@fabricorg/databricks-testkit 0.7.1 → 0.8.0

package/dist/index.cjs

@@ -1,7 +1,6 @@
 'use strict';
 
 var promises = require('fs/promises');
-var databricks = require('@fabric-harness/databricks');
 var path = require('path');
 var experimentsDbPool = require('@fabricorg/experiments-db-pool');
 var crypto = require('crypto');
@@ -177,6 +176,146 @@ var init_duckdb_context = __esm({
   }
 });
 
+// src/workspace-client.ts
+async function waitForDatabricksRun(client, runId, options = {}) {
+  const deadline = Date.now() + (options.timeoutMs ?? 6e5);
+  const interval = options.pollIntervalMs ?? 5e3;
+  let current = await client.get("/api/2.2/jobs/runs/get", {
+    run_id: runId
+  });
+  while (!isTerminalRun(current) && Date.now() < deadline) {
+    await delay(interval, options.signal);
+    current = await client.get("/api/2.2/jobs/runs/get", {
+      run_id: runId
+    });
+  }
+  return current;
+}
+async function waitForDatabricksStatement(client, statementId, options = {}) {
+  const deadline = Date.now() + (options.timeoutMs ?? 3e5);
+  const interval = options.pollIntervalMs ?? 2e3;
+  const path = `/api/2.0/sql/statements/${encodeURIComponent(statementId)}`;
+  let current = await client.get(path);
+  while (!isTerminalStatement(current) && Date.now() < deadline) {
+    await delay(interval, options.signal);
+    current = await client.get(path);
+  }
+  return current;
+}
+function workspaceOrigin(host) {
+  const value = host.trim();
+  if (!value) throw new Error("databricks: workspace host cannot be empty");
+  const url = new URL(value.includes("://") ? value : `https://${value}`);
+  if (url.username || url.password) {
+    throw new Error("databricks: workspace host must not contain credentials");
+  }
+  return url.origin;
+}
+function isRetryableStatus(status) {
+  return status === 429 || status === 499 || status >= 500 && status <= 599;
+}
+function retryDelayMs(response, attempt, base) {
+  const retryAfterHeader = response.headers.get("retry-after");
+  const retryAfter = retryAfterHeader === null ? Number.NaN : Number(retryAfterHeader);
+  return Number.isFinite(retryAfter) && retryAfter >= 0 ? retryAfter * 1e3 : base * 2 ** attempt;
+}
+function isTerminalRun(run) {
+  const state = run.state;
+  return ["TERMINATED", "SKIPPED", "INTERNAL_ERROR"].includes(state?.life_cycle_state ?? "");
+}
+function isTerminalStatement(statement) {
+  const status = statement.status;
+  return ["SUCCEEDED", "FAILED", "CANCELED", "CLOSED"].includes(status?.state ?? "");
+}
+function delay(ms, signal) {
+  if (!signal) return new Promise((resolve2) => setTimeout(resolve2, ms));
+  if (signal.aborted) {
+    return Promise.reject(
+      signal.reason ?? new DOMException("The operation was aborted", "AbortError")
+    );
+  }
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(done, ms);
+    signal.addEventListener("abort", aborted, { once: true });
+    function done() {
+      signal?.removeEventListener("abort", aborted);
+      resolve2();
+    }
+    function aborted() {
+      clearTimeout(timer);
+      reject(signal?.reason ?? new DOMException("The operation was aborted", "AbortError"));
+    }
+  });
+}
+var WorkspaceRestClient;
+var init_workspace_client = __esm({
+  "src/workspace-client.ts"() {
+    WorkspaceRestClient = class {
+      host;
+      token;
+      fetchImpl;
+      maxRetries;
+      retryBaseDelayMs;
+      signal;
+      constructor(options) {
+        this.host = workspaceOrigin(options.host);
+        this.token = options.token;
+        this.fetchImpl = options.fetchImpl ?? fetch;
+        this.maxRetries = options.maxRetries ?? 3;
+        this.retryBaseDelayMs = options.retryBaseDelayMs ?? 500;
+        this.signal = options.signal;
+      }
+      get(path, query) {
+        return this.request("GET", path, void 0, query);
+      }
+      post(path, body, query, options) {
+        return this.request("POST", path, body, query, options);
+      }
+      async request(method, path, body, query = {}, options = {}) {
+        const url = new URL(`${this.host}${path.startsWith("/") ? path : `/${path}`}`);
+        for (const [key, value] of Object.entries(query)) {
+          if (value !== void 0) url.searchParams.set(key, String(value));
+        }
+        const bodyHasIdempotencyToken = typeof body === "object" && body !== null && typeof body.idempotency_token === "string";
+        const canRetry = options.retry === "always" || options.retry !== "never" && (options.retry === "safe" || method === "GET" || Boolean(options.idempotencyKey) || bodyHasIdempotencyToken);
+        const maxRetries = canRetry ? options.maxRetries ?? this.maxRetries : 0;
+        for (let attempt = 0; ; attempt += 1) {
+          const token = typeof this.token === "function" ? await this.token() : this.token;
