@databricks/appkit 0.83.0 → 0.84.0

package/docs/api/appkit/Class.AuthenticationError.md

@@ -54,7 +54,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.ConfigurationError.md

@@ -54,7 +54,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.ConnectionError.md

@@ -54,7 +54,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.DatabaseValidationError.md

@@ -39,7 +39,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.ExecutionError.md

@@ -56,7 +56,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.IdentityExpiredError.md

@@ -0,0 +1,190 @@
+# Class: IdentityExpiredError
+
+The downstream service rejected the active caller's credentials.
+
+## Extends[​](#extends "Direct link to Extends")
+
+* [`AppKitError`](./docs/api/appkit/Class.AppKitError.md)
+
+## Constructors[​](#constructors "Direct link to Constructors")
+
+### Constructor[​](#constructor "Direct link to Constructor")
+
+```ts
+new IdentityExpiredError(tokenFingerprint?: string): IdentityExpiredError;
+
+```
+
+#### Parameters[​](#parameters "Direct link to Parameters")
+
+| Parameter           | Type     |
+| ------------------- | -------- |
+| `tokenFingerprint?` | `string` |
+
+#### Returns[​](#returns "Direct link to Returns")
+
+`IdentityExpiredError`
+
+#### Overrides[​](#overrides "Direct link to Overrides")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`constructor`](./docs/api/appkit/Class.AppKitError.md#constructor)
+
+## Properties[​](#properties "Direct link to Properties")
+
+### \_clientMessage?[​](#_clientmessage "Direct link to _clientMessage?")
+
+```ts
+protected readonly optional _clientMessage: string;
+
+```
+
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+
+Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
+
+#### Inherited from[​](#inherited-from "Direct link to Inherited from")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`_clientMessage`](./docs/api/appkit/Class.AppKitError.md#_clientmessage)
+
+***
+
+### cause?[​](#cause "Direct link to cause?")
+
+```ts
+readonly optional cause: Error;
+
+```
+
+Optional cause of the error
+
+#### Inherited from[​](#inherited-from-1 "Direct link to Inherited from")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`cause`](./docs/api/appkit/Class.AppKitError.md#cause)
+
+***
+
+### code[​](#code "Direct link to code")
+
+```ts
+readonly code: "IDENTITY_EXPIRED" = "IDENTITY_EXPIRED";
+
+```
+
+Error code for programmatic error handling
+
+#### Overrides[​](#overrides-1 "Direct link to Overrides")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`code`](./docs/api/appkit/Class.AppKitError.md#code)
+
+***
+
+### context?[​](#context "Direct link to context?")
+
+```ts
+readonly optional context: Record<string, unknown>;
+
+```
+
+Additional context for the error
+
+#### Inherited from[​](#inherited-from-2 "Direct link to Inherited from")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`context`](./docs/api/appkit/Class.AppKitError.md#context)
+
+***
+
+### isRetryable[​](#isretryable "Direct link to isRetryable")
+
+```ts
+readonly isRetryable: false = false;
+
+```
+
+Whether this error type is generally safe to retry
+
+#### Overrides[​](#overrides-2 "Direct link to Overrides")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`isRetryable`](./docs/api/appkit/Class.AppKitError.md#isretryable)
+
+***
+
+### statusCode[​](#statuscode "Direct link to statusCode")
+
+```ts
+readonly statusCode: 401 = 401;
+
+```
+
+HTTP status code suggestion (can be overridden)
+
+#### Overrides[​](#overrides-3 "Direct link to Overrides")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`statusCode`](./docs/api/appkit/Class.AppKitError.md#statuscode)
+
+***
+
+### tokenFingerprint?[​](#tokenfingerprint "Direct link to tokenFingerprint?")
+
+```ts
+readonly optional tokenFingerprint: string;
+
+```
+
+## Accessors[​](#accessors "Direct link to Accessors")
+
+### clientMessage[​](#clientmessage "Direct link to clientMessage")
+
+#### Get Signature[​](#get-signature "Direct link to Get Signature")
+
+```ts
+get clientMessage(): string;
+
+```
+
+Sanitized message safe to forward to clients. Override in subclasses if a more specific default is appropriate.
+
+##### Returns[​](#returns-1 "Direct link to Returns")
+
+`string`
+
+#### Inherited from[​](#inherited-from-3 "Direct link to Inherited from")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`clientMessage`](./docs/api/appkit/Class.AppKitError.md#clientmessage)
+
+## Methods[​](#methods "Direct link to Methods")
+
+### toJSON()[​](#tojson "Direct link to toJSON()")
+
+```ts
+toJSON(): Record<string, unknown>;
+
+```
+
+Convert error to JSON for logging/serialization. Sensitive values in context are automatically redacted.
+
+#### Returns[​](#returns-2 "Direct link to Returns")
+
+`Record`<`string`, `unknown`>
+
+#### Inherited from[​](#inherited-from-4 "Direct link to Inherited from")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`toJSON`](./docs/api/appkit/Class.AppKitError.md#tojson)
+
+***
+
+### toString()[​](#tostring "Direct link to toString()")
+
+```ts
+toString(): string;
+
+```
+
+Create a human-readable string representation
+
+#### Returns[​](#returns-3 "Direct link to Returns")
+
+`string`
+
+#### Inherited from[​](#inherited-from-5 "Direct link to Inherited from")
+
+[`AppKitError`](./docs/api/appkit/Class.AppKitError.md).[`toString`](./docs/api/appkit/Class.AppKitError.md#tostring)

