,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AACrD,IAAG,cAAc,MAAM,QAAQ;CAC/B,MAAM,QAAQ,UAAU,GAAG,OAAO,UAAU,GAAG,GAAG,MAAM,UAAU;AAClE,SAAQ,IAAI,GAAG,MAAM,GAAG,KAAK,SAAS,KAAK,KAAK,GAAG;;;;;;;;AAcrD,eAAsB,aACpB,OACA,OACA,YAG6B,mBACJ;CACzB,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAM,UAA0B,EAAE;CAGlC,MAAM,WAAW,QAAwB;EACvC,MAAM,OAAO,eAAe,IAAI;AAChC,MAAI,CAAC,gBAAgB,KAAK,CACxB,OAAM,IAAI,MAAM,+BAA+B,KAAK,UAAU,IAAI,GAAG;AAEvE,SAAO;;CAMT,IAAI,QAAQ,MAAM,IAAI,QAAQ,CAAC,QAAQ,SAAS;AAC9C,MAAI,KAAK,IAAI,KAAK,CAAE,QAAO;AAC3B,OAAK,IAAI,KAAK;AACd,SAAO;GACP;AAEF,QAAO,MAAM,SAAS,GAAG;EACvB,MAAM,QAAQ,MAAM,QAAQ,IAC1B,MAAM,IAAI,OAAO,QAAQ;GACvB,MAAM,OAAO,MAAM,UAAU,KAAK,MAAM;AAIxC,QAAK,OAAO;AACZ,UAAO;IACP,CACH;AACD,UAAQ,KAAK,GAAG,MAAM;EACtB,MAAM,OAAiB,EAAE;AACzB,OAAK,MAAM,QAAQ,MACjB,MAAK,MAAM,OAAO,KAAK,wBAAwB,EAAE,EAAE;GACjD,MAAM,UAAU,QAAQ,IAAI;AAC5B,OAAI,KAAK,IAAI,QAAQ,CAAE;AACvB,QAAK,IAAI,QAAQ;AACjB,QAAK,KAAK,QAAQ;;AAGtB,UAAQ;;AAGV,QAAO;;;;;;;;;AA0BT,SAAgB,kBACd,MACA,UAC8C;CAC9C,MAAM,KAAe,EAAE;CACvB,MAAM,MAAgB,EAAE;AACxB,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,eAAe,IAAI;AAChC,MAAI,UAAU,IAAI,KAAK,CAAE,IAAG,KAAK,KAAK;MACjC,KAAI,KAAK,KAAK;;AAErB,QAAO;EAAE,UAAU;EAAI,YAAY;EAAK;;AAG1C,eAAe,OAAO,MAAgB,MAAiC;CACrE,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ,KAAK,IAAI,GAAG,QAAQ,KAAK;CAC7D,MAAM,QAAQ,cAAc;AAC5B,KAAI,MACF,SAAQ,IACN,SAAS,MAAM,QAAQ,iBAAiB,cAAc,aACvD;CAMH,MAAM,YAAY,KAAK,kBACnB,QAAQ,QAAQ,KAAK,GACrB,mBAAmB,MAAM;CAC7B,MAAM,QAAQ,MAAM,aAAa,MAAM,MAAM;AAK7C,KAAI,CAAC,KAAK,iBAAiB;EACzB,MAAM,WAAW,MAAM;EACvB,MAAM,EAAE,eAAe,kBACrB,MAAM,KAAK,MAAM,EAAE,KAAK,EACxB,SACD;AACD,MAAI,WAAW,SAAS,GAAG;GACzB,MAAM,SACJ,aAAa,OACT,4DACA,0BAA0B;AAChC,WAAQ,MACN,GAAG,IACD,uCAAuC,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,GAC1E,CACF;AACD,WAAQ,MACN,GAAG,IACD,mGACD,CACF;AACD,WAAQ,KAAK,EAAE;;;CAInB,MAAM,QAAQ,MAAM,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;CACjD,MAAM,YAAY,MAAM,KAAK,aAAa;CAC1C,MAAM,eAAe,QAAQ,iBAAiB,IAAI,GAAG;CACrD,MAAM,aAAa,YAAY,eAAe,IAAI,GAAG;AACrD,KAAI,SAAS,iBAAiB,IAC5B,SAAQ,IAAI,GAAG,IAAI,mBAAmB,KAAK,SAAS,KAAK,aAAa,CAAC,GAAG,CAAC;AAE7E,KAAI,aAAa,eAAe,IAC9B,SAAQ,IAAI,GAAG,IAAI,aAAa,KAAK,SAAS,KAAK,WAAW,CAAC,GAAG,CAAC;CAGrE,MAAM,uBAAO,IAAI,KAAa;CAC9B,IAAI,UAAU;CACd,MAAM,kBAAmC,EAAE;CAC3C,MAAM,kBAA4C,EAAE;AAEpD,MAAK,MAAM,QAAQ,OAAO;AACxB,OAAK,MAAM,OAAO,KAAK,gBAAgB,EAAE,CAAE,MAAK,IAAI,IAAI;AAExD,MAAI,aAAa,KAAK,EAAE;GACtB,IAAI,YAAY,KAAK,KAAK,WAAW,KAAK,KAAK;AAC/C,QAAK,MAAM,QAAQ,KAAK,SAAS,EAAE,EAAE;IACnC,MAAM,SACJ,KAAK,UACL,KAAK,KAAK,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC;AAC3D,kBACE,YACA,QACA,KAAK,SACL,QAAQ,KAAK,MAAM,EACnB,IACD;AACD,QAAI,KAAK,SAAS,OAAO,KAAK,gBAC5B,aAAY,KAAK,QAAQ,OAAO;;GAGpC,MAAM,eAAe,oBAAoB,KAAK;AAC9C,OAAI,aAAa,SAAS,GAAG;AAC3B,YAAQ,IAAI,KAAK,mBAAmB,MAAM,aAAa,GAAG;AAC1D,oBAAgB,KAAK,GAAG,aAAa;;AAEvC,mBAAgB,KAAK;IACnB,YAAY,KAAK;IACjB,YAAY,iBAAiB,KAAK;IACnC,CAAC;QAEF,MAAK,MAAM,QAAQ,KAAK,SAAS,EAAE,EAAE;AACnC,iBACE,cACA,aAAa,cAAc,KAAK,EAChC,KAAK,SACL,QAAQ,KAAK,MAAM,EACnB,IACD;AACD,aAAU;;;AAKhB,qBAAoB,CAAC,GAAG,KAAK,EAAE,uBAAuB,IAAI,CAAC;AAE3D,KAAI,WAAW;AACb,UAAQ,IAAI,GAAG,IAAI,gDAAgD,CAAC;AACpE,gBAAc,IAAI;;AAGpB,KAAI,QACF,SAAQ,IACN,GAAG,IACD,0GACD,CACF;CAKH,MAAM,yBACJ,KAAK,aAAa,SAAS,gBAAgB,MAAM,MAAM,EAAE,WAAW,IAC/D,MAAM,OAAO,yBAAyB,yBACvC;AACN,MAAK,MAAM,KAAK,iBAAiB;EAG/B,IAAI,QAAQ;EAGZ,IAAI;AACJ,MAAI,KAAK,aAAa,OAAO,YAElB,CAAC,EAAE,WACZ,cACE;WACO,wBAAwB;GACjC,MAAM,SAAS,uBACb,YACA,EAAE,YACF,EAAE,WACH;GAED,MAAM,QACJ,OAAO,QAAQ,KAAK,SAAS,KAAK,KAAK,KAAK,YAAY,OAAO,KAAK,CAAC;AACvE,OAAI,OAAO,WAAW,SAAS;AAC7B,YAAQ,IAAI,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,WAAW,MAAM,QAAQ;AACtE,YAAQ;cACC,OAAO,WAAW,WAAW;AACtC,YAAQ,IACN,GAAG,IAAI,KAAK,EAAE,WAAW,4BAA4B,QAAQ,CAC9D;AACD,YAAQ;SAER,cAAa,OAAO;;AAGxB,MAAI,CAAC,OAAO;GACV,MAAM,MAAM,EAAE,cAAc;AAC5B,OAAI,WACF,SAAQ,IACN,GAAG,OAAO,4BAA4B,IAAI,KAAK,WAAW,GAAG,CAC9D;AAEH,WAAQ,IACN,GAAG,GAAG,KAAK,4CAA4C,CAAC,MACtD,GAAG,IACD,cAAc,IAAI,WAAW,EAAE,WAAW,gDACK,IAAI,oBACpD,CACJ;;;AAIL,KAAI,KAAK,cAAc,SAAS,gBAAgB,SAAS,GAAG;EAG1D,MAAM,EAAE,sBAAsB,sBAAsB,YAClD,MAAM,OAAO;EAGf,MAAM,UAAU,KAAK,WAAW,eAAe,IAAI;AACnD,UAAQ,IAAI,GAAG,IAAI,+CAA+C,CAAC;EACnE,MAAM,cAAc,MAAM,QAAQ,iBAAiB;GACjD;GACA,gBAAgB,QAAQ,KAAK,IAAI;GACjC,QAAQ,KAAK;GACb;GACD,CAAC;AACF,uBAAqB,YAAY;EAKjC,MAAM,SAAiC,EAAE,GAAI,KAAK,OAAO,EAAE,EAAG;AAC9D,OAAK,MAAM,KAAK,YACd,KAAI,EAAE,UAAU,OAAW,QAAO,EAAE,OAAO,EAAE;EAK/C,MAAM,eAAe,yBAAyB,gBAAgB;AAC9D,MAAI,aAAa,SAAS,GAAG;GAC3B,MAAM,gBAAgB,MAAM,qBAAqB,cAAc;IAC7D;IACA,gBAAgB,QAAQ,KAAK,IAAI;IACjC,QAAQ,KAAK;IACb;IACD,CAAC;AACF,UAAO,OAAO,QAAQ,cAAc;;EAEtC,MAAM,OAAO,gBAAgB,iBAAiB,OAAO;AACrD,MAAI,eAAe,KAAK,EAAE;GACxB,MAAM,SAAS,YAAY,KAAK,KAAK;AACrC,qBAAkB,OAAO;AACzB,OAAI,OAAO,qBAAsB,gBAAe,KAAK,QAAQ;;AAE/D,mBAAiB,gBAAgB;;;;;;;;;AAUrC,MAAa,yBAAiD;CAC5D,aAAa;CACb,kBAAkB;CAElB,QAAQ;CACT;;AAGD,SAAgB,mBACd,MACqB;CACrB,MAAM,yBAAS,IAAI,KAAqB;AACxC,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,QAAQ,uBAAuB,IAAI;AACzC,MAAI,MAAO,QAAO,IAAI,IAAI,MAAM,MAAM;;AAExC,QAAO;;AAGT,SAAS,iBAAiB,MAAsC;CAC9D,MAAM,SAAS,mBAAmB,KAAK;AACvC,KAAI,OAAO,SAAS,EAAG;CACvB,MAAM,OAAO,CAAC,GAAG,OAAO,SAAS,CAAC,CAC/B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,KAAK,QAAQ,CAC5C,KAAK,KAAK;AACb,SAAQ,KACN,GAAG,OACD,sEAAsE,KAAK,yEAE5E,CACF;;;AAIH,SAAS,eACP,KACA,KACwB;CACxB,MAAM,KAAK,IAAI,QAAQ,IAAI;AAC3B,KAAI,OAAO,IAAI;AACb,UAAQ,MAAM,mBAAmB,IAAI,yBAAyB;AAC9D,SAAO;;CAET,MAAM,MAAM,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM;CACnC,MAAM,QAAQ,IAAI,MAAM,KAAK,EAAE;AAC/B,KAAI,IAAK,KAAI,OAAO;AACpB,QAAO;;AAGT,MAAa,aAAa,IAAI,QAAQ,MAAM,CACzC,YAAY,+DAA+D,CAC3E,SAAS,aAAa,mDAAmD,CACzE,OAAO,eAAe,2BAA2B,CACjD,OAAO,mBAAmB,6BAA6B,CACvD,OAAO,iBAAiB,kDAAkD,CAC1E,OAAO,kBAAkB,8CAA8C,CACvE,OAAO,aAAa,qDAAqD,CACzE,OACC,qBACA,2CACA,gBACA,EAAE,CACH,CACA,OACC,wBACA,mHACD,CACA,OACC,sBACA,qEACD,CACA,YACC,SACA;;;;;;;;;;;;;;;;;;;;;qEAsBD,CACA,QAAQ,OAAiB,SACxB,OAAO,OAAO,KAAK,CAAC,OAAO,QAAQ;AACjC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}
