refactor(shared): drop private-repo access from the registry CLI

[MarioCadenas]

Warning

DRAFT — do not merge until databricks/appkit-registry is public. While the repo is private, the tokenless public-raw path this PR leaves in place cannot read it, so merging early breaks appkit add / list / search / info for everyone. Merge the day the registry flips public.

What

Removes all private-repo access logic from the registry CLI. Once databricks/appkit-registry is public, the authenticated GitHub Contents API path is dead flexibility — items are fetchable from raw.githubusercontent.com with no auth. The CLI now always uses the public raw URL.

Removed:

• resolveToken, RegistryToken, TOKEN_ENV_VARS (the gh auth token / APPKIT_REGISTRY_TOKEN / GITHUB_TOKEN / GH_TOKEN resolution)
• registryAuthHeaders, and the REGISTRY_ITEM_API_TEMPLATE / REGISTRY_INDEX_API_URL / GH_CONTENTS_API constants
• the token parameter from resolveItems, fetchRegistryItem, fetchVerifiedNames
• the (private) log line, the 401/403 handling, and the "set a token" hints/help text in add / list / info

Net −121 lines (32 insertions, 153 deletions).

Why a draft, not "keep token optional"

The CLI already falls back to the public raw URL when no token is present, so functionally nothing requires this change once public. But leaving the token path in means: a stale/expired gh token would 401 the API path where the raw path would have worked, plus the misleading (private) messaging and a needless gh/env dependency. Deleting it is the clean end-state. Staged as a draft so it lands atomically with the visibility flip.

Verification

• pnpm --filter=shared typecheck: clean
• registry tests: 129 pass (9 files) — resolveItems tests updated to drop the token arg
• oxlint, oxfmt --check, pnpm knip: clean
• pnpm --filter=shared build:package + appkit add --help smoke: clean

Notes for reviewers

• Rate limit: the authenticated Contents API gives 5,000 req/hr vs. unauthenticated limits, but the CLI fetches a couple of small JSON files per run, so the public raw path is fine.
• No escape hatch retained: this drops the APPKIT_REGISTRY_TOKEN env override entirely. If we ever want a private mirror/staging registry, we'd re-introduce an optional token. Flagging in case anyone wants it kept as an opt-in.
• Will need a trivial rebase after fix(shared): don't downgrade already-installed deps in appkit add #580 (both touch add.ts, but different regions).

This pull request and its description were written by Isaac.

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 1.1 MB (+154 B) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	1.1 MB (+67 B)	410 KB (+75 B)
Type declarations	424 KB	152 KB (+4 B)
Source maps	2.3 MB (+156 B)	769 KB (+98 B)
Other	11 KB	3.7 KB
Total	3.8 MB (+223 B)	1.3 MB (+177 B)

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	95 KB	2.5 KB	98 KB	external	313 KB
./beta	92 KB (+27 B)	457 B	92 KB (+27 B)	external	277 KB (+52 B)
./testing	17 KB	0 B	17 KB	external	52 KB
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	23 KB	0 B	23 KB	external	65 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	91 KB
.	utils.js	initial	4.0 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	75 KB
./beta	stream-manager.js	initial	5.8 KB
./beta	wide-event-emitter.js	initial	3.2 KB
./beta	databricks.js	initial	3.2 KB
./beta	configuration.js	initial	2.3 KB
./beta	service-context.js	initial	1.3 KB
./beta	client.js	initial	434 B
./beta	client-options.js	initial	220 B
./beta	supervisor-api.js	lazy	192 B
./beta	databricks.js	lazy	142 B
./beta	index.js	lazy	123 B
./testing	index.js	initial	17 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	23 KB

@databricks/appkit-ui

npm tarball (packed): 350 KB — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	395 KB	132 KB
Type declarations	229 KB	84 KB
Source maps	766 KB	253 KB
CSS	16 KB	3.2 KB
Total	1.4 MB	473 KB

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	20 B	0 B	20 B	0 B	0 B
./react	432 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	1.0 KB	0 B	1.0 KB	0 B	1.9 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	20 B
./react	index.js	initial	430 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	1.0 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 34590630018 -R databricks/appkit -n appkit-template-0.74.0-pr.4971f6b-refactor-registry-public-only-583 -D appkit-pr-583 \
  && unzip -o "appkit-pr-583/appkit-template-0.74.0-pr.4971f6b-refactor-registry-public-only-583.zip" -d "appkit-pr-583" \
  && databricks apps init --template "appkit-pr-583"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.