@databricks/appkit 0.83.0 → 0.84.0

package/dist/plugins/serving/serving.js.map

@@ -1 +1 @@
-{"version":3,"file":"serving.js","names":["manifest","servingConnector.stream","servingConnector.invoke"],"sources":["../../../src/plugins/serving/serving.ts"],"sourcesContent":["import path from \"node:path\";\nimport { Readable } from \"node:stream\";\nimport { pipeline } from \"node:stream/promises\";\n\nimport type express from \"express\";\nimport type { IAppRouter } from \"shared\";\n\nimport * as servingConnector from \"../../connectors/serving/client\";\nimport { getWorkspaceClient } from \"../../context\";\nimport { createLogger } from \"../../logging\";\nimport { type ExecutionResult, Plugin, toPlugin } from \"../../plugin\";\nimport type { ResourceRequirement } from \"../../registry\";\nimport { defineManifest, ResourceType } from \"../../registry\";\nimport { servingInvokeDefaults } from \"./defaults\";\nimport manifest from \"./manifest.json\";\nimport { filterRequestBody, loadEndpointSchemas } from \"./schema-filter\";\nimport type {\n  EndpointConfig,\n  IServingConfig,\n  ServingEndpointMethods,\n  ServingFactory,\n} from \"./types\";\n\nconst logger = createLogger(\"serving\");\n\nclass EndpointNotFoundError extends Error {\n  constructor(alias: string) {\n    super(`Unknown endpoint alias: ${alias}`);\n  }\n}\n\nclass EndpointNotConfiguredError extends Error {\n  constructor(alias: string, envVar: string) {\n    super(\n      `Endpoint '${alias}' is not configured: env var '${envVar}' is not set`,\n    );\n  }\n}\n\ninterface ResolvedEndpoint {\n  name: string;\n}\n\n/**\n * @deprecated The `serving` plugin is deprecated and will be removed in a\n * future release. Use the `agents` plugin instead.\n */\nexport class ServingPlugin extends Plugin {\n  static manifest = defineManifest<\"serving\">(manifest);\n\n  protected static description =\n    \"Authenticated proxy to Databricks Model Serving endpoints\";\n  declare protected config: IServingConfig;\n\n  private readonly endpoints: Record<string, EndpointConfig>;\n  private readonly isNamedMode: boolean;\n  private schemaAllowlists = new Map<string, Set<string>>();\n\n  constructor(config: IServingConfig) {\n    super(config);\n    this.config = config;\n\n    if (config.endpoints) {\n      this.endpoints = config.endpoints;\n      this.isNamedMode = true;\n    } else {\n      this.endpoints = {\n        default: { env: \"DATABRICKS_SERVING_ENDPOINT_NAME\" },\n      };\n      this.isNamedMode = false;\n    }\n  }\n\n  async setup(): Promise<void> {\n    logger.warn(\n      \"The `serving` plugin is deprecated and will be removed in a future release. \" +\n        \"Use the `agents` plugin instead.\",\n    );\n\n    const cacheFile = path.join(\n      process.cwd(),\n      \"node_modules\",\n      \".databricks\",\n      \"appkit\",\n      \".appkit-serving-types-cache.json\",\n    );\n    this.schemaAllowlists = await loadEndpointSchemas(cacheFile);\n    if (this.schemaAllowlists.size > 0) {\n      logger.debug(\n        \"Loaded schema allowlists for %d endpoint(s)\",\n        this.schemaAllowlists.size,\n      );\n    }\n  }\n\n  static getResourceRequirements(\n    config: IServingConfig,\n  ): ResourceRequirement[] {\n    const endpoints = config.endpoints ?? {\n      default: { env: \"DATABRICKS_SERVING_ENDPOINT_NAME\" },\n    };\n\n    return Object.entries(endpoints).map(([alias, endpointConfig]) => ({\n      type: ResourceType.SERVING_ENDPOINT,\n      alias: `serving-${alias}`,\n      resourceKey: `serving-${alias}`,\n      description: `Model Serving endpoint for \"${alias}\" inference`,\n      permission: \"CAN_QUERY\" as const,\n      fields: {\n        name: {\n          env: endpointConfig.env,\n          description: `Serving endpoint name for \"${alias}\"`,\n        },\n      },\n      required: true,\n    }));\n  }\n\n  private resolveAndFilter(\n    alias: string,\n    body: Record<string, unknown>,\n  ): { endpoint: ResolvedEndpoint; filteredBody: Record<string, unknown> } {\n    const config = this.endpoints[alias];\n    if (!config) {\n      throw new EndpointNotFoundError(alias);\n    }\n\n    const name = process.env[config.env];\n    if (!name) {\n      throw new EndpointNotConfiguredError(alias, config.env);\n    }\n\n    const endpoint: ResolvedEndpoint = { name };\n    const filteredBody = filterRequestBody(\n      body,\n      this.schemaAllowlists,\n      alias,\n      this.config.filterMode,\n    );\n    return { endpoint, filteredBody };\n  }\n\n  // All serving routes use OBO (On-Behalf-Of) by default, consistent with the\n  // Genie and Files plugins. This ensures per-user CAN_QUERY permissions are enforced.\n  injectRoutes(router: IAppRouter) {\n    if (this.isNamedMode) {\n      this.route(router, {\n        name: \"invoke\",\n        method: \"post\",\n        path: \"/:alias/invoke\",\n        handler: async (req: express.Request, res: express.Response) => {\n          await this.asUser(req)._handleInvoke(req, res);\n        },\n      });\n\n      this.route(router, {\n        name: \"stream\",\n        method: \"post\",\n        path: \"/:alias/stream\",\n        handler: async (req: express.Request, res: express.Response) => {\n          await this.asUser(req)._handleStream(req, res);\n        },\n      });\n    } else {\n      // Unnamed mode: register both /invoke and /:alias/invoke patterns.\n      // The type generator creates a \"default\" alias, so clients may use either URL.