refactor: manifest imports

apps/dev-playground/package.json

@@ -37,7 +37,7 @@
     "@types/react-syntax-highlighter": "^15.5.13",
     "@vitejs/plugin-react": "^5.0.4",
     "dotenv": "^16.0.0",
-    "tsdown": "^0.15.7",
+    "tsdown": "^0.20.3",
     "tsx": "^4.20.6",
     "vite": "npm:rolldown-vite@7.1.14"
   },

docs/docs/development/project-setup.md

@@ -63,7 +63,7 @@ The AppKit `server()` plugin automatically serves:
     "@types/react": "^19.0.0",
     "@types/react-dom": "^19.0.0",
     "@vitejs/plugin-react": "^5.1.1",
-    "tsdown": "^0.15.7",
+    "tsdown": "^0.20.3",
     "tsx": "^4.19.0",
     "typescript": "~5.6.0",
     "vite": "^7.2.4"

docs/docs/plugins/plugin-management.md

@@ -6,6 +6,8 @@ sidebar_position: 6
 
 AppKit includes a CLI for managing plugins. All commands are available under `npx @databricks/appkit plugin`.
 
+**Manifest convention:** `manifest.json` is the default and recommended format for CLI commands (`sync`, `list`, `validate`). For zero-trust safety, JS manifests (`manifest.js`/`manifest.cjs`) are ignored unless you pass `--allow-js-manifest`, which executes plugin code and should be used only with trusted sources. The **add-resource** command only edits `manifest.json` in place.
+
 ## Create a plugin
 
 Scaffold a new plugin interactively:
@@ -20,7 +22,7 @@ The wizard walks you through:
 - **Resources**: Which Databricks resources the plugin needs (SQL Warehouse, Secret, etc.) and whether each is required or optional
 - **Optional fields**: Author, version, license
 
-The command generates a complete plugin scaffold with `manifest.json`, TypeScript class, and barrel exports — ready to register in your app.
+The command generates a complete plugin scaffold with `manifest.json` and a TypeScript plugin class that imports the manifest directly — ready to register in your app.
 
 ## Sync plugin manifests
 
@@ -32,6 +34,12 @@ npx @databricks/appkit plugin sync --write
 
 This discovers plugin manifests from installed packages and local imports, then writes a consolidated manifest used by deployment tooling. Plugins referenced in your `createApp({ plugins: [...] })` call are automatically marked as required.
 
+Trusted installed Databricks packages (for example `@databricks/appkit`) are allowed to load bundled JS manifests during `plugin sync`. For other sources, if you intentionally rely on JS manifests, opt in explicitly:
+
+```bash
+npx @databricks/appkit plugin sync --write --allow-js-manifest
+```
+
 Use the `--silent` flag in build hooks to suppress output:
 
 ```json
@@ -58,6 +66,8 @@ npx @databricks/appkit plugin validate plugins/my-plugin appkit.plugins.json
 
 The validator auto-detects whether a file is a plugin manifest or a template manifest (from `$schema`) and reports errors with humanized paths and expected values.
 
+To include JS manifests in validation, pass `--allow-js-manifest`.
+
 ## List plugins
 
 View registered plugins from `appkit.plugins.json` or scan a directory:
@@ -69,13 +79,16 @@ npx @databricks/appkit plugin list
 # Scan a directory for plugin folders
 npx @databricks/appkit plugin list --dir plugins/
 
+# Scan a directory and include JS manifests (trusted code only)
+npx @databricks/appkit plugin list --dir plugins/ --allow-js-manifest
+
 # JSON output for scripting
 npx @databricks/appkit plugin list --json
 ```
 