package/docs/api/appkit/Class.InitializationError.md

@@ -54,7 +54,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.Plugin.md

@@ -239,30 +239,26 @@ BasePlugin.abortActiveOperations
 
 ***
 
-### asUser()[​](#asuser "Direct link to asUser()")
+### ~~asUser()~~[​](#asuser "Direct link to asuser")
 
 ```ts
 asUser(req: Request): this;
 
 ```
 
-Execute operations using the user's identity from the request. Returns a proxy of this plugin where all method calls execute with the user's Databricks credentials instead of the service principal.
-
 #### Parameters[​](#parameters-1 "Direct link to Parameters")
 
-| Parameter | Type      | Description                                              |
-| --------- | --------- | -------------------------------------------------------- |
-| `req`     | `Request` | The Express request containing the user token in headers |
+| Parameter | Type      |
+| --------- | --------- |
+| `req`     | `Request` |
 
 #### Returns[​](#returns-2 "Direct link to Returns")
 
 `this`
 
-A proxied plugin instance that executes as the user
+#### Deprecated[​](#deprecated "Direct link to Deprecated")
 
-#### Throws[​](#throws "Direct link to Throws")
-
-AuthenticationError if user token is not available in request headers (production only). In development mode (`NODE_ENV=development`), skips user impersonation instead of throwing.
+Use appkit.asUser(req) to scope the whole app.
 
 ***
 
@@ -374,7 +370,7 @@ Returns an [ExecutionResult](./docs/api/appkit/TypeAlias.ExecutionResult.md) dis
 * `{ ok: true, data: T }` on success
 * `{ ok: false, status: number, message: string }` on failure
 
-Errors are never thrown — the method is production-safe.
+Caller credential expiration retains the failure result and additionally exposes a typed error, preserving existing result-based callers.
 
 #### Type Parameters[​](#type-parameters-1 "Direct link to Type Parameters")
 
@@ -576,7 +572,7 @@ Returns the `x-forwarded-user` header when present. In development mode (`NODE_E
 
 `string`
 
-#### Throws[​](#throws-1 "Direct link to Throws")
+#### Throws[​](#throws "Direct link to Throws")
 
 AuthenticationError in production when no user header is present.
 

package/docs/api/appkit/Class.ServerError.md

@@ -53,7 +53,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.ServiceContext.md