\n      const invokeHandler = async (\n        req: express.Request,\n        res: express.Response,\n      ) => {\n        req.params.alias ??= \"default\";\n        await this.asUser(req)._handleInvoke(req, res);\n      };\n      const streamHandler = async (\n        req: express.Request,\n        res: express.Response,\n      ) => {\n        req.params.alias ??= \"default\";\n        await this.asUser(req)._handleStream(req, res);\n      };\n\n      this.route(router, {\n        name: \"invoke\",\n        method: \"post\",\n        path: \"/invoke\",\n        handler: invokeHandler,\n      });\n      this.route(router, {\n        name: \"invoke-named\",\n        method: \"post\",\n        path: \"/:alias/invoke\",\n        handler: invokeHandler,\n      });\n      this.route(router, {\n        name: \"stream\",\n        method: \"post\",\n        path: \"/stream\",\n        handler: streamHandler,\n      });\n      this.route(router, {\n        name: \"stream-named\",\n        method: \"post\",\n        path: \"/:alias/stream\",\n        handler: streamHandler,\n      });\n    }\n  }\n\n  async _handleInvoke(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    const { alias } = req.params;\n    const rawBody = req.body as Record<string, unknown>;\n\n    try {\n      const result = await this.invoke(alias, rawBody);\n      if (!result.ok) {\n        res.status(result.status).json({ error: result.message });\n        return;\n      }\n      res.json(result.data);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Invocation failed\";\n      if (err instanceof EndpointNotFoundError) {\n        res.status(404).json({ error: message });\n      } else if (\n        err instanceof EndpointNotConfiguredError ||\n        message.startsWith(\"Unknown request parameters:\")\n      ) {\n        res.status(400).json({ error: message });\n      } else {\n        res.status(502).json({ error: message });\n      }\n    }\n  }\n\n  async _handleStream(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    const { alias } = req.params;\n    const rawBody = req.body as Record<string, unknown>;\n\n    let endpoint: ResolvedEndpoint;\n    let filteredBody: Record<string, unknown>;\n    try {\n      ({ endpoint, filteredBody } = this.resolveAndFilter(alias, rawBody));\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Invalid request\";\n      const status = err instanceof EndpointNotFoundError ? 404 : 400;\n      res.status(status).json({ error: message });\n      return;\n    }\n\n    const timeout = this.config.timeout ?? 120_000;\n    const workspaceClient = getWorkspaceClient();\n\n    // Pipe raw SSE bytes from the upstream endpoint directly to the client.\n    // No parsing/re-serialization — the upstream response is already valid SSE.\n    let rawStream: ReadableStream<Uint8Array>;\n    try {\n      rawStream = await servingConnector.stream(\n        workspaceClient,\n        endpoint.name,\n        filteredBody,\n      );\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Streaming request failed\";\n      res.status(502).json({ error: message });\n      return;\n    }\n\n    res.setHeader(\"Content-Type\", \"text/event-stream; charset=utf-8\");\n    res.setHeader(\"Cache-Control\", \"no-cache, no-transform\");\n    res.setHeader(\"X-Accel-Buffering\", \"no\");\n    res.flushHeaders();\n\n    const nodeStream = Readable.fromWeb(\n      rawStream as import(\"stream/web\").ReadableStream,\n    );\n    const abortController = new AbortController();\n    const timeoutId = setTimeout(() => abortController.abort(), timeout);\n\n    req.on(\"close\", () => abortController.abort());\n\n    try {\n      await pipeline(nodeStream, res, { signal: abortController.signal });\n    } catch (err) {\n      // AbortError is expected on client disconnect or timeout\n      if (err instanceof Error && err.name !== \"AbortError\") {\n        logger.warn(\"Stream pipe error: %s\", err.message);\n      }\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  async invoke(\n    alias: string,\n    body: Record<string, unknown>,\n  ): Promise<ExecutionResult<unknown>> {\n    const { endpoint, filteredBody } = this.resolveAndFilter(alias, body);\n    const workspaceClient = getWorkspaceClient();\n    const timeout = this.config.timeout ?? 120_000;\n\n    return this.execute(\n      () =>\n        servingConnector.invoke(workspaceClient, endpoint.name, filteredBody),\n      {\n        default: {\n          ...servingInvokeDefaults,\n          timeout,\n        },\n      },\n    );\n  }\n\n  clientConfig(): Record<string, unknown> {\n    return {\n      isNamedMode: this.isNamedMode,\n      aliases: Object.keys(this.endpoints),\n    };\n  }\n\n  async shutdown(): Promise<void> {\n    this.streamManager.abortAll();\n  }\n\n  protected createEndpointAPI(alias: string): ServingEndpointMethods {\n    return {\n      invoke: (body: Record<string, unknown>) => this.invoke(alias, body),\n    };\n  }\n\n  exports(): ServingFactory {\n    const resolveEndpoint = (alias?: string) => {\n      const resolved = alias ?? \"default\";\n      const spApi = this.createEndpointAPI(resolved);\n      return {\n        ...spApi,\n        asUser: (req: express.Request) => {\n          const userPlugin = this.asUser(req) as ServingPlugin;\n          return userPlugin.createEndpointAPI(resolved);\n        },\n      };\n    };\n    return resolveEndpoint as ServingFactory;\n  }\n}\n\n/**\n * @deprecated The `serving` plugin is deprecated and will be removed in a\n * future release. Use the `agents` plugin instead.