[MarioCadenas]

Warning

DRAFT — do not merge until databricks/appkit-registry is public. While the repo is private, the tokenless public-raw path this PR leaves in place cannot read it, so merging early breaks appkit add / list / search / info for everyone. Merge the day the registry flips public.

What

Removes all private-repo access logic from the registry CLI. Once databricks/appkit-registry is public, the authenticated GitHub Contents API path is dead flexibility — items are fetchable from raw.githubusercontent.com with no auth. The CLI now always uses the public raw URL.

Removed:

• resolveToken, RegistryToken, TOKEN_ENV_VARS (the gh auth token / APPKIT_REGISTRY_TOKEN / GITHUB_TOKEN / GH_TOKEN resolution)
• registryAuthHeaders, and the REGISTRY_ITEM_API_TEMPLATE / REGISTRY_INDEX_API_URL / GH_CONTENTS_API constants
• the token parameter from resolveItems, fetchRegistryItem, fetchVerifiedNames
• the (private) log line, the 401/403 handling, and the "set a token" hints/help text in add / list / info

Net −121 lines (32 insertions, 153 deletions).

Why a draft, not "keep token optional"

The CLI already falls back to the public raw URL when no token is present, so functionally nothing requires this change once public. But leaving the token path in means: a stale/expired gh token would 401 the API path where the raw path would have worked, plus the misleading (private) messaging and a needless gh/env dependency. Deleting it is the clean end-state. Staged as a draft so it lands atomically with the visibility flip.

Verification

• pnpm --filter=shared typecheck: clean
• registry tests: 129 pass (9 files) — resolveItems tests updated to drop the token arg
• oxlint, oxfmt --check, pnpm knip: clean
• pnpm --filter=shared build:package + appkit add --help smoke: clean

Notes for reviewers

• Rate limit: the authenticated Contents API gives 5,000 req/hr vs. unauthenticated limits, but the CLI fetches a couple of small JSON files per run, so the public raw path is fine.
• No escape hatch retained: this drops the APPKIT_REGISTRY_TOKEN env override entirely. If we ever want a private mirror/staging registry, we'd re-introduce an optional token. Flagging in case anyone wants it kept as an opt-in.
• Will need a trivial rebase after fix(shared): don't downgrade already-installed deps in appkit add #580 (both touch add.ts, but different regions).

This pull request and its description were written by Isaac.

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 1.2 MB — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	1.3 MB	458 KB
Type declarations	464 KB	168 KB
Source maps	2.5 MB	856 KB
Other	11 KB	3.7 KB
Total	4.2 MB	1.5 MB

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	106 KB	2.5 KB	108 KB	external	343 KB
./beta	103 KB	485 B	103 KB	external	309 KB
./testing	45 KB	32 KB	77 KB	external	223 KB
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	26 KB	0 B	26 KB	external	74 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	101 KB
.	utils.js	initial	4.6 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	82 KB
./beta	modular.js	initial	6.0 KB
./beta	stream-manager.js	initial	5.9 KB
./beta	service-context.js	initial	4.2 KB
./beta	databricks.js	initial	3.3 KB
./beta	client.js	initial	647 B
./beta	index.js	initial	20 B
./beta	supervisor-api.js	lazy	192 B
./beta	databricks.js	lazy	178 B
./beta	index.js	lazy	115 B
./testing	manifest.js	initial	32 KB
./testing	index.js	initial	10 KB
./testing	wide-event-emitter.js	initial	2.9 KB
./testing	index.js	lazy	28 KB
./testing	remote-tunnel-manager.js	lazy	2.5 KB
./testing	utils.js	lazy	1.8 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	26 KB

@databricks/appkit-ui

npm tarball (packed): 397 KB (+4 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	429 KB	147 KB
Type declarations	267 KB	98 KB (+1 B)
Source maps	853 KB	286 KB
CSS	16 KB	3.2 KB
Total	1.5 MB	534 KB (+1 B)

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	2.1 KB	0 B	2.1 KB	0 B	5.0 KB
./react	433 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	4.9 KB	0 B	4.9 KB	0 B	12 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	2.1 KB
./react	index.js	initial	431 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	4.9 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 40308415947 -R databricks/appkit -n appkit-template-0.89.0-pr.1e554b3-refactor-registry-public-only-583 -D appkit-pr-583 \
  && unzip -o "appkit-pr-583/appkit-template-0.89.0-pr.1e554b3-refactor-registry-public-only-583.zip" -d "appkit-pr-583" \
  && databricks apps init --template "appkit-pr-583"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.

[github-actions]

This pull request has had no activity for 23 days and has been marked as stale. It will be closed in 7 days if there is no further activity. Add a comment, push a commit, or apply the no-stale label to keep it open.