@databricks/appkit 0.31.0 → 0.32.0

package/dist/plugins/lakebase/lakebase.js

@@ -3,7 +3,11 @@ import { createLakebasePool, getLakebaseOrmConfig, getLakebasePgConfig, getUsern
 import { Plugin } from "../../plugin/plugin.js";
 import { toPlugin } from "../../plugin/to-plugin.js";
 import "../../plugin/index.js";
+import { buildToolkitEntries } from "../../core/agent/build-toolkit.js";
+import { defineTool, executeFromRegistry, toolsFromRegistry } from "../../core/agent/tools/define-tool.js";
+import { assertReadOnlySql } from "../../core/agent/tools/sql-policy.js";
 import manifest_default from "./manifest.js";
+import { z } from "zod";
 
 //#region src/plugins/lakebase/lakebase.ts
 const logger = createLogger("lakebase");
@@ -28,10 +32,6 @@ var LakebasePlugin = class extends Plugin {
 	/** Plugin manifest declaring metadata and resource requirements */
 	static manifest = manifest_default;
 	pool = null;
-	constructor(config) {
-		super(config);
-		this.config = config;
-	}
 	/**
 	* Initializes the Lakebase connection pool.
 	* Called automatically by AppKit during the plugin setup phase.
@@ -67,6 +67,33 @@ var LakebasePlugin = class extends Plugin {
 		return this.pool.query(text, values);
 	}
 	/**
+	* Execute a single statement inside a `BEGIN READ ONLY … ROLLBACK`
+	* transaction on a dedicated client.
+	*
+	* The three commands MUST share a connection — a naive
+	* `pool.query("BEGIN READ ONLY; <stmt>; ROLLBACK")` batch cannot accept
+	* parameter values (PostgreSQL's Extended Query protocol rejects multi-
+	* statement prepared queries), which would silently break every
+	* parameterized query the agent tool issues.
+	*
+	* Returns the raw `rows` array for the user's statement. Side effects the
+	* statement may attempt (writes, writable-function side effects) are
+	* rejected by PostgreSQL under the read-only transaction posture.
+	*/
+	async runReadOnlyStatement(text, values) {
+		const client = await this.pool.connect();
+		try {
+			await client.query("BEGIN READ ONLY");
+			return (await client.query(text, values)).rows;
+		} finally {
+			try {
+				await client.query("ROLLBACK");
+			} finally {
+				client.release();
+			}
+		}
+	}
+	/**
 	* Gracefully drains and closes the connection pool.
 	* Called automatically by AppKit during shutdown.
 	*/
@@ -88,6 +115,51 @@ var LakebasePlugin = class extends Plugin {
 	* - `getOrmConfig()` — Returns a config object compatible with Drizzle, TypeORM, Sequelize, etc.
 	* - `getPgConfig()` — Returns a `pg.PoolConfig` object for manual pool construction
 	*/
+	/**
+	* Agent tool registry. Empty by default — the Lakebase plugin does NOT
+	* expose its SQL connection to LLM agents unless the developer explicitly
+	* opts in via `config.exposeAsAgentTool`. See {@link buildQueryTool}.
+	*/
+	tools = {};
+	constructor(config) {
+		super(config);
+		this.config = config;
+		if (config.exposeAsAgentTool) {
+			this.tools = { query: this.buildQueryTool(config.exposeAsAgentTool) };
+			logger.warn("Lakebase agent tool is enabled (readOnly=%s). Every agent with access to this plugin can execute SQL against the Lakebase database as the service principal.", config.exposeAsAgentTool.readOnly !== false);
+		}
+	}
+	buildQueryTool(opt) {
+		const readOnly = opt.readOnly !== false;
+		return defineTool({
+			description: readOnly ? "Execute a read-only SQL query against the Lakebase PostgreSQL database. Only SELECT, WITH, SHOW, EXPLAIN, and DESCRIBE statements are accepted. Use $1, $2, etc. as placeholders and pass values separately. Runs as the application's service principal." : "Execute a parameterized SQL statement against the Lakebase PostgreSQL database. Use $1, $2, etc. as placeholders and pass values separately. Runs as the application's service principal. This tool can modify data; every invocation requires explicit human approval.",
+			schema: z.object({
+				text: z.string().describe("SQL statement with $1, $2, ... placeholders for parameters"),
+				values: z.array(z.unknown()).optional().describe("Parameter values corresponding to placeholders")
+			}),
+			annotations: {
+				readOnly,
+				destructive: !readOnly,
+				idempotent: false
+			},
+			handler: async (args) => {
+				if (readOnly) {
+					assertReadOnlySql(args.text);
+					return this.runReadOnlyStatement(args.text, args.values);
+				}
+				return (await this.query(args.text, args.values)).rows;
+			}
+		});
+	}
+	getAgentTools() {
+		return toolsFromRegistry(this.tools);
+	}
+	async executeAgentTool(name, args, signal) {
+		return executeFromRegistry(this.tools, name, args, signal);
+	}
+	toolkit(opts) {
+		return buildToolkitEntries(this.name, this.tools, opts);
+	}
 	exports() {
 		return {
 			pool: this.pool,
@@ -103,5 +175,5 @@ var LakebasePlugin = class extends Plugin {
 const lakebase = toPlugin(LakebasePlugin);
 
 //#endregion
-export { lakebase };
+export { LakebasePlugin, lakebase };
 //# sourceMappingURL=lakebase.js.map