\n * @internal\n */\nexport const serving = toPlugin(ServingPlugin);\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuBA,MAAM,SAAS,aAAa,UAAU;AAEtC,IAAM,wBAAN,cAAoC,MAAM;CACxC,YAAY,OAAe;AACzB,QAAM,2BAA2B,QAAQ;;;AAI7C,IAAM,6BAAN,cAAyC,MAAM;CAC7C,YAAY,OAAe,QAAgB;AACzC,QACE,aAAa,MAAM,gCAAgC,OAAO,cAC3D;;;;;;;AAYL,IAAa,gBAAb,cAAmC,OAAO;CACxC,OAAO,WAAW,eAA0BA,iBAAS;CAErD,OAAiB,cACf;CAGF,AAAiB;CACjB,AAAiB;CACjB,AAAQ,mCAAmB,IAAI,KAA0B;CAEzD,YAAY,QAAwB;AAClC,QAAM,OAAO;AACb,OAAK,SAAS;AAEd,MAAI,OAAO,WAAW;AACpB,QAAK,YAAY,OAAO;AACxB,QAAK,cAAc;SACd;AACL,QAAK,YAAY,EACf,SAAS,EAAE,KAAK,oCAAoC,EACrD;AACD,QAAK,cAAc;;;CAIvB,MAAM,QAAuB;AAC3B,SAAO,KACL,+GAED;AASD,OAAK,mBAAmB,MAAM,oBAPZ,KAAK,KACrB,QAAQ,KAAK,EACb,gBACA,eACA,UACA,mCACD,CAC2D;AAC5D,MAAI,KAAK,iBAAiB,OAAO,EAC/B,QAAO,MACL,+CACA,KAAK,iBAAiB,KACvB;;CAIL,OAAO,wBACL,QACuB;EACvB,MAAM,YAAY,OAAO,aAAa,EACpC,SAAS,EAAE,KAAK,oCAAoC,EACrD;AAED,SAAO,OAAO,QAAQ,UAAU,CAAC,KAAK,CAAC,OAAO,qBAAqB;GACjE,MAAM,aAAa;GACnB,OAAO,WAAW;GAClB,aAAa,WAAW;GACxB,aAAa,+BAA+B,MAAM;GAClD,YAAY;GACZ,QAAQ,EACN,MAAM;IACJ,KAAK,eAAe;IACpB,aAAa,8BAA8B,MAAM;IAClD,EACF;GACD,UAAU;GACX,EAAE;;CAGL,AAAQ,iBACN,OACA,MACuE;EACvE,MAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,OACH,OAAM,IAAI,sBAAsB,MAAM;EAGxC,MAAM,OAAO,QAAQ,IAAI,OAAO;AAChC,MAAI,CAAC,KACH,OAAM,IAAI,2BAA2B,OAAO,OAAO,IAAI;AAUzD,SAAO;GAAE,UAP0B,EAAE,MAAM;GAOxB,cANE,kBACnB,MACA,KAAK,kBACL,OACA,KAAK,OAAO,WACb;GACgC;;CAKnC,aAAa,QAAoB;AAC/B,MAAI,KAAK,aAAa;AACpB,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS,OAAO,KAAsB,QAA0B;AAC9D,WAAM,KAAK,OAAO,IAAI,CAAC,cAAc,KAAK,IAAI;;IAEjD,CAAC;AAEF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS,OAAO,KAAsB,QAA0B;AAC9D,WAAM,KAAK,OAAO,IAAI,CAAC,cAAc,KAAK,IAAI;;IAEjD,CAAC;SACG;GAGL,MAAM,gBAAgB,OACpB,KACA,QACG;AACH,QAAI,OAAO,UAAU;AACrB,UAAM,KAAK,OAAO,IAAI,CAAC,cAAc,KAAK,IAAI;;GAEhD,MAAM,gBAAgB,OACpB,KACA,QACG;AACH,QAAI,OAAO,UAAU;AACrB,UAAM,KAAK,OAAO,IAAI,CAAC,cAAc,KAAK,IAAI;;AAGhD,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;AACF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;AACF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;AACF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;;;CAIN,MAAM,cACJ,KACA,KACe;EACf,MAAM,EAAE,UAAU,IAAI;EACtB,MAAM,UAAU,IAAI;AAEpB,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,OAAO,OAAO,QAAQ;AAChD,OAAI,CAAC,OAAO,IAAI;AACd,QAAI,OAAO,OAAO,OAAO,CAAC,KAAK,EAAE,OAAO,OAAO,SAAS,CAAC;AACzD;;AAEF,OAAI,KAAK,OAAO,KAAK;WACd,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,OAAI,eAAe,sBACjB,KAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;YAExC,eAAe,8BACf,QAAQ,WAAW,8BAA8B,CAEjD,KAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;OAExC,KAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;;;CAK9C,MAAM,cACJ,KACA,KACe;EACf,MAAM,EAAE,UAAU,IAAI;EACtB,MAAM,UAAU,IAAI;EAEpB,IAAI;EACJ,IAAI;AACJ,MAAI;AACF,IAAC,CAAE,UAAU,gBAAiB,KAAK,iBAAiB,OAAO,QAAQ;WAC5D,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;GACrD,MAAM,SAAS,eAAe,wBAAwB,MAAM;AAC5D,OAAI,OAAO,OAAO,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;AAC3C;;EAGF,MAAM,UAAU,KAAK,OAAO,WAAW;EACvC,MAAM,kBAAkB,oBAAoB;EAI5C,IAAI;AACJ,MAAI;AACF,eAAY,MAAMC,OAChB,iBACA,SAAS,MACT,aACD;WACM,KAAK;GACZ,MAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,OAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;AACxC;;AAGF,MAAI,UAAU,gBAAgB,mCAAmC;AACjE,MAAI,UAAU,iBAAiB,yBAAyB;AACxD,MAAI,UAAU,qBAAqB,KAAK;AACxC,MAAI,cAAc;EAElB,MAAM,aAAa,SAAS,QAC1B,UACD;EACD,MAAM,kBAAkB,IAAI,iBAAiB;EAC7C,MAAM,YAAY,iBAAiB,gBAAgB,OAAO,EAAE,QAAQ;AAEpE,MAAI,GAAG,eAAe,gBAAgB,OAAO,CAAC;AAE9C,MAAI;AACF,SAAM,SAAS,YAAY,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,CAAC;WAC5D,KAAK;AAEZ,OAAI,eAAe,SAAS,IAAI,SAAS,aACvC,QAAO,KAAK,yBAAyB,IAAI,QAAQ;YAE3C;AACR,gBAAa,UAAU;;;CAI3B,MAAM,OACJ,OACA,MACmC;EACnC,MAAM,EAAE,UAAU,iBAAiB,KAAK,iBAAiB,OAAO,KAAK;EACrE,MAAM,kBAAkB,oBAAoB;EAC5C,MAAM,UAAU,KAAK,OAAO,WAAW;AAEvC,SAAO,KAAK,cAERC,OAAwB,iBAAiB,SAAS,MAAM,aAAa,EACvE,EACE,SAAS;GACP,GAAG;GACH;GACD,EACF,CACF;;CAGH,eAAwC;AACtC,SAAO;GACL,aAAa,KAAK;GAClB,SAAS,OAAO,KAAK,KAAK,UAAU;GACrC;;CAGH,MAAM,WAA0B;AAC9B,OAAK,cAAc,UAAU;;CAG/B,AAAU,kBAAkB,OAAuC;AACjE,SAAO,EACL,SAAS,SAAkC,KAAK,OAAO,OAAO,KAAK,EACpE;;CAGH,UAA0B;EACxB,MAAM,mBAAmB,UAAmB;GAC1C,MAAM,WAAW,SAAS;AAE1B,UAAO;IACL,GAFY,KAAK,kBAAkB,SAAS;IAG5C,SAAS,QAAyB;AAEhC,YADmB,KAAK,OAAO,IAAI,CACjB,kBAAkB,SAAS;;IAEhD;;AAEH,SAAO;;;;;;;;AASX,MAAa,UAAU,SAAS,cAAc"}
+{"version":3,"file":"serving.js","names":["manifest","servingConnector.stream","servingConnector.invoke"],"sources":["../../../src/plugins/serving/serving.ts"],"sourcesContent":["import path from \"node:path\";\nimport { Readable } from \"node:stream\";\nimport { pipeline } from \"node:stream/promises\";\n\nimport type express from \"express\";\nimport type { IAppRouter } from \"shared\";\n\nimport * as servingConnector from \"../../connectors/serving/client\";\nimport { getWorkspaceClient } from \"../../context\";\nimport { createLogger } from \"../../logging\";\nimport { type ExecutionResult, Plugin, toPlugin } from \"../../plugin\";\nimport type { ResourceRequirement } from \"../../registry\";\nimport { defineManifest, ResourceType } from \"../../registry\";\nimport { servingInvokeDefaults } from \"./defaults\";\nimport manifest from \"./manifest.json\";\nimport { filterRequestBody, loadEndpointSchemas } from \"./schema-filter\";\nimport type {\n  EndpointConfig,\n  IServingConfig,\n  ServingEndpointMethods,\n  ServingFactory,\n} from \"./types\";\n\nconst logger = createLogger(\"serving\");\n\nclass EndpointNotFoundError extends Error {\n  constructor(alias: string) {\n    super(`Unknown endpoint alias: ${alias}`);\n  }\n}\n\nclass EndpointNotConfiguredError extends Error {\n  constructor(alias: string, envVar: string) {\n    super(\n      `Endpoint '${alias}' is not configured: env var '${envVar}' is not set`,\n    );\n  }\n}\n\ninterface ResolvedEndpoint {\n  name: string;\n}\n\n/**\n * @deprecated The `serving` plugin is deprecated and will be removed in a\n * future release. Use the `agents` plugin instead.