+          let response;
+          try {
+            response = await this.fetchImpl(url, {
+              method,
+              headers: {
+                authorization: `Bearer ${token}`,
+                ...body !== void 0 ? { "content-type": "application/json" } : {},
+                ...options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}
+              },
+              ...body !== void 0 ? { body: JSON.stringify(body) } : {},
+              ...this.signal ? { signal: this.signal } : {}
+            });
+          } catch (error) {
+            if (this.signal?.aborted || attempt >= maxRetries) throw error;
+            await delay(this.retryBaseDelayMs * 2 ** attempt, this.signal);
+            continue;
+          }
+          if (response.ok) {
+            if (response.status === 204) return void 0;
+            return await response.json();
+          }
+          if (isRetryableStatus(response.status) && attempt < maxRetries) {
+            await delay(retryDelayMs(response, attempt, this.retryBaseDelayMs), this.signal);
+            continue;
+          }
+          const message = (await response.text()).split(token).join("[REDACTED]");
+          throw new Error(
+            `databricks: ${response.status} ${response.statusText}: ${message.slice(0, 2e3)}`
+          );
+        }
+      }
+    };
+  }
+});
+
 // src/workspace-context.ts
 var workspace_context_exports = {};
 __export(workspace_context_exports, {
@@ -212,11 +351,10 @@ async function createWorkspaceContext(options = {}) {
     const state = submitted.status?.state;
     let terminal = submitted;
     if (state !== "SUCCEEDED" && state !== "FAILED" && state !== "CANCELED" && state !== "CLOSED") {
-      terminal = await databricks.waitForDatabricksStatement(
-        client,
-        submitted.statement_id ?? "",
-        { pollIntervalMs: options.pollIntervalMs, timeoutMs: options.timeoutMs }
-      );
+      terminal = await waitForDatabricksStatement(client, submitted.statement_id ?? "", {
+        pollIntervalMs: options.pollIntervalMs,
+        timeoutMs: options.timeoutMs
+      });
     }
     if (terminal.status?.state !== "SUCCEEDED") {
       throw new Error(
@@ -332,7 +470,7 @@ function resolveWarehouseId(env) {
 function createClientFromEnv(env, fetchImpl) {
   const host = env.DATABRICKS_HOST;
   if (!host) throw new Error("Live profile requires DATABRICKS_HOST");
-  return new databricks.DatabricksRestClient({
+  return new WorkspaceRestClient({
     host,
     token: resolveTokenProvider(host, env, fetchImpl),
     ...fetchImpl ? { fetchImpl } : {}
@@ -423,6 +561,7 @@ var NUMERIC_TYPES;
 var init_workspace_context = __esm({
   "src/workspace-context.ts"() {
     init_fixtures();
+    init_workspace_client();
     NUMERIC_TYPES = /^(INT|LONG|SHORT|BYTE|FLOAT|DOUBLE|DECIMAL)/i;
   }
 });
@@ -751,6 +890,7 @@ function abortableDelay(ms, signal) {
 }
 
 // src/live-checks.ts
+init_workspace_client();
 function sqlRoundTripCheck() {
   return {
     id: "sql",
@@ -839,7 +979,7 @@ function jobRunCheck() {
       const submitted = await client.post("/api/2.1/jobs/run-now", {
         job_id: jobId
       });
-      const run = await databricks.waitForDatabricksRun(client, submitted.run_id, {
+      const run = await waitForDatabricksRun(client, submitted.run_id, {
         timeoutMs: Number(env.DBX_TEST_TIMEOUT_MS ?? 9e5),
         pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 1e4)
       });
@@ -895,7 +1035,7 @@ function notebookSubmitCheck() {
         ]
       });
       if (!submitted.run_id) throw new Error("Notebook submit returned no run_id");
-      const run = await databricks.waitForDatabricksRun(client, submitted.run_id, {
+      const run = await waitForDatabricksRun(client, submitted.run_id, {
         timeoutMs: Number(env.DBX_TEST_TIMEOUT_MS ?? 9e5),
         pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 1e4)
       });
@@ -963,7 +1103,7 @@ function dbtBuildCheck() {
         request
       );
       if (!submitted.run_id) throw new Error("dbt submit returned no run_id");
-      const run = await databricks.waitForDatabricksRun(client, submitted.run_id, {
+      const run = await waitForDatabricksRun(client, submitted.run_id, {
         timeoutMs: Number(env.DBX_TEST_TIMEOUT_MS ?? 9e5),
         pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 1e4)
       });
@@ -1130,7 +1270,7 @@ async function waitForOperation(client, initial, options) {
   while (!operation.done) {
     if (!operation.name) throw new Error("Lakebase operation did not return an operation name");
     if (Date.now() >= deadline) throw new Error(`Lakebase operation '${operation.name}' timed out`);
-    await delay(options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