+{"version":3,"file":"add.js","names":[],"sources":["../../../../src/cli/commands/registry/add.ts"],"sourcesContent":["import { spawnSync } from \"node:child_process\";\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport process from \"node:process\";\n\nimport { Command } from \"commander\";\nimport pc from \"picocolors\";\n\nimport {\n  fetchRegistryItem,\n  fetchVerifiedNames,\n  isValidItemName,\n  type RegistryItem,\n  type RegistryItemFile,\n  stripNamespace,\n} from \"./client\";\nimport {\n  buildConfigPlan,\n  collectBindingValueNeeds,\n  planHasContent,\n} from \"./config-plan\";\nimport {\n  reportConfigWrite,\n  validateBundle,\n  writeConfig,\n} from \"./config-writer\";\nimport {\n  JS_IDENTIFIER,\n  REGISTRY_REPO,\n  type RegistryToken,\n  resolveToken,\n} from \"./constants\";\nimport { parseEnv } from \"./env-reconcile\";\nimport {\n  extractRequirements,\n  type ResourceRequirementRow,\n  renderRequirements,\n} from \"./requirements\";\n\n/** Subdirectories that commonly hold the frontend / server in an AppKit app. */\nconst FRONTEND_SUBDIRS = [\"client\", \"frontend\", \"web\", \"app\"];\nconst SERVER_SUBDIRS = [\"server\", \"api\", \"backend\"];\n\nfunction isDir(p: string): boolean {\n  return fs.existsSync(p) && fs.statSync(p).isDirectory();\n}\n\n/** A registry item is a server plugin if it ships a manifest.json. */\nfunction isPluginItem(item: RegistryItem): boolean {\n  return (item.files ?? []).some(\n    (f) => path.basename(f.target ?? f.path) === \"manifest.json\",\n  );\n}\n\n/**\n * Locates the frontend root for UI components. AppKit apps put the client in a\n * client/ subdir (with its own components.json + src/); the CLI is typically\n * run from the repo root. Prefer the dir with components.json, then a src/.\n */\nfunction findFrontendRoot(cwd: string): string {\n  if (fs.existsSync(path.join(cwd, \"components.json\"))) return cwd;\n  for (const sub of FRONTEND_SUBDIRS) {\n    if (fs.existsSync(path.join(cwd, sub, \"components.json\"))) {\n      return path.join(cwd, sub);\n    }\n  }\n  if (isDir(path.join(cwd, \"src\"))) return cwd;\n  for (const sub of FRONTEND_SUBDIRS) {\n    if (isDir(path.join(cwd, sub, \"src\"))) return path.join(cwd, sub);\n  }\n  return cwd;\n}\n\n/** Locates the server root for plugins (the server/ subdir, else cwd). */\nfunction findServerRoot(cwd: string): string {\n  for (const sub of SERVER_SUBDIRS) {\n    if (isDir(path.join(cwd, sub))) return path.join(cwd, sub);\n  }\n  return cwd;\n}\n\n/** Nearest dir with a package.json, walking up from start (for dep install). */\nfunction findNearestPackageJson(start: string): string {\n  let dir = start;\n  for (;;) {\n    if (fs.existsSync(path.join(dir, \"package.json\"))) return dir;\n    const parent = path.dirname(dir);\n    if (parent === dir) return start;\n    dir = parent;\n  }\n}\n\n/**\n * The Databricks profile the app is configured with, read from\n * `DATABRICKS_CONFIG_PROFILE` in `cwd/.env` via the same dotenv parser the app\n * loads its env with. The CLI's top-level `dotenv/config` only loads the launch\n * dir's `.env` into `process.env`; when `--cwd` points at a different app dir,\n * that file isn't loaded, so the workspace picker and bundle validate would\n * miss the app's profile — this reads it directly. Undefined if the file or key\n * is absent, so the SDK's own default resolution still applies.\n */\nexport function profileFromEnv(cwd: string): string | undefined {\n  try {\n    const content = fs.readFileSync(path.join(cwd, \".env\"), \"utf-8\");\n    return parseEnv(content).DATABRICKS_CONFIG_PROFILE || undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Resolves a registry item's `target` under `base`, enforcing that the result\n * stays inside `base`. Registry items are untrusted remote data; a `target`\n * like `../../../.zshrc` or an absolute path could otherwise write files\n * anywhere on disk (arbitrary-write → RCE). Throws on any escape.\n */\nexport function resolveWithinBase(base: string, target: string): string {\n  if (path.isAbsolute(target)) {\n    throw new Error(`Refusing absolute file target from registry: ${target}`);\n  }\n  const baseResolved = path.resolve(base);\n  const resolved = path.resolve(baseResolved, target);\n  if (\n    resolved !== baseResolved &&\n    !resolved.startsWith(baseResolved + path.sep)\n  ) {\n    throw new Error(\n      `Refusing file target that escapes the destination directory: ${target}`,\n    );\n  }\n  return resolved;\n}\n\n/** UI file destination (relative to the frontend root): placed in src/ if present. */\nfunction uiTargetPath(base: string, file: RegistryItemFile): string {\n  let target = file.target ?? path.join(\"components\", path.basename(file.path));\n  if (!target.startsWith(\"src/\") && isDir(path.join(base, \"src\"))) {\n    target = path.join(\"src\", target);\n  }\n  return target;\n}\n\n/** Best-effort: the `toPlugin` export name from the item's index.ts. Returns\n * null (caller falls back to printed instructions) unless the name is a plain\n * JS identifier — the item is untrusted remote content and the value is\n * interpolated into the user's server.ts. */\nexport function pluginExportName(item: RegistryItem): string | null {\n  const index = (item.files ?? []).find(\n    (f) => path.basename(f.target ?? f.path) === \"index.ts\",\n  );\n  const match = index?.content.match(/export\\s*\\{([^}]*)\\}/);\n  if (!match) return null;\n  const names = match[1].split(\",\").map((s) => s.trim());\n  // Prefer the camelCase toPlugin instance over the PascalCase class.