@databricks/appkit 0.72.0 → 0.73.0

package/docs/plugins/database.md

@@ -0,0 +1,144 @@
+# Database plugin
+
+Beta plugin
+
+This plugin is currently **beta**. APIs may change between minor releases. Import from `@databricks/appkit/beta`. See [Plugin Stability Tiers](./docs/plugins/stability.md).
+
+Declare a schema and use `database({ schema })` to get generated HTTP CRUD and a server-side database client. CRUD is enabled for every declared table by default. Use `api` to restrict the generated routes without disabling server-side access.
+
+Shared application access
+
+This plugin uses the app's service principal in deployed Databricks Apps. It does not support OBO and does not apply per-user or per-row authorization. Every caller who can reach the generated API can perform every enabled operation on every exposed row, including delete.
+
+Restrict access to the app and grant its service principal only the database permissions it needs. If users need different permissions or row ownership checks, disable the relevant generated routes and implement authorization in custom server routes. App admission alone does not provide row-level isolation.
+
+## Basic usage[​](#basic-usage "Direct link to Basic usage")
+
+Configure a Lakebase `postgres` resource and its connection environment variables as described in [Lakebase configuration](./docs/plugins/lakebase.md#environment-variables). The database tables must already exist and match the declared schema. This plugin checks connectivity during setup; it does not create or migrate tables.
+
+```ts
+import { createApp, server } from "@databricks/appkit";
+import { database, defineSchema, id, text } from "@databricks/appkit/beta";
+
+const schema = defineSchema((builder) => ({
+  notes: builder.table("notes", {
+    id: id(),
+    body: text().notNull(),
+  }),
+}));
+
+const AppKit = await createApp({
+  plugins: [server(), database({ schema })],
+});
+
+```
+
+With the server plugin enabled, this registers:
+
+| Method | Path                      | Operation    |
+| ------ | ------------------------- | ------------ |
+| GET    | `/api/database/notes`     | List rows    |
+| GET    | `/api/database/notes/:id` | Find one row |
+| POST   | `/api/database/notes`     | Create a row |
+| PATCH  | `/api/database/notes/:id` | Update a row |
+| DELETE | `/api/database/notes/:id` | Delete a row |
+
+A table without a public primary key supports list and create only. `upsert` is available to server code but has no generated HTTP route.
+
+## Restrict the generated API[​](#restrict-the-generated-api "Direct link to Restrict the generated API")
+
+Omitting `api`, or setting it to `true` or `{}`, enables full CRUD. Restrictions are optional. There is no separate write opt-in.
+
+```ts
+// No generated HTTP routes. The server-side client still works.
+database({ schema, api: false });
+
+// Read-only routes for every table.
+database({ schema, api: { writes: false } });
+
+// Full CRUD for selected tables only.
+database({ schema, api: { tables: ["notes"] } });
+
+// Allow reads, create, and update, but not delete.
+database({
+  schema,
+  api: { writes: { operations: ["create", "update"] } },
+});
+
+// Read every table, but allow writes only to notes.
+database({
+  schema,
+  api: { writes: { tables: ["notes"] } },
+});
+
+```
+
+| Option                  | Default                      | Effect                                    |
+| ----------------------- | ---------------------------- | ----------------------------------------- |
+| `api`                   | `true`                       | `false` disables all generated routes     |
+| `api.tables`            | All declared tables          | Limits which tables have routes           |
+| `api.writes`            | `true`                       | `false` keeps only read routes            |
+| `api.writes.tables`     | All exposed tables           | Limits which exposed tables accept writes |
+| `api.writes.operations` | `create`, `update`, `delete` | Limits which writes are enabled           |
+
+`api.tables: []` disables all generated routes. An empty write-table or write-operation list keeps reads and disables writes. Tables omitted from `api.tables` also cannot be included through relations on exposed tables. These restrictions apply to HTTP only, not to the server-side client or hooks.
+
+An omitted restriction uses its default. A malformed restriction fails setup. For example, `{ api: { write: false } }` is an error, not permission to generate all writes. Unknown tables, duplicate names, and unsupported operations also fail setup before the plugin creates a connection pool.
