@databricks/appkit 0.71.0 → 0.73.0

package/docs/plugins/database.md

@@ -0,0 +1,144 @@
+# Database plugin
+
+Beta plugin
+
+This plugin is currently **beta**. APIs may change between minor releases. Import from `@databricks/appkit/beta`. See [Plugin Stability Tiers](./docs/plugins/stability.md).
+
+Declare a schema and use `database({ schema })` to get generated HTTP CRUD and a server-side database client. CRUD is enabled for every declared table by default. Use `api` to restrict the generated routes without disabling server-side access.
+
+Shared application access
+
+This plugin uses the app's service principal in deployed Databricks Apps. It does not support OBO and does not apply per-user or per-row authorization. Every caller who can reach the generated API can perform every enabled operation on every exposed row, including delete.
+
+Restrict access to the app and grant its service principal only the database permissions it needs. If users need different permissions or row ownership checks, disable the relevant generated routes and implement authorization in custom server routes. App admission alone does not provide row-level isolation.
+
+## Basic usage[​](#basic-usage "Direct link to Basic usage")
+
+Configure a Lakebase `postgres` resource and its connection environment variables as described in [Lakebase configuration](./docs/plugins/lakebase.md#environment-variables). The database tables must already exist and match the declared schema. This plugin checks connectivity during setup; it does not create or migrate tables.
+
+```ts
+import { createApp, server } from "@databricks/appkit";
+import { database, defineSchema, id, text } from "@databricks/appkit/beta";
+
+const schema = defineSchema((builder) => ({
+  notes: builder.table("notes", {
+    id: id(),
+    body: text().notNull(),
+  }),
+}));
+
+const AppKit = await createApp({
+  plugins: [server(), database({ schema })],
+});
+
+```
+
+With the server plugin enabled, this registers:
+
+| Method | Path                      | Operation    |
+| ------ | ------------------------- | ------------ |
+| GET    | `/api/database/notes`     | List rows    |
+| GET    | `/api/database/notes/:id` | Find one row |
+| POST   | `/api/database/notes`     | Create a row |
+| PATCH  | `/api/database/notes/:id` | Update a row |
+| DELETE | `/api/database/notes/:id` | Delete a row |
+
+A table without a public primary key supports list and create only. `upsert` is available to server code but has no generated HTTP route.
+
+## Restrict the generated API[​](#restrict-the-generated-api "Direct link to Restrict the generated API")
+
+Omitting `api`, or setting it to `true` or `{}`, enables full CRUD. Restrictions are optional. There is no separate write opt-in.
+
+```ts
+// No generated HTTP routes. The server-side client still works.
+database({ schema, api: false });
+
+// Read-only routes for every table.
+database({ schema, api: { writes: false } });
+
+// Full CRUD for selected tables only.
+database({ schema, api: { tables: ["notes"] } });
+
+// Allow reads, create, and update, but not delete.
+database({
+  schema,
+  api: { writes: { operations: ["create", "update"] } },
+});
+
+// Read every table, but allow writes only to notes.
+database({
+  schema,
+  api: { writes: { tables: ["notes"] } },
+});
+
+```
+
+| Option                  | Default                      | Effect                                    |
+| ----------------------- | ---------------------------- | ----------------------------------------- |
+| `api`                   | `true`                       | `false` disables all generated routes     |
+| `api.tables`            | All declared tables          | Limits which tables have routes           |
+| `api.writes`            | `true`                       | `false` keeps only read routes            |
+| `api.writes.tables`     | All exposed tables           | Limits which exposed tables accept writes |
+| `api.writes.operations` | `create`, `update`, `delete` | Limits which writes are enabled           |
+
+`api.tables: []` disables all generated routes. An empty write-table or write-operation list keeps reads and disables writes. Tables omitted from `api.tables` also cannot be included through relations on exposed tables. These restrictions apply to HTTP only, not to the server-side client or hooks.
+
+An omitted restriction uses its default. A malformed restriction fails setup. For example, `{ api: { write: false } }` is an error, not permission to generate all writes. Unknown tables, duplicate names, and unsupported operations also fail setup before the plugin creates a connection pool.
+
+Replace the former `crudRoutes` option with `api`. The old name is rejected at runtime so an old opt-out cannot silently enable the API. To preserve read-only behavior, specify `api: { writes: false }`.
+
+### Table names and setup errors[​](#table-names-and-setup-errors "Direct link to Table names and setup errors")
+
+Generated route names must:
+
+* Start with an ASCII letter.
