feat(shared): bake execution capabilities into synced plugin manifests

[MarioCadenas]

Summary

Front 1, appkit side (F1.1, F1.2, F1.5). appkit plugin sync now bakes the type-level execution facts into appkit.plugins.json, so the Go CLI can pick user_api_scopes and force SP binds from plain data, with no scope map of its own. Stacked on #592 (needs S2 only) and orthogonal to the Front 2 runtime stack (#594 onward). Do not merge independently of the base.

Contract (what the CLI reads)

All fields are optional and additive, so an older CLI ignores them.

• Per resource entry
  • scope: string, present only when the type can run on behalf of the user. Value from SCOPE_BY_TYPE.
  • appOnly: true, present only when the type is in APP_ONLY_RESOURCE_TYPES (secret, database, postgres). Omitted otherwise.
• Per plugin entry
  • scopes: string[], the scopes the plugin always needs (unconditional on-behalf-of calls, or capabilities with no resource ID), copied from the authoring manifest. Omitted when empty.

Example, the analytics sql_warehouse entry in template/appkit.plugins.json:

{
  "type": "sql_warehouse",
  "alias": "SQL Warehouse",
  "resourceKey": "sql-warehouse",
  "description": "SQL Warehouse for executing analytics queries",
  "permission": "CAN_USE",
  "fields": {
    "id": {
      "env": "DATABRICKS_WAREHOUSE_ID",
      "description": "SQL Warehouse ID",
      "discovery": { "type": "kind", "resourceKind": "warehouse" },
      "origin": "user"
    }
  },
  "scope": "sql"
}

Changes

• templateResourceRequirementSchema gains scope and appOnly; templatePluginSchema gains scopes. JSON schema regenerated, template manifest re-synced.
• Both sync discovery paths (plugins dir via loadPluginEntry, and the node_modules scan in scanForPlugins) now build entries through one toTemplatePlugin helper, so they can't drift apart again.
• template/databricks.yml.tmpl: when the CLI sets .bundle.userApiScopes (pre-rendered list items, generator owns indentation, same as .bundle.resources), it renders under user_api_scopes:. Otherwise the existing plugin-presence block renders unchanged.
• Plugins that always call on behalf of the user declare that scope in their manifest scopes, which the CLI unions whenever any resource is OBO: genie ["genie"], serving ["model-serving"]. Without this, a mixed app (for example --auth-mode obo with the genie space bound as SP) dropped the genie scope and every genie request failed closed. analytics, files, ai-search, and agents only act as the user when a resource or config opts in, so they declare nothing. The plugin scopes enum widens from the seven capability-only scopes to every user_api_scope.
• appkit add drops its separate SCOPE_BY_RESOURCE_TYPE map (deprecated long names, three types) and reads SCOPE_BY_TYPE (separate commit).

Scope names are the short ones from the authoritative list in design-docs/execution-identity-e2e.md section 8. The long forms are deprecated aliases. SP stays the default: nothing here changes what a CLI that doesn't read these fields generates.

Verification

• Sync tests exercise both discovery paths against real manifests on disk and assert scope, appOnly, scopes, and that they are omitted when they don't apply.
• Template fallback: rendered with Go text/template. With no userApiScopes, output is byte-identical to the previous template, with and without a genie plugin. With it set, the provided list renders. A guard test pins the fallback block.
• pnpm --filter=shared typecheck, shared suite 662 passed, pnpm check, pnpm build, pnpm docs:build (no generated-doc drift).

This pull request and its description were written by Isaac.

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 1.2 MB (+9.6 KB) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	1.2 MB (+9.1 KB)	431 KB (+3.4 KB)
Type declarations	449 KB (+3.3 KB)	163 KB (+1.4 KB)
Source maps	2.4 MB (+19 KB)	809 KB (+6.6 KB)
Other	11 KB	3.7 KB
Total	4.0 MB (+31 KB)	1.4 MB (+11 KB)

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	98 KB (+1.1 KB)	2.5 KB	100 KB (+1.1 KB)	external	319 KB (+3.5 KB)
./beta	94 KB (+992 B)	479 B (+1 B)	95 KB (+993 B)	external	285 KB (+2.7 KB)
./testing	40 KB (+1.0 KB)	31 KB (+1 B)	70 KB (+1.0 KB)	external	205 KB (+3.2 KB)
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	23 KB	0 B	23 KB	external	65 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	93 KB
.	utils.js	initial	4.6 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	77 KB
./beta	stream-manager.js	initial	5.8 KB
./beta	databricks.js	initial	3.3 KB
./beta	wide-event-emitter.js	initial	3.1 KB
./beta	configuration.js	initial	2.3 KB
./beta	service-context.js	initial	1.9 KB
./beta	client.js	initial	593 B
./beta	client-options.js	initial	219 B
./beta	supervisor-api.js	lazy	191 B
./beta	databricks.js	lazy	165 B
./beta	index.js	lazy	123 B
./testing	manifest.js	initial	27 KB
./testing	index.js	initial	10 KB
./testing	wide-event-emitter.js	initial	2.9 KB
./testing	index.js	lazy	27 KB
./testing	remote-tunnel-manager.js	lazy	2.5 KB
./testing	utils.js	lazy	1.8 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	23 KB

@databricks/appkit-ui

npm tarball (packed): 350 KB — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	395 KB	132 KB
Type declarations	229 KB	84 KB
Source maps	766 KB	253 KB
CSS	16 KB	3.2 KB
Total	1.4 MB	472 KB

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	20 B	0 B	20 B	0 B	0 B
./react	432 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	1.0 KB	0 B	1.0 KB	0 B	1.9 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	20 B
./react	index.js	initial	430 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	1.0 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 36865245264 -R databricks/appkit -n appkit-template-0.81.0-pr.33fc7c9-manifest-scope-capabilities-623 -D appkit-pr-623 \
  && unzip -o "appkit-pr-623/appkit-template-0.81.0-pr.33fc7c9-manifest-scope-capabilities-623.zip" -d "appkit-pr-623" \
  && databricks apps init --template "appkit-pr-623"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.