+    await delay2(options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS);
     operation = await client.get(`/api/2.0/postgres/${operation.name}`);
   }
   if (operation.error) {
@@ -1140,7 +1280,7 @@ async function waitForOperation(client, initial, options) {
   }
   return operation.response;
 }
-function delay(ms) {
+function delay2(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 
@@ -1322,6 +1462,9 @@ function autoLoaderIngestionCheck(options = {}) {
     }
   };
 }
+
+// src/resilience-checks.ts
+init_workspace_client();
 function safeName(prefix) {
   return `${prefix}_${crypto.randomUUID().replaceAll("-", "_")}`;
 }
@@ -1516,7 +1659,7 @@ function classicComputeCheck() {
         ]
       });
       if (!submitted.run_id) throw new Error("Classic compute submit returned no run_id");
-      const run = await databricks.waitForDatabricksRun(client, submitted.run_id, {
+      const run = await waitForDatabricksRun(client, submitted.run_id, {
         timeoutMs: Number(env.DBX_TEST_CLASSIC_TIMEOUT_MS ?? 18e5),
         pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 15e3)
       });
@@ -1841,6 +1984,9 @@ function createFoundationTargetPacks() {
   ];
 }
 var foundationTargetPacks = createFoundationTargetPacks();
+
+// src/jobs-orchestration.ts
+init_workspace_client();
 var DatabricksJobsAdapter = class {
   constructor(client) {
     this.client = client;
@@ -1864,7 +2010,7 @@ var DatabricksJobsAdapter = class {
     return normalizeJobRun(runId, raw);
   }
   async wait(runId, options = {}) {
-    const raw = await databricks.waitForDatabricksRun(this.client, runId, {
+    const raw = await waitForDatabricksRun(this.client, runId, {
       timeoutMs: options.timeoutMs,
       pollIntervalMs: options.pollIntervalMs
     });
@@ -1885,7 +2031,7 @@ var DatabricksJobsAdapter = class {
           `Databricks run ${runId} reached ${run.lifeCycleState}/${run.resultState} before it could be canceled`
         );
       }
-      await delay2(pollIntervalMs);
+      await delay3(pollIntervalMs);
     }
     throw new Error(`Databricks run ${runId} did not become active within ${timeoutMs}ms`);
   }
@@ -1907,7 +2053,7 @@ var DatabricksJobsAdapter = class {
       const run = await this.get(runId);
       const repair = run.repairs.find((candidate) => candidate.repairId === repairId);
       if (repair && isTerminal(repair.lifeCycleState)) return run;
-      await delay2(pollIntervalMs);
+      await delay3(pollIntervalMs);
     }
     throw new Error(
       `Databricks repair ${repairId} for run ${runId} timed out after ${timeoutMs}ms`
@@ -2098,7 +2244,7 @@ function normalizeJobRun(fallbackRunId, raw) {
 function isTerminal(state) {
   return ["TERMINATED", "SKIPPED", "INTERNAL_ERROR", "BLOCKED"].includes(state);
 }
-function delay2(ms) {
+function delay3(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
 function objectOf(value) {
@@ -2349,6 +2495,7 @@ function createLakeflowJobsTargetPack() {
 }
 
 // src/advanced-workload-checks.ts
+init_workspace_client();
 init_workspace_context();
 var DatabricksAdvancedWorkloadsAdapter = class {
   constructor(client) {
@@ -2422,6 +2569,15 @@ var DatabricksAdvancedWorkloadsAdapter = class {
   warehouse(id) {
     return this.client.get(`/api/2.0/sql/warehouses/${segment(id)}`);
   }
+  app(name) {
+    return this.client.get(`/api/2.0/apps/${segment(name)}`);
+  }
+  agentService(fullName) {
+    return this.client.get(`/api/2.1/unity-catalog/agent-services/${segment(fullName)}`);
+  }
+  agentServicePermissions(fullName) {
+    return this.client.get(`/api/2.1/unity-catalog/permissions/AGENT_SERVICE/${segment(fullName)}`);
+  }
 };
 function segment(value) {
   return encodeURIComponent(value);
@@ -2468,6 +2624,27 @@ async function booleanSql(label, sql, query) {
     throw new Error(`${label} assertion did not return a truthy first column`);
   }
 }
+async function runCertificationJob(label, jobIdValue, env, client, options = {}) {
+  const jobId = Number(jobIdValue);
+  if (!Number.isSafeInteger(jobId) || jobId <= 0) {
+    throw new Error(`${label} job id must be a positive integer`);
+  }
+  const submitted = await client.post("/api/2.1/jobs/run-now", {
+    job_id: jobId
+  });
+  if (!Number.isSafeInteger(submitted.run_id)) {
+    throw new Error(`${label} certification job returned no run_id`);
+  }
+  const run = await waitForDatabricksRun(client, submitted.run_id, {
+    timeoutMs: options.timeoutMs ?? Number(env.DBX_TEST_TIMEOUT_MS ?? 9e5),
+    pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 1e4)
+  });
+  const result = run.state?.result_state;
+  if (result !== "SUCCESS") {
+    throw new Error(`${label} certification job ${jobId} ended in ${result ?? "UNKNOWN"}`);
+  }
+  return { jobId, runId: submitted.run_id };
+}
