refactor: manifest imports (#144)

Author: MarioCadenas

apps/dev-playground/package.json

@@ -37,7 +37,7 @@
     "@types/react-syntax-highlighter": "^15.5.13",
     "@vitejs/plugin-react": "^5.0.4",
     "dotenv": "^16.0.0",
-    "tsdown": "^0.15.7",
+    "tsdown": "^0.20.3",
     "tsx": "^4.20.6",
     "vite": "npm:rolldown-vite@7.1.14"
   },

docs/docs/development/project-setup.md

@@ -63,7 +63,7 @@ The AppKit `server()` plugin automatically serves:
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^5.1.1",
-    "tsdown": "^0.15.7",
+    "tsdown": "^0.20.3",
     "tsx": "^4.19.0",
     "typescript": "~5.6.0",
     "vite": "^7.2.4"

docs/docs/plugins/plugin-management.md

@@ -6,6 +6,8 @@ sidebar_position: 6
 
 AppKit includes a CLI for managing plugins. All commands are available under `npx @databricks/appkit plugin`.
 
+**Manifest convention:** `manifest.json` is the default and recommended format for CLI commands (`sync`, `list`, `validate`). For zero-trust safety, JS manifests (`manifest.js`/`manifest.cjs`) are ignored unless you pass `--allow-js-manifest`, which executes plugin code and should be used only with trusted sources. The **add-resource** command only edits `manifest.json` in place.
+
 ## Create a plugin
 
 Scaffold a new plugin interactively:
@@ -20,7 +22,7 @@ The wizard walks you through:
 - **Resources**: Which Databricks resources the plugin needs (SQL Warehouse, Secret, etc.) and whether each is required or optional
 - **Optional fields**: Author, version, license
 
-The command generates a complete plugin scaffold with `manifest.json`, TypeScript class, and barrel exports — ready to register in your app.
+The command generates a complete plugin scaffold with `manifest.json` and a TypeScript plugin class that imports the manifest directly — ready to register in your app.
 
 ## Sync plugin manifests
 
@@ -32,6 +34,12 @@ npx @databricks/appkit plugin sync --write
 
 This discovers plugin manifests from installed packages and local imports, then writes a consolidated manifest used by deployment tooling. Plugins referenced in your `createApp({ plugins: [...] })` call are automatically marked as required.
 
+Trusted installed Databricks packages (for example `@databricks/appkit`) are allowed to load bundled JS manifests during `plugin sync`. For other sources, if you intentionally rely on JS manifests, opt in explicitly:
+
+```bash
+npx @databricks/appkit plugin sync --write --allow-js-manifest
+```
+
 Use the `--silent` flag in build hooks to suppress output:
 
 ```json
@@ -58,6 +66,8 @@ npx @databricks/appkit plugin validate plugins/my-plugin appkit.plugins.json
 
 The validator auto-detects whether a file is a plugin manifest or a template manifest (from `$schema`) and reports errors with humanized paths and expected values.
 
+To include JS manifests in validation, pass `--allow-js-manifest`.
+
 ## List plugins
 
 View registered plugins from `appkit.plugins.json` or scan a directory:
@@ -69,13 +79,16 @@ npx @databricks/appkit plugin list
 # Scan a directory for plugin folders
 npx @databricks/appkit plugin list --dir plugins/
 
+# Scan a directory and include JS manifests (trusted code only)
+npx @databricks/appkit plugin list --dir plugins/ --allow-js-manifest
+
 # JSON output for scripting
 npx @databricks/appkit plugin list --json
 ```
 
 ## Add a resource to a plugin
 
-Interactively add a new resource requirement to an existing plugin manifest:
+Interactively add a new resource requirement to an existing plugin manifest. **Requires `manifest.json`** in the plugin directory (the command edits it in place; it does not modify `manifest.js`):
 
 ```bash
 npx @databricks/appkit plugin add-resource

package.json

@@ -62,7 +62,7 @@
     "plop": "^4.0.4",
     "publint": "^0.3.15",
     "release-it": "^19.1.0",
-    "tsdown": "^0.15.7",
+    "tsdown": "^0.20.3",
     "tsx": "^4.20.6",
     "turbo": "^2.6.1",
     "typescript": "^5.6.0",

packages/appkit-ui/package.json

@@ -2,6 +2,7 @@
   "name": "@databricks/appkit-ui",
   "type": "module",
   "version": "0.15.0",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/databricks/appkit.git"
@@ -14,6 +15,7 @@
     "docs",
     "docs.md",
     "CLAUDE.md",
+    "LICENSE",
     "llms.txt",
     "README.md",
     "DCO",

packages/appkit-ui/tsdown.config.ts

@@ -9,12 +9,13 @@ export default defineConfig([
     platform: "browser",
     minify: false,
     dts: {
-      resolve: true,
+      resolver: "oxc",
     },
     copy: [
       {
         from: "src/react/styles/globals.css",
-        to: "dist/styles.css",
+        to: "dist",
+        rename: "styles.css",
       },
     ],
     clean: false,

packages/appkit/package.json

@@ -5,6 +5,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "packageManager": "pnpm@10.21.0",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/databricks/appkit.git"
@@ -16,6 +17,7 @@
     "docs",
     "docs.md",
     "CLAUDE.md",
+    "LICENSE",
     "llms.txt",
     "README.md",
     "DCO",

packages/appkit/src/connectors/lakebase/index.ts

@@ -2,7 +2,7 @@ import {
   createLakebasePool as createLakebasePoolBase,
   type LakebasePoolConfig,
 } from "@databricks/lakebase";
-import type pg from "pg";
+import type { Pool } from "pg";
 import { createLogger } from "@/logging/logger";
 
 /**
@@ -12,9 +12,7 @@ import { createLogger } from "@/logging/logger";
  * @param config - Lakebase pool configuration
  * @returns PostgreSQL pool with appkit integration
  */
-export function createLakebasePool(
-  config?: Partial<LakebasePoolConfig>,
-): pg.Pool {
+export function createLakebasePool(config?: Partial<LakebasePoolConfig>): Pool {
   const logger = createLogger("connectors:lakebase");
 
   return createLakebasePoolBase({

packages/appkit/src/plugins/analytics/analytics.ts

@@ -14,8 +14,9 @@ import {
 } from "../../context";
 import { createLogger } from "../../logging/logger";
 import { Plugin, toPlugin } from "../../plugin";
+import type { PluginManifest } from "../../registry";
 import { queryDefaults } from "./defaults";
-import { analyticsManifest } from "./manifest";
+import manifest from "./manifest.json";
 import { QueryProcessor } from "./query";
 import type {
   AnalyticsQueryResponse,
@@ -29,7 +30,7 @@ export class AnalyticsPlugin extends Plugin {
   name = "analytics";
 
   /** Plugin manifest declaring metadata and resource requirements */
-  static manifest = analyticsManifest;
+  static manifest = manifest as PluginManifest;
 
   protected static description = "Analytics plugin for data analysis";
   protected declare config: IAnalyticsConfig;

packages/appkit/src/plugins/analytics/index.ts

@@ -1,3 +1,2 @@
 export * from "./analytics";
-export * from "./manifest";
 export * from "./types";