+* Contain only ASCII letters, digits, underscores, or hyphens.
+* Be at most 64 characters long.
+* Be unique without regard to case, because Express routes are case-insensitive.
+
+The default API validates every declared table. A table such as `_events` fails setup instead of being silently omitted. The error names the table and suggests renaming it, excluding it with `api.tables`, or disabling routes with `api: false`. An excluded table remains available to server code.
+
+Configuration errors include actionable details in the server-side error message. Client-facing messages do not expose those details.
+
+## Validation and private columns[​](#validation-and-private-columns "Direct link to Validation and private columns")
+
+The generated API validates request bodies and rejects unknown or read-only fields. Columns marked `.private()` are not available through generated routes. Database-generated primary keys, including `uuid().primaryKey().defaultRandom()`, cannot be supplied by HTTP callers. A natural primary key may be supplied on create, but primary keys cannot be updated through HTTP.
+
+Validation is not authorization. A valid request can still read or change any exposed row. Use custom authorized routes when that is not the desired access model.
+
+## Mutation hooks[​](#mutation-hooks "Direct link to Mutation hooks")
+
+A table can declare `beforeCreate`, `afterCreate`, `beforeUpdate`, `afterUpdate`, `beforeUpsert`, `afterUpsert`, `beforeDelete`, and `afterDelete`. Hooks and the mutation run in one database transaction. Related writes through `ctx.app.database` join that same transaction. This does not make writes through other plugins or external services transactional.
+
+```ts
+import { DatabaseValidationError } from "@databricks/appkit";
+
+database({
+  schema,
+  hooks: {
+    notes: {
+      beforeCreate(values) {
+        if (typeof values.body === "string" && values.body.length > 5_000) {
+          throw new DatabaseValidationError("Note too long", [
+            { path: ["body"], message: "Must be at most 5000 characters" },
+          ]);
+        }
+      },
+    },
+  },
+});
+
+```
+
+A `before*` hook can return replacement values, which are validated again before persistence. `DatabaseValidationError` produces HTTP 422 with issues limited to public columns. Other hook failures return an opaque server error.
+
+Keep hooks short and await all database work. A transaction has a 30-second callback deadline, a shared budget of 100 database operations, and a maximum mutation nesting depth of 8. Repeating the same entity and mutation operation in a nested hook chain is rejected. PostgreSQL also enforces a 30-second `statement_timeout` and a 30-second `idle_in_transaction_session_timeout`.
+
+The callback deadline does not cancel arbitrary JavaScript, HTTP requests, or other external side effects. Avoid putting external side effects in hooks that need database rollback semantics.
+
+## API reference[​](#api-reference "Direct link to API reference")
+
+* [`database`](./docs/api/appkit/Function.database.md)
+* [`IDatabaseConfig`](./docs/api/appkit/TypeAlias.IDatabaseConfig.md)
+* [`DatabaseApiConfig`](./docs/api/appkit/TypeAlias.DatabaseApiConfig.md)
+* [`EntityHooks`](./docs/api/appkit/TypeAlias.EntityHooks.md)

package/llms.txt

@@ -48,6 +48,7 @@ npx @databricks/appkit docs <query>
 - [Analytics plugin](./docs/plugins/analytics.md): Enables SQL query execution against Databricks SQL Warehouses.
 - [Caching](./docs/plugins/caching.md): AppKit provides both global and plugin-level caching capabilities.
 - [Creating custom plugins](./docs/plugins/custom-plugins.md): If you need custom API routes or background logic, implement an AppKit plugin. The fastest way is to use the CLI:
+- [Database plugin](./docs/plugins/database.md): This plugin is currently beta. APIs may change between minor releases. Import from @databricks/appkit/beta. See Plugin Stability Tiers.
 - [Execution context](./docs/plugins/execution-context.md): AppKit manages Databricks authentication via two contexts:
 - [Files plugin](./docs/plugins/files.md): File operations against Databricks Unity Catalog Volumes. Supports listing, reading, downloading, uploading, deleting, and previewing files with built-in caching, retry, and timeout handling via the execution interceptor pipeline.
 - [Genie plugin](./docs/plugins/genie.md): Integrates Databricks AI/BI Genie spaces into your AppKit application, enabling natural language data queries via a conversational interface.