package/dist/plugins/lakebase/lakebase.js.map

@@ -1 +1 @@
-{"version":3,"file":"lakebase.js","names":["manifest"],"sources":["../../../src/plugins/lakebase/lakebase.ts"],"sourcesContent":["import type { Pool, QueryResult, QueryResultRow } from \"pg\";\nimport {\n  createLakebasePool,\n  getLakebaseOrmConfig,\n  getLakebasePgConfig,\n  getUsernameWithApiLookup,\n} from \"../../connectors/lakebase\";\nimport { createLogger } from \"../../logging/logger\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport type { PluginManifest } from \"../../registry\";\nimport manifest from \"./manifest.json\";\nimport type { ILakebaseConfig } from \"./types\";\n\nconst logger = createLogger(\"lakebase\");\n\n/**\n * AppKit plugin for Databricks Lakebase Autoscaling.\n *\n * Wraps `@databricks/lakebase` to provide a standard `pg.Pool` with automatic\n * OAuth token refresh, integrated with AppKit's logger and OpenTelemetry setup.\n *\n * @example\n * ```ts\n * import { createApp, lakebase, server } from \"@databricks/appkit\";\n *\n * const AppKit = await createApp({\n *   plugins: [server(), lakebase()],\n * });\n *\n * const result = await AppKit.lakebase.query(\"SELECT * FROM users WHERE id = $1\", [userId]);\n * ```\n */\nclass LakebasePlugin extends Plugin {\n  /** Plugin manifest declaring metadata and resource requirements */\n  static manifest = manifest as PluginManifest<\"lakebase\">;\n\n  protected declare config: ILakebaseConfig;\n  private pool: Pool | null = null;\n\n  constructor(config: ILakebaseConfig) {\n    super(config);\n    this.config = config;\n  }\n\n  /**\n   * Initializes the Lakebase connection pool.\n   * Called automatically by AppKit during the plugin setup phase.\n   *\n   * Resolves the PostgreSQL username via {@link getUsernameWithApiLookup},\n   * which tries config, env vars, and finally the Databricks workspace API.\n   */\n  async setup() {\n    const poolConfig = this.config.pool;\n    const user = await getUsernameWithApiLookup(poolConfig);\n    this.pool = createLakebasePool({ ...poolConfig, user });\n    logger.info(\"Lakebase pool initialized\");\n  }\n\n  /**\n   * Executes a parameterized SQL query against the Lakebase pool.\n   *\n   * @param text - SQL query string, using `$1`, `$2`, ... placeholders\n   * @param values - Parameter values corresponding to placeholders\n   * @returns Query result with typed rows\n   *\n   * @example\n   * ```ts\n   * const result = await AppKit.lakebase.query<{ id: number; name: string }>(\n   *   \"SELECT id, name FROM users WHERE active = $1\",\n   *   [true],\n   * );\n   * ```\n   */\n  async query<T extends QueryResultRow = any>(\n    text: string,\n    values?: unknown[],\n  ): Promise<QueryResult<T>> {\n    // biome-ignore lint/style/noNonNullAssertion: pool is guaranteed non-null after setup(), which AppKit always awaits before exposing the plugin API\n    return this.pool!.query<T>(text, values);\n  }\n\n  /**\n   * Gracefully drains and closes the connection pool.\n   * Called automatically by AppKit during shutdown.\n   */\n  abortActiveOperations(): void {\n    super.abortActiveOperations();\n    if (this.pool) {\n      logger.info(\"Closing Lakebase pool\");\n      this.pool.end().catch((err) => {\n        logger.error(\"Error closing Lakebase pool: %O\", err);\n      });\n      this.pool = null;\n    }\n  }\n\n  /**\n   * Returns the plugin's public API, accessible via `AppKit.lakebase`.\n   *\n   * - `pool` — The raw `pg.Pool` instance, for use with ORMs or advanced scenarios\n   * - `query` — Convenience method for executing parameterized SQL queries\n   * - `getOrmConfig()` — Returns a config object compatible with Drizzle, TypeORM, Sequelize, etc.\n   * - `getPgConfig()` — Returns a `pg.PoolConfig` object for manual pool construction\n   */\n  exports() {\n    return {\n      // biome-ignore lint/style/noNonNullAssertion: pool is guaranteed non-null after setup(), which AppKit always awaits before exposing the plugin API\n      pool: this.pool!,\n      query: this.query.bind(this),\n      getOrmConfig: () => getLakebaseOrmConfig(this.config.pool),\n      getPgConfig: () => getLakebasePgConfig(this.config.pool),\n    };\n  }\n}\n\n/**\n * @internal\n */\nexport const lakebase = toPlugin(LakebasePlugin);\n"],"mappings":";;;;;;;;AAaA,MAAM,SAAS,aAAa,WAAW;;;;;;;;;;;;;;;;;;AAmBvC,IAAM,iBAAN,cAA6B,OAAO;;CAElC,OAAO,WAAWA;CAGlB,AAAQ,OAAoB;CAE5B,YAAY,QAAyB;AACnC,QAAM,OAAO;AACb,OAAK,SAAS;;;;;;;;;CAUhB,MAAM,QAAQ;EACZ,MAAM,aAAa,KAAK,OAAO;EAC/B,MAAM,OAAO,MAAM,yBAAyB,WAAW;AACvD,OAAK,OAAO,mBAAmB;GAAE,GAAG;GAAY;GAAM,CAAC;AACvD,SAAO,KAAK,4BAA4B;;;;;;;;;;;;;;;;;CAkB1C,MAAM,MACJ,MACA,QACyB;AAEzB,SAAO,KAAK,KAAM,MAAS,MAAM,OAAO;;;;;;CAO1C,wBAA8B;AAC5B,QAAM,uBAAuB;AAC7B,MAAI,KAAK,MAAM;AACb,UAAO,KAAK,wBAAwB;AACpC,QAAK,KAAK,KAAK,CAAC,OAAO,QAAQ;AAC7B,WAAO,MAAM,mCAAmC,IAAI;KACpD;AACF,QAAK,OAAO;;;;;;;;;;;CAYhB,UAAU;AACR,SAAO;GAEL,MAAM,KAAK;GACX,OAAO,KAAK,MAAM,KAAK,KAAK;GAC5B,oBAAoB,qBAAqB,KAAK,OAAO,KAAK;GAC1D,mBAAmB,oBAAoB,KAAK,OAAO,KAAK;GACzD;;;;;;AAOL,MAAa,WAAW,SAAS,eAAe"}
+{"version":3,"file":"lakebase.js","names":["manifest"],"sources":["../../../src/plugins/lakebase/lakebase.ts"],"sourcesContent":["import type { Pool, QueryResult, QueryResultRow } from \"pg\";\nimport type { AgentToolDefinition, ToolProvider } from \"shared\";\nimport { z } from \"zod\";\nimport {\n  createLakebasePool,\n  getLakebaseOrmConfig,\n  getLakebasePgConfig,\n  getUsernameWithApiLookup,\n} from \"../../connectors/lakebase\";\nimport { buildToolkitEntries } from \"../../core/agent/build-toolkit\";\nimport {\n  defineTool,\n  executeFromRegistry,\n  toolsFromRegistry,\n} from \"../../core/agent/tools/define-tool\";\nimport { assertReadOnlySql } from \"../../core/agent/tools/sql-policy\";\nimport { createLogger } from \"../../logging/logger\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport type { PluginManifest } from \"../../registry\";\nimport manifest from \"./manifest.json\";\nimport type { ILakebaseConfig } from \"./types\";\n\nconst logger = createLogger(\"lakebase\");\n\n/**\n * AppKit plugin for Databricks Lakebase Autoscaling.\n *\n * Wraps `@databricks/lakebase` to provide a standard `pg.Pool` with automatic\n * OAuth token refresh, integrated with AppKit's logger and OpenTelemetry setup.\n *\n * @example\n * ```ts\n * import { createApp, lakebase, server } from \"@databricks/appkit\";\n *\n * const AppKit = await createApp({\n *   plugins: [server(), lakebase()],\n * });\n *\n * const result = await AppKit.lakebase.query(\"SELECT * FROM users WHERE id = $1\", [userId]);\n * ```\n */\nexport class LakebasePlugin extends Plugin implements ToolProvider {\n  /** Plugin manifest declaring metadata and resource requirements */\n  static manifest = manifest as PluginManifest<\"lakebase\">;\n\n  protected declare config: ILakebaseConfig;\n  private pool: Pool | null = null;\n\n  /**\n   * Initializes the Lakebase connection pool.\n   * Called automatically by AppKit during the plugin setup phase.\n   *\n   * Resolves the PostgreSQL username via {@link getUsernameWithApiLookup},\n   * which tries config, env vars, and finally the Databricks workspace API.\n   */\n  async setup() {\n    const poolConfig = this.config.pool;\n    const user = await getUsernameWithApiLookup(poolConfig);\n    this.pool = createLakebasePool({ ...poolConfig, user });\n    logger.info(\"Lakebase pool initialized\");\n  }\n\n  /**\n   * Executes a parameterized SQL query against the Lakebase pool.\n   *\n   * @param text - SQL query string, using `$1`, `$2`, ... placeholders\n   * @param values - Parameter values corresponding to placeholders\n   * @returns Query result with typed rows\n   *\n   * @example\n   * ```ts\n   * const result = await AppKit.lakebase.query<{ id: number; name: string }>(\n   *   \"SELECT id, name FROM users WHERE active = $1\",\n   *   [true],\n   * );\n   * ```\n   */\n  async query<T extends QueryResultRow = any>(\n    text: string,\n    values?: unknown[],\n  ): Promise<QueryResult<T>> {\n    // biome-ignore lint/style/noNonNullAssertion: pool is guaranteed non-null after setup(), which AppKit always awaits before exposing the plugin API\n    return this.pool!.query<T>(text, values);\n  }\n\n  /**\n   * Execute a single statement inside a `BEGIN READ ONLY … ROLLBACK`\n   * transaction on a dedicated client.\n   *\n   * The three commands MUST share a connection — a naive\n   * `pool.query(\"BEGIN READ ONLY; <stmt>; ROLLBACK\")` batch cannot accept\n   * parameter values (PostgreSQL's Extended Query protocol rejects multi-\n   * statement prepared queries), which would silently break every\n   * parameterized query the agent tool issues.\n   *\n   * Returns the raw `rows` array for the user's statement. Side effects the\n   * statement may attempt (writes, writable-function side effects) are\n   * rejected by PostgreSQL under the read-only transaction posture.\n   */\n  private async runReadOnlyStatement(\n    text: string,\n    values?: unknown[],\n  ): Promise<unknown[]> {\n    // biome-ignore lint/style/noNonNullAssertion: pool is guaranteed non-null after setup()\n    const client = await this.pool!.connect();\n    try {\n      await client.query(\"BEGIN READ ONLY\");\n      const result = await client.query(text, values);\n      return result.rows;\n    } finally {\n      try {\n        await client.query(\"ROLLBACK\");\n      } finally {\n        client.release();\n      }\n    }\n  }\n\n  /**\n   * Gracefully drains and closes the connection pool.\n   * Called automatically by AppKit during shutdown.\n   */\n  abortActiveOperations(): void {\n    super.abortActiveOperations();\n    if (this.pool) {\n      logger.info(\"Closing Lakebase pool\");\n      this.pool.end().catch((err) => {\n        logger.error(\"Error closing Lakebase pool: %O\", err);\n      });\n      this.pool = null;\n    }\n  }\n\n  /**\n   * Returns the plugin's public API, accessible via `AppKit.lakebase`.\n   *\n   * - `pool` — The raw `pg.Pool` instance, for use with ORMs or advanced scenarios\n   * - `query` — Convenience method for executing parameterized SQL queries\n   * - `getOrmConfig()` — Returns a config object compatible with Drizzle, TypeORM, Sequelize, etc.\n   * - `getPgConfig()` — Returns a `pg.PoolConfig` object for manual pool construction\n   */\n\n  /**\n   * Agent tool registry. Empty by default — the Lakebase plugin does NOT\n   * expose its SQL connection to LLM agents unless the developer explicitly\n   * opts in via `config.exposeAsAgentTool`. See {@link buildQueryTool}.\n   */\n  private tools: Record<string, ReturnType<typeof this.buildQueryTool>> = {};\n\n  constructor(config: ILakebaseConfig) {\n    super(config);\n    this.config = config;\n    if (config.exposeAsAgentTool) {\n      this.tools = { query: this.buildQueryTool(config.exposeAsAgentTool) };\n      logger.warn(\n        \"Lakebase agent tool is enabled (readOnly=%s). Every agent with access to this plugin can execute SQL against the Lakebase database as the service principal.\",\n        config.exposeAsAgentTool.readOnly !== false,\n      );\n    }\n  }\n\n  private buildQueryTool(\n    opt: NonNullable<ILakebaseConfig[\"exposeAsAgentTool\"]>,\n  ) {\n    const readOnly = opt.readOnly !== false;\n    return defineTool({\n      description: readOnly\n        ? \"Execute a read-only SQL query against the Lakebase PostgreSQL database. Only SELECT, WITH, SHOW, EXPLAIN, and DESCRIBE statements are accepted. Use $1, $2, etc. as placeholders and pass values separately. Runs as the application's service principal.\"\n        : \"Execute a parameterized SQL statement against the Lakebase PostgreSQL database. Use $1, $2, etc. as placeholders and pass values separately. Runs as the application's service principal. This tool can modify data; every invocation requires explicit human approval.\",\n      schema: z.object({\n        text: z\n          .string()\n          .describe(\n            \"SQL statement with $1, $2, ... placeholders for parameters\",\n          ),\n        values: z\n          .array(z.unknown())\n          .optional()\n          .describe(\"Parameter values corresponding to placeholders\"),\n      }),\n      annotations: {\n        readOnly,\n        destructive: !readOnly,\n        idempotent: false,\n      },\n      handler: async (args) => {\n        if (readOnly) {\n          assertReadOnlySql(args.text);\n          return this.runReadOnlyStatement(args.text, args.values);\n        }\n        const result = await this.query(args.text, args.values);\n        return result.rows;\n      },\n    });\n  }\n\n  getAgentTools(): AgentToolDefinition[] {\n    return toolsFromRegistry(this.tools);\n  }\n\n  async executeAgentTool(\n    name: string,\n    args: unknown,\n    signal?: AbortSignal,\n  ): Promise<unknown> {\n    return executeFromRegistry(this.tools, name, args, signal);\n  }\n\n  toolkit(opts?: import(\"../../core/agent/types\").ToolkitOptions) {\n    return buildToolkitEntries(this.name, this.tools, opts);\n  }\n\n  exports() {\n    return {\n      // biome-ignore lint/style/noNonNullAssertion: pool is guaranteed non-null after setup(), which AppKit always awaits before exposing the plugin API\n      pool: this.pool!,\n      query: this.query.bind(this),\n      getOrmConfig: () => getLakebaseOrmConfig(this.config.pool),\n      getPgConfig: () => getLakebasePgConfig(this.config.pool),\n    };\n  }\n}\n\n/**\n * @internal\n */\nexport const lakebase = toPlugin(LakebasePlugin);\n"],"mappings":";;;;;;;;;;;;AAsBA,MAAM,SAAS,aAAa,WAAW;;;;;;;;;;;;;;;;;;AAmBvC,IAAa,iBAAb,cAAoC,OAA+B;;CAEjE,OAAO,WAAWA;CAGlB,AAAQ,OAAoB;;;;;;;;CAS5B,MAAM,QAAQ;EACZ,MAAM,aAAa,KAAK,OAAO;EAC/B,MAAM,OAAO,MAAM,yBAAyB,WAAW;AACvD,OAAK,OAAO,mBAAmB;GAAE,GAAG;GAAY;GAAM,CAAC;AACvD,SAAO,KAAK,4BAA4B;;;;;;;;;;;;;;;;;CAkB1C,MAAM,MACJ,MACA,QACyB;AAEzB,SAAO,KAAK,KAAM,MAAS,MAAM,OAAO;;;;;;;;;;;;;;;;CAiB1C,MAAc,qBACZ,MACA,QACoB;EAEpB,MAAM,SAAS,MAAM,KAAK,KAAM,SAAS;AACzC,MAAI;AACF,SAAM,OAAO,MAAM,kBAAkB;AAErC,WADe,MAAM,OAAO,MAAM,MAAM,OAAO,EACjC;YACN;AACR,OAAI;AACF,UAAM,OAAO,MAAM,WAAW;aACtB;AACR,WAAO,SAAS;;;;;;;;CAStB,wBAA8B;AAC5B,QAAM,uBAAuB;AAC7B,MAAI,KAAK,MAAM;AACb,UAAO,KAAK,wBAAwB;AACpC,QAAK,KAAK,KAAK,CAAC,OAAO,QAAQ;AAC7B,WAAO,MAAM,mCAAmC,IAAI;KACpD;AACF,QAAK,OAAO;;;;;;;;;;;;;;;;CAkBhB,AAAQ,QAAgE,EAAE;CAE1E,YAAY,QAAyB;AACnC,QAAM,OAAO;AACb,OAAK,SAAS;AACd,MAAI,OAAO,mBAAmB;AAC5B,QAAK,QAAQ,EAAE,OAAO,KAAK,eAAe,OAAO,kBAAkB,EAAE;AACrE,UAAO,KACL,gKACA,OAAO,kBAAkB,aAAa,MACvC;;;CAIL,AAAQ,eACN,KACA;EACA,MAAM,WAAW,IAAI,aAAa;AAClC,SAAO,WAAW;GAChB,aAAa,WACT,8PACA;GACJ,QAAQ,EAAE,OAAO;IACf,MAAM,EACH,QAAQ,CACR,SACC,6DACD;IACH,QAAQ,EACL,MAAM,EAAE,SAAS,CAAC,CAClB,UAAU,CACV,SAAS,iDAAiD;IAC9D,CAAC;GACF,aAAa;IACX;IACA,aAAa,CAAC;IACd,YAAY;IACb;GACD,SAAS,OAAO,SAAS;AACvB,QAAI,UAAU;AACZ,uBAAkB,KAAK,KAAK;AAC5B,YAAO,KAAK,qBAAqB,KAAK,MAAM,KAAK,OAAO;;AAG1D,YADe,MAAM,KAAK,MAAM,KAAK,MAAM,KAAK,OAAO,EACzC;;GAEjB,CAAC;;CAGJ,gBAAuC;AACrC,SAAO,kBAAkB,KAAK,MAAM;;CAGtC,MAAM,iBACJ,MACA,MACA,QACkB;AAClB,SAAO,oBAAoB,KAAK,OAAO,MAAM,MAAM,OAAO;;CAG5D,QAAQ,MAAwD;AAC9D,SAAO,oBAAoB,KAAK,MAAM,KAAK,OAAO,KAAK;;CAGzD,UAAU;AACR,SAAO;GAEL,MAAM,KAAK;GACX,OAAO,KAAK,MAAM,KAAK,KAAK;GAC5B,oBAAoB,qBAAqB,KAAK,OAAO,KAAK;GAC1D,mBAAmB,oBAAoB,KAAK,OAAO,KAAK;GACzD;;;;;;AAOL,MAAa,WAAW,SAAS,eAAe"}

package/dist/plugins/lakebase/types.d.ts

@@ -3,6 +3,36 @@ import "../../shared/src/index.js";
 import { LakebasePoolConfig } from "../../connectors/lakebase/index.js";
 
 //#region src/plugins/lakebase/types.d.ts
+/**
+ * Opt-in configuration for exposing Lakebase as an agent-callable SQL tool.
+ *
+ * This tool executes LLM-authored SQL against the Lakebase pool. The pool is
+ * **always bound to the application's service-principal credentials**, so any
+ * agent that can call this tool effectively has full SP access to the database
+ * regardless of which end user initiated the request — setting
+ * `exposeAsAgentTool` is itself the deliberate opt-in. The plugin emits a
+ * startup `warn` log whenever the tool is enabled.
+ *
+ * When `readOnly: true` (default when opted in), every statement is:
+ * 1. Classified by {@link @databricks/appkit's sql-policy classifier}; anything
+ *    that isn't a pure `SELECT`/`WITH`/`SHOW`/`EXPLAIN`/`DESCRIBE` is rejected.
+ * 2. Executed inside a `BEGIN READ ONLY … ROLLBACK` transaction so the
+ *    PostgreSQL server rejects writes that slip past the classifier (e.g., a
+ *    `SELECT` over a function with side effects).
+ *
+ * When `readOnly: false`, the tool is annotated `destructive: true` and the
+ * agents plugin will require human approval for every invocation (see
+ * `AgentsPluginConfig.approval`).
+ */
+interface LakebaseExposeAsAgentTool {
+  /**
+   * Enforce read-only execution. Defaults to `true`. Set to `false` to allow
+   * destructive statements — highly discouraged outside of tightly controlled
+   * single-user deployments. Combined with the `destructive: true` annotation,
+   * the agents plugin will require explicit human approval for each call.
+   */
+  readOnly?: boolean;
+}
 /**
  * Configuration for the Lakebase plugin.
  *
@@ -19,7 +49,14 @@ interface ILakebaseConfig extends BasePluginConfig {
    * Common overrides: `max` (pool size), `connectionTimeoutMillis`, `idleTimeoutMillis`.
    */
   pool?: Partial<LakebasePoolConfig>;
+  /**
+   * Opt-in to expose Lakebase as an agent-callable SQL tool. By default no
+   * agent tool is registered — the Lakebase plugin only exposes its API to
+   * application code. See {@link LakebaseExposeAsAgentTool} for the privilege
+   * implications of enabling this.
+   */
+  exposeAsAgentTool?: LakebaseExposeAsAgentTool;
 }
 //#endregion
-export { ILakebaseConfig };
+export { ILakebaseConfig, LakebaseExposeAsAgentTool };
 //# sourceMappingURL=types.d.ts.map