+
+Replace the former `crudRoutes` option with `api`. The old name is rejected at runtime so an old opt-out cannot silently enable the API. To preserve read-only behavior, specify `api: { writes: false }`.
+
+### Table names and setup errors[​](#table-names-and-setup-errors "Direct link to Table names and setup errors")
+
+Generated route names must:
+
+* Start with an ASCII letter.
+* Contain only ASCII letters, digits, underscores, or hyphens.
+* Be at most 64 characters long.
+* Be unique without regard to case, because Express routes are case-insensitive.
+
+The default API validates every declared table. A table such as `_events` fails setup instead of being silently omitted. The error names the table and suggests renaming it, excluding it with `api.tables`, or disabling routes with `api: false`. An excluded table remains available to server code.
+
+Configuration errors include actionable details in the server-side error message. Client-facing messages do not expose those details.
+
+## Validation and private columns[​](#validation-and-private-columns "Direct link to Validation and private columns")
+
+The generated API validates request bodies and rejects unknown or read-only fields. Columns marked `.private()` are not available through generated routes. Database-generated primary keys, including `uuid().primaryKey().defaultRandom()`, cannot be supplied by HTTP callers. A natural primary key may be supplied on create, but primary keys cannot be updated through HTTP.
+
+Validation is not authorization. A valid request can still read or change any exposed row. Use custom authorized routes when that is not the desired access model.
+
+## Mutation hooks[​](#mutation-hooks "Direct link to Mutation hooks")
+
+A table can declare `beforeCreate`, `afterCreate`, `beforeUpdate`, `afterUpdate`, `beforeUpsert`, `afterUpsert`, `beforeDelete`, and `afterDelete`. Hooks and the mutation run in one database transaction. Related writes through `ctx.app.database` join that same transaction. This does not make writes through other plugins or external services transactional.
+
+```ts
+import { DatabaseValidationError } from "@databricks/appkit";
+
+database({
+  schema,
+  hooks: {
+    notes: {
+      beforeCreate(values) {
+        if (typeof values.body === "string" && values.body.length > 5_000) {
+          throw new DatabaseValidationError("Note too long", [
+            { path: ["body"], message: "Must be at most 5000 characters" },
+          ]);
+        }
+      },
+    },
+  },
+});
+
+```
+
+A `before*` hook can return replacement values, which are validated again before persistence. `DatabaseValidationError` produces HTTP 422 with issues limited to public columns. Other hook failures return an opaque server error.
+
+Keep hooks short and await all database work. A transaction has a 30-second callback deadline, a shared budget of 100 database operations, and a maximum mutation nesting depth of 8. Repeating the same entity and mutation operation in a nested hook chain is rejected. PostgreSQL also enforces a 30-second `statement_timeout` and a 30-second `idle_in_transaction_session_timeout`.
+
+The callback deadline does not cancel arbitrary JavaScript, HTTP requests, or other external side effects. Avoid putting external side effects in hooks that need database rollback semantics.
+
+## API reference[​](#api-reference "Direct link to API reference")
+
+* [`database`](./docs/api/appkit/Function.database.md)
+* [`IDatabaseConfig`](./docs/api/appkit/TypeAlias.IDatabaseConfig.md)
+* [`DatabaseApiConfig`](./docs/api/appkit/TypeAlias.DatabaseApiConfig.md)
+* [`EntityHooks`](./docs/api/appkit/TypeAlias.EntityHooks.md)

package/llms.txt

@@ -48,6 +48,7 @@ npx @databricks/appkit docs <query>
 - [Analytics plugin](./docs/plugins/analytics.md): Enables SQL query execution against Databricks SQL Warehouses.
 - [Caching](./docs/plugins/caching.md): AppKit provides both global and plugin-level caching capabilities.
 - [Creating custom plugins](./docs/plugins/custom-plugins.md): If you need custom API routes or background logic, implement an AppKit plugin. The fastest way is to use the CLI:
+- [Database plugin](./docs/plugins/database.md): This plugin is currently beta. APIs may change between minor releases. Import from @databricks/appkit/beta. See Plugin Stability Tiers.