@@ -68,9 +69,11 @@ npx @databricks/appkit docs <query>
 - [Class: AuthenticationError](./docs/api/appkit/Class.AuthenticationError.md): Error thrown when authentication fails.
 - [Class: ConfigurationError](./docs/api/appkit/Class.ConfigurationError.md): Error thrown when configuration is missing or invalid.
 - [Class: ConnectionError](./docs/api/appkit/Class.ConnectionError.md): Error thrown when a connection or network operation fails.
+- [Class: DatabaseValidationError](./docs/api/appkit/Class.DatabaseValidationError.md): Deliberate validation failure raised by a database mutation hook. Generated
 - [Class: DatabricksAdapter](./docs/api/appkit/Class.DatabricksAdapter.md): Adapter that talks directly to Databricks Model Serving /invocations endpoint.
 - [Class: ExecutionError](./docs/api/appkit/Class.ExecutionError.md): Error thrown when an operation execution fails.
 - [Class: InitializationError](./docs/api/appkit/Class.InitializationError.md): Error thrown when a service or component is not properly initialized.
+- [Class: MlflowClient](./docs/api/appkit/Class.MlflowClient.md): A thin client over the Databricks workspace REST API, owning the host + bearer
 - [Abstract Class: Plugin<TConfig>](./docs/api/appkit/Class.Plugin.md): Base abstract class for creating AppKit plugins.
 - [Class: PolicyDeniedError](./docs/api/appkit/Class.PolicyDeniedError.md): Thrown when a policy denies an action.
 - [Class: ResourceRegistry](./docs/api/appkit/Class.ResourceRegistry.md): Central registry for tracking plugin resource requirements.
@@ -86,20 +89,31 @@ npx @databricks/appkit docs <query>
 - [Function: bigid()](./docs/api/appkit/Function.bigid.md): Returns
 - [Function: bigint()](./docs/api/appkit/Function.bigint.md): Returns
 - [Function: boolean()](./docs/api/appkit/Function.boolean.md): Returns
+- [Function: buildAssessments()](./docs/api/appkit/Function.buildAssessments.md): Parameters
+- [Function: configureJudge()](./docs/api/appkit/Function.configureJudge.md): Configure the judge once. Sets the OpenAI-compatible client env autoevals
 - [Function: createAgent()](./docs/api/appkit/Function.createAgent.md): Pure factory for agent definitions: cycle-detects the sub-agent graph and
 - [Function: createApp()](./docs/api/appkit/Function.createApp.md): Bootstraps AppKit with the provided configuration.
+- [Function: createHttpDriver()](./docs/api/appkit/Function.createHttpDriver.md): Drives an agent by POSTing to a running app's chat endpoint and parsing the
 - [Function: createLakebasePool()](./docs/api/appkit/Function.createLakebasePool.md): Create a Lakebase pool with appkit's logger integration.
 - [Function: createLakebasePoolManager()](./docs/api/appkit/Function.createLakebasePoolManager.md): Create a pool manager that maintains per-key Lakebase connection pools.
 - [Function: createWorkspaceClient()](./docs/api/appkit/Function.createWorkspaceClient.md): Construct an AppKit workspace client.
 - [Function: database()](./docs/api/appkit/Function.database.md): Create a typed database plugin registration for a finalized schema.
+- [Function: defineEval()](./docs/api/appkit/Function.defineEval.md): Define an agent eval. Default-export the result from a
 - [Function: defineManifest()](./docs/api/appkit/Function.defineManifest.md): Validates a raw manifest (typically a manifest.json import) against the
 - [Function: defineSchema()](./docs/api/appkit/Function.defineSchema.md): Compile one declared schema. The returned type keeps the table names the
 - [Function: defineTool()](./docs/api/appkit/Function.defineTool.md): Defines a single tool entry for a plugin's internal registry.
+- [Function: discoverEvalFiles()](./docs/api/appkit/Function.discoverEvalFiles.md): Discover evals under /server/agents//evals/ — co-located
 - [Function: enumColumn()](./docs/api/appkit/Function.enumColumn.md): Parameters
+- [Function: equals()](./docs/api/appkit/Function.equals.md): Passes when the value equals expected exactly.
+- [Function: evalGlyph()](./docs/api/appkit/Function.evalGlyph.md): Status glyph for a single eval result.
 - [Function: executeFromRegistry()](./docs/api/appkit/Function.executeFromRegistry.md): Validates tool-call arguments against the entry's schema and invokes its
 - [Function: extractServingEndpoints()](./docs/api/appkit/Function.extractServingEndpoints.md): Extract serving endpoint config from a server file by AST-parsing it.