package/dist/plugins/lakebase/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/plugins/lakebase/types.ts"],"mappings":";;;;;;;;AAWA;;;;;UAAiB,eAAA,SAAwB,gBAAA;EAAgB;;;;;;EAOvD,IAAA,GAAO,OAAA,CAAQ,kBAAA;AAAA"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/plugins/lakebase/types.ts"],"mappings":";;;;;;;;AAwBA;;;;;AAkBA;;;;;;;;;;;;;UAlBiB,yBAAA;EAgCK;;;;;;EAzBpB,QAAA;AAAA;;;;;;;;;UAWe,eAAA,SAAwB,gBAAA;;;;;;;EAOvC,IAAA,GAAO,OAAA,CAAQ,kBAAA;;;;;;;EAOf,iBAAA,GAAoB,yBAAA;AAAA"}

package/dist/plugins/server/index.d.ts

@@ -1,6 +1,7 @@
 import { PluginPhase, TelemetryOptions, ToPlugin } from "../../shared/src/plugin.js";
 import "../../shared/src/index.js";
 import { Plugin } from "../../plugin/plugin.js";
+import { NamedPluginFactory } from "../../plugin/to-plugin.js";
 import "../../plugin/index.js";
 import { PluginManifest } from "../../registry/types.js";
 import "../../registry/index.js";
@@ -29,6 +30,7 @@ import express from "express";
  *   },
  * });
  * ```
+ *
  */
 declare class ServerPlugin extends Plugin {
   static DEFAULT_CONFIG: {
@@ -48,6 +50,8 @@ declare class ServerPlugin extends Plugin {
   private rawBodyPaths;
   static phase: PluginPhase;
   constructor(config: ServerConfig);
+  attachContext(deps?: Parameters<Plugin["attachContext"]>[0]): void;
+  /** Setup the server plugin. */
   setup(): Promise<void>;
   /** Get the server configuration. */
   getConfig(): {
@@ -86,6 +90,13 @@ declare class ServerPlugin extends Plugin {
    * @returns The server plugin instance for chaining.
    */
   extend(fn: (app: express.Application) => void): this;
+  /**
+   * Register a server extension from another plugin during setup.
+   * Unlike extend(), this is designed for internal plugin-to-plugin
+   * coordination where extensions are registered before the server starts
+   * listening — typically called by PluginContext when flushing buffered routes.
+   */
+  addExtension(fn: (app: express.Application) => void): void;
   /**
    * Setup the routes with the plugins.
    *
@@ -131,7 +142,7 @@ declare class ServerPlugin extends Plugin {
 /**
  * @internal
  */
-declare const server: ToPlugin<typeof ServerPlugin, ServerConfig, "server">;
+declare const server: ToPlugin<typeof ServerPlugin, ServerConfig, "server"> & NamedPluginFactory<"server">;
 //#endregion
 export { server };
 //# sourceMappingURL=index.d.ts.map

package/dist/plugins/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/plugins/server/index.ts"],"mappings":";;;;;;;;;;;;;;;;AAgDA;;;;;;;;;;;;;;;;cAAa,YAAA,SAAqB,MAAA;EAAA,OAClB,cAAA;;;;;SAMP,QAAA,EAAuB,cAAA;EAAA,QACtB,iBAAA;EAAA,QACA,MAAA;EAAA,QACA,aAAA;EAAA,QACA,sBAAA;EADA;EAAA,QAGA,kBAAA;EAAA,UACU,MAAA,EAAQ,YAAA;EAAA,QAClB,gBAAA;EAAA,QACA,YAAA;EAAA,OACD,KAAA,EAAO,WAAA;cAEF,MAAA,EAAQ,YAAA;EAmBd,KAAA,CAAA,GAAK,OAAA;EArBG;EAwBd,SAAA,CAAA;IAAA;;;;;gBAHW,gBAAA;EAAA;;;;;;;;;EAiBL,KAAA,CAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,WAAA;EA6D/B;;;;;;;;EAAA,SAAA,CAAA,GAAa,MAAA;EA2IE;;;;;;;;;EA1Hf,MAAA,CAAO,EAAA,GAAK,GAAA,EAAK,OAAA,CAAQ,WAAA;;;;;;;;UAYX,YAAA;;;;;;AAuQhB;UArMgB,aAAA;EAAA,eA4CC,cAAA;EAyJE;;;;;EAAA,QAvIH,iBAAA;EAAA,QAqBN,cAAA;EAAA,QA+BM,iBAAA;EAmFG;;;;EAlCjB,OAAA,CAAA;yEAIgB,GAAA,EAAK,OAAA,CAAQ,WAAA;qBAtQhB,MAAA;;;;;;;kBAAU,gBAAA;IAAA;;;;;;;cAoSZ,MAAA,EAAM,QAAA,QAAA,YAAA,EAAA,YAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/plugins/server/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;AAkDA;;;;;;;;;;;;;;;;cAAa,YAAA,SAAqB,MAAA;EAAA,OAClB,cAAA;;;;EADwB;EAAA,OAO/B,QAAA,EAAuB,cAAA;EAAA,QACtB,iBAAA;EAAA,QACA,MAAA;EAAA,QACA,aAAA;EAAA,QACA,sBAAA;EAJsB;EAAA,QAMtB,kBAAA;EAAA,UACU,MAAA,EAAQ,YAAA;EAAA,QAClB,gBAAA;EAAA,QACA,YAAA;EAAA,OACD,KAAA,EAAO,WAAA;cAEF,MAAA,EAAQ,YAAA;EAepB,aAAA,CAAc,IAAA,GAAM,UAAA,CAAW,MAAA;EAnBvB;EA6BF,KAAA,CAAA,GAAK,OAAA;EA3BJ;EA8BP,SAAA,CAAA;IAAA;;;;;gBAHW,gBAAA;EAAA;EAAL;;;;;;;;EAiBA,KAAA,CAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,WAAA;;;;;;;;;EA8D/B,SAAA,CAAA,GAAa,MAAA;EAiBY;;;;;;;;;EAAzB,MAAA,CAAO,EAAA,GAAK,GAAA,EAAK,OAAA,CAAQ,WAAA;EAqIV;;;;;;EA1Hf,YAAA,CAAa,EAAA,GAAK,GAAA,EAAK,OAAA,CAAQ,WAAA;EAwPF;;;;;;;EAAA,QA7Of,YAAA;;;;;;;UAmEA,aAAA;EAAA,eA4CC,cAAA;EAoLJ;;;;;EAAA,QAlKG,iBAAA;EAAA,QAqBN,cAAA;EAAA,QA+BM,iBAAA;EA8GG;;;;EA1DjB,OAAA,CAAA;IA0DiB,qEAtDD,GAAA,EAAK,OAAA,CAAQ,WAAA,YAsDZ;qBA1UJ,MAAA;;;;;;;kBAAU,gBAAA;IAAA;;;;;;;cA0UZ,MAAA,EAAM,QAAA,QAAA,YAAA,EAAA,YAAA,cAAA,kBAAA"}

package/dist/plugins/server/index.js

@@ -3,6 +3,8 @@ import { ServerError } from "../../errors/server.js";
 import { init_errors } from "../../errors/index.js";
 import { instrumentations } from "../../telemetry/instrumentations.js";
 import "../../telemetry/index.js";
+import { TelemetryReporter } from "../../internal-telemetry/reporter.js";
+import "../../internal-telemetry/index.js";
 import { Plugin } from "../../plugin/plugin.js";
 import { toPlugin } from "../../plugin/to-plugin.js";
 import "../../plugin/index.js";
@@ -44,6 +46,7 @@ const devListenPortSpan = 100;
 *   },
 * });
 * ```
+*
 */
 var ServerPlugin = class ServerPlugin extends Plugin {
 	static DEFAULT_CONFIG = {
@@ -62,14 +65,19 @@ var ServerPlugin = class ServerPlugin extends Plugin {
 	rawBodyPaths = /* @__PURE__ */ new Set();
 	static phase = "deferred";
 	constructor(config) {
-		if ("autoStart" in config) throw new ServerError("server({ autoStart }) has been removed. The server is now started automatically by createApp.\n\nRun `npx appkit codemod on-plugins-ready --write` to auto-migrate.");
 		super(config);
+		if ("autoStart" in config) throw new ServerError("server({ autoStart }) has been removed. The server is now started automatically by createApp.\n\nRun `npx appkit codemod on-plugins-ready --write` to auto-migrate.");
 		this.config = config;
 		this.serverApplication = express();
 		this.server = null;
 		this.serverExtensions = [];
+	}
+	attachContext(deps = {}) {
+		super.attachContext(deps);
 		this.telemetry.registerInstrumentations([instrumentations.http, instrumentations.express]);
+		this.context?.registerAsRouteTarget(this);
 	}
+	/** Setup the server plugin. */
 	async setup() {}
 	/** Get the server configuration. */
 	getConfig() {
@@ -85,6 +93,7 @@ var ServerPlugin = class ServerPlugin extends Plugin {
 	* @returns The express application.
 	*/
 	async start() {
+		this.serverApplication.use(requestMetricsMiddleware);
 		this.serverApplication.use(express.json({ type: (req) => {
 			const urlPath = req.url?.split("?")[0];
 			if (urlPath && this.rawBodyPaths.has(urlPath)) return false;
@@ -130,6 +139,15 @@ var ServerPlugin = class ServerPlugin extends Plugin {
 		return this;
 	}
 	/**
+	* Register a server extension from another plugin during setup.
+	* Unlike extend(), this is designed for internal plugin-to-plugin
+	* coordination where extensions are registered before the server starts
+	* listening — typically called by PluginContext when flushing buffered routes.
+	*/
+	addExtension(fn) {
+		this.serverExtensions.push(fn);
+	}
+	/**
 	* Setup the routes with the plugins.
 	*
 	* This method goes through all the plugins and injects the routes into the server application.
@@ -139,7 +157,8 @@ var ServerPlugin = class ServerPlugin extends Plugin {
 	async extendRoutes() {
 		const endpoints = {};
 		const pluginConfigs = {};
-		if (!this.config.plugins) return {
+		const plugins = this.context?.getPlugins();
+		if (!plugins || plugins.size === 0) return {
 			endpoints,
 			pluginConfigs
 		};
@@ -147,7 +166,7 @@ var ServerPlugin = class ServerPlugin extends Plugin {
 			res.status(200).json({ status: "ok" });
 		});
 		this.registerEndpoint("health", "/health");
-		for (const plugin of Object.values(this.config.plugins)) {
+		for (const plugin of plugins.values()) {
 			if (EXCLUDED_PLUGINS.includes(plugin.name)) continue;
 			if (plugin?.injectRoutes && typeof plugin.injectRoutes === "function") {
 				const router = express.Router();
@@ -245,8 +264,10 @@ var ServerPlugin = class ServerPlugin extends Plugin {
 		logger.info("Starting graceful shutdown...");
 		if (this.viteDevServer) await this.viteDevServer.close();
 		if (this.remoteTunnelController) this.remoteTunnelController.cleanup();
-		if (this.config.plugins) {
-			for (const plugin of Object.values(this.config.plugins)) if (plugin.abortActiveOperations) try {
+		TelemetryReporter.getInstance()?.stop();
+		const shutdownPlugins = this.context?.getPlugins();
+		if (shutdownPlugins) {
+			for (const plugin of shutdownPlugins.values()) if (plugin.abortActiveOperations) try {
 				plugin.abortActiveOperations();
 			} catch (err) {
 				logger.error("Error aborting operations for plugin %s: %O", plugin.name, err);
@@ -283,6 +304,19 @@ var ServerPlugin = class ServerPlugin extends Plugin {
 	}
 };
 const EXCLUDED_PLUGINS = [ServerPlugin.manifest.name];
+/** @internal Exported for unit tests. */
+function requestMetricsMiddleware(req, res, next) {
+	const startMs = Date.now();
+	res.on("finish", () => {
+		const reporter = TelemetryReporter.getInstance();
+		if (!reporter) return;
+		const routePath = req.route?.path;
+		if (!routePath) return;
+		const template = `${req.baseUrl ?? ""}${routePath}`;
+		reporter.recordRequest(req.method, template, res.statusCode, Date.now() - startMs);
+	});
+	next();
+}
 /**
 * @internal
 */