 - [Execution context](./docs/plugins/execution-context.md): AppKit manages Databricks authentication via two contexts:
 - [Files plugin](./docs/plugins/files.md): File operations against Databricks Unity Catalog Volumes. Supports listing, reading, downloading, uploading, deleting, and previewing files with built-in caching, retry, and timeout handling via the execution interceptor pipeline.
 - [Genie plugin](./docs/plugins/genie.md): Integrates Databricks AI/BI Genie spaces into your AppKit application, enabling natural language data queries via a conversational interface.
@@ -68,6 +69,7 @@ npx @databricks/appkit docs <query>
 - [Class: AuthenticationError](./docs/api/appkit/Class.AuthenticationError.md): Error thrown when authentication fails.
 - [Class: ConfigurationError](./docs/api/appkit/Class.ConfigurationError.md): Error thrown when configuration is missing or invalid.
 - [Class: ConnectionError](./docs/api/appkit/Class.ConnectionError.md): Error thrown when a connection or network operation fails.
+- [Class: DatabaseValidationError](./docs/api/appkit/Class.DatabaseValidationError.md): Deliberate validation failure raised by a database mutation hook. Generated
 - [Class: DatabricksAdapter](./docs/api/appkit/Class.DatabricksAdapter.md): Adapter that talks directly to Databricks Model Serving /invocations endpoint.
 - [Class: ExecutionError](./docs/api/appkit/Class.ExecutionError.md): Error thrown when an operation execution fails.
 - [Class: InitializationError](./docs/api/appkit/Class.InitializationError.md): Error thrown when a service or component is not properly initialized.
@@ -138,9 +140,11 @@ npx @databricks/appkit docs <query>
 - [Function: mcpServer()](./docs/api/appkit/Function.mcpServer.md): Factory for declaring a custom MCP server tool.
 - [Function: normalizeHost()](./docs/api/appkit/Function.normalizeHost.md): Ensure the host has a scheme (Databricks env often lacks https://).
 - [Function: parseTextToolCalls()](./docs/api/appkit/Function.parseTextToolCalls.md): Parses text-based tool calls from model output.
+- [Function: readEvalDataset()](./docs/api/appkit/Function.readEvalDataset.md): Read a Databricks managed evaluation dataset (a Unity Catalog table with
 - [Function: reportToMlflow()](./docs/api/appkit/Function.reportToMlflow.md): Write one pass/fail assessment per eval result to the Databricks MLflow REST
 - [Function: resolveDatabricksAuth()](./docs/api/appkit/Function.resolveDatabricksAuth.md): Parameters
 - [Function: resolveHostedTools()](./docs/api/appkit/Function.resolveHostedTools.md): Parameters
+- [Function: resolveWorkspaceClient()](./docs/api/appkit/Function.resolveWorkspaceClient.md): Construct a Databricks WorkspaceClient for the eval runner — the object the
 - [Function: runAgent()](./docs/api/appkit/Function.runAgent.md): Standalone agent execution without createApp. Resolves the adapter, binds
 - [Function: runEval()](./docs/api/appkit/Function.runEval.md): Run a single eval against a driver. Never throws for assertion or agent
 - [Function: runEvalsInDir()](./docs/api/appkit/Function.runEvalsInDir.md): Discover, load, and run every eval under each agent's evals/ dir, driving
@@ -166,10 +170,13 @@ npx @databricks/appkit docs <query>
 - [Interface: CustomJudgeSpec](./docs/api/appkit/Interface.CustomJudgeSpec.md): A custom LLM-judge definition: a prompt template and choice→score mapping.
 - [Interface: DatabaseCredential](./docs/api/appkit/Interface.DatabaseCredential.md): Database credentials with OAuth token for Postgres connection
 - [Interface: DatabaseRegistry](./docs/api/appkit/Interface.DatabaseRegistry.md): CANONICAL augmentation target. Empty by default; the generated database.d.ts
+- [Interface: DatabaseValidationIssue](./docs/api/appkit/Interface.DatabaseValidationIssue.md): One rejected field; path names public columns, never their values.
 - [Interface: DatabricksAuth](./docs/api/appkit/Interface.DatabricksAuth.md): Resolved Databricks host + bearer token for the eval runner's REST calls.