\n */\nexport class ServingPlugin extends Plugin {\n  static manifest = defineManifest<\"serving\">(manifest);\n\n  protected static description =\n    \"Authenticated proxy to Databricks Model Serving endpoints\";\n  declare protected config: IServingConfig;\n\n  private readonly endpoints: Record<string, EndpointConfig>;\n  private readonly isNamedMode: boolean;\n  private schemaAllowlists = new Map<string, Set<string>>();\n\n  constructor(config: IServingConfig) {\n    super(config);\n    this.config = config;\n\n    if (config.endpoints) {\n      this.endpoints = config.endpoints;\n      this.isNamedMode = true;\n    } else {\n      this.endpoints = {\n        default: { env: \"DATABRICKS_SERVING_ENDPOINT_NAME\" },\n      };\n      this.isNamedMode = false;\n    }\n  }\n\n  async setup(): Promise<void> {\n    logger.warn(\n      \"The `serving` plugin is deprecated and will be removed in a future release. \" +\n        \"Use the `agents` plugin instead.\",\n    );\n\n    const cacheFile = path.join(\n      process.cwd(),\n      \"node_modules\",\n      \".databricks\",\n      \"appkit\",\n      \".appkit-serving-types-cache.json\",\n    );\n    this.schemaAllowlists = await loadEndpointSchemas(cacheFile);\n    if (this.schemaAllowlists.size > 0) {\n      logger.debug(\n        \"Loaded schema allowlists for %d endpoint(s)\",\n        this.schemaAllowlists.size,\n      );\n    }\n  }\n\n  static getResourceRequirements(\n    config: IServingConfig,\n  ): ResourceRequirement[] {\n    const endpoints = config.endpoints ?? {\n      default: { env: \"DATABRICKS_SERVING_ENDPOINT_NAME\" },\n    };\n\n    return Object.entries(endpoints).map(([alias, endpointConfig]) => ({\n      type: ResourceType.SERVING_ENDPOINT,\n      alias: `serving-${alias}`,\n      resourceKey: `serving-${alias}`,\n      description: `Model Serving endpoint for \"${alias}\" inference`,\n      permission: \"CAN_QUERY\" as const,\n      fields: {\n        name: {\n          env: endpointConfig.env,\n          description: `Serving endpoint name for \"${alias}\"`,\n        },\n      },\n      required: true,\n    }));\n  }\n\n  private resolveAndFilter(\n    alias: string,\n    body: Record<string, unknown>,\n  ): { endpoint: ResolvedEndpoint; filteredBody: Record<string, unknown> } {\n    const config = this.endpoints[alias];\n    if (!config) {\n      throw new EndpointNotFoundError(alias);\n    }\n\n    const name = process.env[config.env];\n    if (!name) {\n      throw new EndpointNotConfiguredError(alias, config.env);\n    }\n\n    const endpoint: ResolvedEndpoint = { name };\n    const filteredBody = filterRequestBody(\n      body,\n      this.schemaAllowlists,\n      alias,\n      this.config.filterMode,\n    );\n    return { endpoint, filteredBody };\n  }\n\n  // All serving routes use OBO (On-Behalf-Of) by default, consistent with the\n  // Genie and Files plugins. This ensures per-user CAN_QUERY permissions are enforced.\n  injectRoutes(router: IAppRouter) {\n    if (this.isNamedMode) {\n      this.route(router, {\n        name: \"invoke\",\n        method: \"post\",\n        path: \"/:alias/invoke\",\n        handler: async (req: express.Request, res: express.Response) => {\n          await this._asUserScoped(req)._handleInvoke(req, res);\n        },\n      });\n\n      this.route(router, {\n        name: \"stream\",\n        method: \"post\",\n        path: \"/:alias/stream\",\n        handler: async (req: express.Request, res: express.Response) => {\n          await this._asUserScoped(req)._handleStream(req, res);\n        },\n      });\n    } else {\n      // Unnamed mode: register both /invoke and /:alias/invoke patterns.\n      // The type generator creates a \"default\" alias, so clients may use either URL.\n      const invokeHandler = async (\n        req: express.Request,\n        res: express.Response,\n      ) => {\n        req.params.alias ??= \"default\";\n        await this._asUserScoped(req)._handleInvoke(req, res);\n      };\n      const streamHandler = async (\n        req: express.Request,\n        res: express.Response,\n      ) => {\n        req.params.alias ??