\n  const chosen = names.find((n) => /^[a-z]/.test(n)) ?? names[0];\n  return chosen && JS_IDENTIFIER.test(chosen) ? chosen : null;\n}\n\nfunction detectPackageManager(cwd: string): \"pnpm\" | \"yarn\" | \"bun\" | \"npm\" {\n  if (fs.existsSync(path.join(cwd, \"pnpm-lock.yaml\"))) return \"pnpm\";\n  if (fs.existsSync(path.join(cwd, \"yarn.lock\"))) return \"yarn\";\n  if (fs.existsSync(path.join(cwd, \"bun.lockb\"))) return \"bun\";\n  return \"npm\";\n}\n\n/**\n * A safe npm dependency spec: `[@scope/]name` with an optional `@version`\n * range. Registry `dependencies` are untrusted remote data passed to the\n * package manager, so we reject anything that isn't a plain name+range —\n * blocks tarball/git URL specs (install-script RCE) and `-`-prefixed entries\n * that the PM would parse as flags (argument injection).\n */\nconst SAFE_DEP_SPEC =\n  /^(@[a-z0-9][\\w.-]*\\/)?[a-z0-9][\\w.-]*(@[\\w.\\-+~^><=|* ]+)?$/i;\n\n/** Splits deps into safe (installable) and rejected (surfaced to the user). */\nexport function partitionDeps(deps: string[]): {\n  safe: string[];\n  rejected: string[];\n} {\n  const safe: string[] = [];\n  const rejected: string[] = [];\n  for (const dep of deps) {\n    if (dep.startsWith(\"-\") || !SAFE_DEP_SPEC.test(dep)) rejected.push(dep);\n    else safe.push(dep);\n  }\n  return { safe, rejected };\n}\n\n/** Splits an npm spec into `name` and optional version `range`, handling the\n * leading `@` of scoped names (`@databricks/appkit-ui@^0.41.0` → name\n * `@databricks/appkit-ui`, range `^0.41.0`; `lodash` → no range). */\nexport function parseDepSpec(spec: string): { name: string; range?: string } {\n  const at = spec.lastIndexOf(\"@\");\n  // at <= 0 means either no `@` (bare name) or the scope's `@` at index 0.\n  if (at <= 0) return { name: spec };\n  return { name: spec.slice(0, at), range: spec.slice(at + 1) };\n}\n\n/**\n * Registry `dependencies` are floors (\"needs at least this version\"), not pins.\n * Against the versions already in the target `package.json`, returns which specs\n * to install: missing packages (as declared) and genuine upgrades (installed\n * floor below the requested floor). A package already at a same-or-newer version\n * is skipped so the package manager never downgrades it; ranges that can't be\n * compared (workspace:*, catalog:, git) are skipped for the same reason.\n *\n * `semver` is injected so the caller can lazy-load it (see `installDependencies`).\n */\nexport function reconcileDeps(\n  specs: string[],\n  installed: Record<string, string>,\n  { gte, minVersion }: Pick<typeof import(\"semver\"), \"gte\" | \"minVersion\">,\n): { install: string[]; skipped: string[] } {\n  // minVersion() throws on ranges it can't parse (workspace:*, catalog:, git);\n  // treat those as uncomparable and skip rather than risk a downgrade.\n  const floor = (range: string): string | null => {\n    try {\n      return minVersion(range)?.version ?? null;\n    } catch {\n      return null;\n    }\n  };\n  const install: string[] = [];\n  const skipped: string[] = [];\n  for (const spec of specs) {\n    const { name, range } = parseDepSpec(spec);\n    const have = installed[name];\n    if (!have) {\n      install.push(spec); // missing → install as declared\n      continue;\n    }\n    if (!range) {\n      skipped.push(spec); // present, no version asked → keep what's there\n      continue;\n    }\n    const reqFloor = floor(range);\n    const haveFloor = floor(have);\n    if (!reqFloor || !haveFloor) {\n      skipped.push(spec); // can't compare safely → don't touch\n    } else if (gte(haveFloor, reqFloor)) {\n      skipped.push(spec); // installed is same-or-newer → keep (no downgrade)\n    } else {\n      install.push(spec); // installed is older than required → upgrade\n    }\n  }\n  return { install, skipped };\n}\n\n/** Merged dependencies + devDependencies (name → declared range) of a\n * package.json, tolerating a missing/unreadable file (returns {}). */\nfunction readInstalledRanges(pkgPath: string): Record<string, string> {\n  try {\n    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\")) as {\n      dependencies?: Record<string, string>;\n      devDependencies?: Record<string, string>;\n    };\n    return { ...pkg.dependencies, ...pkg.devDependencies };\n  } catch {\n    return {};\n  }\n}\n\nasync function installDependencies(deps: string[], cwd: string): Promise<void> {\n  if (deps.length === 0) return;\n\n  const { safe, rejected } = partitionDeps(deps);\n  if (rejected.length > 0) {\n    console.warn(\n      pc.yellow(\n        `Skipping suspicious dependenc${rejected.length === 1 ? \"y\" : \"ies\"} from the registry (not a plain name@version): ${rejected.join(\", \")}. Install manually if you trust them.`,\n      ),\n    );\n  }\n  if (safe.length === 0) return;\n\n  const pkgPath = path.join(cwd, \"package.json\");\n  if (!fs.existsSync(pkgPath)) {\n    console.warn(\n      pc.yellow(\n        `No package.json found — install these manually: ${safe.join(\" \")}`,\n      ),\n    );\n    return;\n  }\n\n  // Lazy import: this file is loaded eagerly by the CLI entry, so keep semver\n  // (only needed here) off the startup path — as with server-register/env-writer.\n  const semver = await import(\"semver\");\n  const { install, skipped } = reconcileDeps(\n    safe,\n    readInstalledRanges(pkgPath),\n    semver,\n  );\n  if (skipped.length > 0) {\n    console.log(\n      pc.dim(\n        `Keeping already-installed (registry asked for an older/equal range): ${skipped.join(\", \")}`,\n      ),\n    );\n  }\n  if (install.length === 0) return;\n\n  const pm = detectPackageManager(cwd);\n  const subcommand = pm === \"npm\" ? \"install\" : \"add\";\n  console.log(`\\nInstalling dependencies with ${pm}: ${install.join(\" \")}`);\n  // `--` stops the PM from parsing any dep as a flag (defense in depth).