 - [Function: findServerFile()](./docs/api/appkit/Function.findServerFile.md): Find the server entry file by checking candidate paths in order.
 - [Function: fk()](./docs/api/appkit/Function.fk.md): Declare foreign-key to another column.
+- [Function: formatEvalDetail()](./docs/api/appkit/Function.formatEvalDetail.md): Indented detail lines for a failing eval (error + failing assertions).
+- [Function: formatEvalHeadline()](./docs/api/appkit/Function.formatEvalHeadline.md): The one-line header for a single eval result (no failure detail).
+- [Function: formatEvalResults()](./docs/api/appkit/Function.formatEvalResults.md): Render all results as a human-readable console report (non-streaming).
+- [Function: formatSummaryLine()](./docs/api/appkit/Function.formatSummaryLine.md): The final PASS/FAIL summary line.
 - [Function: fromSupervisorApi()](./docs/api/appkit/Function.fromSupervisorApi.md): Creates an AgentAdapter backed by the Databricks AI Gateway
 - [Function: functionToolToDefinition()](./docs/api/appkit/Function.functionToolToDefinition.md): Parameters
 - [Function: generateDatabaseCredential()](./docs/api/appkit/Function.generateDatabaseCredential.md): Generate OAuth credentials for Postgres database connection using the proper Postgres API.
@@ -111,19 +125,30 @@ npx @databricks/appkit docs <query>
 - [Function: getUsernameWithApiLookup()](./docs/api/appkit/Function.getUsernameWithApiLookup.md): Resolves the PostgreSQL username for a Lakebase connection.
 - [Function: getWorkspaceClient()](./docs/api/appkit/Function.getWorkspaceClient.md): Get workspace client from config or SDK default auth chain
 - [Function: id()](./docs/api/appkit/Function.id.md): Returns
+- [Function: includes()](./docs/api/appkit/Function.includes.md): Passes when the value contains substring.
 - [Function: integer()](./docs/api/appkit/Function.integer.md): Returns
 - [Function: isFunctionTool()](./docs/api/appkit/Function.isFunctionTool.md): Parameters
 - [Function: isHostedTool()](./docs/api/appkit/Function.isHostedTool.md): Parameters
+- [Function: isJudgeConfigured()](./docs/api/appkit/Function.isJudgeConfigured.md): Returns
 - [Function: isSQLTypeMarker()](./docs/api/appkit/Function.isSQLTypeMarker.md): Type guard to check if a value is a SQL type marker
 - [Function: isSupervisorTool()](./docs/api/appkit/Function.isSupervisorTool.md): Type guard for HostedSupervisorTool. Used by the agents plugin
 - [Function: isToolkitEntry()](./docs/api/appkit/Function.isToolkitEntry.md): Type guard for ToolkitEntry — used by the agents plugin to differentiate
 - [Function: jsonb()](./docs/api/appkit/Function.jsonb.md): Returns
 - [Function: loadAgentFromFile()](./docs/api/appkit/Function.loadAgentFromFile.md): Loads a single markdown agent file and resolves its frontmatter against
 - [Function: loadAgentsFromDir()](./docs/api/appkit/Function.loadAgentsFromDir.md): Scans a directory for one subdirectory per agent, each containing
+- [Function: matches()](./docs/api/appkit/Function.matches.md): Passes when the value matches pattern.
 - [Function: mcpServer()](./docs/api/appkit/Function.mcpServer.md): Factory for declaring a custom MCP server tool.
+- [Function: normalizeHost()](./docs/api/appkit/Function.normalizeHost.md): Ensure the host has a scheme (Databricks env often lacks https://).
 - [Function: parseTextToolCalls()](./docs/api/appkit/Function.parseTextToolCalls.md): Parses text-based tool calls from model output.
