feat(appkit): establish ambient user execution scopes

[MarioCadenas]

Summary

Add top-level appkit.asUser(req) with a shared caller snapshot for shorthand calls, run blocks, and lazy streams. This is the second layer of the execution-model stack, based on #592. Do not merge independently of the base.

• Keep per-plugin asUser(req) as a deprecated compatibility wrapper.
• Partition cache entries and in-flight requests by app or user:<id>.
• Preserve legacy context types, helpers, and deprecated warehouse access. Resource bindings remain separate from execution identity.
• SP stays the default outside caller execution. Group is deferred and there is no public asApp().

Fail-closed tool dispatch

PluginContext.executeTool inherits an existing ALS caller. With no caller, it establishes the same request-based user scope as asUser(req) before opening the tool span or executing the provider. Missing production credentials reject. This preserves the original direct OBO dispatch behavior; callers do not need to adopt the new top-level API.

The agents HTTP execution routes (/invocations, /responses, /api/agents/chat) also establish user scope at entry. The marked development fallback remains the only missing-token exception. Standalone runAgent retains its separate SP default.

The testing kit uses production header validation and ALS with only the workspace client factory faked. It records the identity actually observed by the tool.

Design reference: design-docs/execution-identity-e2e.md, sections 5.1.2, 5.1.3, 5.1.4, and 9. Per the updated compatibility requirement, this is additive and preserves legacy behavior and exports. No breaking-change marker or bypass label is needed.

Verification

• pnpm -r typecheck
• Full monorepo unit suite: 5,237 passed, one existing skip
• Both original dev-playground OBO regression tests pass unchanged
• Coverage for default user dispatch, missing credentials, ambient caller precedence, concurrency, scope restoration, and public compatibility aliases
• HTTP tests cover user-scoped agent and tool execution on all three routes
• pnpm build, pnpm docs:build, pnpm check:fix, pnpm knip, and generated-type freshness

[github-actions]

📦 Bundle size report

Compared against bundle-size-baseline.json (main).

@databricks/appkit

npm tarball (packed): 1.2 MB (+11 KB) — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	1.2 MB (+11 KB)	429 KB (+4.2 KB)
Type declarations	448 KB (+4.9 KB)	163 KB (+1.8 KB)
Source maps	2.4 MB (+20 KB)	805 KB (+7.8 KB)
Other	11 KB	3.7 KB
Total	4.0 MB (+35 KB)	1.4 MB (+14 KB)

Per-entry composition (own code — deps external (as shipped))

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
.	97 KB (+1.3 KB)	2.5 KB	100 KB (+1.3 KB)	external	318 KB (+4.1 KB)
./beta	94 KB (+1.0 KB)	457 B	94 KB (+1.0 KB)	external	284 KB (+2.8 KB)
./testing	40 KB (+1.3 KB)	30 KB (-21 B)	70 KB (+1.3 KB)	external	204 KB (+3.2 KB)
./tsdown	520 B	0 B	520 B	external	813 B
./type-generator	23 KB	0 B	23 KB	external	65 KB

Chunks:

Entry	Chunk	Load	Size (gz)
.	index.js	initial	93 KB
.	utils.js	initial	4.0 KB
.	remote-tunnel-manager.js	lazy	2.5 KB
./beta	beta.js	initial	77 KB
./beta	stream-manager.js	initial	5.8 KB
./beta	databricks.js	initial	3.2 KB
./beta	wide-event-emitter.js	initial	3.1 KB
./beta	configuration.js	initial	2.3 KB
./beta	service-context.js	initial	1.9 KB
./beta	client.js	initial	542 B
./beta	client-options.js	initial	219 B
./beta	supervisor-api.js	lazy	192 B
./beta	databricks.js	lazy	142 B
./beta	index.js	lazy	123 B
./testing	manifest.js	initial	27 KB
./testing	index.js	initial	10 KB
./testing	wide-event-emitter.js	initial	2.9 KB
./testing	index.js	lazy	26 KB
./testing	remote-tunnel-manager.js	lazy	2.5 KB
./testing	utils.js	lazy	1.2 KB
./tsdown	index.js	initial	520 B
./type-generator	index.js	initial	23 KB

@databricks/appkit-ui

npm tarball (packed): 350 KB — gzipped download (dist + bin; excludes release-only docs/NOTICE).

dist	raw	gzip
JS (runtime)	395 KB	132 KB
Type declarations	229 KB	84 KB
Source maps	766 KB	253 KB (+1 B)
CSS	16 KB	3.2 KB
Total	1.4 MB	472 KB (+1 B)

Per-entry composition (consumer bundle — deps bundled, peerDeps external)

Entry	Initial (gz)	Lazy (gz)	Total (gz)	node_modules (min)	Own code (min)
./js	5.3 KB	49 KB	55 KB	208 KB	14 KB
./js/beta	20 B	0 B	20 B	0 B	0 B
./react	432 KB	49 KB	481 KB	1.3 MB	177 KB
./react/beta	1.0 KB	0 B	1.0 KB	0 B	1.9 KB

Chunks:

Entry	Chunk	Load	Size (gz)
./js	index.js	initial	5.2 KB
./js	chunk	initial	120 B
./js	apache-arrow	lazy	49 KB
./js/beta	beta.js	initial	20 B
./react	index.js	initial	430 KB
./react	tslib	initial	2.1 KB
./react	apache-arrow	lazy	49 KB
./react/beta	beta.js	initial	1.0 KB

[github-actions]

🤖 AppKit PR bot

🔬 Run evals

Start an eval for this PR from the evals-monitor app: Go to Evals Monitor →

📦 Try this PR's app template

Scaffolds a new app from this PR's SDK build. Run it in any folder (requires the GitHub CLI — gh auth login — and the Databricks CLI):

gh run download 36113876418 -R databricks/appkit -n appkit-template-0.78.0-pr.331c6fd-execution-user-scope-594 -D appkit-pr-594 \
  && unzip -o "appkit-pr-594/appkit-template-0.78.0-pr.331c6fd-execution-user-scope-594.zip" -d "appkit-pr-594" \
  && databricks apps init --template "appkit-pr-594"

The template pins @databricks/appkit and @databricks/appkit-ui to tarballs built from this branch, so the scaffolded app runs against this PR's code.