\n  const result = spawnSync(pm, [subcommand, \"--\", ...install], {\n    stdio: \"inherit\",\n    cwd,\n  });\n  if (result.status !== 0) {\n    console.warn(\n      pc.yellow(\n        `Dependency install exited with code ${result.status ?? \"unknown\"} — install manually if needed: ${install.join(\" \")}`,\n      ),\n    );\n  }\n}\n\n/** Runs `appkit plugin sync --write` via this same CLI binary. */\nfunction runPluginSync(cwd: string): void {\n  const result = spawnSync(\n    process.execPath,\n    [process.argv[1], \"plugin\", \"sync\", \"--write\"],\n    { stdio: \"inherit\", cwd },\n  );\n  if (result.status !== 0) {\n    console.warn(\n      pc.yellow(\n        \"  Plugin sync did not complete cleanly — run `appkit plugin sync --write` manually.\",\n      ),\n    );\n  }\n}\n\nfunction writeItemFile(\n  base: string,\n  target: string,\n  content: string,\n  force: boolean,\n  cwd: string,\n): void {\n  const dest = resolveWithinBase(base, target);\n  const existed = fs.existsSync(dest);\n  if (existed && !force) {\n    console.error(\n      pc.red(\n        `Refusing to overwrite ${path.relative(cwd, dest)} — pass --force to replace it.`,\n      ),\n    );\n    process.exit(1);\n  }\n  fs.mkdirSync(path.dirname(dest), { recursive: true });\n  fs.writeFileSync(dest, content);\n  const label = existed ? pc.yellow(\"Updated\") : pc.green(\"Created\");\n  console.log(`${label} ${path.relative(cwd, dest)}`);\n}\n\ninterface PluginSummary {\n  importPath: string;\n  exportName: string | null;\n}\n\n/**\n * Fetches the requested items plus their transitive registryDependencies.\n * Dependencies are resolved breadth-first and de-duplicated by name, so a\n * plugin that depends on another registry item pulls the whole graph in one\n * `add`. Explicitly-requested items keep their request order and come first.\n */\nexport async function resolveItems(\n  names: string[],\n  token: RegistryToken | null,\n  fetchItem: (\n    name: string,\n    token: RegistryToken | null,\n  ) => Promise<RegistryItem> = fetchRegistryItem,\n): Promise<RegistryItem[]> {\n  const seen = new Set<string>();\n  const ordered: RegistryItem[] = [];\n  // A name is both the fetch path and the on-disk `plugins/<name>` dir, so\n  // reject non-slug refs (`/`, `..`, control chars) before they reach either.\n  const enqueue = (ref: string): string => {\n    const name = stripNamespace(ref);\n    if (!isValidItemName(name)) {\n      throw new Error(`Invalid registry item name: ${JSON.stringify(ref)}`);\n    }\n    return name;\n  };\n  // Breadth-first over the dependency graph, one level per iteration. Items in\n  // a level are fetched concurrently (fetch latency is additive otherwise), but\n  // levels stay ordered and dedup/cycle handling is unchanged: a name is marked\n  // seen before its level is fetched, so it's never fetched or queued twice.\n  let level = names.map(enqueue).filter((name) => {\n    if (seen.has(name)) return false;\n    seen.add(name);\n    return true;\n  });\n\n  while (level.length > 0) {\n    const items = await Promise.all(\n      level.map(async (key) => {\n        const item = await fetchItem(key, token);\n        // Pin to the fetch key: the body's self-reported `name` is untrusted\n        // and could claim a verified name to slip past the gate. The key is the\n        // trustworthy identity the index keys `verified` on.\n        item.name = key;\n        return item;\n      }),\n    );\n    ordered.push(...items);\n    const next: string[] = [];\n    for (const item of items) {\n      for (const dep of item.registryDependencies ?? []) {\n        const depName = enqueue(dep);\n        if (seen.has(depName)) continue;\n        seen.add(depName);\n        next.push(depName);\n      }\n    }\n    level = next;\n  }\n\n  return ordered;\n}\n\ninterface AddOptions {\n  force?: boolean;\n  cwd?: string;\n  register?: boolean;\n  /** false = don't reconcile resource env vars into .env. */\n  resources?: boolean;\n  /** true = never prompt; use --env flags or leave unset (agent/CI). */\n  yes?: boolean;\n  /** Pre-supplied env values from repeated --env KEY=VALUE flags. */\n  env?: Record<string, string>;\n  /** Databricks profile passed to `bundle validate` after writing config. */\n  profile?: string;\n  /** true = install items the registry index doesn't mark verified. */\n  allowUnverified?: boolean;\n}\n\n/**\n * Splits requested names into verified and unverified against the index's\n * verified set. When `verified` is null the index couldn't be read — we can't\n * prove anything is verified, so every name is treated as unverified (the gate\n * then decides whether to warn-and-continue or block). Names are compared with\n * the namespace stripped, matching how items are fetched.\n */\nexport function partitionVerified(\n  refs: string[],\n  verified: Set<string> | null,\n): { verified: string[]; unverified: string[] } {\n  const ok: string[] = [];\n  const bad: string[] = [];\n  for (const ref of refs) {\n    const name = stripNamespace(ref);\n    if (verified?.has(name)) ok.push(name);\n    else bad.push(name);\n  }\n  return { verified: ok, unverified: bad };\n}\n\nasync function runAdd(refs: string[], opts: AddOptions): Promise<void> {\n  const cwd = opts.cwd ? path.resolve(opts.cwd) : process.cwd();\n  const token = resolveToken();\n  if (token) {\n    console.log(\n      `Using ${token.envName} to fetch from ${REGISTRY_REPO} (private).`,\n    );\n  }\n\n  // Resolve the full graph and fetch the verified index concurrently (two\n  // independent round-trips). Item resolution is read-only — nothing is written\n  // or installed until after the gate below.