@fabricorg/databricks-testkit 0.7.2 → 0.9.0

package/dist/index.js

@@ -148,7 +148,7 @@ async function runLiveSuite(spec, runtime = {}) {
   const startedAt = (/* @__PURE__ */ new Date()).toISOString();
   const ownedWarehouse = runtime.warehouse === void 0;
   const client = runtime.client ?? createClientFromEnv(env);
-  const warehouse2 = runtime.warehouse ?? (hasWarehouseConfig(env) ? await createWorkspaceContext({ env, client }) : unavailableWarehouseContext());
+  const warehouse3 = runtime.warehouse ?? (hasWarehouseConfig(env) ? await createWorkspaceContext({ env, client }) : unavailableWarehouseContext());
   const results = [];
   try {
     for (const check of spec.checks) {
@@ -163,7 +163,7 @@ async function runLiveSuite(spec, runtime = {}) {
       }
       const before = performance.now();
       try {
-        const details = await check.run({ env, warehouse: warehouse2, client });
+        const details = await check.run({ env, warehouse: warehouse3, client });
         results.push({
           id: check.id,
           description: check.description,
@@ -182,7 +182,7 @@ async function runLiveSuite(spec, runtime = {}) {
       }
     }
   } finally {
-    if (ownedWarehouse) await warehouse2.close();
+    if (ownedWarehouse) await warehouse3.close();
   }
   const success = required3.every(
     (id) => results.find((result) => result.id === id)?.status === "pass"
@@ -296,8 +296,8 @@ function sqlRoundTripCheck() {
     id: "sql",
     description: "SQL Statement Execution round-trip",
     configured: (env) => Boolean(env.DATABRICKS_WAREHOUSE_ID || env.DATABRICKS_HTTP_PATH),
-    async run({ warehouse: warehouse2 }) {
-      const rows = await warehouse2.query("SELECT 1 AS dbx_test_ok");
+    async run({ warehouse: warehouse3 }) {
+      const rows = await warehouse3.query("SELECT 1 AS dbx_test_ok");
       if (Number(rows[0]?.dbx_test_ok) !== 1)
         throw new Error("SQL round-trip returned an unexpected value");
       return { rows: rows.length };
@@ -341,9 +341,9 @@ function deltaContractCheck(tableEnv = "DBX_TEST_DELTA_TABLE", columns = []) {
     id: "delta-contract",
     description: "Delta table schema contract",
     configured: (env) => Boolean(env[tableEnv]),
-    async run({ env, warehouse: warehouse2 }) {
+    async run({ env, warehouse: warehouse3 }) {
       const table = env[tableEnv];
-      const rows = await warehouse2.query(`DESCRIBE TABLE ${table}`);
+      const rows = await warehouse3.query(`DESCRIBE TABLE ${table}`);
       assertDeltaContract(table, rows, columns);
       return { table, columns: rows.length };
     }
@@ -354,10 +354,10 @@ function unityCatalogAccessCheck() {
     id: "uc-grants",
     description: "Unity Catalog allow/deny access assertions",
     configured: (env) => Boolean(env.DBX_TEST_UC_ALLOWED_TABLE && env.DBX_TEST_UC_DENIED_TABLE),
-    async run({ env, warehouse: warehouse2 }) {
-      await warehouse2.query(`SELECT * FROM ${env.DBX_TEST_UC_ALLOWED_TABLE} LIMIT 1`);
+    async run({ env, warehouse: warehouse3 }) {
+      await warehouse3.query(`SELECT * FROM ${env.DBX_TEST_UC_ALLOWED_TABLE} LIMIT 1`);
       try {
-        await warehouse2.query(`SELECT * FROM ${env.DBX_TEST_UC_DENIED_TABLE} LIMIT 1`);
+        await warehouse3.query(`SELECT * FROM ${env.DBX_TEST_UC_DENIED_TABLE} LIMIT 1`);
       } catch (error) {
         if (/permission.?denied|insufficient.?priv|403|unauthoriz/i.test(String(error))) {
           return { allowed: env.DBX_TEST_UC_ALLOWED_TABLE, denied: env.DBX_TEST_UC_DENIED_TABLE };
@@ -720,9 +720,9 @@ function secretScopeCheck() {
         scope
       });
       const actual = new Set((response.secrets ?? []).map((secret) => secret.key).filter(Boolean));
-      const missing = expected.filter((key) => !actual.has(key));
-      if (missing.length > 0) {
-        throw new Error(`Secret scope ${scope} is missing keys: ${missing.join(", ")}`);
+      const missing2 = expected.filter((key) => !actual.has(key));
+      if (missing2.length > 0) {
+        throw new Error(`Secret scope ${scope} is missing keys: ${missing2.join(", ")}`);
       }
       return { scope, expectedKeys: expected.length };
     }
@@ -743,10 +743,10 @@ function appHealthCheck(options = {}) {
       const actual = new Set(
         (app.resources ?? []).map((resource) => resource.name).filter(Boolean)
       );
-      const missing = expected.filter((resource) => !actual.has(resource));
-      if (missing.length > 0) {
+      const missing2 = expected.filter((resource) => !actual.has(resource));
+      if (missing2.length > 0) {
         throw new Error(
-          `Databricks App ${name} is missing resource bindings: ${missing.join(", ")}`
+          `Databricks App ${name} is missing resource bindings: ${missing2.join(", ")}`
         );
       }
       const appUrl = env.DBX_TEST_APP_URL ?? app.url ?? app.app_url;
@@ -817,7 +817,7 @@ function autoLoaderIngestionCheck(options = {}) {
     configured: (env) => Boolean(
       env.DBX_TEST_AUTOLOADER_PIPELINE_ID && env.DBX_TEST_AUTOLOADER_TABLE && env.DBX_TEST_AUTOLOADER_FIXTURE && env.DBX_TEST_VOLUME
     ),
-    async run({ env, client, warehouse: warehouse2 }) {
+    async run({ env, client, warehouse: warehouse3 }) {
       const pipelineId = env.DBX_TEST_AUTOLOADER_PIPELINE_ID;
       if (pipelineId === env.DBX_TEST_PIPELINE_ID) {
         throw new Error("DBX_TEST_AUTOLOADER_PIPELINE_ID must not be the production pipeline");
@@ -842,7 +842,7 @@ function autoLoaderIngestionCheck(options = {}) {
           pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 1e4)
         });
         const table = env.DBX_TEST_AUTOLOADER_TABLE;
-        const rows = await warehouse2.query(
+        const rows = await warehouse3.query(
           `SELECT COUNT(*) AS n, SUM(CASE WHEN _rescued_data IS NOT NULL THEN 1 ELSE 0 END) AS rescued FROM ${table}`
         );
         const count = Number(rows[0]?.n ?? 0);
@@ -865,7 +865,7 @@ function performanceBudgetCheck() {
     id: "performance",
     description: "SQL Statement Execution p95 stays within the configured latency budget",
     configured: (env) => Boolean(env.DBX_TEST_PERFORMANCE_P95_MS),
-    async run({ env, warehouse: warehouse2 }) {
+    async run({ env, warehouse: warehouse3 }) {
       const budgetMs = Number(env.DBX_TEST_PERFORMANCE_P95_MS);
       const runs = Number(env.DBX_TEST_PERFORMANCE_RUNS ?? 7);
       if (!Number.isFinite(budgetMs) || budgetMs <= 0) {
@@ -874,11 +874,11 @@ function performanceBudgetCheck() {
       if (!Number.isInteger(runs) || runs < 3 || runs > 100) {
         throw new Error("DBX_TEST_PERFORMANCE_RUNS must be an integer from 3 to 100");
       }
-      await warehouse2.query("SELECT 1 AS warmup");
+      await warehouse3.query("SELECT 1 AS warmup");
       const durations = [];
       for (let index = 0; index < runs; index += 1) {
         const started = performance.now();
-        await warehouse2.query("SELECT 1 AS performance_probe");
+        await warehouse3.query("SELECT 1 AS performance_probe");
         durations.push(performance.now() - started);
       }
       durations.sort((left, right) => left - right);
@@ -900,15 +900,15 @@ function failureRecoveryCheck() {
     id: "failure-recovery",
     description: "A failed statement is isolated and a subsequent statement recovers",
     configured: (env) => Boolean(env.DATABRICKS_WAREHOUSE_ID || env.DATABRICKS_HTTP_PATH),
-    async run({ warehouse: warehouse2 }) {
+    async run({ warehouse: warehouse3 }) {
       let failedAsExpected = false;
       try {
-        await warehouse2.query("SELECT * FROM __fabric_experiments_expected_missing_table__");
+        await warehouse3.query("SELECT * FROM __fabric_experiments_expected_missing_table__");
       } catch {
         failedAsExpected = true;
       }
       if (!failedAsExpected) throw new Error("Injected failure unexpectedly succeeded");
-      const rows = await warehouse2.query("SELECT 1 AS recovered");
+      const rows = await warehouse3.query("SELECT 1 AS recovered");
       if (Number(rows[0]?.recovered) !== 1) {
         throw new Error("Statement execution did not recover after the injected failure");
       }
@@ -946,20 +946,20 @@ function backupRestoreCheck() {
     id: "backup-restore",
     description: "Delta DEEP CLONE backup restores a dropped scratch table",
     configured: (env) => Boolean(env.DATABRICKS_WAREHOUSE_ID || env.DATABRICKS_HTTP_PATH),
-    async run({ warehouse: warehouse2 }) {
-      const source = warehouse2.qual(safeName("backup_source"));
-      const backup = warehouse2.qual(safeName("backup_clone"));
+    async run({ warehouse: warehouse3 }) {
+      const source = warehouse3.qual(safeName("backup_source"));
+      const backup = warehouse3.qual(safeName("backup_clone"));
       try {
-        await warehouse2.exec(`CREATE TABLE ${source} USING DELTA AS SELECT 7 AS value`);
-        await warehouse2.exec(`CREATE TABLE ${backup} DEEP CLONE ${source}`);
-        await warehouse2.exec(`DROP TABLE ${source}`);
-        await warehouse2.exec(`CREATE TABLE ${source} DEEP CLONE ${backup}`);
-        const rows = await warehouse2.query(`SELECT value FROM ${source}`);
+        await warehouse3.exec(`CREATE TABLE ${source} USING DELTA AS SELECT 7 AS value`);
+        await warehouse3.exec(`CREATE TABLE ${backup} DEEP CLONE ${source}`);
+        await warehouse3.exec(`DROP TABLE ${source}`);
+        await warehouse3.exec(`CREATE TABLE ${source} DEEP CLONE ${backup}`);
+        const rows = await warehouse3.query(`SELECT value FROM ${source}`);
         if (Number(rows[0]?.value) !== 7) throw new Error("Restored Delta table lost its data");
         return { restoredRows: rows.length, deepClone: true };
       } finally {
-        await warehouse2.exec(`DROP TABLE IF EXISTS ${source}`).catch(() => void 0);
-        await warehouse2.exec(`DROP TABLE IF EXISTS ${backup}`).catch(() => void 0);
+        await warehouse3.exec(`DROP TABLE IF EXISTS ${source}`).catch(() => void 0);
+        await warehouse3.exec(`DROP TABLE IF EXISTS ${backup}`).catch(() => void 0);
       }
     }
   };
@@ -969,25 +969,25 @@ function rollbackCheck() {
     id: "rollback",
     description: "Delta time-travel rollback restores a known-good table version",
     configured: (env) => Boolean(env.DATABRICKS_WAREHOUSE_ID || env.DATABRICKS_HTTP_PATH),
-    async run({ warehouse: warehouse2 }) {
-      const table = warehouse2.qual(safeName("rollback_probe"));