package/dist/plugins/server/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":["manifest"],"sources":["../../../src/plugins/server/index.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport type { Server as HTTPServer } from \"node:http\";\nimport path from \"node:path\";\nimport dotenv from \"dotenv\";\nimport express from \"express\";\nimport getPort, { portNumbers } from \"get-port\";\nimport type { PluginClientConfigs, PluginPhase } from \"shared\";\nimport { ServerError } from \"../../errors\";\nimport { createLogger } from \"../../logging/logger\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport type { PluginManifest } from \"../../registry\";\nimport { instrumentations } from \"../../telemetry\";\nimport { sanitizeClientConfig } from \"./client-config-sanitizer\";\nimport manifest from \"./manifest.json\";\nimport { RemoteTunnelController } from \"./remote-tunnel/remote-tunnel-controller\";\nimport { StaticServer } from \"./static-server\";\nimport type { ServerConfig } from \"./types\";\nimport { getRoutes, type PluginEndpoints, printRoutes } from \"./utils\";\nimport { ViteDevServer } from \"./vite-dev-server\";\n\ndotenv.config({ path: path.resolve(process.cwd(), \"./.env\") });\n\nconst logger = createLogger(\"server\");\n\n/** Dev-only: try `requested` then consecutive ports (see `get-port` `portNumbers`). */\nconst devListenPortSpan = 100;\n\n/**\n * Server plugin for the AppKit.\n *\n * This plugin is responsible for starting the server and serving the static files.\n * It also handles the remote tunneling for development purposes.\n *\n * The server is started automatically by `createApp` after all plugins are set up\n * and the optional `onPluginsReady` callback has run.\n *\n * @example\n * ```ts\n * createApp({\n *   plugins: [server(), analytics({})],\n *   onPluginsReady(appkit) {\n *     appkit.server.extend((app) => {\n *       app.get(\"/custom\", (_req, res) => res.json({ ok: true }));\n *     });\n *   },\n * });\n * ```\n */\nexport class ServerPlugin extends Plugin {\n  public static DEFAULT_CONFIG = {\n    host: process.env.FLASK_RUN_HOST || \"0.0.0.0\",\n    port: Number(process.env.DATABRICKS_APP_PORT) || 8000,\n  };\n\n  /** Plugin manifest declaring metadata and resource requirements */\n  static manifest = manifest as PluginManifest<\"server\">;\n  private serverApplication: express.Application;\n  private server: HTTPServer | null;\n  private viteDevServer?: ViteDevServer;\n  private remoteTunnelController?: RemoteTunnelController;\n  /** Bound listen port after optional dev-time resolution. */\n  private resolvedListenPort?: number;\n  protected declare config: ServerConfig;\n  private serverExtensions: ((app: express.Application) => void)[] = [];\n  private rawBodyPaths: Set<string> = new Set();\n  static phase: PluginPhase = \"deferred\";\n\n  constructor(config: ServerConfig) {\n    if (\"autoStart\" in config) {\n      throw new ServerError(\n        \"server({ autoStart }) has been removed. \" +\n          \"The server is now started automatically by createApp.\\n\\n\" +\n          \"Run `npx appkit codemod on-plugins-ready --write` to auto-migrate.\",\n      );\n    }\n    super(config);\n    this.config = config;\n    this.serverApplication = express();\n    this.server = null;\n    this.serverExtensions = [];\n    this.telemetry.registerInstrumentations([\n      instrumentations.http,\n      instrumentations.express,\n    ]);\n  }\n\n  async setup() {}\n\n  /** Get the server configuration. */\n  getConfig() {\n    const { plugins: _plugins, ...config } = this.config;\n\n    return config;\n  }\n\n  /**\n   * Start the server.\n   *\n   * This method starts the server and sets up the frontend.\n   * It also sets up the remote tunneling if enabled.\n   *\n   * @returns The express application.\n   */\n  async start(): Promise<express.Application> {\n    this.serverApplication.use(\n      express.json({\n        type: (req) => {\n          // Skip JSON parsing for routes that declared skipBodyParsing\n          // (e.g. file uploads where the raw body must flow through).\n          // rawBodyPaths is populated by extendRoutes() below; the type\n          // callback runs per-request so the set is already filled.\n          const urlPath = req.url?.split(\"?\")[0];\n          if (urlPath && this.rawBodyPaths.has(urlPath)) return false;\n          const ct = req.headers[\"content-type\"] ?? \"\";\n          return ct.includes(\"json\");\n        },\n      }),\n    );\n\n    const { endpoints, pluginConfigs } = await this.extendRoutes();\n\n    for (const extension of this.serverExtensions) {\n      extension(this.serverApplication);\n    }\n\n    // register remote tunnel controller (before static/vite)\n    this.remoteTunnelController = new RemoteTunnelController(\n      this.devFileReader,\n    );\n    this.serverApplication.use(this.remoteTunnelController.middleware);\n\n    await this.setupFrontend(endpoints, pluginConfigs);\n\n    const listenPort = await this.resolveListenPort();\n\n    const server = this.serverApplication.listen(\n      listenPort,\n      this.config.host ?? ServerPlugin.DEFAULT_CONFIG.host,\n      () => this.logStartupInfo(),\n    );\n\n    this.server = server;\n\n    // attach server to remote tunnel controller\n    this.remoteTunnelController.setServer(server);\n\n    process.on(\"SIGTERM\", () => this._gracefulShutdown());\n    process.on(\"SIGINT\", () => this._gracefulShutdown());\n\n    if (process.env.NODE_ENV === \"development\") {\n      const allRoutes = getRoutes(this.serverApplication._router.stack);\n      printRoutes(allRoutes);\n    }\n    return this.serverApplication;\n  }\n\n  /**\n   * Get the low level node.js http server instance.\n   *\n   * Only use this method if you need to access the server instance for advanced usage like a custom websocket server, etc.\n   *\n   * @throws {Error} If the server has not started yet.\n   * @returns {HTTPServer} The server instance.\n   */\n  getServer(): HTTPServer {\n    if (!this.server) {\n      throw ServerError.notStarted();\n    }\n\n    return this.server;\n  }\n\n  /**\n   * Extend the server with custom routes or middleware.\n   *\n   * Call this inside the `onPluginsReady` callback of `createApp` to register\n   * custom Express routes or middleware before the server starts listening.\n   *\n   * @param fn - A function that receives the express application.\n   * @returns The server plugin instance for chaining.\n   */\n  extend(fn: (app: express.Application) => void) {\n    this.serverExtensions.push(fn);\n    return this;\n  }\n\n  /**\n   * Setup the routes with the plugins.\n   *\n   * This method goes through all the plugins and injects the routes into the server application.\n   * Returns a map of plugin names to their registered named endpoints,\n   * and a map of plugin names to their client-exposed configs.\n   */\n  private async extendRoutes(): Promise<{\n    endpoints: PluginEndpoints;\n    pluginConfigs: PluginClientConfigs;\n  }> {\n    const endpoints: PluginEndpoints = {};\n    const pluginConfigs: PluginClientConfigs = {};\n\n    if (!this.config.plugins) return { endpoints, pluginConfigs };\n\n    this.serverApplication.get(\"/health\", (_, res) => {\n      res.status(200).json({ status: \"ok\" });\n    });\n    this.registerEndpoint(\"health\", \"/health\");\n\n    for (const plugin of Object.values(this.config.plugins)) {\n      if (EXCLUDED_PLUGINS.includes(plugin.name)) continue;\n\n      if (plugin?.injectRoutes && typeof plugin.injectRoutes === \"function\") {\n        const router = express.Router();\n\n        plugin.injectRoutes(router);\n\n        const basePath = `/api/${plugin.name}`;\n        this.serverApplication.use(basePath, router);\n\n        endpoints[plugin.name] = plugin.getEndpoints();\n\n        // Collect paths that should skip body parsing\n        if (\n          plugin.getSkipBodyParsingPaths &&\n          typeof plugin.getSkipBodyParsingPaths === \"function\"\n        ) {\n          for (const p of plugin.getSkipBodyParsingPaths()) {\n            this.rawBodyPaths.add(p);\n          }\n        }\n      }\n\n      if (typeof plugin.clientConfig === \"function\") {\n        try {\n          const raw = plugin.clientConfig();\n          if (raw != null) {\n            const sanitized = sanitizeClientConfig(plugin.name, raw);\n            if (Object.keys(sanitized).length > 0) {\n              pluginConfigs[plugin.name] = sanitized;\n            }\n          }\n        } catch (error) {\n          logger.error(\n            \"Plugin '%s' clientConfig() failed, skipping its config: %O\",\n            plugin.name,\n            error,\n          );\n        }\n      }\n    }\n\n    return { endpoints, pluginConfigs };\n  }\n\n  /**\n   * Setup frontend serving based on environment:\n   * - If staticPath is explicitly provided: use static server\n   * - Dev mode (no staticPath): Vite for HMR\n   * - Production (no staticPath): Static files auto-detected\n   */\n  private async setupFrontend(\n    endpoints: PluginEndpoints,\n    pluginConfigs: PluginClientConfigs,\n  ) {\n    const isDev = process.env.NODE_ENV === \"development\";\n    const hasExplicitStaticPath = this.config.staticPath !== undefined;\n\n    // explict static path provided\n    if (hasExplicitStaticPath) {\n      const staticServer = new StaticServer(\n        this.serverApplication,\n        this.config.staticPath as string,\n        endpoints,\n        pluginConfigs,\n      );\n      staticServer.setup();\n      return;\n    }\n\n    // auto-detection based on environment\n    if (isDev) {\n      this.viteDevServer = new ViteDevServer(\n        this.serverApplication,\n        endpoints,\n        pluginConfigs,\n      );\n      await this.viteDevServer.setup();\n      return;\n    }\n\n    // auto-detection based on static path\n    const staticPath = ServerPlugin.findStaticPath();\n    if (staticPath) {\n      const staticServer = new StaticServer(\n        this.serverApplication,\n        staticPath,\n        endpoints,\n        pluginConfigs,\n      );\n\n      staticServer.setup();\n    }\n  }\n\n  private static findStaticPath() {\n    const staticPaths = [\"dist\", \"client/dist\", \"build\", \"public\", \"out\"];\n    const cwd = process.cwd();\n    for (const p of staticPaths) {\n      const fullPath = path.resolve(cwd, p);\n      if (fs.existsSync(path.resolve(fullPath, \"index.html\"))) {\n        logger.debug(\"Static files: serving from %s\", fullPath);\n        return fullPath;\n      }\n    }\n    return undefined;\n  }\n\n  /**\n   * In development, prefers {@link ServerConfig.port} / env / default (8000), then\n   * scans upward using `get-port`'s `portNumbers()` on the listen host until one binds.\n   * In non-development, uses config / env / default only (no fallback).\n   */\n  private async resolveListenPort(): Promise<number> {\n    const requested = this.config.port ?? ServerPlugin.DEFAULT_CONFIG.port;\n\n    if (process.env.NODE_ENV !== \"development\") {\n      this.resolvedListenPort = requested;\n      return requested;\n    }\n\n    const host = this.config.host ?? ServerPlugin.DEFAULT_CONFIG.host;\n    const upper = Math.min(requested + devListenPortSpan - 1, 65_535);\n    const port = await getPort({\n      host,\n      port: portNumbers(requested, upper),\n    });\n    this.resolvedListenPort = port;\n    if (port !== requested) {\n      logger.info(\"Port %d was busy, picking %d\", requested, port);\n    }\n    return port;\n  }\n\n  private logStartupInfo() {\n    const isDev = process.env.NODE_ENV === \"development\";\n    const hasExplicitStaticPath = this.config.staticPath !== undefined;\n    const port =\n      this.resolvedListenPort ??\n      this.config.port ??\n      ServerPlugin.DEFAULT_CONFIG.port;\n    const host = this.config.host ?? ServerPlugin.DEFAULT_CONFIG.host;\n\n    logger.info(\"Server running on http://%s:%d\", host, port);\n\n    if (hasExplicitStaticPath) {\n      logger.info(\"Mode: static (%s)\", this.config.staticPath);\n    } else if (isDev) {\n      logger.info(\"Mode: development (Vite HMR)\");\n    } else {\n      logger.info(\"Mode: production (static)\");\n    }\n\n    const remoteServerController = this.remoteTunnelController;\n    if (!remoteServerController) {\n      logger.debug(\"Remote tunnel: disabled (controller not initialized)\");\n    } else {\n      logger.debug(\n        \"Remote tunnel: %s; %s\",\n        remoteServerController.isAllowedByEnv() ? \"allowed\" : \"blocked\",\n        remoteServerController.isActive() ? \"active\" : \"inactive\",\n      );\n    }\n  }\n\n  private async _gracefulShutdown() {\n    logger.info(\"Starting graceful shutdown...\");\n\n    if (this.viteDevServer) {\n      await this.viteDevServer.close();\n    }\n\n    if (this.remoteTunnelController) {\n      this.remoteTunnelController.cleanup();\n    }\n\n    // 1. abort active operations from plugins\n    if (this.config.plugins) {\n      for (const plugin of Object.values(this.config.plugins)) {\n        if (plugin.abortActiveOperations) {\n          try {\n            plugin.abortActiveOperations();\n          } catch (err) {\n            logger.error(\n              \"Error aborting operations for plugin %s: %O\",\n              plugin.name,\n              err,\n            );\n          }\n        }\n      }\n    }\n\n    // 2. close the server\n    if (this.server) {\n      this.server.close(() => {\n        logger.debug(\"Server closed gracefully\");\n        process.exit(0);\n      });\n\n      // 3. timeout to force shutdown after 15 seconds\n      setTimeout(() => {\n        logger.debug(\"Force shutdown after timeout\");\n        process.exit(1);\n      }, 15000);\n    } else {\n      process.exit(0);\n    }\n  }\n\n  /**\n   * Returns the public exports for the server plugin.