= \"default\";\n        await this._asUserScoped(req)._handleStream(req, res);\n      };\n\n      this.route(router, {\n        name: \"invoke\",\n        method: \"post\",\n        path: \"/invoke\",\n        handler: invokeHandler,\n      });\n      this.route(router, {\n        name: \"invoke-named\",\n        method: \"post\",\n        path: \"/:alias/invoke\",\n        handler: invokeHandler,\n      });\n      this.route(router, {\n        name: \"stream\",\n        method: \"post\",\n        path: \"/stream\",\n        handler: streamHandler,\n      });\n      this.route(router, {\n        name: \"stream-named\",\n        method: \"post\",\n        path: \"/:alias/stream\",\n        handler: streamHandler,\n      });\n    }\n  }\n\n  async _handleInvoke(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    const { alias } = req.params;\n    const rawBody = req.body as Record<string, unknown>;\n\n    try {\n      const result = await this.invoke(alias, rawBody);\n      if (!result.ok) {\n        res.status(result.status).json({ error: result.message });\n        return;\n      }\n      res.json(result.data);\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Invocation failed\";\n      if (err instanceof EndpointNotFoundError) {\n        res.status(404).json({ error: message });\n      } else if (\n        err instanceof EndpointNotConfiguredError ||\n        message.startsWith(\"Unknown request parameters:\")\n      ) {\n        res.status(400).json({ error: message });\n      } else {\n        res.status(502).json({ error: message });\n      }\n    }\n  }\n\n  async _handleStream(\n    req: express.Request,\n    res: express.Response,\n  ): Promise<void> {\n    const { alias } = req.params;\n    const rawBody = req.body as Record<string, unknown>;\n\n    let endpoint: ResolvedEndpoint;\n    let filteredBody: Record<string, unknown>;\n    try {\n      ({ endpoint, filteredBody } = this.resolveAndFilter(alias, rawBody));\n    } catch (err) {\n      const message = err instanceof Error ? err.message : \"Invalid request\";\n      const status = err instanceof EndpointNotFoundError ? 404 : 400;\n      res.status(status).json({ error: message });\n      return;\n    }\n\n    const timeout = this.config.timeout ?? 120_000;\n    const workspaceClient = getWorkspaceClient();\n\n    // Pipe raw SSE bytes from the upstream endpoint directly to the client.\n    // No parsing/re-serialization — the upstream response is already valid SSE.\n    let rawStream: ReadableStream<Uint8Array>;\n    try {\n      rawStream = await servingConnector.stream(\n        workspaceClient,\n        endpoint.name,\n        filteredBody,\n      );\n    } catch (err) {\n      const message =\n        err instanceof Error ? err.message : \"Streaming request failed\";\n      res.status(502).json({ error: message });\n      return;\n    }\n\n    res.setHeader(\"Content-Type\", \"text/event-stream; charset=utf-8\");\n    res.setHeader(\"Cache-Control\", \"no-cache, no-transform\");\n    res.setHeader(\"X-Accel-Buffering\", \"no\");\n    res.flushHeaders();\n\n    const nodeStream = Readable.fromWeb(\n      rawStream as import(\"stream/web\").ReadableStream,\n    );\n    const abortController = new AbortController();\n    const timeoutId = setTimeout(() => abortController.abort(), timeout);\n\n    req.on(\"close\", () => abortController.abort());\n\n    try {\n      await pipeline(nodeStream, res, { signal: abortController.signal });\n    } catch (err) {\n      // AbortError is expected on client disconnect or timeout\n      if (err instanceof Error && err.name !== \"AbortError\") {\n        logger.warn(\"Stream pipe error: %s\", err.message);\n      }\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  async invoke(\n    alias: string,\n    body: Record<string, unknown>,\n  ): Promise<ExecutionResult<unknown>> {\n    const { endpoint, filteredBody } = this.resolveAndFilter(alias, body);\n    const workspaceClient = getWorkspaceClient();\n    const timeout = this.config.timeout ?? 120_000;\n\n    return this.execute(\n      () =>\n        servingConnector.invoke(workspaceClient, endpoint.name, filteredBody),\n      {\n        default: {\n          ...servingInvokeDefaults,\n          timeout,\n        },\n      },\n    );\n  }\n\n  clientConfig(): Record<string, unknown> {\n    return {\n      isNamedMode: this.isNamedMode,\n      aliases: Object.keys(this.endpoints),\n    };\n  }\n\n  async shutdown(): Promise<void> {\n    this.streamManager.abortAll();\n  }\n\n  protected createEndpointAPI(alias: string): ServingEndpointMethods {\n    return {\n      invoke: (body: Record<string, unknown>) => this.invoke(alias, body),\n    };\n  }\n\n  exports(): ServingFactory {\n    const resolveEndpoint = (alias?: string) => {\n      const resolved = alias ?? \"default\";\n      const spApi = this.createEndpointAPI(resolved);\n      return {\n        ...spApi,\n        asUser: (req: express.Request) => {\n          const userPlugin = this._asUserScoped(req) as ServingPlugin;\n          return userPlugin.createEndpointAPI(resolved);\n        },\n      };\n    };\n    return resolveEndpoint as ServingFactory;\n  }\n}\n\n/**\n * @deprecated The `serving` plugin is deprecated and will be removed in a\n * future release. Use the `agents` plugin instead.\n * @internal\n */\nexport const serving = toPlugin(ServingPlugin);\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuBA,MAAM,SAAS,aAAa,UAAU;AAEtC,IAAM,wBAAN,cAAoC,MAAM;CACxC,YAAY,OAAe;AACzB,QAAM,2BAA2B,QAAQ;;;AAI7C,IAAM,6BAAN,cAAyC,MAAM;CAC7C,YAAY,OAAe,QAAgB;AACzC,QACE,aAAa,MAAM,gCAAgC,OAAO,cAC3D;;;;;;;AAYL,IAAa,gBAAb,cAAmC,OAAO;CACxC,OAAO,WAAW,eAA0BA,iBAAS;CAErD,OAAiB,cACf;CAGF,AAAiB;CACjB,AAAiB;CACjB,AAAQ,mCAAmB,IAAI,KAA0B;CAEzD,YAAY,QAAwB;AAClC,QAAM,OAAO;AACb,OAAK,SAAS;AAEd,MAAI,OAAO,WAAW;AACpB,QAAK,YAAY,OAAO;AACxB,QAAK,cAAc;SACd;AACL,QAAK,YAAY,EACf,SAAS,EAAE,KAAK,oCAAoC,EACrD;AACD,QAAK,cAAc;;;CAIvB,MAAM,QAAuB;AAC3B,SAAO,KACL,+GAED;AASD,OAAK,mBAAmB,MAAM,oBAPZ,KAAK,KACrB,QAAQ,KAAK,EACb,gBACA,eACA,UACA,mCACD,CAC2D;AAC5D,MAAI,KAAK,iBAAiB,OAAO,EAC/B,QAAO,MACL,+CACA,KAAK,iBAAiB,KACvB;;CAIL,OAAO,wBACL,QACuB;EACvB,MAAM,YAAY,OAAO,aAAa,EACpC,SAAS,EAAE,KAAK