+    async run({ warehouse: warehouse3 }) {
+      const table = warehouse3.qual(safeName("rollback_probe"));
       try {
-        await warehouse2.exec(`CREATE TABLE ${table} (value INT) USING DELTA`);
-        await warehouse2.exec(`INSERT INTO ${table} VALUES (1)`);
-        const history = await warehouse2.query(`DESCRIBE HISTORY ${table} LIMIT 1`);
+        await warehouse3.exec(`CREATE TABLE ${table} (value INT) USING DELTA`);
+        await warehouse3.exec(`INSERT INTO ${table} VALUES (1)`);
+        const history = await warehouse3.query(`DESCRIBE HISTORY ${table} LIMIT 1`);
         const knownGoodVersion = Number(history[0]?.version);
         if (!Number.isInteger(knownGoodVersion)) {
           throw new Error("Delta history did not return a known-good version");
         }
-        await warehouse2.exec(`INSERT INTO ${table} VALUES (999)`);
-        await warehouse2.exec(`RESTORE TABLE ${table} TO VERSION AS OF ${knownGoodVersion}`);
-        const rows = await warehouse2.query(`SELECT value FROM ${table} ORDER BY value`);
+        await warehouse3.exec(`INSERT INTO ${table} VALUES (999)`);
+        await warehouse3.exec(`RESTORE TABLE ${table} TO VERSION AS OF ${knownGoodVersion}`);
+        const rows = await warehouse3.query(`SELECT value FROM ${table} ORDER BY value`);
         if (rows.length !== 1 || Number(rows[0]?.value) !== 1) {
           throw new Error("Delta rollback did not restore the known-good contents");
         }
         return { knownGoodVersion, restoredRows: rows.length };
       } finally {
-        await warehouse2.exec(`DROP TABLE IF EXISTS ${table}`).catch(() => void 0);
+        await warehouse3.exec(`DROP TABLE IF EXISTS ${table}`).catch(() => void 0);
       }
     }
   };
@@ -997,13 +997,13 @@ function serverlessComputeCheck() {
     id: "azure-serverless",
     description: "Azure Databricks serverless SQL warehouse is enabled and executes SQL",
     configured: (env) => Boolean(env.DATABRICKS_WAREHOUSE_ID),
-    async run({ env, client, warehouse: warehouse2 }) {
+    async run({ env, client, warehouse: warehouse3 }) {
       const id = env.DATABRICKS_WAREHOUSE_ID;
       const details = await client.get(`/api/2.0/sql/warehouses/${encodeURIComponent(id)}`);
       if (details.enable_serverless_compute !== true) {
         throw new Error(`SQL warehouse ${id} is not configured for serverless compute`);
       }
-      const rows = await warehouse2.query("SELECT current_catalog() AS catalog");
+      const rows = await warehouse3.query("SELECT current_catalog() AS catalog");
       return { warehouseId: id, name: details.name, state: details.state, rows: rows.length };
     }
   };
@@ -1123,15 +1123,15 @@ function createTargetPackRegistry(packs) {
   }
   return registry;
 }
-function doctorTargetPack(pack, env = process.env, requiredChecks = pack.requiredChecks ?? []) {
-  const requirements = (pack.requirements ?? []).map((requirement2) => ({
-    id: requirement2.id,
-    description: requirement2.description,
-    satisfied: requirement2.anyOf.some((name) => Boolean(env[name]?.trim())),
-    required: requirement2.required !== false,
-    variables: [...requirement2.anyOf]
+function doctorTargetPack(pack, env = process.env, requiredChecks = []) {
+  const requirements = (pack.requirements ?? []).map((requirement3) => ({
+    id: requirement3.id,
+    description: requirement3.description,
+    satisfied: requirement3.anyOf.some((name) => Boolean(env[name]?.trim())),
+    required: requirement3.required !== false,
+    variables: [...requirement3.anyOf]
   }));
-  const required3 = new Set(requiredChecks);
+  const required3 = new Set(resolveRequiredChecks(pack, requiredChecks));
   const checks = pack.checks().map((check) => ({
     id: check.id,
     description: check.description,
@@ -1139,7 +1139,7 @@ function doctorTargetPack(pack, env = process.env, requiredChecks = pack.require
     required: required3.has(check.id)
   }));
   const known = new Set(checks.map((check) => check.id));
-  const missingRequirements = requirements.filter((requirement2) => requirement2.required && !requirement2.satisfied).map((requirement2) => requirement2.id);
+  const missingRequirements = requirements.filter((requirement3) => requirement3.required && !requirement3.satisfied).map((requirement3) => requirement3.id);
   const missingRequiredChecks = [
     ...checks.filter((check) => check.required && !check.configured).map((check) => check.id),
     ...[...required3].filter((id) => !known.has(id))
@@ -1160,11 +1160,11 @@ function doctorTargetPack(pack, env = process.env, requiredChecks = pack.require
 }
 function defineTargetPackRun(pack, options = {}) {
   const env = options.env ?? process.env;
-  const requiredChecks = [...options.requiredChecks ?? pack.requiredChecks ?? []];
+  const requiredChecks = resolveRequiredChecks(pack, options.requiredChecks);
   const doctor = doctorTargetPack(pack, env, requiredChecks);
   if (!doctor.ready) {
-    const missing = [...doctor.missingRequirements, ...doctor.missingRequiredChecks].join(", ");
-    throw new Error(`Target pack '${pack.id}' is not configured: ${missing}`);
+    const missing2 = [...doctor.missingRequirements, ...doctor.missingRequiredChecks].join(", ");
+    throw new Error(`Target pack '${pack.id}' is not configured: ${missing2}`);
   }
   const targetPack = evidenceMetadata(pack, env);
   const suite = defineLiveSuite({
@@ -1177,6 +1177,9 @@ function defineTargetPackRun(pack, options = {}) {
   });
   return { pack, run: (runtime) => suite.run(runtime) };
 }
+function resolveRequiredChecks(pack, additional = []) {
+  return [.../* @__PURE__ */ new Set([...pack.requiredChecks ?? [], ...additional])];
+}
 async function runTargetPack(pack, options = {}, runtime) {
   return defineTargetPackRun(pack, options).run(runtime);
 }
@@ -1885,6 +1888,576 @@ function createLakeflowJobsTargetPack() {
   });
 }
 
+// src/next-workload-checks.ts
+function missing(env, names) {
+  return names.filter((name) => !env[name]?.trim());
+}
+function requireEnv(env, names) {
+  const absent = missing(env, names);
+  if (absent.length > 0) throw new Error(`Missing required configuration: ${absent.join(", ")}`);
+}
+async function assertBooleanSql(label, statement, query) {
+  if (!statement) throw new Error(`${label} assertion SQL is not configured`);
+  const rows = await query(statement);
+  const value = rows[0] ? Object.values(rows[0])[0] : void 0;
+  if (!(value === true || value === 1 || value === "1" || value === "true")) {
+    throw new Error(`${label} assertion did not return a truthy first column`);
+  }
+}
+async function certificationJob(label, jobIdValue, env, client) {
+  const jobId = Number(jobIdValue);
+  if (!Number.isSafeInteger(jobId) || jobId <= 0) {
+    throw new Error(`${label} job id must be a positive integer`);
+  }
+  const submitted = await client.post("/api/2.1/jobs/run-now", {
+    job_id: jobId
+  });
+  if (!Number.isSafeInteger(submitted.run_id)) {
+    throw new Error(`${label} certification job returned no run_id`);
+  }
+  const run = await waitForDatabricksRun(client, submitted.run_id, {
+    timeoutMs: Number(env.DBX_TEST_TIMEOUT_MS ?? 36e5),
+    pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 1e4)
+  });
+  const result = run.state?.result_state;
+  if (result !== "SUCCESS") {
+    throw new Error(`${label} certification job ${jobId} ended in ${result ?? "UNKNOWN"}`);
+  }
+  return { jobId, runId: submitted.run_id };
+}
+function jobAndAssertionsCheck(spec) {
+  const names = [spec.job, ...spec.assertions.map(({ env }) => env)];
+  return {
+    id: spec.id,
+    description: spec.description,
+    configured: (env) => missing(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv(env, names);
+      const job = await certificationJob(spec.label, env[spec.job], env, client);
+      for (const assertion of spec.assertions) {
+        await assertBooleanSql(assertion.label, env[assertion.env], warehouse3.query);
+      }
+      return {
+        ...job,
+        assertions: Object.fromEntries(spec.assertions.map(({ label }) => [label, true]))
+      };
+    }
+  };
+}
+function semanticAnalyticsCheck() {
+  return jobAndAssertionsCheck({
+    id: "semantic-analytics",
+    description: "Metric views, materialization, SQL alerts and query-performance evidence are healthy",
+    label: "Semantic analytics",
+    job: "DBX_TEST_SEMANTIC_ANALYTICS_JOB_ID",
+    assertions: [
+      { env: "DBX_TEST_METRIC_VIEW_ASSERTION_SQL", label: "Metric view query" },
+      { env: "DBX_TEST_METRIC_MATERIALIZATION_ASSERTION_SQL", label: "Metric materialization" },
+      { env: "DBX_TEST_SQL_ALERT_ASSERTION_SQL", label: "SQL alert" },
+      { env: "DBX_TEST_QUERY_PERFORMANCE_ASSERTION_SQL", label: "Query performance" }
+    ]
+  });
+}
+function aiFunctionsBatchInferenceCheck() {
+  return jobAndAssertionsCheck({
+    id: "ai-functions-batch-inference",
+    description: "AI Functions batch and streaming inference produce governed durable output",
+    label: "AI Functions batch inference",
+    job: "DBX_TEST_AI_FUNCTIONS_JOB_ID",
+    assertions: [
+      { env: "DBX_TEST_AI_FUNCTIONS_OUTPUT_ASSERTION_SQL", label: "AI Functions output" },
+      { env: "DBX_TEST_BATCH_INFERENCE_QUALITY_ASSERTION_SQL", label: "Batch inference quality" },
+      { env: "DBX_TEST_BATCH_INFERENCE_LINEAGE_ASSERTION_SQL", label: "Batch inference lineage" }
+    ]
+  });
+}
+function agentOrchestrationResponsesCheck() {
+  return jobAndAssertionsCheck({
+    id: "agent-orchestration-responses",
+    description: "Knowledge Assistant, multi-agent orchestration and Responses API produce grounded governed evidence",
+    label: "Agent orchestration and Responses",
+    job: "DBX_TEST_AGENT_ORCHESTRATION_JOB_ID",
+    assertions: [
+      { env: "DBX_TEST_KNOWLEDGE_ASSISTANT_ASSERTION_SQL", label: "Knowledge Assistant" },
+      { env: "DBX_TEST_MULTI_AGENT_ASSERTION_SQL", label: "Multi-agent orchestration" },
+      { env: "DBX_TEST_RESPONSES_API_ASSERTION_SQL", label: "Responses API" },
+      { env: "DBX_TEST_AGENT_GROUNDEDNESS_ASSERTION_SQL", label: "Agent groundedness" }
+    ]
+  });
+}
+function aiRuntimeTrainingCheck() {
+  return jobAndAssertionsCheck({
+    id: "ai-runtime-training",
+    description: "AI Runtime training or fine-tuning produces MLflow and Unity Catalog evidence",
+    label: "AI Runtime training",