+- [Function: readEvalDataset()](./docs/api/appkit/Function.readEvalDataset.md): Read a Databricks managed evaluation dataset (a Unity Catalog table with
+- [Function: reportToMlflow()](./docs/api/appkit/Function.reportToMlflow.md): Write one pass/fail assessment per eval result to the Databricks MLflow REST
+- [Function: resolveDatabricksAuth()](./docs/api/appkit/Function.resolveDatabricksAuth.md): Parameters
 - [Function: resolveHostedTools()](./docs/api/appkit/Function.resolveHostedTools.md): Parameters
+- [Function: resolveWorkspaceClient()](./docs/api/appkit/Function.resolveWorkspaceClient.md): Construct a Databricks WorkspaceClient for the eval runner — the object the
 - [Function: runAgent()](./docs/api/appkit/Function.runAgent.md): Standalone agent execution without createApp. Resolves the adapter, binds
+- [Function: runEval()](./docs/api/appkit/Function.runEval.md): Run a single eval against a driver. Never throws for assertion or agent
+- [Function: runEvalsInDir()](./docs/api/appkit/Function.runEvalsInDir.md): Discover, load, and run every eval under each agent's evals/ dir, driving
+- [Function: summarize()](./docs/api/appkit/Function.summarize.md): Parameters
 - [Function: text()](./docs/api/appkit/Function.text.md): Returns
 - [Function: timestamp()](./docs/api/appkit/Function.timestamp.md): Parameters
 - [Function: tool()](./docs/api/appkit/Function.tool.md): Factory for defining function tools with Zod schemas.
@@ -136,18 +161,36 @@ npx @databricks/appkit docs <query>
 - [Interface: AgentRunContext](./docs/api/appkit/Interface.AgentRunContext.md): Properties
 - [Interface: AgentsPluginConfig](./docs/api/appkit/Interface.AgentsPluginConfig.md): Base configuration interface for AppKit plugins
 - [Interface: AgentToolDefinition](./docs/api/appkit/Interface.AgentToolDefinition.md): Properties
+- [Interface: AssertionHandle](./docs/api/appkit/Interface.AssertionHandle.md): Chainable handle returned by every assertion to control its severity.
+- [Interface: AssertionResult](./docs/api/appkit/Interface.AssertionResult.md): A single recorded assertion outcome.
+- [Interface: Assessment](./docs/api/appkit/Interface.Assessment.md): A Feedback assessment in the MLflow REST proto-JSON shape.
 - [Interface: AutoInheritToolsConfig](./docs/api/appkit/Interface.AutoInheritToolsConfig.md): Auto-inherit configuration. When enabled for a given agent origin, agents
 - [Interface: BasePluginConfig](./docs/api/appkit/Interface.BasePluginConfig.md): Base configuration interface for AppKit plugins
 - [Interface: CacheConfig](./docs/api/appkit/Interface.CacheConfig.md): Configuration for the CacheInterceptor. Controls TTL, size limits, storage backend, and probabilistic cleanup.
+- [Interface: CustomJudgeSpec](./docs/api/appkit/Interface.CustomJudgeSpec.md): A custom LLM-judge definition: a prompt template and choice→score mapping.
 - [Interface: DatabaseCredential](./docs/api/appkit/Interface.DatabaseCredential.md): Database credentials with OAuth token for Postgres connection
 - [Interface: DatabaseRegistry](./docs/api/appkit/Interface.DatabaseRegistry.md): CANONICAL augmentation target. Empty by default; the generated database.d.ts
+- [Interface: DatabaseValidationIssue](./docs/api/appkit/Interface.DatabaseValidationIssue.md): One rejected field; path names public columns, never their values.
+- [Interface: DatabricksAuth](./docs/api/appkit/Interface.DatabricksAuth.md): Resolved Databricks host + bearer token for the eval runner's REST calls.
+- [Interface: DatasetRow](./docs/api/appkit/Interface.DatasetRow.md): One row of a managed evaluation dataset. inputs are the kwargs passed to the
+- [Interface: DiscoveredEval](./docs/api/appkit/Interface.DiscoveredEval.md): An eval file found under server/agents//evals/.
+- [Interface: DriveResult](./docs/api/appkit/Interface.DriveResult.md): What a driver returns for a single t.send.
 - [Interface: EndpointConfig](./docs/api/appkit/Interface.EndpointConfig.md): Properties
+- [Interface: EntityMutationHooks<TTable>](./docs/api/appkit/Interface.EntityMutationHooks.md): Mutation lifecycle for one entity. A before hook may return a replacement
+- [Interface: EvalDefinition](./docs/api/appkit/Interface.EvalDefinition.md): A single eval, default-exported from a *.eval.ts file.
+- [Interface: EvalDriver](./docs/api/appkit/Interface.EvalDriver.md): Abstraction over how the agent is driven. The HTTP driver posts to a running
+- [Interface: EvalResult](./docs/api/appkit/Interface.EvalResult.md): The outcome of running one eval.