,oCAAoC,EACrD;AAED,SAAO,OAAO,QAAQ,UAAU,CAAC,KAAK,CAAC,OAAO,qBAAqB;GACjE,MAAM,aAAa;GACnB,OAAO,WAAW;GAClB,aAAa,WAAW;GACxB,aAAa,+BAA+B,MAAM;GAClD,YAAY;GACZ,QAAQ,EACN,MAAM;IACJ,KAAK,eAAe;IACpB,aAAa,8BAA8B,MAAM;IAClD,EACF;GACD,UAAU;GACX,EAAE;;CAGL,AAAQ,iBACN,OACA,MACuE;EACvE,MAAM,SAAS,KAAK,UAAU;AAC9B,MAAI,CAAC,OACH,OAAM,IAAI,sBAAsB,MAAM;EAGxC,MAAM,OAAO,QAAQ,IAAI,OAAO;AAChC,MAAI,CAAC,KACH,OAAM,IAAI,2BAA2B,OAAO,OAAO,IAAI;AAUzD,SAAO;GAAE,UAP0B,EAAE,MAAM;GAOxB,cANE,kBACnB,MACA,KAAK,kBACL,OACA,KAAK,OAAO,WACb;GACgC;;CAKnC,aAAa,QAAoB;AAC/B,MAAI,KAAK,aAAa;AACpB,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS,OAAO,KAAsB,QAA0B;AAC9D,WAAM,KAAK,cAAc,IAAI,CAAC,cAAc,KAAK,IAAI;;IAExD,CAAC;AAEF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS,OAAO,KAAsB,QAA0B;AAC9D,WAAM,KAAK,cAAc,IAAI,CAAC,cAAc,KAAK,IAAI;;IAExD,CAAC;SACG;GAGL,MAAM,gBAAgB,OACpB,KACA,QACG;AACH,QAAI,OAAO,UAAU;AACrB,UAAM,KAAK,cAAc,IAAI,CAAC,cAAc,KAAK,IAAI;;GAEvD,MAAM,gBAAgB,OACpB,KACA,QACG;AACH,QAAI,OAAO,UAAU;AACrB,UAAM,KAAK,cAAc,IAAI,CAAC,cAAc,KAAK,IAAI;;AAGvD,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;AACF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;AACF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;AACF,QAAK,MAAM,QAAQ;IACjB,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACV,CAAC;;;CAIN,MAAM,cACJ,KACA,KACe;EACf,MAAM,EAAE,UAAU,IAAI;EACtB,MAAM,UAAU,IAAI;AAEpB,MAAI;GACF,MAAM,SAAS,MAAM,KAAK,OAAO,OAAO,QAAQ;AAChD,OAAI,CAAC,OAAO,IAAI;AACd,QAAI,OAAO,OAAO,OAAO,CAAC,KAAK,EAAE,OAAO,OAAO,SAAS,CAAC;AACzD;;AAEF,OAAI,KAAK,OAAO,KAAK;WACd,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,OAAI,eAAe,sBACjB,KAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;YAExC,eAAe,8BACf,QAAQ,WAAW,8BAA8B,CAEjD,KAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;OAExC,KAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;;;CAK9C,MAAM,cACJ,KACA,KACe;EACf,MAAM,EAAE,UAAU,IAAI;EACtB,MAAM,UAAU,IAAI;EAEpB,IAAI;EACJ,IAAI;AACJ,MAAI;AACF,IAAC,CAAE,UAAU,gBAAiB,KAAK,iBAAiB,OAAO,QAAQ;WAC5D,KAAK;GACZ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;GACrD,MAAM,SAAS,eAAe,wBAAwB,MAAM;AAC5D,OAAI,OAAO,OAAO,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;AAC3C;;EAGF,MAAM,UAAU,KAAK,OAAO,WAAW;EACvC,MAAM,kBAAkB,oBAAoB;EAI5C,IAAI;AACJ,MAAI;AACF,eAAY,MAAMC,OAChB,iBACA,SAAS,MACT,aACD;WACM,KAAK;GACZ,MAAM,UACJ,eAAe,QAAQ,IAAI,UAAU;AACvC,OAAI,OAAO,IAAI,CAAC,KAAK,EAAE,OAAO,SAAS,CAAC;AACxC;;AAGF,MAAI,UAAU,gBAAgB,mCAAmC;AACjE,MAAI,UAAU,iBAAiB,yBAAyB;AACxD,MAAI,UAAU,qBAAqB,KAAK;AACxC,MAAI,cAAc;EAElB,MAAM,aAAa,SAAS,QAC1B,UACD;EACD,MAAM,kBAAkB,IAAI,iBAAiB;EAC7C,MAAM,YAAY,iBAAiB,gBAAgB,OAAO,EAAE,QAAQ;AAEpE,MAAI,GAAG,eAAe,gBAAgB,OAAO,CAAC;AAE9C,MAAI;AACF,SAAM,SAAS,YAAY,KAAK,EAAE,QAAQ,gBAAgB,QAAQ,CAAC;WAC5D,KAAK;AAEZ,OAAI,eAAe,SAAS,IAAI,SAAS,aACvC,QAAO,KAAK,yBAAyB,IAAI,QAAQ;YAE3C;AACR,gBAAa,UAAU;;;CAI3B,MAAM,OACJ,OACA,MACmC;EACnC,MAAM,EAAE,UAAU,iBAAiB,KAAK,iBAAiB,OAAO,KAAK;EACrE,MAAM,kBAAkB,oBAAoB;EAC5C,MAAM,UAAU,KAAK,OAAO,WAAW;AAEvC,SAAO,KAAK,cAERC,OAAwB,iBAAiB,SAAS,MAAM,aAAa,EACvE,EACE,SAAS;GACP,GAAG;GACH;GACD,EACF,CACF;;CAGH,eAAwC;AACtC,SAAO;GACL,aAAa,KAAK;GAClB,SAAS,OAAO,KAAK,KAAK,UAAU;GACrC;;CAGH,MAAM,WAA0B;AAC9B,OAAK,cAAc,UAAU;;CAG/B,AAAU,kBAAkB,OAAuC;AACjE,SAAO,EACL,SAAS,SAAkC,KAAK,OAAO,OAAO,KAAK,EACpE;;CAGH,UAA0B;EACxB,MAAM,mBAAmB,UAAmB;GAC1C,MAAM,WAAW,SAAS;AAE1B,UAAO;IACL,GAFY,KAAK,kBAAkB,SAAS;IAG5C,SAAS,QAAyB;AAEhC,YADmB,KAAK,cAAc,IAAI,CACxB,kBAAkB,SAAS;;IAEhD;;AAEH,SAAO;;;;;;;;AASX,MAAa,UAAU,SAAS,cAAc"}

package/dist/schemas/manifest.d.ts

@@ -1,6 +1,31 @@
 import { z } from "zod";
 
 //#region src/schemas/manifest.d.ts
+declare const resourceTypeSchema: z.ZodEnum<{
+  secret: "secret";
+  job: "job";
+  sql_warehouse: "sql_warehouse";
+  serving_endpoint: "serving_endpoint";
+  volume: "volume";
+  vector_search_index: "vector_search_index";
+  uc_function: "uc_function";
+  uc_connection: "uc_connection";
+  database: "database";
+  postgres: "postgres";
+  genie_space: "genie_space";
+  experiment: "experiment";
+  app: "app";
+}>;
+/** Apps user_api_scopes for resource types with confirmed OBO support. */
+declare const SCOPE_BY_TYPE: {
+  readonly sql_warehouse: "sql";
+  readonly serving_endpoint: "model-serving";
+  readonly genie_space: "genie";
+  readonly volume: "files";
+  readonly vector_search_index: "vector-search";
+  readonly uc_connection: "catalog.connections";
+};
+declare const APP_ONLY_RESOURCE_TYPES: ReadonlySet<ResourceType>;
 declare const discoveryDescriptorSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
   type: z.ZodLiteral<"kind">;
   resourceKind: z.ZodEnum<{
@@ -61,6 +86,13 @@ declare const pluginScaffoldingRulesSchema: z.ZodObject<{
 }, z.core.$strict>;
 declare const pluginManifestSchema: z.ZodObject<{
   scopes: z.ZodOptional<z.ZodArray<z.ZodEnum<{
+    postgres: "postgres";
+    sql: "sql";
+    "model-serving": "model-serving";
+    genie: "genie";
+    files: "files";
+    "vector-search": "vector-search";
+    "catalog.connections": "catalog.connections";
     "ai-gateway": "ai-gateway";
     "mcp.external": "mcp.external";
     "mcp.functions": "mcp.functions";
@@ -68,6 +100,7 @@ declare const pluginManifestSchema: z.ZodObject<{
     "catalog.catalogs:read": "catalog.catalogs:read";
     "catalog.schemas:read": "catalog.schemas:read";
     "catalog.tables:read": "catalog.tables:read";
+    "sql:restricted-query": "sql:restricted-query";
   }>>>;
   $schema: z.ZodOptional<z.ZodString>;
   name: z.ZodString;
@@ -1141,10 +1174,11 @@ declare const pluginManifestSchema: z.ZodObject<{