+    job: "DBX_TEST_AI_RUNTIME_JOB_ID",
+    assertions: [
+      { env: "DBX_TEST_AI_RUNTIME_RUN_ASSERTION_SQL", label: "AI Runtime run" },
+      { env: "DBX_TEST_AI_RUNTIME_EVAL_ASSERTION_SQL", label: "AI Runtime evaluation" },
+      { env: "DBX_TEST_AI_RUNTIME_MODEL_ASSERTION_SQL", label: "AI Runtime registered model" }
+    ]
+  });
+}
+function lakebaseAutoscalingFeatureStoreCheck() {
+  return jobAndAssertionsCheck({
+    id: "lakebase-autoscaling-feature-store",
+    description: "Lakebase Autoscaling Online Feature Store publishes fresh features and serves lookups",
+    label: "Lakebase Autoscaling feature store",
+    job: "DBX_TEST_ONLINE_FEATURE_STORE_JOB_ID",
+    assertions: [
+      { env: "DBX_TEST_ONLINE_STORE_ASSERTION_SQL", label: "Online store publication" },
+      { env: "DBX_TEST_FEATURE_SERVING_ASSERTION_SQL", label: "Feature Serving lookup" },
+      { env: "DBX_TEST_ONLINE_FEATURE_FRESHNESS_ASSERTION_SQL", label: "Online feature freshness" }
+    ]
+  });
+}
+function declarativeBundlesCheck() {
+  return jobAndAssertionsCheck({
+    id: "declarative-bundles",
+    description: "A validated bundle deployment runs the exact candidate and records provenance",
+    label: "Declarative Automation Bundle",
+    job: "DBX_TEST_BUNDLE_JOB_ID",
+    assertions: [
+      { env: "DBX_TEST_BUNDLE_PROVENANCE_ASSERTION_SQL", label: "Bundle provenance" },
+      { env: "DBX_TEST_BUNDLE_CANDIDATE_ASSERTION_SQL", label: "Bundle candidate" },
+      { env: "DBX_TEST_BUNDLE_ROLLBACK_ASSERTION_SQL", label: "Bundle rollback" }
+    ]
+  });
+}
+function lakehouseOptimizationCheck() {
+  const names = [
+    "DBX_TEST_PREDICTIVE_OPTIMIZATION_ASSERTION_SQL",
+    "DBX_TEST_LIQUID_CLUSTERING_ASSERTION_SQL",
+    "DBX_TEST_ICEBERG_INTEROP_ASSERTION_SQL"
+  ];
+  return {
+    id: "lakehouse-optimization",
+    description: "Predictive Optimization, liquid clustering and Iceberg interoperability satisfy table contracts",
+    configured: (env) => missing(env, names).length === 0,
+    async run({ env, warehouse: warehouse3 }) {
+      requireEnv(env, names);
+      await assertBooleanSql(
+        "Predictive Optimization",
+        env.DBX_TEST_PREDICTIVE_OPTIMIZATION_ASSERTION_SQL,
+        warehouse3.query
+      );
+      await assertBooleanSql(
+        "Liquid clustering",
+        env.DBX_TEST_LIQUID_CLUSTERING_ASSERTION_SQL,
+        warehouse3.query
+      );
+      await assertBooleanSql(
+        "Iceberg interoperability",
+        env.DBX_TEST_ICEBERG_INTEROP_ASSERTION_SQL,
+        warehouse3.query
+      );
+      return { predictiveOptimization: true, liquidClustering: true, icebergInterop: true };
+    }
+  };
+}
+function marketplaceOpenSharingCheck() {
+  return jobAndAssertionsCheck({
+    id: "marketplace-open-sharing",
+    description: "Marketplace provider and consumer flows preserve OpenSharing governance and asset usability",
+    label: "Marketplace and OpenSharing",
+    job: "DBX_TEST_MARKETPLACE_JOB_ID",
+    assertions: [
+      { env: "DBX_TEST_MARKETPLACE_LISTING_ASSERTION_SQL", label: "Marketplace listing" },
+      { env: "DBX_TEST_OPEN_SHARING_RECIPIENT_ASSERTION_SQL", label: "OpenSharing recipient" },
+      { env: "DBX_TEST_MARKETPLACE_ASSET_ASSERTION_SQL", label: "Marketplace asset" }
+    ]
+  });
+}
+
+// src/next-target-packs.ts
+var DOCS2 = "https://experiments.fabric.pro/docs/testing/target-packs/";
+var AZURE_M2M_SCOPE = "Azure Databricks, dedicated service principal using OAuth M2M, public network path; named managed or disposable certification fixtures";
+var workspace = {
+  id: "workspace",
+  description: "Databricks workspace host",
+  anyOf: ["DATABRICKS_HOST"]
+};
+var auth = {
+  id: "authentication",
+  description: "Databricks OAuth M2M authentication",
+  anyOf: ["DATABRICKS_CLIENT_ID"],
+  secret: true
+};
+var warehouse = {
+  id: "warehouse",
+  description: "SQL warehouse for durable evidence assertions",
+  anyOf: ["DATABRICKS_WAREHOUSE_ID", "DATABRICKS_HTTP_PATH"]
+};
+var requirement = (id, description, ...anyOf) => ({
+  id,
+  description,
+  anyOf
+});
+var identityChecks = () => [restrictedPrincipalCheck()];
+function createSemanticAnalyticsTargetPack() {
+  return defineTargetPack({
+    id: "semantic-analytics",
+    name: "Semantic analytics and SQL operations",
+    description: "Unity Catalog metric views, materialization, SQL alerts and query-performance regression.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "semantics.metric-views",
+      "semantics.materialization",
+      "sql.alerts",
+      "sql.query-performance"
+    ],
+    checks: () => [...identityChecks(), semanticAnalyticsCheck()],
+    requiredChecks: ["restricted-principal", "semantic-analytics"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement(
+        "semantic-job",
+        "Metric-view certification Job",
+        "DBX_TEST_SEMANTIC_ANALYTICS_JOB_ID"
+      ),
+      requirement(
+        "metric-view",
+        "Metric-view query assertion",
+        "DBX_TEST_METRIC_VIEW_ASSERTION_SQL"
+      ),
+      requirement(
+        "metric-materialization",
+        "Metric-view materialization assertion",
+        "DBX_TEST_METRIC_MATERIALIZATION_ASSERTION_SQL"
+      ),
+      requirement("sql-alert", "SQL alert assertion", "DBX_TEST_SQL_ALERT_ASSERTION_SQL"),
+      requirement(
+        "query-performance",
+        "Query performance assertion",
+        "DBX_TEST_QUERY_PERFORMANCE_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#semantic-analytics-and-sql-operations`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; metric view, materialization, alert and query history`
+    ]
+  });
+}
+function createAiFunctionsBatchInferenceTargetPack() {
+  return defineTargetPack({
+    id: "ai-functions-batch-inference",
+    name: "AI Functions and batch inference",
+    description: "Governed batch or streaming inference through Databricks AI Functions.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "ai-functions.inference",
+      "batch-inference.quality",
+      "streaming-inference",
+      "inference.lineage"
+    ],
+    checks: () => [...identityChecks(), aiFunctionsBatchInferenceCheck()],
+    requiredChecks: ["restricted-principal", "ai-functions-batch-inference"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement("ai-functions-job", "AI Functions inference Job", "DBX_TEST_AI_FUNCTIONS_JOB_ID"),
+      requirement(
+        "ai-functions-output",
+        "Inference output assertion",
+        "DBX_TEST_AI_FUNCTIONS_OUTPUT_ASSERTION_SQL"
+      ),
+      requirement(
+        "batch-quality",
+        "Inference quality assertion",
+        "DBX_TEST_BATCH_INFERENCE_QUALITY_ASSERTION_SQL"
+      ),
+      requirement(
+        "batch-lineage",
+        "Inference lineage assertion",
+        "DBX_TEST_BATCH_INFERENCE_LINEAGE_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#ai-functions-and-batch-inference`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; AI Functions Job with durable output, quality and lineage`
+    ]
+  });
+}
+function createAgentOrchestrationTargetPack() {
+  return defineTargetPack({
+    id: "agent-orchestration-responses",
+    name: "Knowledge Assistant, multi-agent and Responses",
+    description: "Knowledge Assistant and multi-agent application behavior through the Responses API.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "agents.knowledge-assistant",
+      "agents.multi-agent",
+      "agents.responses-api",
+      "agents.groundedness"
+    ],
+    checks: () => [...identityChecks(), agentOrchestrationResponsesCheck()],
+    requiredChecks: ["restricted-principal", "agent-orchestration-responses"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement(
+        "agent-orchestration-job",
+        "Agent orchestration certification Job",
+        "DBX_TEST_AGENT_ORCHESTRATION_JOB_ID"
+      ),
+      requirement(
+        "knowledge-assistant",
+        "Knowledge Assistant assertion",
+        "DBX_TEST_KNOWLEDGE_ASSISTANT_ASSERTION_SQL"
+      ),
+      requirement("multi-agent", "Multi-agent assertion", "DBX_TEST_MULTI_AGENT_ASSERTION_SQL"),
+      requirement(
+        "responses-api",
+        "Responses API assertion",
+        "DBX_TEST_RESPONSES_API_ASSERTION_SQL"
+      ),
+      requirement(
+        "agent-groundedness",
+        "Groundedness assertion",
+        "DBX_TEST_AGENT_GROUNDEDNESS_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#knowledge-assistant-multi-agent-and-responses`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; Databricks preview agent surfaces with durable groundedness evidence`
+    ]
+  });
+}
+function createAiRuntimeTrainingTargetPack() {
+  return defineTargetPack({
+    id: "ai-runtime-training",
+    name: "AI Runtime training and fine-tuning",
+    description: "AI Runtime training or fine-tuning with MLflow and Unity Catalog model evidence.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "ai-runtime.training",
+      "ai-runtime.fine-tuning",
+      "mlflow.training-evaluation",
+      "models.unity-catalog"
+    ],
+    checks: () => [...identityChecks(), aiRuntimeTrainingCheck()],
+    requiredChecks: ["restricted-principal", "ai-runtime-training"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement("ai-runtime-job", "AI Runtime certification Job", "DBX_TEST_AI_RUNTIME_JOB_ID"),
+      requirement(
+        "ai-runtime-run",
+        "Training-run assertion",
+        "DBX_TEST_AI_RUNTIME_RUN_ASSERTION_SQL"
+      ),
+      requirement(
+        "ai-runtime-eval",
+        "Training evaluation assertion",
+        "DBX_TEST_AI_RUNTIME_EVAL_ASSERTION_SQL"
+      ),
+      requirement(
+        "ai-runtime-model",
+        "Registered-model assertion",
+        "DBX_TEST_AI_RUNTIME_MODEL_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#ai-runtime-training-and-fine-tuning`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; serverless GPU AI Runtime candidate tracked in MLflow and Unity Catalog`
+    ]
+  });
+}
+function createLakebaseAutoscalingFeatureStoreTargetPack() {
+  return defineTargetPack({
+    id: "lakebase-autoscaling-features",
+    name: "Lakebase Autoscaling Online Feature Store",
+    description: "Online feature publication, freshness and Feature Serving lookup behavior.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "lakebase.autoscaling",
+      "features.online-store",
+      "features.serving-endpoint",
+      "features.online-freshness"