@@ -0,0 +1,169 @@
+# Class: ServiceContext
+
+ServiceContext is a singleton that manages the service principal's WorkspaceClient and workspace ID. WarehouseResource owns warehouse bindings.
+
+It's initialized once at app startup and provides the foundation for both service principal and user context execution.
+
+## Constructors[​](#constructors "Direct link to Constructors")
+
+### Constructor[​](#constructor "Direct link to Constructor")
+
+```ts
+new ServiceContext(): ServiceContext;
+
+```
+
+#### Returns[​](#returns "Direct link to Returns")
+
+`ServiceContext`
+
+## Methods[​](#methods "Direct link to Methods")
+
+### createCallerContext()[​](#createcallercontext "Direct link to createCallerContext()")
+
+```ts
+static createCallerContext(
+   token: string, 
+   userId: string, 
+   userName?: string, 
+   userEmail?: string): CallerContext;
+
+```
+
+Create an immutable caller context from the existing user request headers.
+
+#### Parameters[​](#parameters "Direct link to Parameters")
+
+| Parameter    | Type     | Description                                                  |
+| ------------ | -------- | ------------------------------------------------------------ |
+| `token`      | `string` | The user's access token from x-forwarded-access-token header |
+| `userId`     | `string` | The user's ID from x-forwarded-user header                   |
+| `userName?`  | `string` | Optional user name                                           |
+| `userEmail?` | `string` | Optional email from x-forwarded-email                        |
+
+#### Returns[​](#returns-1 "Direct link to Returns")
+
+[`CallerContext`](./docs/api/appkit/Interface.CallerContext.md)
+
+#### Throws[​](#throws "Direct link to Throws")
+
+Error if token is not provided
+
+***
+
+### ~~createUserContext()~~[​](#createusercontext "Direct link to createusercontext")
+
+```ts
+static createUserContext(
+   token: string, 
+   userId: string, 
+   userName?: string, 
+   userEmail?: string): CallerContext & UserContext;
+
+```
+
+#### Parameters[​](#parameters-1 "Direct link to Parameters")
+
+| Parameter    | Type     |
+| ------------ | -------- |
+| `token`      | `string` |
+| `userId`     | `string` |
+| `userName?`  | `string` |
+| `userEmail?` | `string` |
+
+#### Returns[​](#returns-2 "Direct link to Returns")
+
+[`CallerContext`](./docs/api/appkit/Interface.CallerContext.md) & [`UserContext`](./docs/api/appkit/TypeAlias.UserContext.md)
+
+#### Deprecated[​](#deprecated "Direct link to Deprecated")
+
+Use ServiceContext.createCallerContext.
+
+***
+
+### get()[​](#get "Direct link to get()")
+
+```ts
+static get(): ServiceContextState;
+
+```
+
+Get the initialized service context.
+
+#### Returns[​](#returns-3 "Direct link to Returns")
+
+`ServiceContextState`
+
+#### Throws[​](#throws-1 "Direct link to Throws")
+
+Error if not initialized
+
+***
+
+### getClientOptions()[​](#getclientoptions "Direct link to getClientOptions()")
+
+```ts
+static getClientOptions(): ClientOptions;
+
+```
+
+Get the client options for WorkspaceClient. Exposed for testing purposes.
+
+#### Returns[​](#returns-4 "Direct link to Returns")
+
+`ClientOptions`
+
+***
+
+### initialize()[​](#initialize "Direct link to initialize()")
+
+```ts
+static initialize(options?: {
+  warehouseId?: string | boolean;
+}, client?: WorkspaceClient): Promise<ServiceContextState>;
+
+```
+
+Initialize the service context. Should be called once at app startup. Safe to call multiple times - will return the same instance.
+
+#### Parameters[​](#parameters-2 "Direct link to Parameters")
+
+| Parameter              | Type                                                                      | Description                                                                                          |
+| ---------------------- | ------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------- |
+| `options?`             | { `warehouseId?`: `string` \| `boolean`; }                                | A resolved warehouse ID, or a boolean enabling discovery.                                            |
+| `options.warehouseId?` | `string` \| `boolean`                                                     | -                                                                                                    |
+| `client?`              | [`WorkspaceClient`](./docs/api/appkit/Interface.WorkspaceClient.md) | Optional pre-configured WorkspaceClient to use instead of creating one from environment credentials. |
+
+#### Returns[​](#returns-5 "Direct link to Returns")
+
+`Promise`<`ServiceContextState`>
+
+***
+
+### isInitialized()[​](#isinitialized "Direct link to isInitialized()")
+
+```ts
+static isInitialized(): boolean;
+
+```
+
+Check if the service context has been initialized.
+
+#### Returns[​](#returns-6 "Direct link to Returns")
+
+`boolean`
+
+***
+
+### reset()[​](#reset "Direct link to reset()")
+
+```ts
+static reset(): void;
+
+```
+
+Reset the service context. Only for testing purposes.
+
+#### Returns[​](#returns-7 "Direct link to Returns")
+
+`void`

package/docs/api/appkit/Class.TunnelError.md

@@ -54,7 +54,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Class.ValidationError.md