\n  const verifiedP = opts.allowUnverified\n    ? Promise.resolve(null)\n    : fetchVerifiedNames(token);\n  const items = await resolveItems(refs, token);\n\n  // Integrity gate over the *entire resolved set* (not just requested names, so\n  // an unverified transitive dep can't ride in on a verified item). Fails closed:\n  // a null verified set (unreadable index) makes every item count as unverified.\n  if (!opts.allowUnverified) {\n    const verified = await verifiedP;\n    const { unverified } = partitionVerified(\n      items.map((i) => i.name),\n      verified,\n    );\n    if (unverified.length > 0) {\n      const reason =\n        verified === null\n          ? \"could not read the registry index to verify these items\"\n          : `not marked verified in ${REGISTRY_REPO}`;\n      console.error(\n        pc.red(\n          `Refusing to add unverified item(s) (${reason}): ${unverified.join(\", \")}.`,\n        ),\n      );\n      console.error(\n        pc.dim(\n          \"  Re-run with --allow-unverified if you trust the source; unverified items run code in your app.\",\n        ),\n      );\n      process.exit(1);\n    }\n  }\n\n  const hasUi = items.some((i) => !isPluginItem(i));\n  const hasPlugin = items.some(isPluginItem);\n  const frontendRoot = hasUi ? findFrontendRoot(cwd) : cwd;\n  const serverRoot = hasPlugin ? findServerRoot(cwd) : cwd;\n  if (hasUi && frontendRoot !== cwd) {\n    console.log(pc.dim(`UI components → ${path.relative(cwd, frontendRoot)}/`));\n  }\n  if (hasPlugin && serverRoot !== cwd) {\n    console.log(pc.dim(`Plugins → ${path.relative(cwd, serverRoot)}/`));\n  }\n\n  const deps = new Set<string>();\n  let wroteUi = false;\n  const pluginSummaries: PluginSummary[] = [];\n  const allRequirements: ResourceRequirementRow[] = [];\n\n  for (const item of items) {\n    for (const dep of item.dependencies ?? []) deps.add(dep);\n\n    if (isPluginItem(item)) {\n      let pluginRel = path.join(\"plugins\", item.name);\n      for (const file of item.files ?? []) {\n        const target =\n          file.target ??\n          path.join(\"plugins\", item.name, path.basename(file.path));\n        writeItemFile(\n          serverRoot,\n          target,\n          file.content,\n          Boolean(opts.force),\n          cwd,\n        );\n        if (path.basename(target) === \"manifest.json\") {\n          pluginRel = path.dirname(target);\n        }\n      }\n      const requirements = extractRequirements(item);\n      if (requirements.length > 0) {\n        console.log(`\\n${renderRequirements(item, requirements)}`);\n        allRequirements.push(...requirements);\n      }\n      pluginSummaries.push({\n        importPath: `./${pluginRel}`,\n        exportName: pluginExportName(item),\n      });\n    } else {\n      for (const file of item.files ?? []) {\n        writeItemFile(\n          frontendRoot,\n          uiTargetPath(frontendRoot, file),\n          file.content,\n          Boolean(opts.force),\n          cwd,\n        );\n        wroteUi = true;\n      }\n    }\n  }\n\n  await installDependencies([...deps], findNearestPackageJson(cwd));\n\n  if (hasPlugin) {\n    console.log(pc.dim(\"\\nRegistering plugins (appkit plugin sync)...\"));\n    runPluginSync(cwd);\n  }\n\n  if (wroteUi) {\n    console.log(\n      pc.dim(\n        '\\nReminder: import \"@databricks/appkit-ui/styles.css\" once at your app root so components are themed.',\n      ),\n    );\n  }\n  // Lazy import: server-register pulls in @ast-grep/napi (a native addon), and\n  // this CLI is imported eagerly by index.ts, so a static import would make\n  // every unrelated command pay that cost.\n  const registerPluginInServer =\n    opts.register !== false && pluginSummaries.some((s) => s.exportName)\n      ? (await import(\"./server-register.js\")).registerPluginInServer\n      : null;\n  for (const s of pluginSummaries) {\n    // Try to wire the plugin into the server's createApp call automatically;\n    // fall back to printing the snippet when the shape isn't the standard one.\n    let wired = false;\n    // Why auto-registration was skipped, so the fallback can say so (an empty\n    // reason means the user opted out via --no-register — no nag then).\n    let skipReason: string | undefined;\n    if (opts.register === false) {\n      // opted out — print the snippet without a \"couldn't\" message\n    } else if (!s.exportName) {\n      skipReason =\n        \"couldn't read a plugin export name from the item's index.ts\";\n    } else if (registerPluginInServer) {\n      const result = registerPluginInServer(\n        serverRoot,\n        s.importPath,\n        s.exportName,\n      );\n      // result.file is relative to serverRoot; show it from cwd for the user.\n      const shown =\n        result.file && path.relative(cwd, path.join(serverRoot, result.file));\n      if (result.status === \"wired\") {\n        console.log(`\\n${pc.green(\"Registered\")} ${s.exportName} in ${shown}`);\n        wired = true;\n      } else if (result.status === \"already\") {\n        console.log(\n          pc.dim(`\\n${s.exportName} is already registered in ${shown}`),\n        );\n        wired = true;\n      } else {\n        skipReason = result.reason;\n      }\n    }\n    if (!wired) {\n      const imp = s.exportName ?? \"<plugin>\";\n      if (skipReason) {\n        console.log(\n          pc.yellow(`\\nCouldn't auto-register ${imp} — ${skipReason}.`),\n        );\n      }\n      console.log(\n        `${pc.bold(\"Add this to your server's createApp call:\")}\\n` +\n          pc.dim(\n            `  import { ${imp} } from \"${s.importPath}\";\\n` +\n              `  const app = await createApp({ plugins: [${imp}(), /* ... */] });`,\n          ),\n      );\n    }\n  }\n\n  if (opts.resources !