 function advancedStreamingCdcCheck() {
   const names = [
     "DBX_TEST_STREAMING_PIPELINE_ID",
@@ -2847,6 +3024,201 @@ function securityPostureCostCheck() {
     }
   };
 }
+function mlflow3GenAiQualityCheck() {
+  const names = [
+    "DBX_TEST_MLFLOW3_JOB_ID",
+    "DBX_TEST_MLFLOW3_TRACE_ASSERTION_SQL",
+    "DBX_TEST_MLFLOW3_EVAL_ASSERTION_SQL",
+    "DBX_TEST_MLFLOW3_SCORER_ASSERTION_SQL",
+    "DBX_TEST_MLFLOW3_MONITOR_ASSERTION_SQL",
+    "DBX_TEST_AI_SEARCH_EVAL_ASSERTION_SQL"
+  ];
+  return {
+    id: "mlflow3-genai-quality",
+    description: "MLflow 3 tracing, offline agent evaluation and production scorer monitoring produce durable evidence",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse2 }) {
+      requireEnv(env, names);
+      const job = await runCertificationJob(
+        "MLflow 3 GenAI",
+        env.DBX_TEST_MLFLOW3_JOB_ID,
+        env,
+        client,
+        { timeoutMs: Number(env.DBX_TEST_MLFLOW3_TIMEOUT_MS ?? 72e5) }
+      );
+      await booleanSql("MLflow 3 trace", env.DBX_TEST_MLFLOW3_TRACE_ASSERTION_SQL, warehouse2.query);
+      await booleanSql(
+        "MLflow 3 offline evaluation",
+        env.DBX_TEST_MLFLOW3_EVAL_ASSERTION_SQL,
+        warehouse2.query
+      );
+      await booleanSql(
+        "MLflow 3 production scorer lifecycle",
+        env.DBX_TEST_MLFLOW3_SCORER_ASSERTION_SQL,
+        warehouse2.query
+      );
+      await booleanSql(
+        "MLflow 3 production monitoring",
+        env.DBX_TEST_MLFLOW3_MONITOR_ASSERTION_SQL,
+        warehouse2.query
+      );
+      await booleanSql(
+        "AI Search retrieval quality",
+        env.DBX_TEST_AI_SEARCH_EVAL_ASSERTION_SQL,
+        warehouse2.query
+      );
+      return {
+        ...job,
+        traces: true,
+        offlineEvaluation: true,
+        scorerLifecycle: true,
+        monitor: true,
+        aiSearchEvaluation: true
+      };
+    }
+  };
+}
+function agentEvaluationPipelineCheck() {
+  const names = ["DBX_TEST_AGENT_EVAL_E2E_JOB_ID", "DBX_TEST_AGENT_EVAL_ASSERTION_SQL"];
+  return {
+    id: "agent-evaluation-pipeline",
+    description: "Experiments API, outbox, Temporal worker, Model Serving judge, SQL score sink and Quality completion execute end to end",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse2 }) {
+      requireEnv(env, names);
+      const job = await runCertificationJob(
+        "Agent evaluation end-to-end",
+        env.DBX_TEST_AGENT_EVAL_E2E_JOB_ID,
+        env,
+        client
+      );
+      await booleanSql(
+        "Agent evaluation terminal Quality evidence",
+        env.DBX_TEST_AGENT_EVAL_ASSERTION_SQL,
+        warehouse2.query
+      );
+      return { ...job, api: true, outbox: true, temporal: true, judged: true, persisted: true };
+    }
+  };
+}
+function managedMcpAgentsCheck() {
+  const names = [
+    "DBX_TEST_MCP_JOB_ID",
+    "DBX_TEST_MCP_MANAGED_ASSERTION_SQL",
+    "DBX_TEST_MCP_SERVICE_ASSERTION_SQL",
+    "DBX_TEST_MCP_DENY_ASSERTION_SQL"
+  ];
+  return {
+    id: "managed-mcp-agents",
+    description: "Managed MCP and Unity Catalog MCP Services support list, call and deny behavior",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse2 }) {
+      requireEnv(env, names);
+      const job = await runCertificationJob("Databricks MCP", env.DBX_TEST_MCP_JOB_ID, env, client);
+      await booleanSql(
+        "Managed MCP list/call",
+        env.DBX_TEST_MCP_MANAGED_ASSERTION_SQL,
+        warehouse2.query
+      );
+      await booleanSql(
+        "Unity Catalog MCP Service list/call",
+        env.DBX_TEST_MCP_SERVICE_ASSERTION_SQL,
+        warehouse2.query
+      );
+      await booleanSql(
+        "MCP excluded-tool denial",
+        env.DBX_TEST_MCP_DENY_ASSERTION_SQL,
+        warehouse2.query
+      );
+      return { ...job, managedServer: true, mcpService: true, denyControl: true };
+    }
+  };
+}
+function dataQualityAppTelemetryCheck() {
+  const names = [
+    "DBX_TEST_TELEMETRY_APP_NAME",
+    "DBX_TEST_DQM_ASSERTION_SQL",
+    "DBX_TEST_APP_LOGS_ASSERTION_SQL",
+    "DBX_TEST_APP_SPANS_ASSERTION_SQL",
+    "DBX_TEST_APP_METRICS_ASSERTION_SQL"
+  ];
+  return {
+    id: "data-quality-app-telemetry",
+    description: "Unity Catalog data quality monitoring and Databricks Apps logs, spans and metrics are current",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse2 }) {
+      requireEnv(env, names);
+      const appName = env.DBX_TEST_TELEMETRY_APP_NAME;
+      const app = await adapter(client).app(appName);
+      const destinations = Array.isArray(app.telemetry_export_destinations) ? app.telemetry_export_destinations : [];
+      const unityCatalog = destinations.find(
+        (destination) => isObject(destination) && isObject(destination.unity_catalog)
+      );