@@ -54,7 +54,7 @@ protected readonly optional _clientMessage: string;
 
 ```
 
-Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message` — `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
+Client-safe error message. When set, callers serializing the error to a client (SSE, HTTP body) MUST prefer `clientMessage` over `message`. `message` may contain raw upstream / SDK text including statement fragments, internal object names, and correlation IDs.
 
 Subclasses can set this in their constructor for a fixed sanitized string. When unset, `clientMessage` defaults to a generic per-code string (see the getter), and the raw `message` is kept server-side only.
 

package/docs/api/appkit/Function.createApp.md

@@ -5,10 +5,10 @@ function createApp<T>(config: {
   cache?: CacheConfig;
   client?: WorkspaceClient;
   disableInternalTelemetry?: boolean;
-  onPluginsReady?: (appkit: PluginMap<T>) => void | Promise<void>;
+  onPluginsReady?: (appkit: AppKitApi<T>) => void | Promise<void>;
   plugins?: T;
   telemetry?: TelemetryConfig;
-}): Promise<PluginMap<T>>;
+}): Promise<AppKitApi<T>>;
 
 ```
 
@@ -24,19 +24,19 @@ Initializes telemetry, cache, and service context, then registers plugins in pha
 
 ## Parameters[​](#parameters "Direct link to Parameters")
 
-| Parameter                          | Type                                                                                                                                                                                                                                                                                                                                                                                                     | Description                                               |
-| ---------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
-| `config`                           | { `cache?`: [`CacheConfig`](./docs/api/appkit/Interface.CacheConfig.md); `client?`: [`WorkspaceClient`](./docs/api/appkit/Interface.WorkspaceClient.md); `disableInternalTelemetry?`: `boolean`; `onPluginsReady?`: (`appkit`: `PluginMap`<`T`>) => `void` \| `Promise`<`void`>; `plugins?`: `T`; `telemetry?`: [`TelemetryConfig`](./docs/api/appkit/Interface.TelemetryConfig.md); } | -                                                         |
-| `config.cache?`                    | [`CacheConfig`](./docs/api/appkit/Interface.CacheConfig.md)                                                                                                                                                                                                                                                                                                                                        | -                                                         |
-| `config.client?`                   | [`WorkspaceClient`](./docs/api/appkit/Interface.WorkspaceClient.md)                                                                                                                                                                                                                                                                                                                                | -                                                         |
-| `config.disableInternalTelemetry?` | `boolean`                                                                                                                                                                                                                                                                                                                                                                                                | -                                                         |
-| `config.onPluginsReady?`           | (`appkit`: `PluginMap`<`T`>) => `void` \| `Promise`<`void`>                                                                                                                                                                                                                                                                                                                                              | Runs after plugin setup but **before** the server starts. |
-| `config.plugins?`                  | `T`                                                                                                                                                                                                                                                                                                                                                                                                      | -                                                         |
-| `config.telemetry?`                | [`TelemetryConfig`](./docs/api/appkit/Interface.TelemetryConfig.md)                                                                                                                                                                                                                                                                                                                                | -                                                         |
+| Parameter                          | Type                                                                                                                                                                                                                                                                                                                                                                                                                                                       | Description                                               |
+| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------- |
+| `config`                           | { `cache?`: [`CacheConfig`](./docs/api/appkit/Interface.CacheConfig.md); `client?`: [`WorkspaceClient`](./docs/api/appkit/Interface.WorkspaceClient.md); `disableInternalTelemetry?`: `boolean`; `onPluginsReady?`: (`appkit`: [`AppKitApi`](./docs/api/appkit/TypeAlias.AppKitApi.md)<`T`>) => `void` \| `Promise`<`void`>; `plugins?`: `T`; `telemetry?`: [`TelemetryConfig`](./docs/api/appkit/Interface.TelemetryConfig.md); } | -                                                         |
+| `config.cache?`                    | [`CacheConfig`](./docs/api/appkit/Interface.CacheConfig.md)                                                                                                                                                                                                                                                                                                                                                                                          | -                                                         |
+| `config.client?`                   | [`WorkspaceClient`](./docs/api/appkit/Interface.WorkspaceClient.md)                                                                                                                                                                                                                                                                                                                                                                                  | -                                                         |
+| `config.disableInternalTelemetry?` | `boolean`                                                                                                                                                                                                                                                                                                                                                                                                                                                  | -                                                         |
+| `config.onPluginsReady?`           | (`appkit`: [`AppKitApi`](./docs/api/appkit/TypeAlias.AppKitApi.md)<`T`>) => `void` \| `Promise`<`void`>                                                                                                                                                                                                                                                                                                                                              | Runs after plugin setup but **before** the server starts. |
+| `config.plugins?`                  | `T`                                                                                                                                                                                                                                                                                                                                                                                                                                                        | -                                                         |
+| `config.telemetry?`                | [`TelemetryConfig`](./docs/api/appkit/Interface.TelemetryConfig.md)                                                                                                                                                                                                                                                                                                                                                                                  | -                                                         |
 