 ## Add a resource to a plugin
 
-Interactively add a new resource requirement to an existing plugin manifest:
+Interactively add a new resource requirement to an existing plugin manifest. **Requires `manifest.json`** in the plugin directory (the command edits it in place; it does not modify `manifest.js`):
 
 ```bash
 npx @databricks/appkit plugin add-resource

package.json

@@ -62,7 +62,7 @@
     "plop": "^4.0.4",
     "publint": "^0.3.15",
     "release-it": "^19.1.0",
-    "tsdown": "^0.15.7",
+    "tsdown": "^0.20.3",
     "tsx": "^4.20.6",
     "turbo": "^2.6.1",
     "typescript": "^5.6.0",

packages/appkit-ui/package.json

@@ -2,6 +2,7 @@
   "name": "@databricks/appkit-ui",
   "type": "module",
   "version": "0.15.0",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/databricks/appkit.git"
@@ -14,6 +15,7 @@
     "docs",
     "docs.md",
     "CLAUDE.md",
+    "LICENSE",
     "llms.txt",
     "README.md",
     "DCO",

packages/appkit-ui/tsdown.config.ts

@@ -9,12 +9,13 @@ export default defineConfig([
     platform: "browser",
     minify: false,
     dts: {
-      resolve: true,
+      resolver: "oxc",
     },
     copy: [
       {
         from: "src/react/styles/globals.css",
-        to: "dist/styles.css",
+        to: "dist",
+        rename: "styles.css",
       },
     ],
     clean: false,

packages/appkit/package.json

@@ -5,6 +5,7 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "packageManager": "pnpm@10.21.0",
+  "license": "Apache-2.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/databricks/appkit.git"
@@ -16,6 +17,7 @@
     "docs",
     "docs.md",
     "CLAUDE.md",
+    "LICENSE",
     "llms.txt",
     "README.md",
     "DCO",

packages/appkit/src/connectors/lakebase/index.ts

@@ -2,7 +2,7 @@ import {
   createLakebasePool as createLakebasePoolBase,
   type LakebasePoolConfig,
 } from "@databricks/lakebase";
-import type pg from "pg";
+import type { Pool } from "pg";
 import { createLogger } from "@/logging/logger";
 
 /**
@@ -12,9 +12,7 @@ import { createLogger } from "@/logging/logger";
  * @param config - Lakebase pool configuration
  * @returns PostgreSQL pool with appkit integration
  */
-export function createLakebasePool(
-  config?: Partial<LakebasePoolConfig>,
-): pg.Pool {
+export function createLakebasePool(config?: Partial<LakebasePoolConfig>): Pool {
   const logger = createLogger("connectors:lakebase");
 
   return createLakebasePoolBase({

packages/appkit/src/plugins/analytics/analytics.ts

@@ -14,8 +14,9 @@ import {
 } from "../../context";
 import { createLogger } from "../../logging/logger";
 import { Plugin, toPlugin } from "../../plugin";
+import type { PluginManifest } from "../../registry";
 import { queryDefaults } from "./defaults";
-import { analyticsManifest } from "./manifest";
+import manifest from "./manifest.json";
 import { QueryProcessor } from "./query";
 import type {
   AnalyticsQueryResponse,
@@ -29,7 +30,7 @@ export class AnalyticsPlugin extends Plugin {
   name = "analytics";
 
   /** Plugin manifest declaring metadata and resource requirements */
-  static manifest = analyticsManifest;
+  static manifest = manifest as PluginManifest;
 
   protected static description = "Analytics plugin for data analysis";
   protected declare config: IAnalyticsConfig;

packages/appkit/src/plugins/analytics/index.ts

@@ -1,3 +1,2 @@
 export * from "./analytics";
-export * from "./manifest";
 export * from "./types";

packages/appkit/src/plugins/genie/genie.ts

@@ -5,8 +5,9 @@ import { GenieConnector } from "../../connectors";
 import { getWorkspaceClient } from "../../context";
 import { createLogger } from "../../logging";
 import { Plugin, toPlugin } from "../../plugin";
+import type { PluginManifest } from "../../registry";
 import { genieStreamDefaults } from "./defaults";
-import { genieManifest } from "./manifest";
+import manifest from "./manifest.json";
 import type {
   GenieConversationHistoryResponse,
   GenieSendMessageRequest,
@@ -19,7 +20,7 @@ const logger = createLogger("genie");
 export class GeniePlugin extends Plugin {
   name = "genie";
 
-  static manifest = genieManifest;
+  static manifest = manifest as PluginManifest;
 
   protected static description =
     "AI/BI Genie space integration for natural language data queries";

