chore(appkit): fail packaging when the CLI imports a module outside dist/cli

[MarioCadenas]

What it guards

The published @databricks/appkit CLI imports a few leaf modules that live outside dist/cli (for example naming.js, used by appkit plugin promote). tools/dist-appkit.ts copies those into the tarball by hand. If someone adds a new import of that kind without adding the matching copy, the build and tests still pass and the CLI only breaks after publish.

This adds a pack-time check: after dist-appkit.ts assembles tmp/, it walks tmp/dist/cli and fails packaging if any relative import does not resolve inside the packed tree.

• tools/validate-package-imports.ts: the guard (uses @ast-grep/napi, added as a root devDependency)
• tools/dist-appkit.ts: calls assertPackageImportsResolve("tmp/dist/cli")
• packages/appkit/src/tsdown/tests/package-imports.test.ts: unit test
• knip.json: root entry so knip sees the script

Why it is separate

It was first added inside the execution-identity stack (#597), but it is unrelated to local OBO, so it moved here to land on its own.

Verification

• pnpm pack:sdk on this branch passes with the guard active, so main has no missing relative imports today.
• Typecheck, appkit and shared tests, pnpm check, and knip pass.

This pull request and its description were written by Isaac.

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 1.2 MB (+27 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	1.2 MB (+86 B)	428 KB (+8 B)
Type declarations	446 KB	162 KB (-3 B)
Source maps	2.4 MB (+20 B)	802 KB (+14 B)
Other	11 KB	3.7 KB
Total	4.0 MB (+106 B)	1.4 MB (+19 B)

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	96 KB	2.5 KB (-1 B)	99 KB (-1 B)	external	316 KB
./beta	93 KB	478 B	94 KB	external	282 KB
./testing	38 KB	31 KB (+1 B)	69 KB (+1 B)	external	202 KB
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	23 KB	0 B	23 KB	external	65 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	92 KB
.	utils.js	initial	4.6 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	77 KB
./beta	stream-manager.js	initial	5.8 KB
./beta	databricks.js	initial	3.3 KB
./beta	wide-event-emitter.js	initial	3.2 KB
./beta	configuration.js	initial	2.3 KB
./beta	service-context.js	initial	1.3 KB
./beta	client.js	initial	434 B
./beta	client-options.js	initial	219 B
./beta	supervisor-api.js	lazy	192 B
./beta	databricks.js	lazy	164 B
./beta	index.js	lazy	122 B
./testing	manifest.js	initial	26 KB
./testing	index.js	initial	9.9 KB
./testing	wide-event-emitter.js	initial	2.9 KB
./testing	index.js	lazy	27 KB
./testing	remote-tunnel-manager.js	lazy	2.5 KB
./testing	utils.js	lazy	1.8 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	23 KB

@databricks/appkit-ui

npm tarball (packed): 350 KB — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	395 KB	132 KB
Type declarations	229 KB	84 KB
Source maps	766 KB	253 KB
CSS	16 KB	3.2 KB
Total	1.4 MB	472 KB

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	20 B	0 B	20 B	0 B	0 B
./react	432 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	1.0 KB	0 B	1.0 KB	0 B	1.9 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	20 B
./react	index.js	initial	430 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	1.0 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 37301633914 -R databricks/appkit -n appkit-template-0.82.0-pr.24f6165-chore-validate-package-imports-628 -D appkit-pr-628 \
  && unzip -o "appkit-pr-628/appkit-template-0.82.0-pr.24f6165-chore-validate-package-imports-628.zip" -d "appkit-pr-628" \
  && databricks apps init --template "appkit-pr-628"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.