+- [Interface: EvalRunSummary](./docs/api/appkit/Interface.EvalRunSummary.md): Properties
+- [Interface: EvalSummary](./docs/api/appkit/Interface.EvalSummary.md): Properties
 - [Interface: FilePolicyUser](./docs/api/appkit/Interface.FilePolicyUser.md): Minimal user identity passed to the policy function.
 - [Interface: FileResource](./docs/api/appkit/Interface.FileResource.md): Describes the file or directory being acted upon.
 - [Interface: FunctionTool](./docs/api/appkit/Interface.FunctionTool.md): Properties
 - [Interface: GenerateDatabaseCredentialRequest](./docs/api/appkit/Interface.GenerateDatabaseCredentialRequest.md): Request parameters for generating database OAuth credentials
 - [Interface: GenerationParams](./docs/api/appkit/Interface.GenerationParams.md): Optional generation parameters forwarded to the OpenAI-compatible serving
+- [Interface: HookApp](./docs/api/appkit/Interface.HookApp.md): The only capability a hook receives: entities bound to its transaction.
+- [Interface: HookContext](./docs/api/appkit/Interface.HookContext.md): Which entity is being mutated, and the surface a hook may write through.
 - [Interface: HostedSupervisorTool](./docs/api/appkit/Interface.HostedSupervisorTool.md): Tagged record returned by every supervisorTools factory. The
+- [Interface: HttpDriverOptions](./docs/api/appkit/Interface.HttpDriverOptions.md): Properties
 - [Interface: IAiSearchConfig](./docs/api/appkit/Interface.IAiSearchConfig.md): Base configuration interface for AppKit plugins
 - [Interface: IJobsConfig](./docs/api/appkit/Interface.IJobsConfig.md): Configuration for the Jobs plugin.
 - [Interface: IndexConfig](./docs/api/appkit/Interface.IndexConfig.md): Properties
@@ -155,22 +198,32 @@ npx @databricks/appkit docs <query>
 - [Interface: JobAPI](./docs/api/appkit/Interface.JobAPI.md): User-facing API for a single configured job.
 - [Interface: JobConfig](./docs/api/appkit/Interface.JobConfig.md): Per-job configuration options.
 - [Interface: JobsConnectorConfig](./docs/api/appkit/Interface.JobsConnectorConfig.md): Properties
+- [Interface: JudgeConfig](./docs/api/appkit/Interface.JudgeConfig.md): Properties
+- [Interface: JudgeScore](./docs/api/appkit/Interface.JudgeScore.md): A normalized judge result. score is 0..1.
 - [Interface: LakebasePool](./docs/api/appkit/Interface.LakebasePool.md): Subset of pg.Pool exposed by the Lakebase plugin.
 - [Interface: LakebasePoolConfig](./docs/api/appkit/Interface.LakebasePoolConfig.md): Configuration for creating a Lakebase connection pool
 - [Interface: LakebasePoolManager](./docs/api/appkit/Interface.LakebasePoolManager.md): Manages multiple Lakebase connection pools keyed by an identifier (e.g. userId).
+- [Interface: MatchResult](./docs/api/appkit/Interface.MatchResult.md): Result of a deterministic matcher run against a value.
 - [Interface: McpConnectAllResult](./docs/api/appkit/Interface.McpConnectAllResult.md): Per-endpoint outcome of AppKitMcpClient.connectAll. Callers (the
 - [Interface: Message](./docs/api/appkit/Interface.Message.md): Properties
 - [Interface: PluginManifest<TName>](./docs/api/appkit/Interface.PluginManifest.md): Plugin manifest that declares metadata and resource requirements.
 - [Interface: PluginToolkitProvider](./docs/api/appkit/Interface.PluginToolkitProvider.md): Minimum shape every entry in the Plugins map must expose. Core
+- [Interface: PostResult](./docs/api/appkit/Interface.PostResult.md): Structured result for a best-effort POST that must not throw.
 - [Interface: PromptContext](./docs/api/appkit/Interface.PromptContext.md): Context passed to baseSystemPrompt callbacks.
+- [Interface: ReadEvalDatasetOptions](./docs/api/appkit/Interface.ReadEvalDatasetOptions.md): Properties
+- [Interface: ReadSerializerContext](./docs/api/appkit/Interface.ReadSerializerContext.md): Which entity and generated operation produced the row being shaped.