\n   * Exposes server management methods.\n   */\n  exports() {\n    const self = this;\n    return {\n      /** Extend the server with custom routes or middleware */\n      extend(fn: (app: express.Application) => void) {\n        self.extend(fn);\n        return this;\n      },\n      /** Get the underlying HTTP server instance */\n      getServer: this.getServer,\n      /** Get the server configuration */\n      getConfig: this.getConfig,\n      /** @deprecated Server is now started automatically by createApp. */\n      start() {\n        throw new ServerError(\n          \"server.start() has been removed. Use the onPluginsReady callback instead:\\n\\n\" +\n            \"  createApp({\\n\" +\n            \"    plugins: [server(), ...],\\n\" +\n            \"    onPluginsReady(appkit) {\\n\" +\n            \"      appkit.server.extend(...);\\n\" +\n            \"    },\\n\" +\n            \"  });\\n\\n\" +\n            \"Run `npx appkit codemod on-plugins-ready --write` to auto-migrate.\",\n        );\n      },\n    };\n  }\n}\n\nconst EXCLUDED_PLUGINS: string[] = [ServerPlugin.manifest.name];\n\n/**\n * @internal\n */\nexport const server = toPlugin(ServerPlugin);\n// Export manifest and types\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;aAO2C;AAa3C,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,QAAQ,KAAK,EAAE,SAAS,EAAE,CAAC;AAE9D,MAAM,SAAS,aAAa,SAAS;;AAGrC,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;AAuB1B,IAAa,eAAb,MAAa,qBAAqB,OAAO;CACvC,OAAc,iBAAiB;EAC7B,MAAM,QAAQ,IAAI,kBAAkB;EACpC,MAAM,OAAO,QAAQ,IAAI,oBAAoB,IAAI;EAClD;;CAGD,OAAO,WAAWA;CAClB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;;CAER,AAAQ;CAER,AAAQ,mBAA2D,EAAE;CACrE,AAAQ,+BAA4B,IAAI,KAAK;CAC7C,OAAO,QAAqB;CAE5B,YAAY,QAAsB;AAChC,MAAI,eAAe,OACjB,OAAM,IAAI,YACR,sKAGD;AAEH,QAAM,OAAO;AACb,OAAK,SAAS;AACd,OAAK,oBAAoB,SAAS;AAClC,OAAK,SAAS;AACd,OAAK,mBAAmB,EAAE;AAC1B,OAAK,UAAU,yBAAyB,CACtC,iBAAiB,MACjB,iBAAiB,QAClB,CAAC;;CAGJ,MAAM,QAAQ;;CAGd,YAAY;EACV,MAAM,EAAE,SAAS,UAAU,GAAG,WAAW,KAAK;AAE9C,SAAO;;;;;;;;;;CAWT,MAAM,QAAsC;AAC1C,OAAK,kBAAkB,IACrB,QAAQ,KAAK,EACX,OAAO,QAAQ;GAKb,MAAM,UAAU,IAAI,KAAK,MAAM,IAAI,CAAC;AACpC,OAAI,WAAW,KAAK,aAAa,IAAI,QAAQ,CAAE,QAAO;AAEtD,WADW,IAAI,QAAQ,mBAAmB,IAChC,SAAS,OAAO;KAE7B,CAAC,CACH;EAED,MAAM,EAAE,WAAW,kBAAkB,MAAM,KAAK,cAAc;AAE9D,OAAK,MAAM,aAAa,KAAK,iBAC3B,WAAU,KAAK,kBAAkB;AAInC,OAAK,yBAAyB,IAAI,uBAChC,KAAK,cACN;AACD,OAAK,kBAAkB,IAAI,KAAK,uBAAuB,WAAW;AAElE,QAAM,KAAK,cAAc,WAAW,cAAc;EAElD,MAAM,aAAa,MAAM,KAAK,mBAAmB;EAEjD,MAAM,SAAS,KAAK,kBAAkB,OACpC,YACA,KAAK,OAAO,QAAQ,aAAa,eAAe,YAC1C,KAAK,gBAAgB,CAC5B;AAED,OAAK,SAAS;AAGd,OAAK,uBAAuB,UAAU,OAAO;AAE7C,UAAQ,GAAG,iBAAiB,KAAK,mBAAmB,CAAC;AACrD,UAAQ,GAAG,gBAAgB,KAAK,mBAAmB,CAAC;AAEpD,MAAI,QAAQ,IAAI,aAAa,cAE3B,aADkB,UAAU,KAAK,kBAAkB,QAAQ,MAAM,CAC3C;AAExB,SAAO,KAAK;;;;;;;;;;CAWd,YAAwB;AACtB,MAAI,CAAC,KAAK,OACR,OAAM,YAAY,YAAY;AAGhC,SAAO,KAAK;;;;;;;;;;;CAYd,OAAO,IAAwC;AAC7C,OAAK,iBAAiB,KAAK,GAAG;AAC9B,SAAO;;;;;;;;;CAUT,MAAc,eAGX;EACD,MAAM,YAA6B,EAAE;EACrC,MAAM,gBAAqC,EAAE;AAE7C,MAAI,CAAC,KAAK,OAAO,QAAS,QAAO;GAAE;GAAW;GAAe;AAE7D,OAAK,kBAAkB,IAAI,YAAY,GAAG,QAAQ;AAChD,OAAI,OAAO,IAAI,CAAC,KAAK,EAAE,QAAQ,MAAM,CAAC;IACtC;AACF,OAAK,iBAAiB,UAAU,UAAU;AAE1C,OAAK,MAAM,UAAU,OAAO,OAAO,KAAK,OAAO,QAAQ,EAAE;AACvD,OAAI,iBAAiB,SAAS,OAAO,KAAK,CAAE;AAE5C,OAAI,QAAQ,gBAAgB,OAAO,OAAO,iBAAiB,YAAY;IACrE,MAAM,SAAS,QAAQ,QAAQ;AAE/B,WAAO,aAAa,OAAO;IAE3B,MAAM,WAAW,QAAQ,OAAO;AAChC,SAAK,kBAAkB,IAAI,UAAU,OAAO;AAE5C,cAAU,OAAO,QAAQ,OAAO,cAAc;AAG9C,QACE,OAAO,2BACP,OAAO,OAAO,4BAA4B,WAE1C,MAAK,MAAM,KAAK,OAAO,yBAAyB,CAC9C,MAAK,aAAa,IAAI,EAAE;;AAK9B,OAAI,OAAO,OAAO,iBAAiB,WACjC,KAAI;IACF,MAAM,MAAM,OAAO,cAAc;AACjC,QAAI,OAAO,MAAM;KACf,MAAM,YAAY,qBAAqB,OAAO,MAAM,IAAI;AACxD,SAAI,OAAO,KAAK,UAAU,CAAC,SAAS,EAClC,eAAc,OAAO,QAAQ;;YAG1B,OAAO;AACd,WAAO,MACL,8DACA,OAAO,MACP,MACD;;;AAKP,SAAO;GAAE;GAAW;GAAe;;;;;;;;CASrC,MAAc,cACZ,WACA,eACA;EACA,MAAM,QAAQ,QAAQ,IAAI,aAAa;AAIvC,MAH8B,KAAK,OAAO,eAAe,QAG9B;AAOzB,GANqB,IAAI,aACvB,KAAK,mBACL,KAAK,OAAO,YACZ,WACA,cACD,CACY,OAAO;AACpB;;AAIF,MAAI,OAAO;AACT,QAAK,gBAAgB,IAAI,cACvB,KAAK,mBACL,WACA,cACD;AACD,SAAM,KAAK,cAAc,OAAO;AAChC;;EAIF,MAAM,aAAa,aAAa,gBAAgB;AAChD,MAAI,WAQF,CAPqB,IAAI,aACvB,KAAK,mBACL,YACA,WACA,cACD,CAEY,OAAO;;CAIxB,OAAe,iBAAiB;EAC9B,MAAM,cAAc;GAAC;GAAQ;GAAe;GAAS;GAAU;GAAM;EACrE,MAAM,MAAM,QAAQ,KAAK;AACzB,OAAK,MAAM,KAAK,aAAa;GAC3B,MAAM,WAAW,KAAK,QAAQ,KAAK,EAAE;AACrC,OAAI,GAAG,WAAW,KAAK,QAAQ,UAAU,aAAa,CAAC,EAAE;AACvD,WAAO,MAAM,iCAAiC,SAAS;AACvD,WAAO;;;;;;;;;CAWb,MAAc,oBAAqC;EACjD,MAAM,YAAY,KAAK,OAAO,QAAQ,aAAa,eAAe;AAElE,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,QAAK,qBAAqB;AAC1B,UAAO;;EAKT,MAAM,OAAO,MAAM,QAAQ;GACzB,MAHW,KAAK,OAAO,QAAQ,aAAa,eAAe;GAI3D,MAAM,YAAY,WAHN,KAAK,IAAI,YAAY,oBAAoB,GAAG,MAAO,CAG5B;GACpC,CAAC;AACF,OAAK,qBAAqB;AAC1B,MAAI,SAAS,UACX,QAAO,KAAK,gCAAgC,WAAW,KAAK;AAE9D,SAAO;;CAGT,AAAQ,iBAAiB;EACvB,MAAM,QAAQ,QAAQ,IAAI,aAAa;EACvC,MAAM,wBAAwB,KAAK,OAAO,eAAe;EACzD,MAAM,OACJ,KAAK,sBACL,KAAK,OAAO,QACZ,aAAa,eAAe;EAC9B,MAAM,OAAO,KAAK,OAAO,QAAQ,aAAa,eAAe;AAE7D,SAAO,KAAK,kCAAkC,MAAM,KAAK;AAEzD,MAAI,sBACF,QAAO,KAAK,qBAAqB,KAAK,OAAO,WAAW;WAC/C,MACT,QAAO,KAAK,+BAA+B;MAE3C,QAAO,KAAK,4BAA4B;EAG1C,MAAM,yBAAyB,KAAK;AACpC,MAAI,CAAC,uBACH,QAAO,MAAM,uDAAuD;MAEpE,QAAO,MACL,yBACA,uBAAuB,gBAAgB,GAAG,YAAY,WACtD,uBAAuB,UAAU,GAAG,WAAW,WAChD;;CAIL,MAAc,oBAAoB;AAChC,SAAO,KAAK,gCAAgC;AAE5C,MAAI,KAAK,cACP,OAAM,KAAK,cAAc,OAAO;AAGlC,MAAI,KAAK,uBACP,MAAK,uBAAuB,SAAS;AAIvC,MAAI,KAAK,OAAO,SACd;QAAK,MAAM,UAAU,OAAO,OAAO,KAAK,OAAO,QAAQ,CACrD,KAAI,OAAO,sBACT,KAAI;AACF,WAAO,uBAAuB;YACvB,KAAK;AACZ,WAAO,MACL,+CACA,OAAO,MACP,IACD;;;AAOT,MAAI,KAAK,QAAQ;AACf,QAAK,OAAO,YAAY;AACtB,WAAO,MAAM,2BAA2B;AACxC,YAAQ,KAAK,EAAE;KACf;AAGF,oBAAiB;AACf,WAAO,MAAM,+BAA+B;AAC5C,YAAQ,KAAK,EAAE;MACd,KAAM;QAET,SAAQ,KAAK,EAAE;;;;;;CAQnB,UAAU;EACR,MAAM,OAAO;AACb,SAAO;GAEL,OAAO,IAAwC;AAC7C,SAAK,OAAO,GAAG;AACf,WAAO;;GAGT,WAAW,KAAK;GAEhB,WAAW,KAAK;GAEhB,QAAQ;AACN,UAAM,IAAI,YACR,iRAQD;;GAEJ;;;AAIL,MAAM,mBAA6B,CAAC,aAAa,SAAS,KAAK;;;;AAK/D,MAAa,SAAS,SAAS,aAAa"}
+{"version":3,"file":"index.js","names":["manifest"],"sources":["../../../src/plugins/server/index.ts"],"sourcesContent":["import fs from \"node:fs\";\nimport type { Server as HTTPServer } from \"node:http\";\nimport path from \"node:path\";\nimport dotenv from \"dotenv\";\nimport express from \"express\";\nimport getPort, { portNumbers } from \"get-port\";\nimport type { PluginClientConfigs, PluginPhase } from \"shared\";\nimport { ServerError } from \"../../errors\";\nimport { TelemetryReporter } from \"../../internal-telemetry\";\nimport { createLogger } from \"../../logging/logger\";\nimport { Plugin, toPlugin } from \"../../plugin\";\nimport type { PluginManifest } from \"../../registry\";\nimport { instrumentations } from \"../../telemetry\";\nimport { sanitizeClientConfig } from \"./client-config-sanitizer\";\nimport manifest from \"./manifest.json\";\nimport { RemoteTunnelController } from \"./remote-tunnel/remote-tunnel-controller\";\nimport { StaticServer } from \"./static-server\";\nimport type { ServerConfig } from \"./types\";\nimport { getRoutes, type PluginEndpoints, printRoutes } from \"./utils\";\nimport { ViteDevServer } from \"./vite-dev-server\";\n\ndotenv.config({ path: path.resolve(process.cwd(), \"./.env\") });\n\nconst logger = createLogger(\"server\");\n\n/** Dev-only: try `requested` then consecutive ports (see `get-port` `portNumbers`). */\nconst devListenPortSpan = 100;\n\n/**\n * Server plugin for the AppKit.\n *\n * This plugin is responsible for starting the server and serving the static files.\n * It also handles the remote tunneling for development purposes.\n *\n * The server is started automatically by `createApp` after all plugins are set up\n * and the optional `onPluginsReady` callback has run.\n *\n * @example\n * ```ts\n * createApp({\n *   plugins: [server(), analytics({})],\n *   onPluginsReady(appkit) {\n *     appkit.server.extend((app) => {\n *       app.get(\"/custom\", (_req, res) => res.json({ ok: true }));\n *     });\n *   },\n * });\n * ```\n *\n */\nexport class ServerPlugin extends Plugin {\n  public static DEFAULT_CONFIG = {\n    host: process.env.FLASK_RUN_HOST || \"0.0.0.0\",\n    port: Number(process.env.DATABRICKS_APP_PORT) || 8000,\n  };\n\n  /** Plugin manifest declaring metadata and resource requirements */\n  static manifest = manifest as PluginManifest<\"server\">;\n  private serverApplication: express.Application;\n  private server: HTTPServer | null;\n  private viteDevServer?: ViteDevServer;\n  private remoteTunnelController?: RemoteTunnelController;\n  /** Bound listen port after optional dev-time resolution. */\n  private resolvedListenPort?: number;\n  protected declare config: ServerConfig;\n  private serverExtensions: ((app: express.Application) => void)[] = [];\n  private rawBodyPaths: Set<string> = new Set();\n  static phase: PluginPhase = \"deferred\";\n\n  constructor(config: ServerConfig) {\n    super(config);\n    if (\"autoStart\" in config) {\n      throw new ServerError(\n        \"server({ autoStart }) has been removed. \" +\n          \"The server is now started automatically by createApp.\\n\\n\" +\n          \"Run `npx appkit codemod on-plugins-ready --write` to auto-migrate.\",\n      );\n    }\n    this.config = config;\n    this.serverApplication = express();\n    this.server = null;\n    this.serverExtensions = [];\n  }\n\n  attachContext(deps: Parameters<Plugin[\"attachContext\"]>[0] = {}): void {\n    super.attachContext(deps);\n    this.telemetry.registerInstrumentations([\n      instrumentations.http,\n      instrumentations.express,\n    ]);\n    this.context?.registerAsRouteTarget(this);\n  }\n\n  /** Setup the server plugin. */\n  async setup() {}\n\n  /** Get the server configuration. */\n  getConfig() {\n    const { plugins: _plugins, ...config } = this.config;\n\n    return config;\n  }\n\n  /**\n   * Start the server.\n   *\n   * This method starts the server and sets up the frontend.\n   * It also sets up the remote tunneling if enabled.\n   *\n   * @returns The express application.\n   */\n  async start(): Promise<express.Application> {\n    this.serverApplication.use(requestMetricsMiddleware);\n    this.serverApplication.use(\n      express.json({\n        type: (req) => {\n          // Skip JSON parsing for routes that declared skipBodyParsing\n          // (e.g. file uploads where the raw body must flow through).\n          // rawBodyPaths is populated by extendRoutes() below; the type\n          // callback runs per-request so the set is already filled.\n          const urlPath = req.url?.split(\"?\")[0];\n          if (urlPath && this.rawBodyPaths.has(urlPath)) return false;\n          const ct = req.headers[\"content-type\"] ?? \"\";\n          return ct.includes(\"json\");\n        },\n      }),\n    );\n\n    const { endpoints, pluginConfigs } = await this.extendRoutes();\n\n    for (const extension of this.serverExtensions) {\n      extension(this.serverApplication);\n    }\n\n    // register remote tunnel controller (before static/vite)\n    this.remoteTunnelController = new RemoteTunnelController(\n      this.devFileReader,\n    );\n    this.serverApplication.use(this.remoteTunnelController.middleware);\n\n    await this.setupFrontend(endpoints, pluginConfigs);\n\n    const listenPort = await this.resolveListenPort();\n\n    const server = this.serverApplication.listen(\n      listenPort,\n      this.config.host ?? ServerPlugin.DEFAULT_CONFIG.host,\n      () => this.logStartupInfo(),\n    );\n\n    this.server = server;\n\n    // attach server to remote tunnel controller\n    this.remoteTunnelController.setServer(server);\n\n    process.on(\"SIGTERM\", () => this._gracefulShutdown());\n    process.on(\"SIGINT\", () => this._gracefulShutdown());\n\n    if (process.env.NODE_ENV === \"development\") {\n      const allRoutes = getRoutes(this.serverApplication._router.stack);\n      printRoutes(allRoutes);\n    }\n    return this.serverApplication;\n  }\n\n  /**\n   * Get the low level node.js http server instance.\n   *\n   * Only use this method if you need to access the server instance for advanced usage like a custom websocket server, etc.\n   *\n   * @throws {Error} If the server has not started yet.\n   * @returns {HTTPServer} The server instance.\n   */\n  getServer(): HTTPServer {\n    if (!this.server) {\n      throw ServerError.notStarted();\n    }\n\n    return this.server;\n  }\n\n  /**\n   * Extend the server with custom routes or middleware.\n   *\n   * Call this inside the `onPluginsReady` callback of `createApp` to register\n   * custom Express routes or middleware before the server starts listening.\n   *\n   * @param fn - A function that receives the express application.\n   * @returns The server plugin instance for chaining.\n   */\n  extend(fn: (app: express.Application) => void) {\n    this.serverExtensions.push(fn);\n    return this;\n  }\n\n  /**\n   * Register a server extension from another plugin during setup.\n   * Unlike extend(), this is designed for internal plugin-to-plugin\n   * coordination where extensions are registered before the server starts\n   * listening — typically called by PluginContext when flushing buffered routes.\n   */\n  addExtension(fn: (app: express.Application) => void) {\n    this.serverExtensions.push(fn);\n  }\n\n  /**\n   * Setup the routes with the plugins.\n   *\n   * This method goes through all the plugins and injects the routes into the server application.\n   * Returns a map of plugin names to their registered named endpoints,\n   * and a map of plugin names to their client-exposed configs.