+    ],
+    checks: () => [...identityChecks(), lakebaseAutoscalingFeatureStoreCheck()],
+    requiredChecks: ["restricted-principal", "lakebase-autoscaling-feature-store"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement(
+        "online-feature-job",
+        "Online Feature Store publication Job",
+        "DBX_TEST_ONLINE_FEATURE_STORE_JOB_ID"
+      ),
+      requirement(
+        "online-store",
+        "Online publication assertion",
+        "DBX_TEST_ONLINE_STORE_ASSERTION_SQL"
+      ),
+      requirement(
+        "feature-serving",
+        "Feature Serving lookup assertion",
+        "DBX_TEST_FEATURE_SERVING_ASSERTION_SQL"
+      ),
+      requirement(
+        "feature-freshness",
+        "Online freshness assertion",
+        "DBX_TEST_ONLINE_FEATURE_FRESHNESS_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#lakebase-autoscaling-online-feature-store`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; Lakebase Autoscaling store and Feature Serving lookup`
+    ]
+  });
+}
+function createDeclarativeBundlesTargetPack() {
+  return defineTargetPack({
+    id: "declarative-bundles",
+    name: "Declarative Automation Bundles",
+    description: "Bundle validation, exact-candidate deployment, execution provenance and rollback.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "bundles.validation",
+      "bundles.deployment",
+      "bundles.provenance",
+      "bundles.rollback"
+    ],
+    checks: () => [...identityChecks(), declarativeBundlesCheck()],
+    requiredChecks: ["restricted-principal", "declarative-bundles"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement("bundle-job", "Bundle-managed certification Job", "DBX_TEST_BUNDLE_JOB_ID"),
+      requirement(
+        "bundle-provenance",
+        "Deployment provenance assertion",
+        "DBX_TEST_BUNDLE_PROVENANCE_ASSERTION_SQL"
+      ),
+      requirement(
+        "bundle-candidate",
+        "Exact-candidate assertion",
+        "DBX_TEST_BUNDLE_CANDIDATE_ASSERTION_SQL"
+      ),
+      requirement(
+        "bundle-rollback",
+        "Rollback assertion",
+        "DBX_TEST_BUNDLE_ROLLBACK_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#declarative-automation-bundles`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; validate/deploy/run/rollback lifecycle for an immutable bundle target`
+    ]
+  });
+}
+function createLakehouseOptimizationTargetPack() {
+  return defineTargetPack({
+    id: "lakehouse-optimization",
+    name: "Lakehouse optimization and Iceberg interoperability",
+    description: "Predictive Optimization, liquid clustering and governed Iceberg interoperability.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "tables.predictive-optimization",
+      "tables.liquid-clustering",
+      "tables.iceberg",
+      "tables.interoperability"
+    ],
+    checks: () => [...identityChecks(), lakehouseOptimizationCheck()],
+    requiredChecks: ["restricted-principal", "lakehouse-optimization"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement(
+        "predictive-optimization",
+        "Predictive Optimization assertion",
+        "DBX_TEST_PREDICTIVE_OPTIMIZATION_ASSERTION_SQL"
+      ),
+      requirement(
+        "liquid-clustering",
+        "Liquid clustering assertion",
+        "DBX_TEST_LIQUID_CLUSTERING_ASSERTION_SQL"
+      ),
+      requirement(
+        "iceberg-interop",
+        "Iceberg interoperability assertion",
+        "DBX_TEST_ICEBERG_INTEROP_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#lakehouse-optimization-and-iceberg`,
+    certificationScopes: [`${AZURE_M2M_SCOPE}; Unity Catalog managed Delta and Iceberg fixtures`]
+  });
+}
+function createMarketplaceOpenSharingTargetPack() {
+  return defineTargetPack({
+    id: "marketplace-open-sharing",
+    name: "Marketplace and OpenSharing",
+    description: "Provider listing, recipient access and usable governed data or AI assets.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "marketplace.provider",
+      "marketplace.consumer",
+      "open-sharing.recipient",
+      "marketplace.ai-assets"
+    ],
+    checks: () => [...identityChecks(), marketplaceOpenSharingCheck()],
+    requiredChecks: ["restricted-principal", "marketplace-open-sharing"],
+    requirements: [
+      workspace,
+      auth,
+      warehouse,
+      requirement(
+        "marketplace-job",
+        "Marketplace certification Job",
+        "DBX_TEST_MARKETPLACE_JOB_ID"
+      ),
+      requirement(
+        "marketplace-listing",
+        "Listing assertion",
+        "DBX_TEST_MARKETPLACE_LISTING_ASSERTION_SQL"
+      ),
+      requirement(
+        "open-sharing-recipient",
+        "Recipient assertion",
+        "DBX_TEST_OPEN_SHARING_RECIPIENT_ASSERTION_SQL"
+      ),
+      requirement(
+        "marketplace-asset",
+        "Shared asset usability assertion",
+        "DBX_TEST_MARKETPLACE_ASSET_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS2}#marketplace-and-opensharing`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE}; private listing provider and recipient lifecycle with governed asset access`
+    ]
+  });
+}
+function createNextTargetPacks() {
+  return [
+    createSemanticAnalyticsTargetPack(),
+    createAiFunctionsBatchInferenceTargetPack(),
+    createAgentOrchestrationTargetPack(),
+    createAiRuntimeTrainingTargetPack(),
+    createLakebaseAutoscalingFeatureStoreTargetPack(),
+    createDeclarativeBundlesTargetPack(),
+    createLakehouseOptimizationTargetPack(),
+    createMarketplaceOpenSharingTargetPack()
+  ];
+}
+
 // src/advanced-workload-checks.ts
 var DatabricksAdvancedWorkloadsAdapter = class {
   constructor(client) {
@@ -1958,6 +2531,15 @@ var DatabricksAdvancedWorkloadsAdapter = class {
   warehouse(id) {
     return this.client.get(`/api/2.0/sql/warehouses/${segment(id)}`);
   }
+  app(name) {
+    return this.client.get(`/api/2.0/apps/${segment(name)}`);
+  }
+  agentService(fullName) {
+    return this.client.get(`/api/2.1/unity-catalog/agent-services/${segment(fullName)}`);
+  }
+  agentServicePermissions(fullName) {
+    return this.client.get(`/api/2.1/unity-catalog/permissions/AGENT_SERVICE/${segment(fullName)}`);
+  }
 };
 function segment(value) {
   return encodeURIComponent(value);
@@ -1968,9 +2550,9 @@ function adapter(client) {
 function required2(env, names) {
   return names.filter((name) => !env[name]?.trim());
 }
-function requireEnv(env, names) {
-  const missing = required2(env, names);
-  if (missing.length > 0) throw new Error(`Missing required configuration: ${missing.join(", ")}`);
+function requireEnv2(env, names) {
+  const missing2 = required2(env, names);
+  if (missing2.length > 0) throw new Error(`Missing required configuration: ${missing2.join(", ")}`);
 }
 function parseJson(value, name) {
   if (!value) return void 0;
@@ -2004,6 +2586,27 @@ async function booleanSql(label, sql, query) {
     throw new Error(`${label} assertion did not return a truthy first column`);
   }
 }
+async function runCertificationJob(label, jobIdValue, env, client, options = {}) {
+  const jobId = Number(jobIdValue);
+  if (!Number.isSafeInteger(jobId) || jobId <= 0) {
+    throw new Error(`${label} job id must be a positive integer`);
+  }
+  const submitted = await client.post("/api/2.1/jobs/run-now", {
+    job_id: jobId
+  });
+  if (!Number.isSafeInteger(submitted.run_id)) {
+    throw new Error(`${label} certification job returned no run_id`);
+  }
+  const run = await waitForDatabricksRun(client, submitted.run_id, {
+    timeoutMs: options.timeoutMs ?? Number(env.DBX_TEST_TIMEOUT_MS ?? 9e5),
+    pollIntervalMs: Number(env.DBX_TEST_POLL_INTERVAL_MS ?? 1e4)
+  });
+  const result = run.state?.result_state;
+  if (result !== "SUCCESS") {
+    throw new Error(`${label} certification job ${jobId} ended in ${result ?? "UNKNOWN"}`);
+  }
+  return { jobId, runId: submitted.run_id };
+}
 function advancedStreamingCdcCheck() {
   const names = [
     "DBX_TEST_STREAMING_PIPELINE_ID",
@@ -2015,8 +2618,8 @@ function advancedStreamingCdcCheck() {
     id: "streaming-cdc",
     description: "Streaming pipeline, streaming table and CDC assertions are healthy",
     configured: (env) => required2(env, names).length === 0,
-    async run({ env, client, warehouse: warehouse2 }) {
-      requireEnv(env, names);
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
       const api = adapter(client);
       const pipeline = await api.pipeline(env.DBX_TEST_STREAMING_PIPELINE_ID);
       assertNotFailed("Streaming pipeline", pipeline.state);
@@ -2025,11 +2628,11 @@ function advancedStreamingCdcCheck() {
       if (!["STREAMING_TABLE", "MATERIALIZED_VIEW", "DELTA"].includes(tableType)) {
         throw new Error(`Streaming target has unsupported table type ${tableType || "UNKNOWN"}`);
       }
-      await booleanSql("CDC", env.DBX_TEST_CDC_ASSERTION_SQL, warehouse2.query);
+      await booleanSql("CDC", env.DBX_TEST_CDC_ASSERTION_SQL, warehouse3.query);
       await booleanSql(
         "Streaming freshness",
         env.DBX_TEST_STREAMING_ASSERTION_SQL,
-        warehouse2.query
+        warehouse3.query
       );
       return { pipelineId: pipeline.pipeline_id, table: env.DBX_TEST_STREAMING_TABLE, tableType };
     }
@@ -2041,8 +2644,8 @@ function lakeflowConnectCheck() {
     id: "lakeflow-connect",
     description: "Lakeflow Connect ingestion pipeline exists and is not failed",
     configured: (env) => required2(env, names).length === 0,
-    async run({ env, client, warehouse: warehouse2 }) {
-      requireEnv(env, names);
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
       const id = env.DBX_TEST_CONNECT_PIPELINE_ID;
       const pipeline = await adapter(client).pipeline(id);
       assertNotFailed("Lakeflow Connect pipeline", pipeline.state);
@@ -2053,7 +2656,7 @@ function lakeflowConnectCheck() {
       await booleanSql(
         "Lakeflow Connect replication",
         env.DBX_TEST_CONNECT_ASSERTION_SQL,
-        warehouse2.query
+        warehouse3.query
       );
       return {
         pipelineId: pipeline.pipeline_id ?? id,
@@ -2093,7 +2696,7 @@ function genieCheck() {
     description: "Genie space is accessible and can optionally start a grounded conversation",
     configured: (env) => required2(env, names).length === 0,
     async run({ env, client }) {
-      requireEnv(env, names);
+      requireEnv2(env, names);
       const api = adapter(client);