== false && allRequirements.length > 0) {\n    // Lazy import (same reason as server-register above): env-writer pulls in\n    // the workspace picker and, through it, the Databricks SDK.\n    const { collectBindingValues, reportEnvResolutions, syncEnv } =\n      await import(\"./env-writer.js\");\n    // Without --profile, fall back to the app's configured profile so the\n    // picker and bundle validate reach the workspace the app runs against.\n    const profile = opts.profile ?? profileFromEnv(cwd);\n    console.log(pc.dim(\"\\nReconciling resource env vars into .env...\"));\n    const resolutions = await syncEnv(allRequirements, {\n      cwd,\n      nonInteractive: Boolean(opts.yes),\n      values: opts.env,\n      profile,\n    });\n    reportEnvResolutions(resolutions);\n\n    // Deploy config (app.yaml + databricks.yml). Values come from what the\n    // user supplied for env fields (flags or prompts); other fields fall back\n    // to their manifest defaults inside buildConfigPlan.\n    const values: Record<string, string> = { ...(opts.env ?? {}) };\n    for (const r of resolutions) {\n      if (r.value !== undefined) values[r.env] = r.value;\n    }\n    // Binding fields with no env name (e.g. postgres project/branch/database)\n    // never flow through .env, so collect them separately — else their\n    // databricks.yml bundle variables stay unassigned and bundle validate fails.\n    const bindingNeeds = collectBindingValueNeeds(allRequirements);\n    if (bindingNeeds.length > 0) {\n      const bindingValues = await collectBindingValues(bindingNeeds, {\n        cwd,\n        nonInteractive: Boolean(opts.yes),\n        values: opts.env,\n        profile,\n      });\n      Object.assign(values, bindingValues);\n    }\n    const plan = buildConfigPlan(allRequirements, values);\n    if (planHasContent(plan)) {\n      const result = writeConfig(cwd, plan);\n      reportConfigWrite(result);\n      if (result.databricksYmlChanged) validateBundle(cwd, profile);\n    }\n    warnScopeNeeding(allRequirements);\n  }\n}\n\n/**\n * v1 does not write `user_api_scopes` (deferred to the manifest scope\n * extension). Warn when an added plugin's resource type is known to need one,\n * so the user adds it before deploy.\n */\n/** Resource types known to require a user_api_scope, and the scope each needs. */\nexport const SCOPE_BY_RESOURCE_TYPE: Record<string, string> = {\n  genie_space: \"dashboards.genie\",\n  serving_endpoint: \"serving.serving-endpoints\",\n  // volumes/files-backed access uses files.files\n  volume: \"files.files\",\n};\n\n/** Returns the user_api_scopes implied by a set of resource rows (deduped). */\nexport function scopesForResources(\n  rows: ResourceRequirementRow[],\n): Map<string, string> {\n  const needed = new Map<string, string>();\n  for (const row of rows) {\n    const scope = SCOPE_BY_RESOURCE_TYPE[row.type];\n    if (scope) needed.set(row.type, scope);\n  }\n  return needed;\n}\n\nfunction warnScopeNeeding(rows: ResourceRequirementRow[]): void {\n  const needed = scopesForResources(rows);\n  if (needed.size === 0) return;\n  const list = [...needed.entries()]\n    .map(([type, scope]) => `${type} → ${scope}`)\n    .join(\", \");\n  console.warn(\n    pc.yellow(\n      `\\n  Note: these resources may need a user_api_scope before deploy: ${list}.\\n` +\n        \"  Add it under resources.apps.app.user_api_scopes in databricks.yml.\",\n    ),\n  );\n}\n\n/** Commander reducer for repeatable `--env KEY=VALUE` flags. */\nfunction collectEnvFlag(\n  raw: string,\n  acc: Record<string, string>,\n): Record<string, string> {\n  const eq = raw.indexOf(\"=\");\n  if (eq === -1) {\n    console.error(`Ignoring --env \"${raw}\" (expected KEY=VALUE).`);\n    return acc;\n  }\n  const key = raw.slice(0, eq).trim();\n  const value = raw.slice(eq + 1);\n  if (key) acc[key] = value;\n  return acc;\n}\n\nexport const addCommand = new Command(\"add\")\n  .description(\"Add a UI component or server plugin from the AppKit registry\")\n  .argument(\"<item...>\", \"Registry item name(s), e.g. metric-card or hello\")\n  .option(\"-f, --force\", \"Overwrite existing files\")\n  .option(\"-C, --cwd <dir>\", \"Run as if started in <dir>\")\n  .option(\"--no-register\", \"Don't edit the server entry to register plugins\")\n  .option(\"--no-resources\", \"Don't reconcile resource env vars into .env\")\n  .option(\"-y, --yes\", \"Don't prompt; use --env values or leave vars unset\")\n  .option(\n    \"--env <KEY=VALUE>\",\n    \"Pre-set a resource env var (repeatable)\",\n    collectEnvFlag,\n    {},\n  )\n  .option(\n    \"-p, --profile <name>\",\n    \"Databricks profile for the resource picker and bundle validate (defaults to the app's DATABRICKS_CONFIG_PROFILE)\",\n  )\n  .option(\n    \"--allow-unverified\",\n    \"Add items the registry doesn't mark verified (runs untrusted code)\",\n  )\n  .addHelpText(\n    \"after\",\n    `\nNo components.json is required. Item type is detected automatically:\n  • UI components → <frontend>/src/components/appkit/  (client/ detected)\n  • Server plugins → <server>/plugins/<name>/, runs plugin sync, and registers\n    them in your createApp call (use --no-register to skip the server edit)\n\nServer plugins declare Databricks resources. On add, their env vars are\nreconciled into .env (and names into .env.example), and the deploy config\n(app.yaml + databricks.yml resource bindings) is patched to match — existing\nentries are never clobbered. Interactive by default; pass --yes for agents/CI\n(uses --env values, leaves the rest unset) and --env KEY=VALUE to supply\nvalues non-interactively. Pass --profile to validate the bundle after writing.\n\nThe frontend/server roots are detected from common layouts, so you can run\nthis from the repo root. While the registry repo is private, a read token is\nresolved from \\`gh auth token\\` or APPKIT_REGISTRY_TOKEN / GITHUB_TOKEN / GH_TOKEN.