+- [Interface: DatasetRow](./docs/api/appkit/Interface.DatasetRow.md): One row of a managed evaluation dataset. inputs are the kwargs passed to the
 - [Interface: DiscoveredEval](./docs/api/appkit/Interface.DiscoveredEval.md): An eval file found under server/agents//evals/.
 - [Interface: DriveResult](./docs/api/appkit/Interface.DriveResult.md): What a driver returns for a single t.send.
 - [Interface: EndpointConfig](./docs/api/appkit/Interface.EndpointConfig.md): Properties
+- [Interface: EntityMutationHooks<TTable>](./docs/api/appkit/Interface.EntityMutationHooks.md): Mutation lifecycle for one entity. A before hook may return a replacement
 - [Interface: EvalDefinition](./docs/api/appkit/Interface.EvalDefinition.md): A single eval, default-exported from a *.eval.ts file.
 - [Interface: EvalDriver](./docs/api/appkit/Interface.EvalDriver.md): Abstraction over how the agent is driven. The HTTP driver posts to a running
 - [Interface: EvalResult](./docs/api/appkit/Interface.EvalResult.md): The outcome of running one eval.
@@ -180,6 +187,8 @@ npx @databricks/appkit docs <query>
 - [Interface: FunctionTool](./docs/api/appkit/Interface.FunctionTool.md): Properties
 - [Interface: GenerateDatabaseCredentialRequest](./docs/api/appkit/Interface.GenerateDatabaseCredentialRequest.md): Request parameters for generating database OAuth credentials
 - [Interface: GenerationParams](./docs/api/appkit/Interface.GenerationParams.md): Optional generation parameters forwarded to the OpenAI-compatible serving
+- [Interface: HookApp](./docs/api/appkit/Interface.HookApp.md): The only capability a hook receives: entities bound to its transaction.
+- [Interface: HookContext](./docs/api/appkit/Interface.HookContext.md): Which entity is being mutated, and the surface a hook may write through.
 - [Interface: HostedSupervisorTool](./docs/api/appkit/Interface.HostedSupervisorTool.md): Tagged record returned by every supervisorTools factory. The
 - [Interface: HttpDriverOptions](./docs/api/appkit/Interface.HttpDriverOptions.md): Properties
 - [Interface: IAiSearchConfig](./docs/api/appkit/Interface.IAiSearchConfig.md): Base configuration interface for AppKit plugins
@@ -201,6 +210,8 @@ npx @databricks/appkit docs <query>
 - [Interface: PluginToolkitProvider](./docs/api/appkit/Interface.PluginToolkitProvider.md): Minimum shape every entry in the Plugins map must expose. Core
 - [Interface: PostResult](./docs/api/appkit/Interface.PostResult.md): Structured result for a best-effort POST that must not throw.
 - [Interface: PromptContext](./docs/api/appkit/Interface.PromptContext.md): Context passed to baseSystemPrompt callbacks.
+- [Interface: ReadEvalDatasetOptions](./docs/api/appkit/Interface.ReadEvalDatasetOptions.md): Properties
+- [Interface: ReadSerializerContext](./docs/api/appkit/Interface.ReadSerializerContext.md): Which entity and generated operation produced the row being shaped.
 - [Interface: RegisteredAgent](./docs/api/appkit/Interface.RegisteredAgent.md): Properties
 - [Interface: ReportOutcome](./docs/api/appkit/Interface.ReportOutcome.md): Properties
 - [Interface: RequestedClaims](./docs/api/appkit/Interface.RequestedClaims.md): Optional claims for fine-grained Unity Catalog table permissions
@@ -242,7 +253,11 @@ npx @databricks/appkit docs <query>
 - [Type Alias: AgentToolsFn()](./docs/api/appkit/TypeAlias.AgentToolsFn.md): Function form of AgentDefinition.tools. Receives the typed
 - [Type Alias: BaseSystemPromptOption](./docs/api/appkit/TypeAlias.BaseSystemPromptOption.md)
 - [Type Alias: ConfigSchema](./docs/api/appkit/TypeAlias.ConfigSchema.md): Configuration schema definition for plugin config.