       const id = env.DBX_TEST_GENIE_SPACE_ID;
       const space = await api.genieSpace(id);
@@ -2123,7 +2726,7 @@ function mlflowLifecycleCheck() {
     description: "MLflow experiment and Unity Catalog model version are accessible",
     configured: (env) => required2(env, names).length === 0,
     async run({ env, client }) {
-      requireEnv(env, names);
+      requireEnv2(env, names);
       const api = adapter(client);
       const experiment = await api.experiment(env.DBX_TEST_MLFLOW_EXPERIMENT_ID);
       const model = await api.registeredModel(env.DBX_TEST_REGISTERED_MODEL);
@@ -2147,8 +2750,8 @@ function featureEngineeringServingCheck() {
     configured: (env) => Boolean(
       env.DBX_TEST_FEATURE_TABLE && env.DBX_TEST_FEATURE_ASSERTION_SQL && (env.DBX_TEST_ONLINE_TABLE || env.DBX_TEST_FEATURE_SERVING_PIPELINE_ID)
     ),
-    async run({ env, client, warehouse: warehouse2 }) {
-      requireEnv(env, ["DBX_TEST_FEATURE_TABLE"]);
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, ["DBX_TEST_FEATURE_TABLE"]);
       if (!env.DBX_TEST_ONLINE_TABLE && !env.DBX_TEST_FEATURE_SERVING_PIPELINE_ID) {
         throw new Error(
           "Feature serving requires DBX_TEST_ONLINE_TABLE or DBX_TEST_FEATURE_SERVING_PIPELINE_ID"
@@ -2171,7 +2774,7 @@ function featureEngineeringServingCheck() {
         assertNotFailed("Synced Table pipeline", state);
         servingResource = pipeline.pipeline_id ?? pipelineId;
       }
-      await booleanSql("Feature freshness", env.DBX_TEST_FEATURE_ASSERTION_SQL, warehouse2.query);
+      await booleanSql("Feature freshness", env.DBX_TEST_FEATURE_ASSERTION_SQL, warehouse3.query);
       return {
         featureTable: source.full_name ?? env.DBX_TEST_FEATURE_TABLE,
         servingResource,
@@ -2191,7 +2794,7 @@ function modelServingCheck() {
     description: "Model Serving endpoint is ready and can optionally serve an inference request",
     configured: (env) => required2(env, names).length === 0,
     async run({ env, client }) {
-      requireEnv(env, names);
+      requireEnv2(env, names);
       if (env.DBX_TEST_AI_GATEWAY_REQUIRED !== "1") {
         throw new Error("DBX_TEST_AI_GATEWAY_REQUIRED must be 1 for the Model Serving target pack");
       }
@@ -2227,7 +2830,7 @@ function evalJudgeModelServingCheck() {
     description: "Databricks Model Serving satisfies the deterministic evaluator chat contract",
     configured: (env) => required2(env, names).length === 0,
     async run({ env, client }) {
-      requireEnv(env, names);
+      requireEnv2(env, names);
       const api = adapter(client);
       const name = env.DBX_TEST_EVAL_SERVING_ENDPOINT;
       const endpoint = await api.servingEndpoint(name);
@@ -2267,7 +2870,7 @@ function vectorSearchCheck() {
     description: "Vector Search endpoint and index are online",
     configured: (env) => required2(env, names).length === 0,
     async run({ env, client }) {
-      requireEnv(env, names);
+      requireEnv2(env, names);
       const api = adapter(client);
       const endpoint = await api.vectorSearchEndpoint(env.DBX_TEST_VECTOR_ENDPOINT);
       assertReady("Vector Search endpoint", endpoint.endpoint_status?.state, ["ONLINE", "READY"]);
@@ -2294,7 +2897,7 @@ function ragAgentCheck() {
     description: "RAG retrieval and agent serving endpoint return non-empty responses",
     configured: (env) => required2(env, names).length === 0,
     async run({ env, client }) {
-      requireEnv(env, names);
+      requireEnv2(env, names);
       const api = adapter(client);
       let retrieval;
       if (env.DBX_TEST_VECTOR_QUERY_JSON) {
@@ -2338,13 +2941,13 @@ function federationSharingCleanRoomsCheck() {
     id: "federation-sharing-cleanrooms",
     description: "Lakehouse Federation connection, Delta Share and Clean Room are accessible",
     configured: (env) => required2(env, names).length === 0,
-    async run({ env, client, warehouse: warehouse2 }) {
-      requireEnv(env, names);
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
       const api = adapter(client);
       const connection = await api.connection(env.DBX_TEST_CONNECTION);
       const share = await api.share(env.DBX_TEST_SHARE);
       const room = await api.cleanRoom(env.DBX_TEST_CLEAN_ROOM);
-      await booleanSql("Federated query", env.DBX_TEST_FEDERATION_ASSERTION_SQL, warehouse2.query);
+      await booleanSql("Federated query", env.DBX_TEST_FEDERATION_ASSERTION_SQL, warehouse3.query);
       return {
         connection: connection.name ?? env.DBX_TEST_CONNECTION,
         share: share.name ?? env.DBX_TEST_SHARE,
@@ -2363,8 +2966,8 @@ function securityPostureCostCheck() {
     id: "security-cost",
     description: "Network access controls, compute policy and cost guardrail are enforced",
     configured: (env) => required2(env, names).length === 0,
-    async run({ env, client, warehouse: warehouse2 }) {
-      requireEnv(env, names);
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
       const api = adapter(client);
       const access = await api.ipAccessList(env.DBX_TEST_IP_ACCESS_LIST_ID);
       if (access.enabled === false) throw new Error("Configured IP access list is disabled");
@@ -2374,7 +2977,7 @@ function securityPostureCostCheck() {
       if (env.DBX_TEST_EXPECT_HOST_SUFFIX && !env.DATABRICKS_HOST?.endsWith(env.DBX_TEST_EXPECT_HOST_SUFFIX)) {
         throw new Error(`Workspace host does not end with ${env.DBX_TEST_EXPECT_HOST_SUFFIX}`);
       }
-      await booleanSql("Cost guardrail", env.DBX_TEST_COST_ASSERTION_SQL, warehouse2.query);
+      await booleanSql("Cost guardrail", env.DBX_TEST_COST_ASSERTION_SQL, warehouse3.query);
       return {
         ipAccessList: access.list_id ?? env.DBX_TEST_IP_ACCESS_LIST_ID,
         policy: policy.policy_id ?? policy.name,
@@ -2383,6 +2986,201 @@ function securityPostureCostCheck() {
     }
   };
 }
+function mlflow3GenAiQualityCheck() {
+  const names = [
+    "DBX_TEST_MLFLOW3_JOB_ID",
+    "DBX_TEST_MLFLOW3_TRACE_ASSERTION_SQL",
+    "DBX_TEST_MLFLOW3_EVAL_ASSERTION_SQL",
+    "DBX_TEST_MLFLOW3_SCORER_ASSERTION_SQL",
+    "DBX_TEST_MLFLOW3_MONITOR_ASSERTION_SQL",
+    "DBX_TEST_AI_SEARCH_EVAL_ASSERTION_SQL"
+  ];
+  return {
+    id: "mlflow3-genai-quality",
+    description: "MLflow 3 tracing, offline agent evaluation and production scorer monitoring produce durable evidence",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
+      const job = await runCertificationJob(
+        "MLflow 3 GenAI",
+        env.DBX_TEST_MLFLOW3_JOB_ID,
+        env,
+        client,
+        { timeoutMs: Number(env.DBX_TEST_MLFLOW3_TIMEOUT_MS ?? 72e5) }
+      );
+      await booleanSql("MLflow 3 trace", env.DBX_TEST_MLFLOW3_TRACE_ASSERTION_SQL, warehouse3.query);
+      await booleanSql(
+        "MLflow 3 offline evaluation",
+        env.DBX_TEST_MLFLOW3_EVAL_ASSERTION_SQL,
+        warehouse3.query
+      );
+      await booleanSql(
+        "MLflow 3 production scorer lifecycle",
+        env.DBX_TEST_MLFLOW3_SCORER_ASSERTION_SQL,
+        warehouse3.query
+      );
+      await booleanSql(
+        "MLflow 3 production monitoring",
+        env.DBX_TEST_MLFLOW3_MONITOR_ASSERTION_SQL,
+        warehouse3.query
+      );
+      await booleanSql(
+        "AI Search retrieval quality",
+        env.DBX_TEST_AI_SEARCH_EVAL_ASSERTION_SQL,
+        warehouse3.query
+      );
+      return {
+        ...job,
+        traces: true,
+        offlineEvaluation: true,
+        scorerLifecycle: true,
+        monitor: true,
+        aiSearchEvaluation: true
+      };
+    }
+  };
+}
+function agentEvaluationPipelineCheck() {
+  const names = ["DBX_TEST_AGENT_EVAL_E2E_JOB_ID", "DBX_TEST_AGENT_EVAL_ASSERTION_SQL"];
+  return {
+    id: "agent-evaluation-pipeline",
+    description: "Experiments API, outbox, Temporal worker, Model Serving judge, SQL score sink and Quality completion execute end to end",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
+      const job = await runCertificationJob(
+        "Agent evaluation end-to-end",
+        env.DBX_TEST_AGENT_EVAL_E2E_JOB_ID,
+        env,
+        client
+      );
+      await booleanSql(
+        "Agent evaluation terminal Quality evidence",
+        env.DBX_TEST_AGENT_EVAL_ASSERTION_SQL,
+        warehouse3.query
+      );
+      return { ...job, api: true, outbox: true, temporal: true, judged: true, persisted: true };
+    }
+  };
+}
+function managedMcpAgentsCheck() {
+  const names = [
+    "DBX_TEST_MCP_JOB_ID",
+    "DBX_TEST_MCP_MANAGED_ASSERTION_SQL",
+    "DBX_TEST_MCP_SERVICE_ASSERTION_SQL",
+    "DBX_TEST_MCP_DENY_ASSERTION_SQL"
+  ];
+  return {
+    id: "managed-mcp-agents",
+    description: "Managed MCP and Unity Catalog MCP Services support list, call and deny behavior",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
+      const job = await runCertificationJob("Databricks MCP", env.DBX_TEST_MCP_JOB_ID, env, client);
+      await booleanSql(
+        "Managed MCP list/call",
+        env.DBX_TEST_MCP_MANAGED_ASSERTION_SQL,
+        warehouse3.query
+      );
+      await booleanSql(
+        "Unity Catalog MCP Service list/call",
+        env.DBX_TEST_MCP_SERVICE_ASSERTION_SQL,
+        warehouse3.query
+      );
+      await booleanSql(
+        "MCP excluded-tool denial",
+        env.DBX_TEST_MCP_DENY_ASSERTION_SQL,
+        warehouse3.query
+      );
+      return { ...job, managedServer: true, mcpService: true, denyControl: true };
+    }
+  };
+}
+function dataQualityAppTelemetryCheck() {
+  const names = [
+    "DBX_TEST_TELEMETRY_APP_NAME",
+    "DBX_TEST_DQM_ASSERTION_SQL",
+    "DBX_TEST_APP_LOGS_ASSERTION_SQL",
+    "DBX_TEST_APP_SPANS_ASSERTION_SQL",
+    "DBX_TEST_APP_METRICS_ASSERTION_SQL"
+  ];
+  return {
+    id: "data-quality-app-telemetry",
+    description: "Unity Catalog data quality monitoring and Databricks Apps logs, spans and metrics are current",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client, warehouse: warehouse3 }) {
+      requireEnv2(env, names);
+      const appName = env.DBX_TEST_TELEMETRY_APP_NAME;
+      const app = await adapter(client).app(appName);
+      const destinations = Array.isArray(app.telemetry_export_destinations) ? app.telemetry_export_destinations : [];
+      const unityCatalog = destinations.find(
+        (destination) => isObject(destination) && isObject(destination.unity_catalog)
+      );
+      if (!isObject(unityCatalog) || !isObject(unityCatalog.unity_catalog)) {