 - [Interface: RegisteredAgent](./docs/api/appkit/Interface.RegisteredAgent.md): Properties
+- [Interface: ReportOutcome](./docs/api/appkit/Interface.ReportOutcome.md): Properties
 - [Interface: RequestedClaims](./docs/api/appkit/Interface.RequestedClaims.md): Optional claims for fine-grained Unity Catalog table permissions
 - [Interface: RequestedResource](./docs/api/appkit/Interface.RequestedResource.md): Resource to request permissions for in Unity Catalog
 - [Interface: RerankerConfig](./docs/api/appkit/Interface.RerankerConfig.md): Properties
+- [Interface: ResolveDatabricksAuthOptions](./docs/api/appkit/Interface.ResolveDatabricksAuthOptions.md): Properties
 - [Interface: ResourceEntry](./docs/api/appkit/Interface.ResourceEntry.md): Internal representation of a resource in the registry.
 - [Interface: ResourceRequirement](./docs/api/appkit/Interface.ResourceRequirement.md): Declares a resource requirement for a plugin.
 - [Interface: RunAgentInput](./docs/api/appkit/Interface.RunAgentInput.md): Properties
 - [Interface: RunAgentResult](./docs/api/appkit/Interface.RunAgentResult.md): Properties
+- [Interface: RunEvalOptions](./docs/api/appkit/Interface.RunEvalOptions.md): Properties
+- [Interface: RunEvalsOptions](./docs/api/appkit/Interface.RunEvalsOptions.md): Properties
 - [Interface: Schema<TTableName>](./docs/api/appkit/Interface.Schema.md): One finalized schema. TTableName keeps the declared names in the type, so
 - [Interface: SearchRequest](./docs/api/appkit/Interface.SearchRequest.md): Properties
 - [Interface: SearchResponse<T>](./docs/api/appkit/Interface.SearchResponse.md): Type Parameters
@@ -181,6 +234,7 @@ npx @databricks/appkit docs <query>
 - [Interface: SupervisorApiAdapterOptions](./docs/api/appkit/Interface.SupervisorApiAdapterOptions.md): Properties
 - [Interface: SupervisorExtension](./docs/api/appkit/Interface.SupervisorExtension.md): Shape of the value at AgentInput.extensions[SUPERVISOREXTENSIONKEY].
 - [Interface: TelemetryConfig](./docs/api/appkit/Interface.TelemetryConfig.md): OpenTelemetry configuration for AppKit applications
+- [Interface: TestContext](./docs/api/appkit/Interface.TestContext.md): The t context passed to an eval's test function.
 - [Interface: Thread](./docs/api/appkit/Interface.Thread.md): Properties
 - [Interface: ThreadStore](./docs/api/appkit/Interface.ThreadStore.md): Methods
 - [Interface: ToolAnnotations](./docs/api/appkit/Interface.ToolAnnotations.md): Properties
@@ -199,7 +253,12 @@ npx @databricks/appkit docs <query>
 - [Type Alias: AgentToolsFn()](./docs/api/appkit/TypeAlias.AgentToolsFn.md): Function form of AgentDefinition.tools. Receives the typed
 - [Type Alias: BaseSystemPromptOption](./docs/api/appkit/TypeAlias.BaseSystemPromptOption.md)
 - [Type Alias: ConfigSchema](./docs/api/appkit/TypeAlias.ConfigSchema.md): Configuration schema definition for plugin config.
+- [Type Alias: DatabaseApiConfig<TSchema>](./docs/api/appkit/TypeAlias.DatabaseApiConfig.md): Full generated CRUD for every declared table by default. Set false to disable
+- [Type Alias: DatabaseApiWriteOperation](./docs/api/appkit/TypeAlias.DatabaseApiWriteOperation.md): Generated HTTP write operations.
+- [Type Alias: DatabaseApiWritesConfig<TSchema>](./docs/api/appkit/TypeAlias.DatabaseApiWritesConfig.md): All writes by default; false keeps reads only, and an object narrows writes.
 - [Type Alias: DatabaseExports](./docs/api/appkit/TypeAlias.DatabaseExports.md): Typed database API published by the plugin.
+- [Type Alias: EntityHooks<TTable>](./docs/api/appkit/TypeAlias.EntityHooks.md): Response shaping and mutation lifecycle declared for one table.