\n   */\n  private async extendRoutes(): Promise<{\n    endpoints: PluginEndpoints;\n    pluginConfigs: PluginClientConfigs;\n  }> {\n    const endpoints: PluginEndpoints = {};\n    const pluginConfigs: PluginClientConfigs = {};\n\n    const plugins = this.context?.getPlugins();\n    if (!plugins || plugins.size === 0) return { endpoints, pluginConfigs };\n\n    this.serverApplication.get(\"/health\", (_, res) => {\n      res.status(200).json({ status: \"ok\" });\n    });\n    this.registerEndpoint(\"health\", \"/health\");\n\n    for (const plugin of plugins.values()) {\n      if (EXCLUDED_PLUGINS.includes(plugin.name)) continue;\n\n      if (plugin?.injectRoutes && typeof plugin.injectRoutes === \"function\") {\n        const router = express.Router();\n\n        plugin.injectRoutes(router);\n\n        const basePath = `/api/${plugin.name}`;\n        this.serverApplication.use(basePath, router);\n\n        endpoints[plugin.name] = plugin.getEndpoints();\n\n        // Collect paths that should skip body parsing\n        if (\n          plugin.getSkipBodyParsingPaths &&\n          typeof plugin.getSkipBodyParsingPaths === \"function\"\n        ) {\n          for (const p of plugin.getSkipBodyParsingPaths()) {\n            this.rawBodyPaths.add(p);\n          }\n        }\n      }\n\n      if (typeof plugin.clientConfig === \"function\") {\n        try {\n          const raw = plugin.clientConfig();\n          if (raw != null) {\n            const sanitized = sanitizeClientConfig(plugin.name, raw);\n            if (Object.keys(sanitized).length > 0) {\n              pluginConfigs[plugin.name] = sanitized;\n            }\n          }\n        } catch (error) {\n          logger.error(\n            \"Plugin '%s' clientConfig() failed, skipping its config: %O\",\n            plugin.name,\n            error,\n          );\n        }\n      }\n    }\n\n    return { endpoints, pluginConfigs };\n  }\n\n  /**\n   * Setup frontend serving based on environment:\n   * - If staticPath is explicitly provided: use static server\n   * - Dev mode (no staticPath): Vite for HMR\n   * - Production (no staticPath): Static files auto-detected\n   */\n  private async setupFrontend(\n    endpoints: PluginEndpoints,\n    pluginConfigs: PluginClientConfigs,\n  ) {\n    const isDev = process.env.NODE_ENV === \"development\";\n    const hasExplicitStaticPath = this.config.staticPath !== undefined;\n\n    // explict static path provided\n    if (hasExplicitStaticPath) {\n      const staticServer = new StaticServer(\n        this.serverApplication,\n        this.config.staticPath as string,\n        endpoints,\n        pluginConfigs,\n      );\n      staticServer.setup();\n      return;\n    }\n\n    // auto-detection based on environment\n    if (isDev) {\n      this.viteDevServer = new ViteDevServer(\n        this.serverApplication,\n        endpoints,\n        pluginConfigs,\n      );\n      await this.viteDevServer.setup();\n      return;\n    }\n\n    // auto-detection based on static path\n    const staticPath = ServerPlugin.findStaticPath();\n    if (staticPath) {\n      const staticServer = new StaticServer(\n        this.serverApplication,\n        staticPath,\n        endpoints,\n        pluginConfigs,\n      );\n\n      staticServer.setup();\n    }\n  }\n\n  private static findStaticPath() {\n    const staticPaths = [\"dist\", \"client/dist\", \"build\", \"public\", \"out\"];\n    const cwd = process.cwd();\n    for (const p of staticPaths) {\n      const fullPath = path.resolve(cwd, p);\n      if (fs.existsSync(path.resolve(fullPath, \"index.html\"))) {\n        logger.debug(\"Static files: serving from %s\", fullPath);\n        return fullPath;\n      }\n    }\n    return undefined;\n  }\n\n  /**\n   * In development, prefers {@link ServerConfig.port} / env / default (8000), then\n   * scans upward using `get-port`'s `portNumbers()` on the listen host until one binds.\n   * In non-development, uses config / env / default only (no fallback).\n   */\n  private async resolveListenPort(): Promise<number> {\n    const requested = this.config.port ?? ServerPlugin.DEFAULT_CONFIG.port;\n\n    if (process.env.NODE_ENV !== \"development\") {\n      this.resolvedListenPort = requested;\n      return requested;\n    }\n\n    const host = this.config.host ?? ServerPlugin.DEFAULT_CONFIG.host;\n    const upper = Math.min(requested + devListenPortSpan - 1, 65_535);\n    const port = await getPort({\n      host,\n      port: portNumbers(requested, upper),\n    });\n    this.resolvedListenPort = port;\n    if (port !== requested) {\n      logger.info(\"Port %d was busy, picking %d\", requested, port);\n    }\n    return port;\n  }\n\n  private logStartupInfo() {\n    const isDev = process.env.NODE_ENV === \"development\";\n    const hasExplicitStaticPath = this.config.staticPath !== undefined;\n    const port =\n      this.resolvedListenPort ??\n      this.config.port ??\n      ServerPlugin.DEFAULT_CONFIG.port;\n    const host = this.config.host ?? ServerPlugin.DEFAULT_CONFIG.host;\n\n    logger.info(\"Server running on http://%s:%d\", host, port);\n\n    if (hasExplicitStaticPath) {\n      logger.info(\"Mode: static (%s)\", this.config.staticPath);\n    } else if (isDev) {\n      logger.info(\"Mode: development (Vite HMR)\");\n    } else {\n      logger.info(\"Mode: production (static)\");\n    }\n\n    const remoteServerController = this.remoteTunnelController;\n    if (!remoteServerController) {\n      logger.debug(\"Remote tunnel: disabled (controller not initialized)\");\n    } else {\n      logger.debug(\n        \"Remote tunnel: %s; %s\",\n        remoteServerController.isAllowedByEnv() ? \"allowed\" : \"blocked\",\n        remoteServerController.isActive() ? \"active\" : \"inactive\",\n      );\n    }\n  }\n\n  private async _gracefulShutdown() {\n    logger.info(\"Starting graceful shutdown...\");\n\n    if (this.viteDevServer) {\n      await this.viteDevServer.close();\n    }\n\n    if (this.remoteTunnelController) {\n      this.remoteTunnelController.cleanup();\n    }\n\n    TelemetryReporter.getInstance()?.stop();\n\n    // 1. abort active operations from plugins\n    const shutdownPlugins = this.context?.getPlugins();\n    if (shutdownPlugins) {\n      for (const plugin of shutdownPlugins.values()) {\n        if (plugin.abortActiveOperations) {\n          try {\n            plugin.abortActiveOperations();\n          } catch (err) {\n            logger.error(\n              \"Error aborting operations for plugin %s: %O\",\n              plugin.name,\n              err,\n            );\n          }\n        }\n      }\n    }\n\n    // 2. close the server\n    if (this.server) {\n      this.server.close(() => {\n        logger.debug(\"Server closed gracefully\");\n        process.exit(0);\n      });\n\n      // 3. timeout to force shutdown after 15 seconds\n      setTimeout(() => {\n        logger.debug(\"Force shutdown after timeout\");\n        process.exit(1);\n      }, 15000);\n    } else {\n      process.exit(0);\n    }\n  }\n\n  /**\n   * Returns the public exports for the server plugin.\n   * Exposes server management methods.\n   */\n  exports() {\n    const self = this;\n    return {\n      /** Extend the server with custom routes or middleware */\n      extend(fn: (app: express.Application) => void) {\n        self.extend(fn);\n        return this;\n      },\n      /** Get the underlying HTTP server instance */\n      getServer: this.getServer,\n      /** Get the server configuration */\n      getConfig: this.getConfig,\n      /** @deprecated Server is now started automatically by createApp. */\n      start() {\n        throw new ServerError(\n          \"server.start() has been removed. Use the onPluginsReady callback instead:\\n\\n\" +\n            \"  createApp({\\n\" +\n            \"    plugins: [server(), ...],\\n\" +\n            \"    onPluginsReady(appkit) {\\n\" +\n            \"      appkit.server.extend(...);\\n\" +\n            \"    },\\n\" +\n            \"  });\\n\\n\" +\n            \"Run `npx appkit codemod on-plugins-ready --write` to auto-migrate.\",\n        );\n      },\n    };\n  }\n}\n\nconst EXCLUDED_PLUGINS: string[] = [ServerPlugin.manifest.name];\n\n/** @internal Exported for unit tests. */\nexport function requestMetricsMiddleware(\n  req: express.Request,\n  res: express.Response,\n  next: express.NextFunction,\n) {\n  const startMs = Date.now();\n  res.on(\"finish\", () => {\n    const reporter = TelemetryReporter.getInstance();\n    if (!reporter) return;\n    const routePath = (req.route as { path?: string } | undefined)?.path;\n    if (!routePath) return;\n    const baseUrl = req.baseUrl ?? \"\";\n    const template = `${baseUrl}${routePath}`;\n    reporter.recordRequest(\n      req.method,\n      template,\n      res.statusCode,\n      Date.now() - startMs,\n    );\n  });\n  next();\n}\n\n/**\n * @internal\n */\nexport const server = toPlugin(ServerPlugin);\n// Export manifest and types\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;aAO2C;AAc3C,OAAO,OAAO,EAAE,MAAM,KAAK,QAAQ,QAAQ,KAAK,EAAE,SAAS,EAAE,CAAC;AAE9D,MAAM,SAAS,aAAa,SAAS;;AAGrC,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;AAwB1B,IAAa,eAAb,MAAa,qBAAqB,OAAO;CACvC,OAAc,iBAAiB;EAC7B,MAAM,QAAQ,IAAI,kBAAkB;EACpC,MAAM,OAAO,QAAQ,IAAI,oBAAoB,IAAI;EAClD;;CAGD,OAAO,WAAWA;CAClB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;;CAER,AAAQ;CAER,AAAQ,mBAA2D,EAAE;CACrE,AAAQ,+BAA4B,IAAI,KAAK;CAC7C,OAAO,QAAqB;CAE5B,YAAY,QAAsB;AAChC,QAAM,OAAO;AACb,MAAI,eAAe,OACjB,OAAM,IAAI,YACR,sKAGD;AAEH,OAAK,SAAS;AACd,OAAK,oBAAoB,SAAS;AAClC,OAAK,SAAS;AACd,OAAK,mBAAmB,EAAE;;CAG5B,cAAc,OAA+C,EAAE,EAAQ;AACrE,QAAM,cAAc,KAAK;AACzB,OAAK,UAAU,yBAAyB,CACtC,iBAAiB,MACjB,iBAAiB,QAClB,CAAC;AACF,OAAK,SAAS,sBAAsB,KAAK;;;CAI3C,MAAM,QAAQ;;CAGd,YAAY;EACV,MAAM,EAAE,SAAS,UAAU,GAAG,WAAW,KAAK;AAE9C,SAAO;;;;;;;;;;CAWT,MAAM,QAAsC;AAC1C,OAAK,kBAAkB,IAAI,yBAAyB;AACpD,OAAK,kBAAkB,IACrB,QAAQ,KAAK,EACX,OAAO,QAAQ;GAKb,MAAM,UAAU,IAAI,KAAK,MAAM,IAAI,CAAC;AACpC,OAAI,WAAW,KAAK,aAAa,IAAI,QAAQ,CAAE,QAAO;AAEtD,WADW,IAAI,QAAQ,mBAAmB,IAChC,SAAS,OAAO;KAE7B,CAAC,CACH;EAED,MAAM,EAAE,WAAW,kBAAkB,MAAM,KAAK,cAAc;AAE9D,OAAK,MAAM,aAAa,KAAK,iBAC3B,WAAU,KAAK,kBAAkB;AAInC,OAAK,yBAAyB,IAAI,uBAChC,KAAK,cACN;AACD,OAAK,kBAAkB,IAAI,KAAK,uBAAuB,WAAW;AAElE,QAAM,KAAK,cAAc,WAAW,cAAc;EAElD,MAAM,aAAa,MAAM,KAAK,mBAAmB;EAEjD,MAAM,SAAS,KAAK,kBAAkB,OACpC,YACA,KAAK,OAAO,QAAQ,aAAa,eAAe,YAC1C,KAAK,gBAAgB,CAC5B;AAED,OAAK,SAAS;AAGd,OAAK,uBAAuB,UAAU,OAAO;AAE7C,UAAQ,GAAG,iBAAiB,KAAK,mBAAmB,CAAC;AACrD,UAAQ,GAAG,gBAAgB,KAAK,mBAAmB,CAAC;AAEpD,MAAI,QAAQ,IAAI,aAAa,cAE3B,aADkB,UAAU,KAAK,kBAAkB,QAAQ,MAAM,CAC3C;AAExB,SAAO,KAAK;;;;;;;;;;CAWd,YAAwB;AACtB,MAAI,CAAC,KAAK,OACR,OAAM,YAAY,YAAY;AAGhC,SAAO,KAAK;;;;;;;;;;;CAYd,OAAO,IAAwC;AAC7C,OAAK,iBAAiB,KAAK,GAAG;AAC9B,SAAO;;;;;;;;CAST,aAAa,IAAwC;AACnD,OAAK,iBAAiB,KAAK,GAAG;;;;;;;;;CAUhC,MAAc,eAGX;EACD,MAAM,YAA6B,EAAE;EACrC,MAAM,gBAAqC,EAAE;EAE7C,MAAM,UAAU,KAAK,SAAS,YAAY;AAC1C,MAAI,CAAC,WAAW,QAAQ,SAAS,EAAG,QAAO;GAAE;GAAW;GAAe;AAEvE,OAAK,kBAAkB,IAAI,YAAY,GAAG,QAAQ;AAChD,OAAI,OAAO,IAAI,CAAC,KAAK,EAAE,QAAQ,MAAM,CAAC;IACtC;AACF,OAAK,iBAAiB,UAAU,UAAU;AAE1C,OAAK,MAAM,UAAU,QAAQ,QAAQ,EAAE;AACrC,OAAI,iBAAiB,SAAS,OAAO,KAAK,CAAE;AAE5C,OAAI,QAAQ,gBAAgB,OAAO,OAAO,iBAAiB,YAAY;IACrE,MAAM,SAAS,QAAQ,QAAQ;AAE/B,WAAO,aAAa,OAAO;IAE3B,MAAM,WAAW,QAAQ,OAAO;AAChC,SAAK,kBAAkB,IAAI,UAAU,OAAO;AAE5C,cAAU,OAAO,QAAQ,OAAO,cAAc;AAG9C,QACE,OAAO,2BACP,OAAO,OAAO,4BAA4B,WAE1C,MAAK,MAAM,KAAK,OAAO,yBAAyB,CAC9C,MAAK,aAAa,IAAI,EAAE;;AAK9B,OAAI,OAAO,OAAO,iBAAiB,WACjC,KAAI;IACF,MAAM,MAAM,OAAO,cAAc;AACjC,QAAI,OAAO,MAAM;KACf,MAAM,YAAY,qBAAqB,OAAO,MAAM,IAAI;AACxD,SAAI,OAAO,KAAK,UAAU,CAAC,SAAS,EAClC,eAAc,OAAO,QAAQ;;YAG1B,OAAO;AACd,WAAO,MACL,8DACA,OAAO,MACP,MACD;;;AAKP,SAAO;GAAE;GAAW;GAAe;;;;;;;;CASrC,MAAc,cACZ,WACA,eACA;EACA,MAAM,QAAQ,QAAQ,IAAI,aAAa;AAIvC,MAH8B,KAAK,OAAO,eAAe,QAG9B;AAOzB,GANqB,IAAI,aACvB,KAAK,mBACL,KAAK,OAAO,YACZ,WACA,cACD,CACY,OAAO;AACpB;;AAIF,MAAI,OAAO;AACT,QAAK,gBAAgB,IAAI,cACvB,KAAK,mBACL,WACA,cACD;AACD,SAAM,KAAK,cAAc,OAAO;AAChC;;EAIF,MAAM,aAAa,aAAa,gBAAgB;AAChD,MAAI,WAQF,CAPqB,IAAI,aACvB,KAAK,mBACL,YACA,WACA,cACD,CAEY,OAAO;;CAIxB,OAAe,iBAAiB;EAC9B,MAAM,cAAc;GAAC;GAAQ;GAAe;GAAS;GAAU;GAAM;EACrE,MAAM,MAAM,QAAQ,KAAK;AACzB,OAAK,MAAM,KAAK,aAAa;GAC3B,MAAM,WAAW,KAAK,QAAQ,KAAK,EAAE;AACrC,OAAI,GAAG,WAAW,KAAK,QAAQ,UAAU,aAAa,CAAC,EAAE;AACvD,WAAO,MAAM,iCAAiC,SAAS;AACvD,WAAO;;;;;;;;;CAWb,MAAc,oBAAqC;EACjD,MAAM,YAAY,KAAK,OAAO,QAAQ,aAAa,eAAe;AAElE,MAAI,QAAQ,IAAI,aAAa,eAAe;AAC1C,QAAK,qBAAqB;AAC1B,UAAO;;EAKT,MAAM,OAAO,MAAM,QAAQ;GACzB,MAHW,KAAK,OAAO,QAAQ,aAAa,eAAe;GAI3D,MAAM,YAAY,WAHN,KAAK,IAAI,YAAY,oBAAoB,GAAG,MAAO,CAG5B;GACpC,CAAC;AACF,OAAK,qBAAqB;AAC1B,MAAI,SAAS,UACX,QAAO,KAAK,gCAAgC,WAAW,KAAK;AAE9D,SAAO;;CAGT,AAAQ,iBAAiB;EACvB,MAAM,QAAQ,QAAQ,IAAI,aAAa;EACvC,MAAM,wBAAwB,KAAK,OAAO,eAAe;EACzD,MAAM,OACJ,KAAK,sBACL,KAAK,OAAO,QACZ,aAAa,eAAe;EAC9B,MAAM,OAAO,KAAK,OAAO,QAAQ,aAAa,eAAe;AAE7D,SAAO,KAAK,kCAAkC,MAAM,KAAK;AAEzD,MAAI,sBACF,QAAO,KAAK,qBAAqB,KAAK,OAAO,WAAW;WAC/C,MACT,QAAO,KAAK,+BAA+B;MAE3C,QAAO,KAAK,4BAA4B;EAG1C,MAAM,yBAAyB,KAAK;AACpC,MAAI,CAAC,uBACH,QAAO,MAAM,uDAAuD;MAEpE,QAAO,MACL,yBACA,uBAAuB,gBAAgB,GAAG,YAAY,WACtD,uBAAuB,UAAU,GAAG,WAAW,WAChD;;CAIL,MAAc,oBAAoB;AAChC,SAAO,KAAK,gCAAgC;AAE5C,MAAI,KAAK,cACP,OAAM,KAAK,cAAc,OAAO;AAGlC,MAAI,KAAK,uBACP,MAAK,uBAAuB,SAAS;AAGvC,oBAAkB,aAAa,EAAE,MAAM;EAGvC,MAAM,kBAAkB,KAAK,SAAS,YAAY;AAClD,MAAI,iBACF;QAAK,MAAM,UAAU,gBAAgB,QAAQ,CAC3C,KAAI,OAAO,sBACT,KAAI;AACF,WAAO,uBAAuB;YACvB,KAAK;AACZ,WAAO,MACL,+CACA,OAAO,MACP,IACD;;;AAOT,MAAI,KAAK,QAAQ;AACf,QAAK,OAAO,YAAY;AACtB,WAAO,MAAM,2BAA2B;AACxC,YAAQ,KAAK,EAAE;KACf;AAGF,oBAAiB;AACf,WAAO,MAAM,+BAA+B;AAC5C,YAAQ,KAAK,EAAE;MACd,KAAM;QAET,SAAQ,KAAK,EAAE;;;;;;CAQnB,UAAU;EACR,MAAM,OAAO;AACb,SAAO;GAEL,OAAO,IAAwC;AAC7C,SAAK,OAAO,GAAG;AACf,WAAO;;GAGT,WAAW,KAAK;GAEhB,WAAW,KAAK;GAEhB,QAAQ;AACN,UAAM,IAAI,YACR,iRAQD;;GAEJ;;;AAIL,MAAM,mBAA6B,CAAC,aAAa,SAAS,KAAK;;AAG/D,SAAgB,yBACd,KACA,KACA,MACA;CACA,MAAM,UAAU,KAAK,KAAK;AAC1B,KAAI,GAAG,gBAAgB;EACrB,MAAM,WAAW,kBAAkB,aAAa;AAChD,MAAI,CAAC,SAAU;EACf,MAAM,YAAa,IAAI,OAAyC;AAChE,MAAI,CAAC,UAAW;EAEhB,MAAM,WAAW,GADD,IAAI,WAAW,KACD;AAC9B,WAAS,cACP,IAAI,QACJ,UACA,IAAI,YACJ,KAAK,KAAK,GAAG,QACd;GACD;AACF,OAAM;;;;;AAMR,MAAa,SAAS,SAAS,aAAa"}