+      if (!isObject(unityCatalog) || !isObject(unityCatalog.unity_catalog)) {
+        throw new Error(`Databricks App ${appName} has no Unity Catalog telemetry destination`);
+      }
+      const tables = unityCatalog.unity_catalog;
+      for (const field of ["logs_table", "traces_table", "metrics_table"]) {
+        if (typeof tables[field] !== "string" || !tables[field]) {
+          throw new Error(`Databricks App ${appName} telemetry destination has no ${field}`);
+        }
+      }
+      await booleanSql("Data Quality Monitoring", env.DBX_TEST_DQM_ASSERTION_SQL, warehouse2.query);
+      await booleanSql("App logs", env.DBX_TEST_APP_LOGS_ASSERTION_SQL, warehouse2.query);
+      await booleanSql("App spans", env.DBX_TEST_APP_SPANS_ASSERTION_SQL, warehouse2.query);
+      await booleanSql("App metrics", env.DBX_TEST_APP_METRICS_ASSERTION_SQL, warehouse2.query);
+      return { app: appName, unityCatalogTelemetry: true, dataQualityMonitoring: true };
+    }
+  };
+}
+function agentServicesEnrollmentCheck() {
+  const names = [
+    "DBX_TEST_AGENT_SERVICE_FULL_NAME",
+    "DBX_TEST_AGENT_SERVICE_CONNECTION",
+    "DBX_TEST_AGENT_SERVICE_EXECUTE_PRINCIPAL"
+  ];
+  return {
+    id: "agent-services-enrollment",
+    description: "A customer-owned Harness agent is registered as an external Unity Catalog Agent Service with governed access",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client }) {
+      requireEnv(env, names);
+      const fullName = env.DBX_TEST_AGENT_SERVICE_FULL_NAME;
+      const api = adapter(client);
+      const service = await api.agentService(fullName);
+      if (service.agent_service_type !== "AGENT_SERVICE_TYPE_EXTERNAL") {
+        throw new Error(`${fullName} is not an external Agent Service`);
+      }
+      const expectedConnection = env.DBX_TEST_AGENT_SERVICE_CONNECTION;
+      const actualConnection = service.config?.connection?.name ?? "";
+      if (actualConnection !== expectedConnection && actualConnection.split("/").at(-1) !== expectedConnection) {
+        throw new Error(`${fullName} uses unexpected connection ${actualConnection || "UNKNOWN"}`);
+      }
+      if (!service.config?.base_path?.startsWith("/")) {
+        throw new Error(`${fullName} has no absolute external base path`);
+      }
+      const permissions = await api.agentServicePermissions(fullName);
+      const assignments = Array.isArray(permissions.privilege_assignments) ? permissions.privilege_assignments : [];
+      const expectedPrincipal = env.DBX_TEST_AGENT_SERVICE_EXECUTE_PRINCIPAL;
+      const assignment = assignments.find(
+        (entry) => isObject(entry) && entry.principal === expectedPrincipal
+      );
+      const privileges = isObject(assignment) && Array.isArray(assignment.privileges) ? assignment.privileges : [];
+      const canExecute = privileges.some(
+        (privilege) => isObject(privilege) && privilege.privilege === "EXECUTE"
+      );
+      if (!canExecute) {
+        throw new Error(`${expectedPrincipal} does not have EXECUTE on ${fullName}`);
+      }
+      return {
+        fullName: service.full_name ?? service.name ?? fullName,
+        connection: actualConnection,
+        executePrincipal: expectedPrincipal,
+        runtimeInvocationAvailable: false
+      };
+    }
+  };
+}
 function regionalDrCheck(options = {}) {
   const names = [
     "DBX_TEST_DR_HOST",
@@ -2931,7 +3303,7 @@ function createAdvancedStreamingTargetPack() {
       "lakeflow-connect.replication"
     ],
     checks: () => [restrictedPrincipalCheck(), advancedStreamingCdcCheck(), lakeflowConnectCheck()],
-    requiredChecks: ["streaming-cdc", "lakeflow-connect"],
+    requiredChecks: ["restricted-principal", "streaming-cdc", "lakeflow-connect"],
     requirements: [
       workspace,
       auth,
@@ -2970,7 +3342,7 @@ function createAiBiGenieTargetPack() {
     maturity: "live-gated",
     capabilities: ["aibi.dashboard", "genie.space", "genie.conversation"],
     checks: () => [restrictedPrincipalCheck(), aiBiDashboardCheck(), genieCheck()],
-    requiredChecks: ["aibi-dashboard", "genie"],
+    requiredChecks: ["restricted-principal", "aibi-dashboard", "genie"],
     requirements: [
       workspace,
       auth,
@@ -3002,7 +3374,7 @@ function createMlflowLifecycleTargetPack() {
       "models.lifecycle"
     ],
     checks: () => [restrictedPrincipalCheck(), mlflowLifecycleCheck()],
-    requiredChecks: ["mlflow-lifecycle"],
+    requiredChecks: ["restricted-principal", "mlflow-lifecycle"],
     requirements: [
       workspace,
       auth,
@@ -3034,7 +3406,7 @@ function createFeatureEngineeringTargetPack() {
       "features.serving"
     ],
     checks: () => [restrictedPrincipalCheck(), featureEngineeringServingCheck()],
-    requiredChecks: ["feature-engineering"],