     }, z.core.$strict>>;
   }, z.core.$strict>>;
 }, z.core.$strict>;
+type ResourceType = z.infer<typeof resourceTypeSchema>;
 type DiscoveryDescriptor = z.infer<typeof discoveryDescriptorSchema>;
 type ResourceFieldEntry = z.infer<typeof resourceFieldEntrySchema>;
 type PluginScaffoldingRules = z.infer<typeof pluginScaffoldingRulesSchema>;
 type PluginManifest = z.infer<typeof pluginManifestSchema>;
 //#endregion
-export { DiscoveryDescriptor, PluginManifest, PluginScaffoldingRules, ResourceFieldEntry, pluginManifestSchema };
+export { APP_ONLY_RESOURCE_TYPES, DiscoveryDescriptor, PluginManifest, PluginScaffoldingRules, ResourceFieldEntry, SCOPE_BY_TYPE, pluginManifestSchema };
 //# sourceMappingURL=manifest.d.ts.map

package/dist/schemas/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","names":[],"sources":["../../src/schemas/manifest.ts"],"mappings":";;;cAyRa,yBAAA,EAAyB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;cA8FzB,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkQxB,4BAAA,EAA4B,CAAA,CAAA,SAAA;;;;;cAoE5B,oBAAA,EAAoB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAqhBrB,mBAAA,GAAsB,CAAA,CAAE,KAAA,QAAa,yBAAA;AAAA,KACrC,kBAAA,GAAqB,CAAA,CAAE,KAAA,QAAa,wBAAA;AAAA,KAIpC,sBAAA,GAAyB,CAAA,CAAE,KAAA,QAC9B,4BAAA;AAAA,KAEG,cAAA,GAAiB,CAAA,CAAE,KAAA,QAAa,oBAAA"}
+{"version":3,"file":"manifest.d.ts","names":[],"sources":["../../src/schemas/manifest.ts"],"mappings":";;;cAoCa,kBAAA,EAAkB,CAAA,CAAA,OAAA;;;;;;;;;;;;;;;;cAmBlB,aAAA;EAAA;;;;;;;cAaA,uBAAA,EAAyB,WAAA,CAAY,YAAA;AAAA,cAsUrC,yBAAA,EAAyB,CAAA,CAAA,qBAAA,EAAA,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;cA8FzB,wBAAA,EAAwB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cAkQxB,4BAAA,EAA4B,CAAA,CAAA,SAAA;;;;;cAoE5B,oBAAA,EAAoB,CAAA,CAAA,SAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;KAmiBrB,YAAA,GAAe,CAAA,CAAE,KAAA,QAAa,kBAAA;AAAA,KA6B9B,mBAAA,GAAsB,CAAA,CAAE,KAAA,QAAa,yBAAA;AAAA,KACrC,kBAAA,GAAqB,CAAA,CAAE,KAAA,QAAa,wBAAA;AAAA,KAIpC,sBAAA,GAAyB,CAAA,CAAE,KAAA,QAC9B,4BAAA;AAAA,KAEG,cAAA,GAAiB,CAAA,CAAE,KAAA,QAAa,oBAAA"}

package/dist/schemas/manifest.js

@@ -46,6 +46,89 @@ const resourceTypeSchema = z.enum([
 	"experiment",
 	"app"
 ]).describe("Type of Databricks resource");
+/** Apps user_api_scopes for resource types with confirmed OBO support. */
+const SCOPE_BY_TYPE = {
+	sql_warehouse: "sql",
+	serving_endpoint: "model-serving",
+	genie_space: "genie",
+	volume: "files",
+	vector_search_index: "vector-search",
+	uc_connection: "catalog.connections"
+};
+const APP_ONLY_RESOURCE_TYPES = new Set([
+	"secret",
+	"database",
+	"postgres"
+]);
+/**
+* DABs binding spec per resource type. Faithful port of the CLI's
+* `appResourceSpecs`. App-only types still bind (as the service principal). The
+* `app` type is intentionally absent: bundles do not yet support it as an app
+* resource, matching the commented-out CLI entry.
+*
+* TODO(sdk-migration): anchor these yamlKeys to the Apps SDK once the modular migration
+*   (analytics-migration-sdk / #562) adds @databricks/sdk-apps:
+*   1. add @databricks/sdk-apps; re-export AppResource via packages/shared/src/workspace-client/modular.ts
+*      (direct @databricks/sdk-* imports are banned by the repo lint rule)
+*   2. the new AppResource is a $case union: kinds = NonNullable<AppResource["resource"]>["$case"]
+*      (camelCase: sqlWarehouse | servingEndpoint | genieSpace | ucSecurable | ...)
+*   3. map camelCase $case -> snake_case yamlKey and assert every table entry is covered
+*   (the new SDK models postgres/experiment/app, so the old skew exceptions are not needed)
+*/
+const DABS_BINDING_BY_TYPE = {
+	sql_warehouse: {
+		yamlKey: "sql_warehouse",
+		varFields: [["id", "id"]]
+	},
+	job: {
+		yamlKey: "job",
+		varFields: [["id", "id"]]
+	},
+	serving_endpoint: {
+		yamlKey: "serving_endpoint",
+		varFields: [["name", "name"]]
+	},
+	experiment: {
+		yamlKey: "experiment",
+		varFields: [["experimentId", "experiment_id"]]
+	},
+	secret: {
+		yamlKey: "secret",
+		varFields: [["scope", "scope"], ["key", "key"]]
+	},
+	database: {
+		yamlKey: "database",
+		varFields: [["instance_name", "instance_name"], ["database_name", "database_name"]]
+	},
+	postgres: {
+		yamlKey: "postgres",
+		varFields: [["branch", "branch"], ["database", "database"]]
+	},
+	genie_space: {
+		yamlKey: "genie_space",
+		varFields: [["name", "name"], ["id", "space_id"]]
+	},
+	volume: {
+		yamlKey: "uc_securable",
+		varFields: [["path", "securable_full_name"]],
+		staticFields: [["securable_type", "VOLUME"]]
+	},
+	uc_function: {
+		yamlKey: "uc_securable",
+		varFields: [["id", "securable_full_name"]],
+		staticFields: [["securable_type", "FUNCTION"]]
+	},
+	uc_connection: {
+		yamlKey: "uc_securable",
+		varFields: [["id", "securable_full_name"]],
+		staticFields: [["securable_type", "CONNECTION"]]
+	},
+	vector_search_index: {
+		yamlKey: "uc_securable",
+		varFields: [["id", "securable_full_name"]],
+		staticFields: [["securable_type", "TABLE"]]
+	}
+};
 /** Capabilities that need a user_api_scope but have no resource ID. */
 const capabilityScopeSchema = z.enum([
 	"ai-gateway",
@@ -56,6 +139,23 @@ const capabilityScopeSchema = z.enum([
 	"catalog.schemas:read",
 	"catalog.tables:read"
 ]);
+/**
+* Every Apps user_api_scope (short names; the long forms such as
+* `dashboards.genie` are deprecated aliases). A plugin declares one in its
+* `scopes` when it always calls on behalf of the user, or when the capability
+* has no resource ID.