packages/appkit/src/plugins/genie/index.ts

@@ -1,3 +1,2 @@
 export * from "./genie";
-export * from "./manifest";
 export * from "./types";

packages/appkit/src/plugins/lakebase/index.ts

@@ -1,3 +1,2 @@
 export * from "./lakebase";
-export * from "./manifest";
 export * from "./types";

packages/appkit/src/plugins/lakebase/lakebase.ts

@@ -1,4 +1,4 @@
-import type pg from "pg";
+import type { Pool, QueryResult, QueryResultRow } from "pg";
 import {
   createLakebasePool,
   getLakebaseOrmConfig,
@@ -7,7 +7,8 @@ import {
 } from "../../connectors/lakebase";
 import { createLogger } from "../../logging/logger";
 import { Plugin, toPlugin } from "../../plugin";
-import { lakebaseManifest } from "./manifest";
+import type { PluginManifest } from "../../registry";
+import manifest from "./manifest.json";
 import type { ILakebaseConfig } from "./types";
 
 const logger = createLogger("lakebase");
@@ -33,10 +34,10 @@ export class LakebasePlugin extends Plugin {
   name = "lakebase";
 
   /** Plugin manifest declaring metadata and resource requirements */
-  static manifest = lakebaseManifest;
+  static manifest = manifest as PluginManifest;
 
   protected declare config: ILakebaseConfig;
-  private pool: pg.Pool | null = null;
+  private pool: Pool | null = null;
 
   constructor(config: ILakebaseConfig) {
     super(config);
@@ -72,10 +73,10 @@ export class LakebasePlugin extends Plugin {
    * );
    * ```
    */
-  async query<T extends pg.QueryResultRow = any>(
+  async query<T extends QueryResultRow = any>(
     text: string,
     values?: unknown[],
-  ): Promise<pg.QueryResult<T>> {
+  ): Promise<QueryResult<T>> {
     // biome-ignore lint/style/noNonNullAssertion: pool is guaranteed non-null after setup(), which AppKit always awaits before exposing the plugin API
     return this.pool!.query<T>(text, values);
   }

packages/appkit/src/plugins/server/index.ts

@@ -7,8 +7,9 @@ import type { PluginPhase } from "shared";
 import { ServerError } from "../../errors";
 import { createLogger } from "../../logging/logger";
 import { Plugin, toPlugin } from "../../plugin";
+import type { PluginManifest } from "../../registry";
 import { instrumentations } from "../../telemetry";
-import { serverManifest } from "./manifest";
+import manifest from "./manifest.json";
 import { RemoteTunnelController } from "./remote-tunnel/remote-tunnel-controller";
 import { StaticServer } from "./static-server";
 import type { ServerConfig } from "./types";
@@ -41,7 +42,7 @@ export class ServerPlugin extends Plugin {
   };
 
   /** Plugin manifest declaring metadata and resource requirements */
-  static manifest = serverManifest;
+  static manifest = manifest as PluginManifest;
 
   public name = "server" as const;
   private serverApplication: express.Application;
@@ -360,5 +361,4 @@ export const server = toPlugin<typeof ServerPlugin, ServerConfig, "server">(
 );
 
 // Export manifest and types
-export { serverManifest } from "./manifest";
 export type { ServerConfig } from "./types";

packages/appkit/tsdown.config.ts

@@ -11,11 +11,14 @@ export default defineConfig([
     platform: "node",
     minify: false,
     dts: {
-      resolve: true,
+      resolver: "oxc",
     },
     sourcemap: false,
     clean: false,
     unbundle: true,
+    outExtensions: () => ({
+      js: ".js",
+    }),
     noExternal: ["shared"],
     external: (id) => {
       // Bundle "shared" workspace package and @/ path aliases
@@ -37,23 +40,6 @@ export default defineConfig([
         from: "src/plugins/server/remote-tunnel/denied.html",
         to: "dist/plugins/server/remote-tunnel/denied.html",
       },
-      // Plugin manifest JSON files (source of truth for static analysis)
-      {
-        from: "src/plugins/analytics/manifest.json",
-        to: "dist/plugins/analytics/manifest.json",
-      },
-      {
-        from: "src/plugins/genie/manifest.json",
-        to: "dist/plugins/genie/manifest.json",
-      },
-      {
-        from: "src/plugins/lakebase/manifest.json",
-        to: "dist/plugins/lakebase/manifest.json",
-      },
-      {
-        from: "src/plugins/server/manifest.json",
-        to: "dist/plugins/server/manifest.json",
-      },
     ],
   },
 ]);