+    requiredChecks: ["restricted-principal", "feature-engineering"],
     requirements: [
       workspace,
       auth,
@@ -3071,7 +3443,7 @@ function createModelServingTargetPack() {
       "ai-gateway.configuration"
     ],
     checks: () => [restrictedPrincipalCheck(), modelServingCheck()],
-    requiredChecks: ["model-serving"],
+    requiredChecks: ["restricted-principal", "model-serving"],
     requirements: [
       workspace,
       auth,
@@ -3107,7 +3479,7 @@ function createVectorRagAgentsTargetPack() {
       "agents.serving"
     ],
     checks: () => [restrictedPrincipalCheck(), vectorSearchCheck(), ragAgentCheck()],
-    requiredChecks: ["vector-search", "rag-agent"],
+    requiredChecks: ["restricted-principal", "vector-search", "rag-agent"],
     requirements: [
       workspace,
       auth,
@@ -3137,7 +3509,7 @@ function createFederationSharingTargetPack() {
       "clean-rooms.access"
     ],
     checks: () => [restrictedPrincipalCheck(), federationSharingCleanRoomsCheck()],
-    requiredChecks: ["federation-sharing-cleanrooms"],
+    requiredChecks: ["restricted-principal", "federation-sharing-cleanrooms"],
     requirements: [
       workspace,
       auth,
@@ -3171,7 +3543,7 @@ function createSecurityCostDrTargetPack() {
       "dr.secondary-region"
     ],
     checks: () => [restrictedPrincipalCheck(), securityPostureCostCheck(), regionalDrCheck()],
-    requiredChecks: ["security-cost", "regional-dr"],
+    requiredChecks: ["restricted-principal", "security-cost", "regional-dr"],
     requirements: [
       workspace,
       auth,
@@ -3193,6 +3565,234 @@ function createSecurityCostDrTargetPack() {
     ]
   });
 }
+function createMlflow3AgentQualityTargetPack() {
+  return defineTargetPack({
+    id: "mlflow3-agent-quality",
+    name: "MLflow 3 agent quality and monitoring",
+    description: "Native MLflow 3 traces, offline agent evaluation, production scorer lifecycle and online monitoring.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "mlflow3.tracing",
+      "mlflow3.agent-evaluation",
+      "mlflow3.production-scorers",
+      "mlflow3.production-monitoring",
+      "ai-search.retrieval-evaluation"
+    ],
+    checks: () => [restrictedPrincipalCheck(), mlflow3GenAiQualityCheck()],
+    requiredChecks: ["restricted-principal", "mlflow3-genai-quality"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement("mlflow3-job", "Native MLflow 3 certification Job", "DBX_TEST_MLFLOW3_JOB_ID"),
+      requirement(
+        "mlflow3-traces",
+        "Boolean SQL proving a fresh MLflow 3 trace",
+        "DBX_TEST_MLFLOW3_TRACE_ASSERTION_SQL"
+      ),
+      requirement(
+        "mlflow3-evaluation",
+        "Boolean SQL proving offline agent evaluation results",
+        "DBX_TEST_MLFLOW3_EVAL_ASSERTION_SQL"
+      ),
+      requirement(
+        "mlflow3-scorers",
+        "Boolean SQL proving production scorer lifecycle evidence",
+        "DBX_TEST_MLFLOW3_SCORER_ASSERTION_SQL"
+      ),
+      requirement(
+        "mlflow3-monitoring",
+        "Boolean SQL proving production monitoring output",
+        "DBX_TEST_MLFLOW3_MONITOR_ASSERTION_SQL"
+      ),
+      requirement(
+        "ai-search-evaluation",
+        "Boolean SQL proving AI Search retrieval-quality thresholds",
+        "DBX_TEST_AI_SEARCH_EVAL_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#mlflow-3-agent-quality-and-monitoring`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; Python-native MLflow 3 trace, evaluation, complete scorer lifecycle and monitor evidence`
+    ]
+  });
+}
+function createAgentEvaluationPipelineTargetPack() {
+  return defineTargetPack({
+    id: "agent-evaluation-pipeline",
+    name: "Agent evaluation delivery pipeline",
+    description: "Exact-candidate API submission, outbox dispatch, Temporal execution, Databricks judge inference, SQL score persistence and Quality completion.",
+    version: "1.0.0",
+    maturity: "live-gated",
+    capabilities: [
+      "agent-evals.api-submission",
+      "agent-evals.temporal-dispatch",
+      "agent-evals.model-serving-judge",
+      "agent-evals.sql-persistence",
+      "agent-evals.quality-evidence"
+    ],
+    checks: () => [
+      restrictedPrincipalCheck(),
+      evalJudgeModelServingCheck(),
+      agentEvaluationPipelineCheck()
+    ],
+    requiredChecks: ["restricted-principal", "model-eval-judge", "agent-evaluation-pipeline"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement(
+        "eval-serving-endpoint",
+        "Databricks Model Serving endpoint satisfying the evaluator chat contract",
+        "DBX_TEST_EVAL_SERVING_ENDPOINT"
+      ),
+      requirement(
+        "agent-eval-job",
+        "Exact-candidate end-to-end agent evaluation certification Job",
+        "DBX_TEST_AGENT_EVAL_E2E_JOB_ID"
+      ),