\n\nExamples:\n  $ appkit add metric-card           # UI component\n  $ appkit add hello                 # server plugin\n  $ appkit add metric-card hello     # mix in one call\n  $ appkit add analytics --yes --env DATABRICKS_WAREHOUSE_ID=abc123`,\n  )\n  .action((items: string[], opts: AddOptions) =>\n    runAdd(items, opts).catch((err) => {\n      console.error(err);\n      process.exit(1);\n    }),\n  );\n"],"mappings":";;;;;;;;;;;;;;;AAwCA,MAAM,mBAAmB;CAAC;CAAU;CAAY;CAAO;CAAM;AAC7D,MAAM,iBAAiB;CAAC;CAAU;CAAO;CAAU;AAEnD,SAAS,MAAM,GAAoB;AACjC,QAAO,GAAG,WAAW,EAAE,IAAI,GAAG,SAAS,EAAE,CAAC,aAAa;;;AAIzD,SAAS,aAAa,MAA6B;AACjD,SAAQ,KAAK,SAAS,EAAE,EAAE,MACvB,MAAM,KAAK,SAAS,EAAE,UAAU,EAAE,KAAK,KAAK,gBAC9C;;;;;;;AAQH,SAAS,iBAAiB,KAAqB;AAC7C,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,kBAAkB,CAAC,CAAE,QAAO;AAC7D,MAAK,MAAM,OAAO,iBAChB,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,KAAK,kBAAkB,CAAC,CACvD,QAAO,KAAK,KAAK,KAAK,IAAI;AAG9B,KAAI,MAAM,KAAK,KAAK,KAAK,MAAM,CAAC,CAAE,QAAO;AACzC,MAAK,MAAM,OAAO,iBAChB,KAAI,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,CAAC,CAAE,QAAO,KAAK,KAAK,KAAK,IAAI;AAEnE,QAAO;;;AAIT,SAAS,eAAe,KAAqB;AAC3C,MAAK,MAAM,OAAO,eAChB,KAAI,MAAM,KAAK,KAAK,KAAK,IAAI,CAAC,CAAE,QAAO,KAAK,KAAK,KAAK,IAAI;AAE5D,QAAO;;;AAIT,SAAS,uBAAuB,OAAuB;CACrD,IAAI,MAAM;AACV,UAAS;AACP,MAAI,GAAG,WAAW,KAAK,KAAK,KAAK,eAAe,CAAC,CAAE,QAAO;EAC1D,MAAM,SAAS,KAAK,QAAQ,IAAI;AAChC,MAAI,WAAW,IAAK,QAAO;AAC3B,QAAM;;;;;;;;;;;;AAaV,SAAgB,eAAe,KAAiC;AAC9D,KAAI;AAEF,SAAO,SADS,GAAG,aAAa,KAAK,KAAK,KAAK,OAAO,EAAE,QAAQ,CACxC,CAAC,6BAA6B;SAChD;AACN;;;;;;;;;AAUJ,SAAgB,kBAAkB,MAAc,QAAwB;AACtE,KAAI,KAAK,WAAW,OAAO,CACzB,OAAM,IAAI,MAAM,gDAAgD,SAAS;CAE3E,MAAM,eAAe,KAAK,QAAQ,KAAK;CACvC,MAAM,WAAW,KAAK,QAAQ,cAAc,OAAO;AACnD,KACE,aAAa,gBACb,CAAC,SAAS,WAAW,eAAe,KAAK,IAAI,CAE7C,OAAM,IAAI,MACR,gEAAgE,SACjE;AAEH,QAAO;;;AAIT,SAAS,aAAa,MAAc,MAAgC;CAClE,IAAI,SAAS,KAAK,UAAU,KAAK,KAAK,cAAc,KAAK,SAAS,KAAK,KAAK,CAAC;AAC7E,KAAI,CAAC,OAAO,WAAW,OAAO,IAAI,MAAM,KAAK,KAAK,MAAM,MAAM,CAAC,CAC7D,UAAS,KAAK,KAAK,OAAO,OAAO;AAEnC,QAAO;;;;;;AAOT,SAAgB,iBAAiB,MAAmC;CAIlE,MAAM,SAHS,KAAK,SAAS,EAAE,EAAE,MAC9B,MAAM,KAAK,SAAS,EAAE,UAAU,EAAE,KAAK,KAAK,WAC9C,EACoB,QAAQ,MAAM,uBAAuB;AAC1D,KAAI,CAAC,MAAO,QAAO;CACnB,MAAM,QAAQ,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,MAAM,EAAE,MAAM,CAAC;CAEtD,MAAM,SAAS,MAAM,MAAM,MAAM,SAAS,KAAK,EAAE,CAAC,IAAI,MAAM;AAC5D,QAAO,UAAU,cAAc,KAAK,OAAO,GAAG,SAAS;;AAGzD,SAAS,qBAAqB,KAA8C;AAC1E,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,iBAAiB,CAAC,CAAE,QAAO;AAC5D,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACvD,KAAI,GAAG,WAAW,KAAK,KAAK,KAAK,YAAY,CAAC,CAAE,QAAO;AACvD,QAAO;;;;;;;;;AAUT,MAAM,gBACJ;;AAGF,SAAgB,cAAc,MAG5B;CACA,MAAM,OAAiB,EAAE;CACzB,MAAM,WAAqB,EAAE;AAC7B,MAAK,MAAM,OAAO,KAChB,KAAI,IAAI,WAAW,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,CAAE,UAAS,KAAK,IAAI;KAClE,MAAK,KAAK,IAAI;AAErB,QAAO;EAAE;EAAM;EAAU;;;;;AAM3B,SAAgB,aAAa,MAAgD;CAC3E,MAAM,KAAK,KAAK,YAAY,IAAI;AAEhC,KAAI,MAAM,EAAG,QAAO,EAAE,MAAM,MAAM;AAClC,QAAO;EAAE,MAAM,KAAK,MAAM,GAAG,GAAG;EAAE,OAAO,KAAK,MAAM,KAAK,EAAE;EAAE;;;;;;;;;;;;AAa/D,SAAgB,cACd,OACA,WACA,EAAE,KAAK,cACmC;CAG1C,MAAM,SAAS,UAAiC;AAC9C,MAAI;AACF,UAAO,WAAW,MAAM,EAAE,WAAW;UAC/B;AACN,UAAO;;;CAGX,MAAM,UAAoB,EAAE;CAC5B,MAAM,UAAoB,EAAE;AAC5B,MAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,EAAE,MAAM,UAAU,aAAa,KAAK;EAC1C,MAAM,OAAO,UAAU;AACvB,MAAI,CAAC,MAAM;AACT,WAAQ,KAAK,KAAK;AAClB;;AAEF,MAAI,CAAC,OAAO;AACV,WAAQ,KAAK,KAAK;AAClB;;EAEF,MAAM,WAAW,MAAM,MAAM;EAC7B,MAAM,YAAY,MAAM,KAAK;AAC7B,MAAI,CAAC,YAAY,CAAC,UAChB,SAAQ,KAAK,KAAK;WACT,IAAI,WAAW,SAAS,CACjC,SAAQ,KAAK,KAAK;MAElB,SAAQ,KAAK,KAAK;;AAGtB,QAAO;EAAE;EAAS;EAAS;;;;AAK7B,SAAS,oBAAoB,SAAyC;AACpE,KAAI;EACF,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,SAAS,QAAQ,CAAC;AAIzD,SAAO;GAAE,GAAG,IAAI;GAAc,GAAG,IAAI;GAAiB;SAChD;AACN,SAAO,EAAE;;;AAIb,eAAe,oBAAoB,MAAgB,KAA4B;AAC7E,KAAI,KAAK,WAAW,EAAG;CAEvB,MAAM,EAAE,MAAM,aAAa,cAAc,KAAK;AAC9C,KAAI,SAAS,SAAS,EACpB,SAAQ,KACN,GAAG,OACD,gCAAgC,SAAS,WAAW,IAAI,MAAM,MAAM,iDAAiD,SAAS,KAAK,KAAK,CAAC,uCAC1I,CACF;AAEH,KAAI,KAAK,WAAW,EAAG;CAEvB,MAAM,UAAU,KAAK,KAAK,KAAK,eAAe;AAC9C,KAAI,CAAC,GAAG,WAAW,QAAQ,EAAE;AAC3B,UAAQ,KACN,GAAG,OACD,mDAAmD,KAAK,KAAK,IAAI,GAClE,CACF;AACD;;CAKF,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,EAAE,SAAS,YAAY,cAC3B,MACA,oBAAoB,QAAQ,EAC5B,OACD;AACD,KAAI,QAAQ,SAAS,EACnB,SAAQ,IACN,GAAG,IACD,wEAAwE,QAAQ,KAAK,KAAK,GAC3F,CACF;AAEH,KAAI,QAAQ,WAAW,EAAG;CAE1B,MAAM,KAAK,qBAAqB,IAAI;CACpC,MAAM,aAAa,OAAO,QAAQ,YAAY;AAC9C,SAAQ,IAAI,kCAAkC,GAAG,IAAI,QAAQ,KAAK,IAAI,GAAG;CAEzE,MAAM,SAAS,UAAU,IAAI;EAAC;EAAY;EAAM,GAAG;EAAQ,EAAE;EAC3D,OAAO;EACP;EACD,CAAC;AACF,KAAI,OAAO,WAAW,EACpB,SAAQ,KACN,GAAG,OACD,uCAAuC,OAAO,UAAU,UAAU,iCAAiC,QAAQ,KAAK,IAAI,GACrH,CACF;;;AAKL,SAAS,cAAc,KAAmB;AAMxC,KALe,UACb,QAAQ,UACR;EAAC,QAAQ,KAAK;EAAI;EAAU;EAAQ;EAAU,EAC9C;EAAE,OAAO;EAAW;EAAK,CAC1B,CACU,WAAW,EACpB,SAAQ,KACN,GAAG,OACD,sFACD,CACF;;AAIL,SAAS,cACP,MACA,QACA,SACA,OACA,KACM;CACN,MAAM,OAAO,kBAAkB,MAAM,OAAO;CAC5C,MAAM,UAAU,GAAG,WAAW,KAAK;AACnC,KAAI,WAAW,CAAC,OAAO;AACrB,UAAQ,MACN,GAAG,IACD,yBAAyB,KAAK,SAAS,KAAK,KAAK,CAAC,gCACnD,CACF;AACD,UAAQ,KAAK,EAAE;;AAEjB,IAAG,UAAU,KAAK,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AACrD,IAAG,cAAc,MAAM,QAAQ;CAC/B,MAAM,QAAQ,UAAU,GAAG,OAAO,UAAU,GAAG,GAAG,MAAM,UAAU;AAClE,SAAQ,IAAI,GAAG,MAAM,GAAG,KAAK,SAAS,KAAK,KAAK,GAAG;;;;;;;;AAcrD,eAAsB,aACpB,OACA,OACA,YAG6B,mBACJ;CACzB,MAAM,uBAAO,IAAI,KAAa;CAC9B,MAAM,UAA0B,EAAE;CAGlC,MAAM,WAAW,QAAwB;EACvC,MAAM,OAAO,eAAe,IAAI;AAChC,MAAI,CAAC,gBAAgB,KAAK,CACxB,OAAM,IAAI,MAAM,+BAA+B,KAAK,UAAU,IAAI,GAAG;AAEvE,SAAO;;CAMT,IAAI,QAAQ,MAAM,IAAI,QAAQ,CAAC,QAAQ,SAAS;AAC9C,MAAI,KAAK,IAAI,KAAK,CAAE,QAAO;AAC3B,OAAK,IAAI,KAAK;AACd,SAAO;GACP;AAEF,QAAO,MAAM,SAAS,GAAG;EACvB,MAAM,QAAQ,MAAM,QAAQ,IAC1B,MAAM,IAAI,OAAO,