package/dist/plugins/server/types.d.ts

@@ -1,12 +1,9 @@
 import { BasePluginConfig } from "../../shared/src/plugin.js";
 import "../../shared/src/index.js";
-import { Plugin } from "../../plugin/plugin.js";
-import "../../plugin/index.js";
 
 //#region src/plugins/server/types.d.ts
 interface ServerConfig extends BasePluginConfig {
   port?: number;
-  plugins?: Record<string, Plugin>;
   staticPath?: string;
   host?: string;
 }

package/dist/plugins/server/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/plugins/server/types.ts"],"mappings":";;;;;;UAGiB,YAAA,SAAqB,gBAAA;EACpC,IAAA;EACA,OAAA,GAAU,MAAA,SAAe,MAAA;EACzB,UAAA;EACA,IAAA;AAAA"}
+{"version":3,"file":"types.d.ts","names":[],"sources":["../../../src/plugins/server/types.ts"],"mappings":";;;;UAEiB,YAAA,SAAqB,gBAAA;EACpC,IAAA;EACA,UAAA;EACA,IAAA;AAAA"}

package/dist/plugins/serving/serving.d.ts

@@ -2,6 +2,7 @@ import { IAppRouter, ToPlugin } from "../../shared/src/plugin.js";
 import "../../shared/src/index.js";
 import { ExecutionResult } from "../../plugin/execution-result.js";
 import { Plugin } from "../../plugin/plugin.js";
+import { NamedPluginFactory } from "../../plugin/to-plugin.js";
 import "../../plugin/index.js";
 import { PluginManifest, ResourceRequirement } from "../../registry/types.js";
 import "../../registry/index.js";
@@ -32,7 +33,7 @@ declare class ServingPlugin extends Plugin {
 /**
  * @internal
  */
-declare const serving: ToPlugin<typeof ServingPlugin, IServingConfig, "serving">;
+declare const serving: ToPlugin<typeof ServingPlugin, IServingConfig, "serving"> & NamedPluginFactory<"serving">;
 //#endregion
 export { ServingPlugin, serving };
 //# sourceMappingURL=serving.d.ts.map