+      requirement(
+        "agent-eval-evidence",
+        "Boolean SQL proving terminal scores and Quality evidence",
+        "DBX_TEST_AGENT_EVAL_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#agent-evaluation-delivery-pipeline`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; Experiments API through customer worker and Databricks judge to SQL/Quality`
+    ]
+  });
+}
+function createManagedMcpAgentsTargetPack() {
+  return defineTargetPack({
+    id: "managed-mcp-agents",
+    name: "Managed MCP and MCP Services",
+    description: "Streamable HTTP tool discovery and calls for Databricks managed MCP servers and governed Unity Catalog MCP Services, including a deny control.",
+    version: "1.0.0",
+    maturity: "live-gated",
+    capabilities: [
+      "mcp.managed.list-call",
+      "mcp.services.list-call",
+      "mcp.unity-catalog-governance",
+      "mcp.denial"
+    ],
+    checks: () => [restrictedPrincipalCheck(), managedMcpAgentsCheck()],
+    requiredChecks: ["restricted-principal", "managed-mcp-agents"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement("mcp-job", "Native Streamable HTTP MCP certification Job", "DBX_TEST_MCP_JOB_ID"),
+      requirement(
+        "managed-mcp",
+        "Boolean SQL proving managed MCP list/call behavior",
+        "DBX_TEST_MCP_MANAGED_ASSERTION_SQL"
+      ),
+      requirement(
+        "mcp-service",
+        "Boolean SQL proving UC MCP Service list/call behavior",
+        "DBX_TEST_MCP_SERVICE_ASSERTION_SQL"
+      ),
+      requirement(
+        "mcp-denial",
+        "Boolean SQL proving an MCP tool excluded by UC selectors was denied",
+        "DBX_TEST_MCP_DENY_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#managed-mcp-and-mcp-services`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; managed AI Search or SQL MCP plus a UC MCP Service over Streamable HTTP`
+    ]
+  });
+}
+function createDataQualityObservabilityTargetPack() {
+  return defineTargetPack({
+    id: "data-quality-observability",
+    name: "Data quality and Databricks Apps observability",
+    description: "Unity Catalog Data Quality Monitoring plus Databricks Apps OpenTelemetry logs, spans and metrics.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "data-quality.freshness-completeness",
+      "apps.telemetry.logs",
+      "apps.telemetry.traces",
+      "apps.telemetry.metrics"
+    ],
+    checks: () => [restrictedPrincipalCheck(), dataQualityAppTelemetryCheck()],
+    requiredChecks: ["restricted-principal", "data-quality-app-telemetry"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement("telemetry-app", "App with UC telemetry export", "DBX_TEST_TELEMETRY_APP_NAME"),
+      requirement(
+        "data-quality",
+        "Boolean SQL over current Data Quality Monitoring results",
+        "DBX_TEST_DQM_ASSERTION_SQL"
+      ),
+      requirement(
+        "app-logs",
+        "Boolean SQL proving current app logs",
+        "DBX_TEST_APP_LOGS_ASSERTION_SQL"
+      ),
+      requirement(
+        "app-spans",
+        "Boolean SQL proving current app spans",
+        "DBX_TEST_APP_SPANS_ASSERTION_SQL"
+      ),
+      requirement(
+        "app-metrics",
+        "Boolean SQL proving current app metrics",
+        "DBX_TEST_APP_METRICS_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#data-quality-and-databricks-apps-observability`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; system.data_quality_monitoring.table_results and UC OTel tables`
+    ]
+  });
+}
+function createAgentServicesEnrollmentTargetPack() {
+  return defineTargetPack({
+    id: "agent-services-enrollment",
+    name: "Unity Catalog Agent Services enrollment",
+    description: "Customer-owned Fabric Harness agents registered as external Unity Catalog Agent Services with explicit EXECUTE grants.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "agent-services.external-registration",
+      "agent-services.discovery",
+      "agent-services.permissions",
+      "harness.customer-worker-enrollment"
+    ],
+    checks: () => [restrictedPrincipalCheck(), agentServicesEnrollmentCheck()],
+    requiredChecks: ["restricted-principal", "agent-services-enrollment"],
+    requirements: [
+      workspace,
+      auth,
+      requirement(
+        "agent-service",
+        "External Unity Catalog Agent Service full name",
+        "DBX_TEST_AGENT_SERVICE_FULL_NAME"
+      ),
+      requirement(
+        "agent-connection",
+        "Expected Unity Catalog HTTP connection",
+        "DBX_TEST_AGENT_SERVICE_CONNECTION"
+      ),
+      requirement(
+        "agent-execute-principal",
+        "Principal expected to have EXECUTE",
+        "DBX_TEST_AGENT_SERVICE_EXECUTE_PRINCIPAL"
+      )
+    ],