+        throw new Error(`Databricks App ${appName} has no Unity Catalog telemetry destination`);
+      }
+      const tables = unityCatalog.unity_catalog;
+      for (const field of ["logs_table", "traces_table", "metrics_table"]) {
+        if (typeof tables[field] !== "string" || !tables[field]) {
+          throw new Error(`Databricks App ${appName} telemetry destination has no ${field}`);
+        }
+      }
+      await booleanSql("Data Quality Monitoring", env.DBX_TEST_DQM_ASSERTION_SQL, warehouse3.query);
+      await booleanSql("App logs", env.DBX_TEST_APP_LOGS_ASSERTION_SQL, warehouse3.query);
+      await booleanSql("App spans", env.DBX_TEST_APP_SPANS_ASSERTION_SQL, warehouse3.query);
+      await booleanSql("App metrics", env.DBX_TEST_APP_METRICS_ASSERTION_SQL, warehouse3.query);
+      return { app: appName, unityCatalogTelemetry: true, dataQualityMonitoring: true };
+    }
+  };
+}
+function agentServicesEnrollmentCheck() {
+  const names = [
+    "DBX_TEST_AGENT_SERVICE_FULL_NAME",
+    "DBX_TEST_AGENT_SERVICE_CONNECTION",
+    "DBX_TEST_AGENT_SERVICE_EXECUTE_PRINCIPAL"
+  ];
+  return {
+    id: "agent-services-enrollment",
+    description: "A customer-owned Harness agent is registered as an external Unity Catalog Agent Service with governed access",
+    configured: (env) => required2(env, names).length === 0,
+    async run({ env, client }) {
+      requireEnv2(env, names);
+      const fullName = env.DBX_TEST_AGENT_SERVICE_FULL_NAME;
+      const api = adapter(client);
+      const service = await api.agentService(fullName);
+      if (service.agent_service_type !== "AGENT_SERVICE_TYPE_EXTERNAL") {
+        throw new Error(`${fullName} is not an external Agent Service`);
+      }
+      const expectedConnection = env.DBX_TEST_AGENT_SERVICE_CONNECTION;
+      const actualConnection = service.config?.connection?.name ?? "";
+      if (actualConnection !== expectedConnection && actualConnection.split("/").at(-1) !== expectedConnection) {
+        throw new Error(`${fullName} uses unexpected connection ${actualConnection || "UNKNOWN"}`);
+      }
+      if (!service.config?.base_path?.startsWith("/")) {
+        throw new Error(`${fullName} has no absolute external base path`);
+      }
+      const permissions = await api.agentServicePermissions(fullName);
+      const assignments = Array.isArray(permissions.privilege_assignments) ? permissions.privilege_assignments : [];
+      const expectedPrincipal = env.DBX_TEST_AGENT_SERVICE_EXECUTE_PRINCIPAL;
+      const assignment = assignments.find(
+        (entry) => isObject(entry) && entry.principal === expectedPrincipal
+      );
+      const privileges = isObject(assignment) && Array.isArray(assignment.privileges) ? assignment.privileges : [];
+      const canExecute = privileges.some(
+        (privilege) => isObject(privilege) && privilege.privilege === "EXECUTE"
+      );
+      if (!canExecute) {
+        throw new Error(`${expectedPrincipal} does not have EXECUTE on ${fullName}`);
+      }
+      return {
+        fullName: service.full_name ?? service.name ?? fullName,
+        connection: actualConnection,
+        executePrincipal: expectedPrincipal,
+        runtimeInvocationAvailable: false
+      };
+    }
+  };
+}
 function regionalDrCheck(options = {}) {
   const names = [
     "DBX_TEST_DR_HOST",
@@ -2394,7 +3192,7 @@ function regionalDrCheck(options = {}) {
     description: "Secondary-region workspace authentication and SQL warehouse are reachable",
     configured: (env) => required2(env, names).length === 0,
     async run({ env }) {
-      requireEnv(env, names);
+      requireEnv2(env, names);
       const drEnv = {
         ...env,
         DATABRICKS_HOST: env.DBX_TEST_DR_HOST,
@@ -2424,14 +3222,14 @@ function regionalDrCheck(options = {}) {
 }
 
 // src/advanced-target-packs.ts
-var DOCS2 = "https://experiments.fabric.pro/docs/testing/target-packs/";
-var AZURE_M2M_SCOPE = "Azure Databricks, dedicated service principal using OAuth M2M, public network path; named managed or disposable certification fixtures";
-var workspace = {
+var DOCS3 = "https://experiments.fabric.pro/docs/testing/target-packs/";
+var AZURE_M2M_SCOPE2 = "Azure Databricks, dedicated service principal using OAuth M2M, public network path; named managed or disposable certification fixtures";
+var workspace2 = {
   id: "workspace",
   description: "Databricks workspace host",
   anyOf: ["DATABRICKS_HOST"]
 };
-var auth = {
+var auth2 = {
   id: "authentication",
   description: "Databricks OAuth, OIDC, bearer, or PAT authentication",
   anyOf: [
@@ -2443,12 +3241,12 @@ var auth = {
   ],
   secret: true
 };
-var warehouse = {
+var warehouse2 = {
   id: "warehouse",
   description: "SQL warehouse for data-plane assertions",
   anyOf: ["DATABRICKS_WAREHOUSE_ID", "DATABRICKS_HTTP_PATH"]
 };
-var requirement = (id, description, ...anyOf) => ({
+var requirement2 = (id, description, ...anyOf) => ({
   id,
   description,
   anyOf
@@ -2467,33 +3265,33 @@ function createAdvancedStreamingTargetPack() {
       "lakeflow-connect.replication"
     ],
     checks: () => [restrictedPrincipalCheck(), advancedStreamingCdcCheck(), lakeflowConnectCheck()],
-    requiredChecks: ["streaming-cdc", "lakeflow-connect"],
+    requiredChecks: ["restricted-principal", "streaming-cdc", "lakeflow-connect"],
     requirements: [
-      workspace,
-      auth,
-      warehouse,
-      requirement("streaming-pipeline", "Streaming pipeline ID", "DBX_TEST_STREAMING_PIPELINE_ID"),
-      requirement("streaming-table", "Streaming target table", "DBX_TEST_STREAMING_TABLE"),
-      requirement(
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2("streaming-pipeline", "Streaming pipeline ID", "DBX_TEST_STREAMING_PIPELINE_ID"),
+      requirement2("streaming-table", "Streaming target table", "DBX_TEST_STREAMING_TABLE"),
+      requirement2(
         "connect-pipeline",
         "Lakeflow Connect ingestion pipeline",
         "DBX_TEST_CONNECT_PIPELINE_ID"
       ),
-      requirement(
+      requirement2(
         "streaming-assertion",
         "Streaming freshness SQL",
         "DBX_TEST_STREAMING_ASSERTION_SQL"
       ),
-      requirement("cdc-assertion", "CDC correctness SQL", "DBX_TEST_CDC_ASSERTION_SQL"),
-      requirement(
+      requirement2("cdc-assertion", "CDC correctness SQL", "DBX_TEST_CDC_ASSERTION_SQL"),
+      requirement2(
         "connect-assertion",
         "Lakeflow Connect replication SQL",
         "DBX_TEST_CONNECT_ASSERTION_SQL"
       )
     ],
-    docsUrl: `${DOCS2}#advanced-streaming-cdc-and-lakeflow-connect`,
+    docsUrl: `${DOCS3}#advanced-streaming-cdc-and-lakeflow-connect`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; serverless Lakeflow pipeline AUTO CDC and query-based PostgreSQL foreign-catalog ingestion`
+      `${AZURE_M2M_SCOPE2}; serverless Lakeflow pipeline AUTO CDC and query-based PostgreSQL foreign-catalog ingestion`
     ]
   });
 }
@@ -2506,21 +3304,21 @@ function createAiBiGenieTargetPack() {
     maturity: "live-gated",
     capabilities: ["aibi.dashboard", "genie.space", "genie.conversation"],
     checks: () => [restrictedPrincipalCheck(), aiBiDashboardCheck(), genieCheck()],
-    requiredChecks: ["aibi-dashboard", "genie"],
+    requiredChecks: ["restricted-principal", "aibi-dashboard", "genie"],
     requirements: [
-      workspace,
-      auth,
-      requirement("dashboard", "AI/BI dashboard ID", "DBX_TEST_DASHBOARD_ID"),
-      requirement("genie-space", "Genie space ID", "DBX_TEST_GENIE_SPACE_ID"),
-      requirement(
+      workspace2,
+      auth2,
+      requirement2("dashboard", "AI/BI dashboard ID", "DBX_TEST_DASHBOARD_ID"),
+      requirement2("genie-space", "Genie space ID", "DBX_TEST_GENIE_SPACE_ID"),
+      requirement2(
         "genie-question",
         "Grounded Genie certification question",
         "DBX_TEST_GENIE_QUESTION"
       )
     ],
-    docsUrl: `${DOCS2}#aibi-dashboards-and-genie`,
+    docsUrl: `${DOCS3}#aibi-dashboards-and-genie`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; published AI/BI dashboard revision and Genie conversation start`
+      `${AZURE_M2M_SCOPE2}; published AI/BI dashboard revision and Genie conversation start`
     ]
   });
 }
@@ -2538,21 +3336,21 @@ function createMlflowLifecycleTargetPack() {
       "models.lifecycle"
     ],
     checks: () => [restrictedPrincipalCheck(), mlflowLifecycleCheck()],
-    requiredChecks: ["mlflow-lifecycle"],
+    requiredChecks: ["restricted-principal", "mlflow-lifecycle"],
     requirements: [
-      workspace,
-      auth,
-      requirement("experiment", "MLflow experiment ID", "DBX_TEST_MLFLOW_EXPERIMENT_ID"),
-      requirement(
+      workspace2,
+      auth2,
+      requirement2("experiment", "MLflow experiment ID", "DBX_TEST_MLFLOW_EXPERIMENT_ID"),
+      requirement2(
         "registered-model",
         "Unity Catalog registered model",
         "DBX_TEST_REGISTERED_MODEL"
       ),
-      requirement("model-version", "Registered model version", "DBX_TEST_MODEL_VERSION")
+      requirement2("model-version", "Registered model version", "DBX_TEST_MODEL_VERSION")
     ],
-    docsUrl: `${DOCS2}#mlflow-and-model-lifecycle`,
+    docsUrl: `${DOCS3}#mlflow-and-model-lifecycle`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; MLflow experiment and configured Unity Catalog model version`
+      `${AZURE_M2M_SCOPE2}; MLflow experiment and configured Unity Catalog model version`
     ]
   });
 }
@@ -2570,27 +3368,27 @@ function createFeatureEngineeringTargetPack() {
       "features.serving"
     ],
     checks: () => [restrictedPrincipalCheck(), featureEngineeringServingCheck()],
-    requiredChecks: ["feature-engineering"],
+    requiredChecks: ["restricted-principal", "feature-engineering"],
     requirements: [
-      workspace,
-      auth,
-      warehouse,
-      requirement("feature-table", "Unity Catalog feature table", "DBX_TEST_FEATURE_TABLE"),
-      requirement(
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2("feature-table", "Unity Catalog feature table", "DBX_TEST_FEATURE_TABLE"),
+      requirement2(
         "online-materialization",
         "Databricks Online Table or Synced Table pipeline",
         "DBX_TEST_ONLINE_TABLE",
         "DBX_TEST_FEATURE_SERVING_PIPELINE_ID"
       ),
-      requirement(
+      requirement2(
         "feature-assertion",
         "Feature freshness/correctness SQL",
         "DBX_TEST_FEATURE_ASSERTION_SQL"
       )