+*/
+const userApiScopeSchema = z.enum([
+	"sql",
+	"sql:restricted-query",
+	"genie",
+	"postgres",
+	"model-serving",
+	"files",
+	"vector-search",
+	"catalog.connections",
+	...capabilityScopeSchema.options
+]);
 const secretPermissionSchema = z.enum([
 	"READ",
 	"WRITE",
@@ -329,7 +429,7 @@ const pluginScaffoldingRulesSchema = z.object({
 	}
 }).describe("Structured rules for scaffolding agents declared at the plugin level. Each rule is a short directive (≤120 chars).");
 const pluginManifestSchema = z.object({
-	scopes: z.array(capabilityScopeSchema).optional().describe("Capability-only user_api_scopes with no resource ID."),
+	scopes: z.array(userApiScopeSchema).optional().describe("user_api_scopes the plugin always needs, whatever its resources are bound as: calls it makes on behalf of the user unconditionally, or capabilities with no resource ID."),
 	$schema: z.string().optional().describe("Reference to the JSON Schema for validation"),
 	name: z.string().regex(PLUGIN_NAME_PATTERN).describe("Plugin identifier and JS binding. Must start with a lowercase letter; camelCase for multi-word names (e.g. aiSearch)."),
 	displayName: z.string().min(1).describe("Human-readable display name for UI and CLI"),
@@ -392,7 +492,14 @@ const templateResourceRequirementBaseShape = {
 	alias: z.string().min(1).describe("Human-readable label for UI/display only."),
 	resourceKey: z.string().regex(/^[a-z][a-z0-9-]*$/).describe("Stable key for machine use: deduplication, env naming, composite keys."),
 	description: z.string().min(1).describe("Human-readable description of why this resource is needed"),
-	fields: z.record(z.string(), templateFieldEntrySchema).refine((obj) => Object.keys(obj).length >= 1, { message: "fields must contain at least one entry" }).optional().describe("Map of field name to field entry with computed origin.")
+	fields: z.record(z.string(), templateFieldEntrySchema).refine((obj) => Object.keys(obj).length >= 1, { message: "fields must contain at least one entry" }).optional().describe("Map of field name to field entry with computed origin."),
+	scope: z.string().min(1).optional().describe("Apps user_api_scope for this resource type. Present only when the type can run on behalf of the user. Resolved by sync from SCOPE_BY_TYPE."),
+	appOnly: z.literal(true).optional().describe("Present only when the type always runs as the app service principal and must be bound (secret, database, postgres). Resolved by sync from APP_ONLY_RESOURCE_TYPES."),
+	binding: z.object({
+		yamlKey: z.string().min(1).describe("DABs YAML key under the resource entry."),
+		varFields: z.array(z.tuple([z.string(), z.string()])).describe("[manifestField, dabsField] pairs. Each becomes ${var.<resourceKey>_<manifestField>} written to dabsField."),
+		staticFields: z.array(z.tuple([z.string(), z.string()])).optional().describe("[dabsField, value] constant pairs.")
+	}).strict().optional().describe("How this resource type binds in databricks.yml as a DABs app resource. Resolved by sync from DABS_BINDING_BY_TYPE.")
 };
 function makeTemplateResourceVariant(typeLiteral, permission) {
 	return z.object({
@@ -429,7 +536,8 @@ const templatePluginSchema = z.object({
 	resources: z.object({
 		required: z.array(templateResourceRequirementSchema).describe("Resources that must be available for the plugin to function"),
 		optional: z.array(templateResourceRequirementSchema).describe("Resources that enhance functionality but are not mandatory")
-	}).strict().describe("Databricks resource requirements for this plugin")
+	}).strict().describe("Databricks resource requirements for this plugin"),
+	scopes: z.array(userApiScopeSchema).min(1).optional().describe("user_api_scopes the plugin always needs, copied from the plugin manifest. Omitted when empty.")
 }).strict().describe("Plugin manifest with package source information");
 const scaffoldingFlagSchema = z.object({
 	description: z.string().describe("Human-readable description of the flag."),
@@ -535,5 +643,5 @@ const templatePluginsManifestSchema = z.object({
 }).describe("Aggregated plugin manifest for AppKit templates. Read by Databricks CLI during init to discover available plugins and their resource requirements.");
 
 //#endregion
-export { TEMPLATE_SCAFFOLDING, appPermissionSchema, computeOriginFromField, databasePermissionSchema, experimentPermissionSchema, genieSpacePermissionSchema, jobPermissionSchema, pluginManifestSchema, postgresPermissionSchema, resourceTypeSchema, secretPermissionSchema, servingEndpointPermissionSchema, sqlWarehousePermissionSchema, templateFieldEntrySchema, templatePluginsManifestSchema, ucConnectionPermissionSchema, ucFunctionPermissionSchema, vectorSearchIndexPermissionSchema, volumePermissionSchema };
+export { APP_ONLY_RESOURCE_TYPES, DABS_BINDING_BY_TYPE, SCOPE_BY_TYPE, TEMPLATE_SCAFFOLDING, appPermissionSchema, computeOriginFromField, databasePermissionSchema, experimentPermissionSchema, genieSpacePermissionSchema, jobPermissionSchema, pluginManifestSchema, postgresPermissionSchema, resourceTypeSchema, secretPermissionSchema, servingEndpointPermissionSchema, sqlWarehousePermissionSchema, templateFieldEntrySchema, templatePluginsManifestSchema, ucConnectionPermissionSchema, ucFunctionPermissionSchema, vectorSearchIndexPermissionSchema, volumePermissionSchema };
 //# sourceMappingURL=manifest.js.map