package/dist/plugins/serving/serving.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serving.d.ts","names":[],"sources":["../../../src/plugins/serving/serving.ts"],"mappings":";;;;;;;;;;;cAyCa,aAAA,SAAsB,MAAA;EAAA,OAC1B,QAAA,EAAuB,cAAA;EAAA,iBAEb,WAAA;EAAA,UAEC,MAAA,EAAQ,cAAA;EAAA,iBAET,SAAA;EAAA,iBACA,WAAA;EAAA,QACT,gBAAA;cAEI,MAAA,EAAQ,cAAA;EAed,KAAA,CAAA,GAAS,OAAA;EAAA,OAiBR,uBAAA,CACL,MAAA,EAAQ,cAAA,GACP,mBAAA;EAAA,QAqBK,gBAAA;EA0BR,YAAA,CAAa,MAAA,EAAQ,UAAA;EAgEf,aAAA,CACJ,GAAA,EAAK,OAAA,CAAQ,OAAA,EACb,GAAA,EAAK,OAAA,CAAQ,QAAA,GACZ,OAAA;EA0BG,aAAA,CACJ,GAAA,EAAK,OAAA,CAAQ,OAAA,EACb,GAAA,EAAK,OAAA,CAAQ,QAAA,GACZ,OAAA;EA2DG,MAAA,CACJ,KAAA,UACA,IAAA,EAAM,MAAA,oBACL,OAAA,CAAQ,eAAA;EAiBX,YAAA,CAAA,GAAgB,MAAA;EAOV,QAAA,CAAA,GAAY,OAAA;EAAA,UAIR,iBAAA,CAAkB,KAAA,WAAgB,sBAAA;EAM5C,OAAA,CAAA,GAAW,cAAA;AAAA;;;;cAmBA,OAAA,EAAO,QAAA,QAAA,aAAA,EAAA,cAAA"}
+{"version":3,"file":"serving.d.ts","names":[],"sources":["../../../src/plugins/serving/serving.ts"],"mappings":";;;;;;;;;;;;cAyCa,aAAA,SAAsB,MAAA;EAAA,OAC1B,QAAA,EAAuB,cAAA;EAAA,iBAEb,WAAA;EAAA,UAEC,MAAA,EAAQ,cAAA;EAAA,iBAET,SAAA;EAAA,iBACA,WAAA;EAAA,QACT,gBAAA;cAEI,MAAA,EAAQ,cAAA;EAed,KAAA,CAAA,GAAS,OAAA;EAAA,OAiBR,uBAAA,CACL,MAAA,EAAQ,cAAA,GACP,mBAAA;EAAA,QAqBK,gBAAA;EA0BR,YAAA,CAAa,MAAA,EAAQ,UAAA;EAgEf,aAAA,CACJ,GAAA,EAAK,OAAA,CAAQ,OAAA,EACb,GAAA,EAAK,OAAA,CAAQ,QAAA,GACZ,OAAA;EA0BG,aAAA,CACJ,GAAA,EAAK,OAAA,CAAQ,OAAA,EACb,GAAA,EAAK,OAAA,CAAQ,QAAA,GACZ,OAAA;EA2DG,MAAA,CACJ,KAAA,UACA,IAAA,EAAM,MAAA,oBACL,OAAA,CAAQ,eAAA;EAiBX,YAAA,CAAA,GAAgB,MAAA;EAOV,QAAA,CAAA,GAAY,OAAA;EAAA,UAIR,iBAAA,CAAkB,KAAA,WAAgB,sBAAA;EAM5C,OAAA,CAAA,GAAW,cAAA;AAAA;;;;cAmBA,OAAA,EAAO,QAAA,QAAA,aAAA,EAAA,cAAA,eAAA,kBAAA"}

package/dist/shared/src/agent.d.ts

@@ -1,8 +1,39 @@
 import { JSONSchema7 } from "json-schema";
 
 //#region ../shared/src/agent.d.ts
+/**
+ * Semantic hint for what the tool does to the world. Drives both the
+ * agents-plugin approval gate and the client's approval-card styling.
+ *
+ * - `read` — observes only; never needs approval.
+ * - `write` — creates or appends new state (e.g. saving a new view). Approval
+ *   required by default. Rendered as a low-severity "writes" card.
+ * - `update` — mutates existing state in place (e.g. renaming, toggling).
+ *   Approval required. Rendered as a medium-severity "updates" card.
+ * - `destructive` — deletes or irreversibly mutates (e.g. dropping a view).
+ *   Approval required. Rendered as a high-severity "destructive" card.
+ *
+ * Prefer this over the legacy `readOnly`/`destructive` booleans: it lets the
+ * UI distinguish "captured a screenshot" from "deleted a dashboard", both of
+ * which today are lumped under a single red "destructive" label.
+ */
+type ToolEffect = "read" | "write" | "update" | "destructive";
 interface ToolAnnotations {
+  /**
+   * Preferred semantic label. When set, drives both the approval gate (fires
+   * for `write`/`update`/`destructive`) and the approval-card styling.
+   */
+  effect?: ToolEffect;
+  /**
+   * @deprecated Prefer {@link effect}. Retained for backward compatibility
+   * with tools authored against the original flags and for MCP interop.
+   */
   readOnly?: boolean;
+  /**
+   * @deprecated Prefer {@link effect} with value `"destructive"`. Retained
+   * so existing annotations continue to force the approval gate, and so
+   * MCP-style consumers that only read `destructive` still see the hint.
+   */
   destructive?: boolean;
   idempotent?: boolean;
   requiresUserContext?: boolean;
@@ -13,6 +44,10 @@ interface AgentToolDefinition {
   parameters: JSONSchema7;
   annotations?: ToolAnnotations;
 }
+interface ToolProvider {
+  getAgentTools(): AgentToolDefinition[];
+  executeAgentTool(name: string, args: unknown, signal?: AbortSignal): Promise<unknown>;
+}
 interface Message {
   id: string;
   role: "user" | "assistant" | "system" | "tool";
@@ -26,6 +61,20 @@ interface ToolCall {
   name: string;
   args: unknown;
 }
+interface Thread {
+  id: string;
+  userId: string;
+  messages: Message[];
+  createdAt: Date;
+  updatedAt: Date;
+}
+interface ThreadStore {
+  create(userId: string): Promise<Thread>;
+  get(threadId: string, userId: string): Promise<Thread | null>;
+  list(userId: string): Promise<Thread[]>;
+  addMessage(threadId: string, userId: string, message: Message): Promise<void>;
+  delete(threadId: string, userId: string): Promise<boolean>;
+}
 type AgentEvent = {
   type: "message_delta";
   content: string;
@@ -52,6 +101,19 @@ type AgentEvent = {
 } | {
   type: "metadata";
   data: Record<string, unknown>;
+} | {
+  /**
+   * Emitted by the agents plugin (not adapters) when a tool call annotated
+   * `destructive: true` is awaiting human approval. Clients should render
+   * an approval prompt and POST to `/chat/approve` with the matching
+   * `approvalId` and a `decision` of `approve` or `deny`.
+   */
+  type: "approval_pending";
+  approvalId: string;
+  streamId: string;
+  toolName: string;
+  args: unknown;
+  annotations?: ToolAnnotations;
 };
 interface AgentInput {
   messages: Message[];
@@ -68,5 +130,5 @@ interface AgentAdapter {
   run(input: AgentInput, context: AgentRunContext): AsyncGenerator<AgentEvent, void, unknown>;
 }
 //#endregion
-export { AgentAdapter, AgentEvent, AgentInput, AgentRunContext, AgentToolDefinition, Message, ToolAnnotations, ToolCall };
+export { AgentAdapter, AgentEvent, AgentInput, AgentRunContext, AgentToolDefinition, Message, Thread, ThreadStore, ToolAnnotations, ToolCall, ToolEffect, ToolProvider };
 //# sourceMappingURL=agent.d.ts.map

package/dist/shared/src/agent.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent.d.ts","names":[],"sources":["../../../../shared/src/agent.ts"],"mappings":";;;UAMiB,eAAA;EACf,QAAA;EACA,WAAA;EACA,UAAA;EACA,mBAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA;EACA,WAAA;EACA,UAAA,EAAY,WAAA;EACZ,WAAA,GAAc,eAAA;AAAA;AAAA,UAgBC,OAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;EACA,UAAA;EACA,SAAA,GAAY,QAAA;EACZ,SAAA,EAAW,IAAA;AAAA;AAAA,UAGI,QAAA;EACf,EAAA;EACA,IAAA;EACA,IAAA;AAAA;AAAA,KA2BU,UAAA;EACN,IAAA;EAAuB,OAAA;AAAA;EACvB,IAAA;EAAiB,OAAA;AAAA;EACjB,IAAA;EAAmB,MAAA;EAAgB,IAAA;EAAc,IAAA;AAAA;EAEjD,IAAA;EACA,MAAA;EACA,MAAA;EACA,KAAA;AAAA;EAEA,IAAA;EAAkB,OAAA;AAAA;EAElB,IAAA;EACA,MAAA;EACA,KAAA;AAAA;EAEA,IAAA;EAAkB,IAAA,EAAM,MAAA;AAAA;AAAA,UA0Gb,UAAA;EACf,QAAA,EAAU,OAAA;EACV,KAAA,EAAO,mBAAA;EACP,QAAA;EACA,MAAA,GAAS,WAAA;AAAA;AAAA,UAGM,eAAA;;EAEf,WAAA,GAAc,IAAA,UAAc,IAAA,cAAkB,OAAA;EAC9C,MAAA,GAAS,WAAA;AAAA;AAAA,UAGM,YAAA;EACf,GAAA,CACE,KAAA,EAAO,UAAA,EACP,OAAA,EAAS,eAAA,GACR,cAAA,CAAe,UAAA;AAAA"}
+{"version":3,"file":"agent.d.ts","names":[],"sources":["../../../../shared/src/agent.ts"],"mappings":";;;;;AAsBA;;;;;AAEA;;;;;;;;;KAFY,UAAA;AAAA,UAEK,eAAA;EAkBI;AAGrB;;;EAhBE,MAAA,GAAS,UAAA;EAiBT;;;;EAZA,QAAA;EAec;;;AAGhB;;EAZE,WAAA;EACA,UAAA;EACA,mBAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA;EACA,WAAA;EACA,UAAA,EAAY,WAAA;EACZ,WAAA,GAAc,eAAA;AAAA;AAAA,UAGC,YAAA;EACf,aAAA,IAAiB,mBAAA;EACjB,gBAAA,CACE,IAAA,UACA,IAAA,WACA,MAAA,GAAS,WAAA,GACR,OAAA;AAAA;AAAA,UAOY,OAAA;EACf,EAAA;EACA,IAAA;EACA,OAAA;EACA,UAAA;EACA,SAAA,GAAY,QAAA;EACZ,SAAA,EAAW,IAAA;AAAA;AAAA,UAGI,QAAA;EACf,EAAA;EACA,IAAA;EACA,IAAA;AAAA;AAAA,UAGe,MAAA;EACf,EAAA;EACA,MAAA;EACA,QAAA,EAAU,OAAA;EACV,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;AAAA;AAAA,UAOI,WAAA;EACf,MAAA,CAAO,MAAA,WAAiB,OAAA,CAAQ,MAAA;EAChC,GAAA,CAAI,QAAA,UAAkB,MAAA,WAAiB,OAAA,CAAQ,MAAA;EAC/C,IAAA,CAAK,MAAA,WAAiB,OAAA,CAAQ,MAAA;EAC9B,UAAA,CAAW,QAAA,UAAkB,MAAA,UAAgB,OAAA,EAAS,OAAA,GAAU,OAAA;EAChE,MAAA,CAAO,QAAA,UAAkB,MAAA,WAAiB,OAAA;AAAA;AAAA,KAOhC,UAAA;EACN,IAAA;EAAuB,OAAA;AAAA;EACvB,IAAA;EAAiB,OAAA;AAAA;EACjB,IAAA;EAAmB,MAAA;EAAgB,IAAA;EAAc,IAAA;AAAA;EAEjD,IAAA;EACA,MAAA;EACA,MAAA;EACA,KAAA;AAAA;EAEA,IAAA;EAAkB,OAAA;AAAA;EAElB,IAAA;EACA,MAAA;EACA,KAAA;AAAA;EAEA,IAAA;EAAkB,IAAA,EAAM,MAAA;AAAA;EAvBc;;;;;;EA+BtC,IAAA;EACA,UAAA;EACA,QAAA;EACA,QAAA;EACA,IAAA;EACA,WAAA,GAAc,eAAA;AAAA;AAAA,UA6HH,UAAA;EACf,QAAA,EAAU,OAAA;EACV,KAAA,EAAO,mBAAA;EACP,QAAA;EACA,MAAA,GAAS,WAAA;AAAA;AAAA,UAGM,eAAA;EAUa;EAR5B,WAAA,GAAc,IAAA,UAAc,IAAA,cAAkB,OAAA;EAC9C,MAAA,GAAS,WAAA;AAAA;AAAA,UAGM,YAAA;EACf,GAAA,CACE,KAAA,EAAO,UAAA,EACP,OAAA,EAAS,eAAA,GACR,cAAA,CAAe,UAAA;AAAA"}

package/dist/shared/src/index.d.ts

@@ -1,4 +1,4 @@
-import { AgentAdapter, AgentEvent, AgentInput, AgentRunContext, AgentToolDefinition, Message, ToolAnnotations, ToolCall } from "./agent.js";
+import { AgentAdapter, AgentEvent, AgentInput, AgentRunContext, AgentToolDefinition, Message, Thread, ThreadStore, ToolAnnotations, ToolCall, ToolEffect, ToolProvider } from "./agent.js";
 import { ResourceFieldEntry } from "./schemas/plugin-manifest.generated.js";
 import { BasePlugin, BasePluginConfig, HttpMethod, IAppRequest, IAppResponse, IAppRouter, PluginConstructor, PluginData, PluginEndpointMap, PluginExports, PluginManifest, PluginMap, PluginPhase, ResourceRequirement, RouteConfig, TelemetryOptions, ToPlugin, WithAsUser } from "./plugin.js";
 import { CacheConfig, CacheEntry, CacheStorage } from "./cache.js";