QAAQ;GACvB,MAAM,OAAO,MAAM,UAAU,KAAK,MAAM;AAIxC,QAAK,OAAO;AACZ,UAAO;IACP,CACH;AACD,UAAQ,KAAK,GAAG,MAAM;EACtB,MAAM,OAAiB,EAAE;AACzB,OAAK,MAAM,QAAQ,MACjB,MAAK,MAAM,OAAO,KAAK,wBAAwB,EAAE,EAAE;GACjD,MAAM,UAAU,QAAQ,IAAI;AAC5B,OAAI,KAAK,IAAI,QAAQ,CAAE;AACvB,QAAK,IAAI,QAAQ;AACjB,QAAK,KAAK,QAAQ;;AAGtB,UAAQ;;AAGV,QAAO;;;;;;;;;AA0BT,SAAgB,kBACd,MACA,UAC8C;CAC9C,MAAM,KAAe,EAAE;CACvB,MAAM,MAAgB,EAAE;AACxB,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,OAAO,eAAe,IAAI;AAChC,MAAI,UAAU,IAAI,KAAK,CAAE,IAAG,KAAK,KAAK;MACjC,KAAI,KAAK,KAAK;;AAErB,QAAO;EAAE,UAAU;EAAI,YAAY;EAAK;;AAG1C,eAAe,OAAO,MAAgB,MAAiC;CACrE,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ,KAAK,IAAI,GAAG,QAAQ,KAAK;CAC7D,MAAM,QAAQ,cAAc;AAC5B,KAAI,MACF,SAAQ,IACN,SAAS,MAAM,QAAQ,iBAAiB,cAAc,aACvD;CAMH,MAAM,YAAY,KAAK,kBACnB,QAAQ,QAAQ,KAAK,GACrB,mBAAmB,MAAM;CAC7B,MAAM,QAAQ,MAAM,aAAa,MAAM,MAAM;AAK7C,KAAI,CAAC,KAAK,iBAAiB;EACzB,MAAM,WAAW,MAAM;EACvB,MAAM,EAAE,eAAe,kBACrB,MAAM,KAAK,MAAM,EAAE,KAAK,EACxB,SACD;AACD,MAAI,WAAW,SAAS,GAAG;GACzB,MAAM,SACJ,aAAa,OACT,4DACA,0BAA0B;AAChC,WAAQ,MACN,GAAG,IACD,uCAAuC,OAAO,KAAK,WAAW,KAAK,KAAK,CAAC,GAC1E,CACF;AACD,WAAQ,MACN,GAAG,IACD,mGACD,CACF;AACD,WAAQ,KAAK,EAAE;;;CAInB,MAAM,QAAQ,MAAM,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC;CACjD,MAAM,YAAY,MAAM,KAAK,aAAa;CAC1C,MAAM,eAAe,QAAQ,iBAAiB,IAAI,GAAG;CACrD,MAAM,aAAa,YAAY,eAAe,IAAI,GAAG;AACrD,KAAI,SAAS,iBAAiB,IAC5B,SAAQ,IAAI,GAAG,IAAI,mBAAmB,KAAK,SAAS,KAAK,aAAa,CAAC,GAAG,CAAC;AAE7E,KAAI,aAAa,eAAe,IAC9B,SAAQ,IAAI,GAAG,IAAI,aAAa,KAAK,SAAS,KAAK,WAAW,CAAC,GAAG,CAAC;CAGrE,MAAM,uBAAO,IAAI,KAAa;CAC9B,IAAI,UAAU;CACd,MAAM,kBAAmC,EAAE;CAC3C,MAAM,kBAA4C,EAAE;AAEpD,MAAK,MAAM,QAAQ,OAAO;AACxB,OAAK,MAAM,OAAO,KAAK,gBAAgB,EAAE,CAAE,MAAK,IAAI,IAAI;AAExD,MAAI,aAAa,KAAK,EAAE;GACtB,IAAI,YAAY,KAAK,KAAK,WAAW,KAAK,KAAK;AAC/C,QAAK,MAAM,QAAQ,KAAK,SAAS,EAAE,EAAE;IACnC,MAAM,SACJ,KAAK,UACL,KAAK,KAAK,WAAW,KAAK,MAAM,KAAK,SAAS,KAAK,KAAK,CAAC;AAC3D,kBACE,YACA,QACA,KAAK,SACL,QAAQ,KAAK,MAAM,EACnB,IACD;AACD,QAAI,KAAK,SAAS,OAAO,KAAK,gBAC5B,aAAY,KAAK,QAAQ,OAAO;;GAGpC,MAAM,eAAe,oBAAoB,KAAK;AAC9C,OAAI,aAAa,SAAS,GAAG;AAC3B,YAAQ,IAAI,KAAK,mBAAmB,MAAM,aAAa,GAAG;AAC1D,oBAAgB,KAAK,GAAG,aAAa;;AAEvC,mBAAgB,KAAK;IACnB,YAAY,KAAK;IACjB,YAAY,iBAAiB,KAAK;IACnC,CAAC;QAEF,MAAK,MAAM,QAAQ,KAAK,SAAS,EAAE,EAAE;AACnC,iBACE,cACA,aAAa,cAAc,KAAK,EAChC,KAAK,SACL,QAAQ,KAAK,MAAM,EACnB,IACD;AACD,aAAU;;;AAKhB,OAAM,oBAAoB,CAAC,GAAG,KAAK,EAAE,uBAAuB,IAAI,CAAC;AAEjE,KAAI,WAAW;AACb,UAAQ,IAAI,GAAG,IAAI,gDAAgD,CAAC;AACpE,gBAAc,IAAI;;AAGpB,KAAI,QACF,SAAQ,IACN,GAAG,IACD,0GACD,CACF;CAKH,MAAM,yBACJ,KAAK,aAAa,SAAS,gBAAgB,MAAM,MAAM,EAAE,WAAW,IAC/D,MAAM,OAAO,yBAAyB,yBACvC;AACN,MAAK,MAAM,KAAK,iBAAiB;EAG/B,IAAI,QAAQ;EAGZ,IAAI;AACJ,MAAI,KAAK,aAAa,OAAO,YAElB,CAAC,EAAE,WACZ,cACE;WACO,wBAAwB;GACjC,MAAM,SAAS,uBACb,YACA,EAAE,YACF,EAAE,WACH;GAED,MAAM,QACJ,OAAO,QAAQ,KAAK,SAAS,KAAK,KAAK,KAAK,YAAY,OAAO,KAAK,CAAC;AACvE,OAAI,OAAO,WAAW,SAAS;AAC7B,YAAQ,IAAI,KAAK,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,WAAW,MAAM,QAAQ;AACtE,YAAQ;cACC,OAAO,WAAW,WAAW;AACtC,YAAQ,IACN,GAAG,IAAI,KAAK,EAAE,WAAW,4BAA4B,QAAQ,CAC9D;AACD,YAAQ;SAER,cAAa,OAAO;;AAGxB,MAAI,CAAC,OAAO;GACV,MAAM,MAAM,EAAE,cAAc;AAC5B,OAAI,WACF,SAAQ,IACN,GAAG,OAAO,4BAA4B,IAAI,KAAK,WAAW,GAAG,CAC9D;AAEH,WAAQ,IACN,GAAG,GAAG,KAAK,4CAA4C,CAAC,MACtD,GAAG,IACD,cAAc,IAAI,WAAW,EAAE,WAAW,gDACK,IAAI,oBACpD,CACJ;;;AAIL,KAAI,KAAK,cAAc,SAAS,gBAAgB,SAAS,GAAG;EAG1D,MAAM,EAAE,sBAAsB,sBAAsB,YAClD,MAAM,OAAO;EAGf,MAAM,UAAU,KAAK,WAAW,eAAe,IAAI;AACnD,UAAQ,IAAI,GAAG,IAAI,+CAA+C,CAAC;EACnE,MAAM,cAAc,MAAM,QAAQ,iBAAiB;GACjD;GACA,gBAAgB,QAAQ,KAAK,IAAI;GACjC,QAAQ,KAAK;GACb;GACD,CAAC;AACF,uBAAqB,YAAY;EAKjC,MAAM,SAAiC,EAAE,GAAI,KAAK,OAAO,EAAE,EAAG;AAC9D,OAAK,MAAM,KAAK,YACd,KAAI,EAAE,UAAU,OAAW,QAAO,EAAE,OAAO,EAAE;EAK/C,MAAM,eAAe,yBAAyB,gBAAgB;AAC9D,MAAI,aAAa,SAAS,GAAG;GAC3B,MAAM,gBAAgB,MAAM,qBAAqB,cAAc;IAC7D;IACA,gBAAgB,QAAQ,KAAK,IAAI;IACjC,QAAQ,KAAK;IACb;IACD,CAAC;AACF,UAAO,OAAO,QAAQ,cAAc;;EAEtC,MAAM,OAAO,gBAAgB,iBAAiB,OAAO;AACrD,MAAI,eAAe,KAAK,EAAE;GACxB,MAAM,SAAS,YAAY,KAAK,KAAK;AACrC,qBAAkB,OAAO;AACzB,OAAI,OAAO,qBAAsB,gBAAe,KAAK,QAAQ;;AAE/D,mBAAiB,gBAAgB;;;;;;;;;AAUrC,MAAa,yBAAiD;CAC5D,aAAa;CACb,kBAAkB;CAElB,QAAQ;CACT;;AAGD,SAAgB,mBACd,MACqB;CACrB,MAAM,yBAAS,IAAI,KAAqB;AACxC,MAAK,MAAM,OAAO,MAAM;EACtB,MAAM,QAAQ,uBAAuB,IAAI;AACzC,MAAI,MAAO,QAAO,IAAI,IAAI,MAAM,MAAM;;AAExC,QAAO;;AAGT,SAAS,iBAAiB,MAAsC;CAC9D,MAAM,SAAS,mBAAmB,KAAK;AACvC,KAAI,OAAO,SAAS,EAAG;CACvB,MAAM,OAAO,CAAC,GAAG,OAAO,SAAS,CAAC,CAC/B,KAAK,CAAC,MAAM,WAAW,GAAG,KAAK,KAAK,QAAQ,CAC5C,KAAK,KAAK;AACb,SAAQ,KACN,GAAG,OACD,sEAAsE,KAAK,yEAE5E,CACF;;;AAIH,SAAS,eACP,KACA,KACwB;CACxB,MAAM,KAAK,IAAI,QAAQ,IAAI;AAC3B,KAAI,OAAO,IAAI;AACb,UAAQ,MAAM,mBAAmB,IAAI,yBAAyB;AAC9D,SAAO;;CAET,MAAM,MAAM,IAAI,MAAM,GAAG,GAAG,CAAC,MAAM;CACnC,MAAM,QAAQ,IAAI,MAAM,KAAK,EAAE;AAC/B,KAAI,IAAK,KAAI,OAAO;AACpB,QAAO;;AAGT,MAAa,aAAa,IAAI,QAAQ,MAAM,CACzC,YAAY,+DAA+D,CAC3E,SAAS,aAAa,mDAAmD,CACzE,OAAO,eAAe,2BAA2B,CACjD,OAAO,mBAAmB,6BAA6B,CACvD,OAAO,iBAAiB,kDAAkD,CAC1E,OAAO,kBAAkB,8CAA8C,CACvE,OAAO,aAAa,qDAAqD,CACzE,OACC,qBACA,2CACA,gBACA,EAAE,CACH,CACA,OACC,wBACA,mHACD,CACA,OACC,sBACA,qEACD,CACA,YACC,SACA;;;;;;;;;;;;;;;;;;;;;qEAsBD,CACA,QAAQ,OAAiB,SACxB,OAAO,OAAO,KAAK,CAAC,OAAO,QAAQ;AACjC,SAAQ,MAAM,IAAI;AAClB,SAAQ,KAAK,EAAE;EACf,CACH"}

package/dist/react/ui/button.d.ts

@@ -5,7 +5,7 @@ import * as class_variance_authority_types0 from "class-variance-authority/types
 
 //#region src/react/ui/button.d.ts
 declare const buttonVariants: (props?: ({
-  variant?: "default" | "link" | "destructive" | "secondary" | "outline" | "ghost" | null | undefined;
+  variant?: "default" | "destructive" | "secondary" | "outline" | "ghost" | "link" | null | undefined;
   size?: "default" | "sm" | "lg" | "icon" | "icon-sm" | "icon-lg" | null | undefined;
 } & class_variance_authority_types0.ClassProp) | undefined) => string;
 /** Clickable button with multiple variants and sizes */