 ## Returns[​](#returns "Direct link to Returns")
 
-`Promise`<`PluginMap`<`T`>>
+`Promise`<[`AppKitApi`](./docs/api/appkit/TypeAlias.AppKitApi.md)<`T`>>
 
 A `PluginMap` keyed by plugin name with typed exports
 

package/docs/api/appkit/Function.getCallerContext.md

@@ -0,0 +1,12 @@
+# Function: getCallerContext()
+
+```ts
+function getCallerContext(): CallerContext | undefined;
+
+```
+
+Get the caller context if one is active, otherwise `undefined`. Unlike `getExecutionContext()`, this does not require `ServiceContext` to be initialized and never throws.
+
+## Returns[​](#returns "Direct link to Returns")
+
+[`CallerContext`](./docs/api/appkit/Interface.CallerContext.md) | `undefined`

package/docs/api/appkit/Function.getCurrentUserId.md

@@ -0,0 +1,14 @@
+# ~~Function: getCurrentUserId()~~
+
+```ts
+function getCurrentUserId(): string;
+
+```
+
+## Returns[​](#returns "Direct link to Returns")
+
+`string`
+
+## Deprecated[​](#deprecated "Direct link to Deprecated")
+
+Use getCurrentPrincipalKey for new cache keys or getCurrentActorId for audit. Preserves the bare user or service ID for existing callers.

package/docs/api/appkit/Function.getExecutionContext.md

@@ -14,7 +14,7 @@ Get the current execution context.
 
 ## Returns[​](#returns "Direct link to Returns")
 
-\| `ServiceContextState` | [`CallerContext`](./docs/api/appkit/Interface.CallerContext.md) & `UserContext`
+\| `ServiceContextState` | [`CallerContext`](./docs/api/appkit/Interface.CallerContext.md) & [`UserContext`](./docs/api/appkit/TypeAlias.UserContext.md)
 
 ## Throws[​](#throws "Direct link to Throws")
 

package/docs/api/appkit/Function.getUserContext.md

@@ -0,0 +1,16 @@
+# ~~Function: getUserContext()~~
+
+```ts
+function getUserContext(): 
+  | CallerContext & UserContext
+  | undefined;
+
+```
+
+## Returns[​](#returns "Direct link to Returns")
+
+\| [`CallerContext`](./docs/api/appkit/Interface.CallerContext.md) & [`UserContext`](./docs/api/appkit/TypeAlias.UserContext.md) | `undefined`
+
+## Deprecated[​](#deprecated "Direct link to Deprecated")
+
+Use getCallerContext and its principal field.

package/docs/api/appkit/Function.isInUserContext.md

@@ -0,0 +1,12 @@
+# Function: isInUserContext()
+
+```ts
+function isInUserContext(): boolean;
+
+```
+
+Check if currently running in a user context.
+
+## Returns[​](#returns "Direct link to Returns")
+
+`boolean`

package/docs/api/appkit/Function.isUserContext.md

@@ -0,0 +1,20 @@
+# ~~Function: isUserContext()~~
+
+```ts
+function isUserContext(ctx: ExecutionContext): ctx is UserContext & Partial<CallerContext>;
+
+```
+
+## Parameters[​](#parameters "Direct link to Parameters")
+
+| Parameter | Type                                                                        |
+| --------- | --------------------------------------------------------------------------- |
+| `ctx`     | [`ExecutionContext`](./docs/api/appkit/TypeAlias.ExecutionContext.md) |
+
+## Returns[​](#returns "Direct link to Returns")
+
+`ctx is UserContext & Partial<CallerContext>`
+
+## Deprecated[​](#deprecated "Direct link to Deprecated")
+
+Use isCallerContext. Active caller contexts retain the legacy identity accessors for callers narrowed by this guard.