+- [Type Alias: EvalProgress](./docs/api/appkit/TypeAlias.EvalProgress.md)
 - [Type Alias: ExecutionResult<T>](./docs/api/appkit/TypeAlias.ExecutionResult.md): Discriminated union for plugin execution results.
 - [Type Alias: FileAction](./docs/api/appkit/TypeAlias.FileAction.md): Every action the files plugin can perform.
 - [Type Alias: FilePolicy()](./docs/api/appkit/TypeAlias.FilePolicy.md): A policy function that decides whether user may perform action on
@@ -207,16 +266,20 @@ npx @databricks/appkit docs <query>
 - [Type Alias: IAppRouter](./docs/api/appkit/TypeAlias.IAppRouter.md): Express router type for plugin route registration
 - [Type Alias: IDatabaseConfig<TSchema>](./docs/api/appkit/TypeAlias.IDatabaseConfig.md): Configuration for one schema-bound DatabasePlugin instance.
 - [Type Alias: JobsExport()](./docs/api/appkit/TypeAlias.JobsExport.md): Public API shape of the jobs plugin.
+- [Type Alias: Matcher()](./docs/api/appkit/TypeAlias.Matcher.md): A deterministic matcher: inspects a string value and returns a result.
 - [Type Alias: PluginData<T, U, N>](./docs/api/appkit/TypeAlias.PluginData.md): Tuple of plugin class, config, and name. Created by toPlugin() and passed to createApp().
 - [Type Alias: Plugins](./docs/api/appkit/TypeAlias.Plugins.md): Plugin map passed to the function form of AgentDefinition.tools.
+- [Type Alias: ReadSerializer()](./docs/api/appkit/TypeAlias.ReadSerializer.md): Shape one already private-safe row before it reaches the wire. A Promise
 - [Type Alias: ResolvedToolEntry](./docs/api/appkit/TypeAlias.ResolvedToolEntry.md): Internal tool-index entry after a tool record has been resolved to a dispatchable form.
 - [Type Alias: ResourceFieldEntry](./docs/api/appkit/TypeAlias.ResourceFieldEntry.md)
 - [Type Alias: ResourcePermission](./docs/api/appkit/TypeAlias.ResourcePermission.md): Union of all possible permission levels across all resource types.
 - [Type Alias: SearchFilters](./docs/api/appkit/TypeAlias.SearchFilters.md)
 - [Type Alias: ServingFactory](./docs/api/appkit/TypeAlias.ServingFactory.md): Factory function returned by AppKit.serving.
+- [Type Alias: Severity](./docs/api/appkit/TypeAlias.Severity.md): Whether an assertion fails the eval (gate) or is tracked only (soft).
 - [Type Alias: SupervisorTool](./docs/api/appkit/TypeAlias.SupervisorTool.md): Tools supported by the Databricks AI Gateway Responses API. The shapes match
 - [Type Alias: ToolRegistry](./docs/api/appkit/TypeAlias.ToolRegistry.md)
 - [Type Alias: ToPlugin()<T, U, N>](./docs/api/appkit/TypeAlias.ToPlugin.md): Factory function type returned by toPlugin(). Accepts optional config and returns a PluginData tuple.
+- [Type Alias: TransactionClient](./docs/api/appkit/TypeAlias.TransactionClient.md): Entity and SQL capabilities bound to one transaction.
 - [Variable: agents](./docs/api/appkit/Variable.agents.md): Plugin factory for the agents plugin. Discovers agents from
 - [Variable: aiSearch](./docs/api/appkit/Variable.aiSearch.md)
 - [Variable: READ_ACTIONS](./docs/api/appkit/Variable.READ_ACTIONS.md): Actions that only read data.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@databricks/appkit",
   "type": "module",
-  "version": "0.71.0",
+  "version": "0.73.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
@@ -56,7 +56,7 @@
   },
   "dependencies": {
     "@ast-grep/napi": "0.37.0",
-    "@databricks/lakebase": "0.5.0",
+    "@databricks/lakebase": "0.6.0",
     "@databricks/sdk-experimental": "0.17.0",
     "@mlflow/core": "0.4.0",
     "@opentelemetry/api": "1.9.0",
@@ -76,6 +76,7 @@
     "@opentelemetry/semantic-conventions": "1.38.0",
     "@types/semver": "7.7.1",
     "apache-arrow": "21.1.0",
+    "autoevals": "0.3.0",
     "dotenv": "16.6.1",
     "drizzle-orm": "0.45.2",
     "express": "4.22.2",