+- [Type Alias: DatabaseApiConfig<TSchema>](./docs/api/appkit/TypeAlias.DatabaseApiConfig.md): Full generated CRUD for every declared table by default. Set false to disable
+- [Type Alias: DatabaseApiWriteOperation](./docs/api/appkit/TypeAlias.DatabaseApiWriteOperation.md): Generated HTTP write operations.
+- [Type Alias: DatabaseApiWritesConfig<TSchema>](./docs/api/appkit/TypeAlias.DatabaseApiWritesConfig.md): All writes by default; false keeps reads only, and an object narrows writes.
 - [Type Alias: DatabaseExports](./docs/api/appkit/TypeAlias.DatabaseExports.md): Typed database API published by the plugin.
+- [Type Alias: EntityHooks<TTable>](./docs/api/appkit/TypeAlias.EntityHooks.md): Response shaping and mutation lifecycle declared for one table.
 - [Type Alias: EvalProgress](./docs/api/appkit/TypeAlias.EvalProgress.md)
 - [Type Alias: ExecutionResult<T>](./docs/api/appkit/TypeAlias.ExecutionResult.md): Discriminated union for plugin execution results.
 - [Type Alias: FileAction](./docs/api/appkit/TypeAlias.FileAction.md): Every action the files plugin can perform.
@@ -254,6 +269,7 @@ npx @databricks/appkit docs <query>
 - [Type Alias: Matcher()](./docs/api/appkit/TypeAlias.Matcher.md): A deterministic matcher: inspects a string value and returns a result.
 - [Type Alias: PluginData<T, U, N>](./docs/api/appkit/TypeAlias.PluginData.md): Tuple of plugin class, config, and name. Created by toPlugin() and passed to createApp().
 - [Type Alias: Plugins](./docs/api/appkit/TypeAlias.Plugins.md): Plugin map passed to the function form of AgentDefinition.tools.
+- [Type Alias: ReadSerializer()](./docs/api/appkit/TypeAlias.ReadSerializer.md): Shape one already private-safe row before it reaches the wire. A Promise
 - [Type Alias: ResolvedToolEntry](./docs/api/appkit/TypeAlias.ResolvedToolEntry.md): Internal tool-index entry after a tool record has been resolved to a dispatchable form.
 - [Type Alias: ResourceFieldEntry](./docs/api/appkit/TypeAlias.ResourceFieldEntry.md)
 - [Type Alias: ResourcePermission](./docs/api/appkit/TypeAlias.ResourcePermission.md): Union of all possible permission levels across all resource types.
@@ -263,6 +279,7 @@ npx @databricks/appkit docs <query>
 - [Type Alias: SupervisorTool](./docs/api/appkit/TypeAlias.SupervisorTool.md): Tools supported by the Databricks AI Gateway Responses API. The shapes match
 - [Type Alias: ToolRegistry](./docs/api/appkit/TypeAlias.ToolRegistry.md)
 - [Type Alias: ToPlugin()<T, U, N>](./docs/api/appkit/TypeAlias.ToPlugin.md): Factory function type returned by toPlugin(). Accepts optional config and returns a PluginData tuple.
+- [Type Alias: TransactionClient](./docs/api/appkit/TypeAlias.TransactionClient.md): Entity and SQL capabilities bound to one transaction.
 - [Variable: agents](./docs/api/appkit/Variable.agents.md): Plugin factory for the agents plugin. Discovers agents from
 - [Variable: aiSearch](./docs/api/appkit/Variable.aiSearch.md)
 - [Variable: READ_ACTIONS](./docs/api/appkit/Variable.READ_ACTIONS.md): Actions that only read data.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@databricks/appkit",
   "type": "module",
-  "version": "0.72.0",
+  "version": "0.73.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "bin": {
@@ -56,7 +56,7 @@
   },
   "dependencies": {
     "@ast-grep/napi": "0.37.0",
-    "@databricks/lakebase": "0.5.0",
+    "@databricks/lakebase": "0.6.0",
     "@databricks/sdk-experimental": "0.17.0",
     "@mlflow/core": "0.4.0",
     "@opentelemetry/api": "1.9.0",