     ],
-    docsUrl: `${DOCS2}#feature-engineering-and-serving`,
+    docsUrl: `${DOCS3}#feature-engineering-and-serving`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; Delta feature table, PostgreSQL-backed Synced Table, and SQL freshness`
+      `${AZURE_M2M_SCOPE2}; Delta feature table, PostgreSQL-backed Synced Table, and SQL freshness`
     ]
   });
 }
@@ -2607,25 +3405,25 @@ function createModelServingTargetPack() {
       "ai-gateway.configuration"
     ],
     checks: () => [restrictedPrincipalCheck(), modelServingCheck()],
-    requiredChecks: ["model-serving"],
+    requiredChecks: ["restricted-principal", "model-serving"],
     requirements: [
-      workspace,
-      auth,
-      requirement("serving-endpoint", "Model Serving endpoint name", "DBX_TEST_SERVING_ENDPOINT"),
-      requirement(
+      workspace2,
+      auth2,
+      requirement2("serving-endpoint", "Model Serving endpoint name", "DBX_TEST_SERVING_ENDPOINT"),
+      requirement2(
         "serving-request",
         "Safe inference request JSON",
         "DBX_TEST_SERVING_REQUEST_JSON"
       ),
-      requirement(
+      requirement2(
         "ai-gateway",
         "AI Gateway enforcement flag set to 1",
         "DBX_TEST_AI_GATEWAY_REQUIRED"
       )
     ],
-    docsUrl: `${DOCS2}#model-serving-and-ai-gateway`,
+    docsUrl: `${DOCS3}#model-serving-and-ai-gateway`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; custom-model inference and AI Gateway inference-table configuration`
+      `${AZURE_M2M_SCOPE2}; custom-model inference and AI Gateway inference-table configuration`
     ]
   });
 }
@@ -2643,19 +3441,19 @@ function createVectorRagAgentsTargetPack() {
       "agents.serving"
     ],
     checks: () => [restrictedPrincipalCheck(), vectorSearchCheck(), ragAgentCheck()],
-    requiredChecks: ["vector-search", "rag-agent"],
+    requiredChecks: ["restricted-principal", "vector-search", "rag-agent"],
     requirements: [
-      workspace,
-      auth,
-      requirement("vector-endpoint", "Vector Search endpoint", "DBX_TEST_VECTOR_ENDPOINT"),
-      requirement("vector-index", "Vector Search index", "DBX_TEST_VECTOR_INDEX"),
-      requirement("vector-query", "Vector retrieval request JSON", "DBX_TEST_VECTOR_QUERY_JSON"),
-      requirement("agent-endpoint", "Agent serving endpoint", "DBX_TEST_AGENT_ENDPOINT"),
-      requirement("agent-request", "Safe agent request JSON", "DBX_TEST_AGENT_REQUEST_JSON")
+      workspace2,
+      auth2,
+      requirement2("vector-endpoint", "Vector Search endpoint", "DBX_TEST_VECTOR_ENDPOINT"),
+      requirement2("vector-index", "Vector Search index", "DBX_TEST_VECTOR_INDEX"),
+      requirement2("vector-query", "Vector retrieval request JSON", "DBX_TEST_VECTOR_QUERY_JSON"),
+      requirement2("agent-endpoint", "Agent serving endpoint", "DBX_TEST_AGENT_ENDPOINT"),
+      requirement2("agent-request", "Safe agent request JSON", "DBX_TEST_AGENT_REQUEST_JSON")
     ],
-    docsUrl: `${DOCS2}#vector-search-rag-and-agents`,
+    docsUrl: `${DOCS3}#vector-search-rag-and-agents`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; Delta Sync vector retrieval and custom PyFunc agent invocation`
+      `${AZURE_M2M_SCOPE2}; Delta Sync vector retrieval and custom PyFunc agent invocation`
     ]
   });
 }
@@ -2673,23 +3471,23 @@ function createFederationSharingTargetPack() {
       "clean-rooms.access"
     ],
     checks: () => [restrictedPrincipalCheck(), federationSharingCleanRoomsCheck()],
-    requiredChecks: ["federation-sharing-cleanrooms"],
+    requiredChecks: ["restricted-principal", "federation-sharing-cleanrooms"],
     requirements: [
-      workspace,
-      auth,
-      warehouse,
-      requirement("connection", "Lakehouse Federation connection", "DBX_TEST_CONNECTION"),
-      requirement("share", "Delta Sharing share", "DBX_TEST_SHARE"),
-      requirement("clean-room", "Clean Room name", "DBX_TEST_CLEAN_ROOM"),
-      requirement(
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2("connection", "Lakehouse Federation connection", "DBX_TEST_CONNECTION"),
+      requirement2("share", "Delta Sharing share", "DBX_TEST_SHARE"),
+      requirement2("clean-room", "Clean Room name", "DBX_TEST_CLEAN_ROOM"),
+      requirement2(
         "federation-assertion",
         "Federated data-plane SQL",
         "DBX_TEST_FEDERATION_ASSERTION_SQL"
       )
     ],
-    docsUrl: `${DOCS2}#federation-delta-sharing-and-clean-rooms`,
+    docsUrl: `${DOCS3}#federation-delta-sharing-and-clean-rooms`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; managed PostgreSQL federation, Delta Sharing table, and two-metastore Clean Room`
+      `${AZURE_M2M_SCOPE2}; managed PostgreSQL federation, Delta Sharing table, and two-metastore Clean Room`
     ]
   });
 }
@@ -2707,25 +3505,253 @@ function createSecurityCostDrTargetPack() {
       "dr.secondary-region"
     ],
     checks: () => [restrictedPrincipalCheck(), securityPostureCostCheck(), regionalDrCheck()],
-    requiredChecks: ["security-cost", "regional-dr"],
+    requiredChecks: ["restricted-principal", "security-cost", "regional-dr"],
     requirements: [
-      workspace,
-      auth,
-      warehouse,
-      requirement(
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2(
         "ip-access-list",
         "Enabled workspace IP access list",
         "DBX_TEST_IP_ACCESS_LIST_ID"
       ),
-      requirement("cluster-policy", "Compute policy ID", "DBX_TEST_CLUSTER_POLICY_ID"),
-      requirement("cost-assertion", "Boolean SQL cost guardrail", "DBX_TEST_COST_ASSERTION_SQL"),
-      requirement("dr-workspace", "Secondary workspace host", "DBX_TEST_DR_HOST"),
-      requirement("dr-warehouse", "Running secondary-region warehouse", "DBX_TEST_DR_WAREHOUSE_ID"),
-      requirement("dr-assertion", "Secondary-region workload SQL", "DBX_TEST_DR_ASSERTION_SQL")
+      requirement2("cluster-policy", "Compute policy ID", "DBX_TEST_CLUSTER_POLICY_ID"),
+      requirement2("cost-assertion", "Boolean SQL cost guardrail", "DBX_TEST_COST_ASSERTION_SQL"),
+      requirement2("dr-workspace", "Secondary workspace host", "DBX_TEST_DR_HOST"),
+      requirement2("dr-warehouse", "Running secondary-region warehouse", "DBX_TEST_DR_WAREHOUSE_ID"),
+      requirement2("dr-assertion", "Secondary-region workload SQL", "DBX_TEST_DR_ASSERTION_SQL")
+    ],
+    docsUrl: `${DOCS3}#networking-security-cost-and-regional-dr`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE2}; TEST-NET block list, bounded compute policy, billing system-table guardrail, and West US 3 serverless DR warehouse`
+    ]
+  });
+}
+function createMlflow3AgentQualityTargetPack() {
+  return defineTargetPack({
+    id: "mlflow3-agent-quality",
+    name: "MLflow 3 agent quality and monitoring",
+    description: "Native MLflow 3 traces, offline agent evaluation, production scorer lifecycle and online monitoring.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "mlflow3.tracing",
+      "mlflow3.agent-evaluation",
+      "mlflow3.production-scorers",
+      "mlflow3.production-monitoring",
+      "ai-search.retrieval-evaluation"
+    ],
+    checks: () => [restrictedPrincipalCheck(), mlflow3GenAiQualityCheck()],
+    requiredChecks: ["restricted-principal", "mlflow3-genai-quality"],
+    requirements: [
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2("mlflow3-job", "Native MLflow 3 certification Job", "DBX_TEST_MLFLOW3_JOB_ID"),
+      requirement2(
+        "mlflow3-traces",
+        "Boolean SQL proving a fresh MLflow 3 trace",
+        "DBX_TEST_MLFLOW3_TRACE_ASSERTION_SQL"
+      ),
+      requirement2(
+        "mlflow3-evaluation",
+        "Boolean SQL proving offline agent evaluation results",
+        "DBX_TEST_MLFLOW3_EVAL_ASSERTION_SQL"
+      ),
+      requirement2(
+        "mlflow3-scorers",
+        "Boolean SQL proving production scorer lifecycle evidence",
+        "DBX_TEST_MLFLOW3_SCORER_ASSERTION_SQL"
+      ),
+      requirement2(
+        "mlflow3-monitoring",
+        "Boolean SQL proving production monitoring output",
+        "DBX_TEST_MLFLOW3_MONITOR_ASSERTION_SQL"
+      ),
+      requirement2(
+        "ai-search-evaluation",
+        "Boolean SQL proving AI Search retrieval-quality thresholds",
+        "DBX_TEST_AI_SEARCH_EVAL_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS3}#mlflow-3-agent-quality-and-monitoring`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE2}; Python-native MLflow 3 trace, evaluation, complete scorer lifecycle and monitor evidence`
+    ]
+  });
+}
+function createAgentEvaluationPipelineTargetPack() {
+  return defineTargetPack({
+    id: "agent-evaluation-pipeline",
+    name: "Agent evaluation delivery pipeline",
+    description: "Exact-candidate API submission, outbox dispatch, Temporal execution, Databricks judge inference, SQL score persistence and Quality completion.",
+    version: "1.0.0",
+    maturity: "live-gated",
+    capabilities: [
+      "agent-evals.api-submission",
+      "agent-evals.temporal-dispatch",
+      "agent-evals.model-serving-judge",
+      "agent-evals.sql-persistence",
+      "agent-evals.quality-evidence"
+    ],
+    checks: () => [
+      restrictedPrincipalCheck(),
+      evalJudgeModelServingCheck(),
+      agentEvaluationPipelineCheck()
+    ],
+    requiredChecks: ["restricted-principal", "model-eval-judge", "agent-evaluation-pipeline"],
+    requirements: [
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2(
+        "eval-serving-endpoint",
+        "Databricks Model Serving endpoint satisfying the evaluator chat contract",
+        "DBX_TEST_EVAL_SERVING_ENDPOINT"
+      ),
+      requirement2(
+        "agent-eval-job",
+        "Exact-candidate end-to-end agent evaluation certification Job",
+        "DBX_TEST_AGENT_EVAL_E2E_JOB_ID"
+      ),
+      requirement2(
+        "agent-eval-evidence",
+        "Boolean SQL proving terminal scores and Quality evidence",
+        "DBX_TEST_AGENT_EVAL_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS3}#agent-evaluation-delivery-pipeline`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE2}; Experiments API through customer worker and Databricks judge to SQL/Quality`
+    ]
+  });
+}
+function createManagedMcpAgentsTargetPack() {
+  return defineTargetPack({
+    id: "managed-mcp-agents",
+    name: "Managed MCP and MCP Services",
+    description: "Streamable HTTP tool discovery and calls for Databricks managed MCP servers and governed Unity Catalog MCP Services, including a deny control.",