+    docsUrl: `${DOCS2}#unity-catalog-agent-services-enrollment`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; Agent Services Beta registration/discovery/ACL only; runtime invocation is not claimed`
+    ]
+  });
+}
 function createAdvancedTargetPacks() {
   return [
     createAdvancedStreamingTargetPack(),
@@ -3202,7 +3802,12 @@ function createAdvancedTargetPacks() {
     createModelServingTargetPack(),
     createVectorRagAgentsTargetPack(),
     createFederationSharingTargetPack(),
-    createSecurityCostDrTargetPack()
+    createSecurityCostDrTargetPack(),
+    createMlflow3AgentQualityTargetPack(),
+    createManagedMcpAgentsTargetPack(),
+    createDataQualityObservabilityTargetPack(),
+    createAgentServicesEnrollmentTargetPack(),
+    createAgentEvaluationPipelineTargetPack()
   ];
 }
 
@@ -3216,17 +3821,14 @@ function createBuiltinTargetPacks() {
 }
 var builtinTargetPacks = createBuiltinTargetPacks();
 
-Object.defineProperty(exports, "waitForDatabricksRun", {
-  enumerable: true,
-  get: function () { return databricks.waitForDatabricksRun; }
-});
-Object.defineProperty(exports, "waitForDatabricksStatement", {
-  enumerable: true,
-  get: function () { return databricks.waitForDatabricksStatement; }
-});
+// src/index.ts
+init_workspace_client();
+
 exports.DatabricksAdvancedWorkloadsAdapter = DatabricksAdvancedWorkloadsAdapter;
 exports.DatabricksJobsAdapter = DatabricksJobsAdapter;
 exports.advancedStreamingCdcCheck = advancedStreamingCdcCheck;
+exports.agentEvaluationPipelineCheck = agentEvaluationPipelineCheck;
+exports.agentServicesEnrollmentCheck = agentServicesEnrollmentCheck;
 exports.aiBiDashboardCheck = aiBiDashboardCheck;
 exports.appHealthCheck = appHealthCheck;
 exports.assertDeltaContract = assertDeltaContract;
@@ -3237,10 +3839,13 @@ exports.classicComputeCheck = classicComputeCheck;
 exports.compareToGolden = compareToGolden;
 exports.createAdvancedStreamingTargetPack = createAdvancedStreamingTargetPack;
 exports.createAdvancedTargetPacks = createAdvancedTargetPacks;
+exports.createAgentEvaluationPipelineTargetPack = createAgentEvaluationPipelineTargetPack;
+exports.createAgentServicesEnrollmentTargetPack = createAgentServicesEnrollmentTargetPack;
 exports.createAiBiGenieTargetPack = createAiBiGenieTargetPack;
 exports.createAppsOperationalFoundationPack = createAppsOperationalFoundationPack;
 exports.createBuiltinTargetPacks = createBuiltinTargetPacks;
 exports.createClientFromEnv = createClientFromEnv;
+exports.createDataQualityObservabilityTargetPack = createDataQualityObservabilityTargetPack;
 exports.createDuckDbContext = createDuckDbContext;
 exports.createEphemeralLakebaseBranch = createEphemeralLakebaseBranch;
 exports.createExecutionContext = createExecutionContext;
@@ -3251,6 +3856,8 @@ exports.createJobsCodeFoundationPack = createJobsCodeFoundationPack;
 exports.createLakebaseTestProvider = createLakebaseTestProvider;
 exports.createLakeflowFoundationPack = createLakeflowFoundationPack;
 exports.createLakeflowJobsTargetPack = createLakeflowJobsTargetPack;
+exports.createManagedMcpAgentsTargetPack = createManagedMcpAgentsTargetPack;
+exports.createMlflow3AgentQualityTargetPack = createMlflow3AgentQualityTargetPack;
 exports.createMlflowLifecycleTargetPack = createMlflowLifecycleTargetPack;
 exports.createMockDatabricksClient = createMockDatabricksClient;
 exports.createModelServingTargetPack = createModelServingTargetPack;
@@ -3261,6 +3868,7 @@ exports.createUnityStorageFoundationPack = createUnityStorageFoundationPack;
 exports.createVectorRagAgentsTargetPack = createVectorRagAgentsTargetPack;
 exports.createWorkspaceContext = createWorkspaceContext;
 exports.customLiveCheck = customLiveCheck;
+exports.dataQualityAppTelemetryCheck = dataQualityAppTelemetryCheck;
 exports.dbtBuildCheck = dbtBuildCheck;
 exports.defineLiveSuite = defineLiveSuite;
 exports.defineTargetPack = defineTargetPack;
@@ -3284,6 +3892,8 @@ exports.jobsOrchestrationCheck = jobsOrchestrationCheck;
 exports.lakebaseCredentialCheck = lakebaseCredentialCheck;
 exports.lakebaseRoundTripCheck = lakebaseRoundTripCheck;
 exports.lakeflowConnectCheck = lakeflowConnectCheck;
+exports.managedMcpAgentsCheck = managedMcpAgentsCheck;
+exports.mlflow3GenAiQualityCheck = mlflow3GenAiQualityCheck;
 exports.mlflowLifecycleCheck = mlflowLifecycleCheck;
 exports.modelServingCheck = modelServingCheck;
 exports.normalizeJobRun = normalizeJobRun;
@@ -3318,6 +3928,8 @@ exports.uploadVolumeFile = uploadVolumeFile;
 exports.validateJobGraph = validateJobGraph;
 exports.vectorSearchCheck = vectorSearchCheck;
 exports.volumeIOCheck = volumeIOCheck;
+exports.waitForDatabricksRun = waitForDatabricksRun;
+exports.waitForDatabricksStatement = waitForDatabricksStatement;
 exports.waitForPipelineUpdate = waitForPipelineUpdate;
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map