+    version: "1.0.0",
+    maturity: "live-gated",
+    capabilities: [
+      "mcp.managed.list-call",
+      "mcp.services.list-call",
+      "mcp.unity-catalog-governance",
+      "mcp.denial"
+    ],
+    checks: () => [restrictedPrincipalCheck(), managedMcpAgentsCheck()],
+    requiredChecks: ["restricted-principal", "managed-mcp-agents"],
+    requirements: [
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2("mcp-job", "Native Streamable HTTP MCP certification Job", "DBX_TEST_MCP_JOB_ID"),
+      requirement2(
+        "managed-mcp",
+        "Boolean SQL proving managed MCP list/call behavior",
+        "DBX_TEST_MCP_MANAGED_ASSERTION_SQL"
+      ),
+      requirement2(
+        "mcp-service",
+        "Boolean SQL proving UC MCP Service list/call behavior",
+        "DBX_TEST_MCP_SERVICE_ASSERTION_SQL"
+      ),
+      requirement2(
+        "mcp-denial",
+        "Boolean SQL proving an MCP tool excluded by UC selectors was denied",
+        "DBX_TEST_MCP_DENY_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS3}#managed-mcp-and-mcp-services`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE2}; managed AI Search or SQL MCP plus a UC MCP Service over Streamable HTTP`
+    ]
+  });
+}
+function createDataQualityObservabilityTargetPack() {
+  return defineTargetPack({
+    id: "data-quality-observability",
+    name: "Data quality and Databricks Apps observability",
+    description: "Unity Catalog Data Quality Monitoring plus Databricks Apps OpenTelemetry logs, spans and metrics.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "data-quality.freshness-completeness",
+      "apps.telemetry.logs",
+      "apps.telemetry.traces",
+      "apps.telemetry.metrics"
+    ],
+    checks: () => [restrictedPrincipalCheck(), dataQualityAppTelemetryCheck()],
+    requiredChecks: ["restricted-principal", "data-quality-app-telemetry"],
+    requirements: [
+      workspace2,
+      auth2,
+      warehouse2,
+      requirement2("telemetry-app", "App with UC telemetry export", "DBX_TEST_TELEMETRY_APP_NAME"),
+      requirement2(
+        "data-quality",
+        "Boolean SQL over current Data Quality Monitoring results",
+        "DBX_TEST_DQM_ASSERTION_SQL"
+      ),
+      requirement2(
+        "app-logs",
+        "Boolean SQL proving current app logs",
+        "DBX_TEST_APP_LOGS_ASSERTION_SQL"
+      ),
+      requirement2(
+        "app-spans",
+        "Boolean SQL proving current app spans",
+        "DBX_TEST_APP_SPANS_ASSERTION_SQL"
+      ),
+      requirement2(
+        "app-metrics",
+        "Boolean SQL proving current app metrics",
+        "DBX_TEST_APP_METRICS_ASSERTION_SQL"
+      )
+    ],
+    docsUrl: `${DOCS3}#data-quality-and-databricks-apps-observability`,
+    certificationScopes: [
+      `${AZURE_M2M_SCOPE2}; system.data_quality_monitoring.table_results and UC OTel tables`
+    ]
+  });
+}
+function createAgentServicesEnrollmentTargetPack() {
+  return defineTargetPack({
+    id: "agent-services-enrollment",
+    name: "Unity Catalog Agent Services enrollment",
+    description: "Customer-owned Fabric Harness agents registered as external Unity Catalog Agent Services with explicit EXECUTE grants.",
+    version: "1.0.0",
+    maturity: "shipped",
+    capabilities: [
+      "agent-services.external-registration",
+      "agent-services.discovery",
+      "agent-services.permissions",
+      "harness.customer-worker-enrollment"
+    ],
+    checks: () => [restrictedPrincipalCheck(), agentServicesEnrollmentCheck()],
+    requiredChecks: ["restricted-principal", "agent-services-enrollment"],
+    requirements: [
+      workspace2,
+      auth2,
+      requirement2(
+        "agent-service",
+        "External Unity Catalog Agent Service full name",
+        "DBX_TEST_AGENT_SERVICE_FULL_NAME"
+      ),
+      requirement2(
+        "agent-connection",
+        "Expected Unity Catalog HTTP connection",
+        "DBX_TEST_AGENT_SERVICE_CONNECTION"
+      ),
+      requirement2(
+        "agent-execute-principal",
+        "Principal expected to have EXECUTE",
+        "DBX_TEST_AGENT_SERVICE_EXECUTE_PRINCIPAL"
+      )
     ],
-    docsUrl: `${DOCS2}#networking-security-cost-and-regional-dr`,
+    docsUrl: `${DOCS3}#unity-catalog-agent-services-enrollment`,
     certificationScopes: [
-      `${AZURE_M2M_SCOPE}; TEST-NET block list, bounded compute policy, billing system-table guardrail, and West US 3 serverless DR warehouse`
+      `${AZURE_M2M_SCOPE2}; Agent Services Beta registration/discovery/ACL only; runtime invocation is not claimed`
     ]
   });
 }
@@ -2738,7 +3764,12 @@ function createAdvancedTargetPacks() {
     createModelServingTargetPack(),
     createVectorRagAgentsTargetPack(),
     createFederationSharingTargetPack(),
-    createSecurityCostDrTargetPack()
+    createSecurityCostDrTargetPack(),
+    createMlflow3AgentQualityTargetPack(),
+    createManagedMcpAgentsTargetPack(),
+    createDataQualityObservabilityTargetPack(),
+    createAgentServicesEnrollmentTargetPack(),
+    createAgentEvaluationPipelineTargetPack()
   ];
 }
 
@@ -2747,11 +3778,12 @@ function createBuiltinTargetPacks() {
   return [
     ...createFoundationTargetPacks(),
     createLakeflowJobsTargetPack(),
-    ...createAdvancedTargetPacks()
+    ...createAdvancedTargetPacks(),
+    ...createNextTargetPacks()
   ];
 }
 var builtinTargetPacks = createBuiltinTargetPacks();
 
-export { DatabricksAdvancedWorkloadsAdapter, DatabricksJobsAdapter, advancedStreamingCdcCheck, aiBiDashboardCheck, appHealthCheck, assertDeltaContract, autoLoaderIngestionCheck, backupRestoreCheck, builtinTargetPacks, classicComputeCheck, createAdvancedStreamingTargetPack, createAdvancedTargetPacks, createAiBiGenieTargetPack, createAppsOperationalFoundationPack, createBuiltinTargetPacks, createEphemeralLakebaseBranch, createExecutionContext, createFeatureEngineeringTargetPack, createFederationSharingTargetPack, createFoundationTargetPacks, createJobsCodeFoundationPack, createLakebaseTestProvider, createLakeflowFoundationPack, createLakeflowJobsTargetPack, createMlflowLifecycleTargetPack, createMockDatabricksClient, createModelServingTargetPack, createSecurityCostDrTargetPack, createSqlDeltaFoundationPack, createTargetPackRegistry, createUnityStorageFoundationPack, createVectorRagAgentsTargetPack, customLiveCheck, dbtBuildCheck, defineLiveSuite, defineTargetPack, defineTargetPackRun, deleteEphemeralLakebaseBranch, deleteVolumeFile, deltaContractCheck, doctorTargetPack, ensureVolumeDirectory, evalJudgeModelServingCheck, expectQueryToMatchGolden, expectTable, failureRecoveryCheck, featureEngineeringServingCheck, federationSharingCleanRoomsCheck, foundationTargetPacks, genieCheck, jobRunCheck, jobsCertificationCheck, jobsOrchestrationCheck, lakebaseCredentialCheck, lakebaseRoundTripCheck, lakeflowConnectCheck, mlflowLifecycleCheck, modelServingCheck, normalizeJobRun, normalizeVolumeRoot, notebookSubmitCheck, parseJobOrchestrationLiveSpec, performanceBudgetCheck, pipelineRefreshCheck, ragAgentCheck, regionalDrCheck, renderJUnit, resolveLakebaseProject, resolveProfile, restrictedPrincipalCheck, rollbackCheck, runLiveSuite, runTargetPack, secretRotationCheck, secretScopeCheck, securityPostureCostCheck, serverlessComputeCheck, sqlRoundTripCheck, toLakebaseBranchId, unityCatalogAccessCheck, uploadVolumeFile, validateJobGraph, vectorSearchCheck, volumeIOCheck, waitForPipelineUpdate };
+export { DatabricksAdvancedWorkloadsAdapter, DatabricksJobsAdapter, advancedStreamingCdcCheck, agentEvaluationPipelineCheck, agentOrchestrationResponsesCheck, agentServicesEnrollmentCheck, aiBiDashboardCheck, aiFunctionsBatchInferenceCheck, aiRuntimeTrainingCheck, appHealthCheck, assertDeltaContract, autoLoaderIngestionCheck, backupRestoreCheck, builtinTargetPacks, classicComputeCheck, createAdvancedStreamingTargetPack, createAdvancedTargetPacks, createAgentEvaluationPipelineTargetPack, createAgentOrchestrationTargetPack, createAgentServicesEnrollmentTargetPack, createAiBiGenieTargetPack, createAiFunctionsBatchInferenceTargetPack, createAiRuntimeTrainingTargetPack, createAppsOperationalFoundationPack, createBuiltinTargetPacks, createDataQualityObservabilityTargetPack, createDeclarativeBundlesTargetPack, createEphemeralLakebaseBranch, createExecutionContext, createFeatureEngineeringTargetPack, createFederationSharingTargetPack, createFoundationTargetPacks, createJobsCodeFoundationPack, createLakebaseAutoscalingFeatureStoreTargetPack, createLakebaseTestProvider, createLakeflowFoundationPack, createLakeflowJobsTargetPack, createLakehouseOptimizationTargetPack, createManagedMcpAgentsTargetPack, createMarketplaceOpenSharingTargetPack, createMlflow3AgentQualityTargetPack, createMlflowLifecycleTargetPack, createMockDatabricksClient, createModelServingTargetPack, createNextTargetPacks, createSecurityCostDrTargetPack, createSemanticAnalyticsTargetPack, createSqlDeltaFoundationPack, createTargetPackRegistry, createUnityStorageFoundationPack, createVectorRagAgentsTargetPack, customLiveCheck, dataQualityAppTelemetryCheck, dbtBuildCheck, declarativeBundlesCheck, defineLiveSuite, defineTargetPack, defineTargetPackRun, deleteEphemeralLakebaseBranch, deleteVolumeFile, deltaContractCheck, doctorTargetPack, ensureVolumeDirectory, evalJudgeModelServingCheck, expectQueryToMatchGolden, expectTable, failureRecoveryCheck, featureEngineeringServingCheck, federationSharingCleanRoomsCheck, foundationTargetPacks, genieCheck, jobRunCheck, jobsCertificationCheck, jobsOrchestrationCheck, lakebaseAutoscalingFeatureStoreCheck, lakebaseCredentialCheck, lakebaseRoundTripCheck, lakeflowConnectCheck, lakehouseOptimizationCheck, managedMcpAgentsCheck, marketplaceOpenSharingCheck, mlflow3GenAiQualityCheck, mlflowLifecycleCheck, modelServingCheck, normalizeJobRun, normalizeVolumeRoot, notebookSubmitCheck, parseJobOrchestrationLiveSpec, performanceBudgetCheck, pipelineRefreshCheck, ragAgentCheck, regionalDrCheck, renderJUnit, resolveLakebaseProject, resolveProfile, resolveRequiredChecks, restrictedPrincipalCheck, rollbackCheck, runLiveSuite, runTargetPack, secretRotationCheck, secretScopeCheck, securityPostureCostCheck, semanticAnalyticsCheck, serverlessComputeCheck, sqlRoundTripCheck, toLakebaseBranchId, unityCatalogAccessCheck, uploadVolumeFile, validateJobGraph, vectorSearchCheck, volumeIOCheck, waitForPipelineUpdate };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map